SELinux (Security-Enhanced Linux) in Fedora is an implementation of mandatory access control in the Linux kernel using the Linux Security Modules (LSM) framework. Standard Linux security is a discretionary access control model.
Discretionary access control (DAC)
DAC is standard Linux security, and it provides minimal protection from broken software or malware running as a normal user or root. Users can grant risky levels of access to files they own.
Mandatory access control (MAC)
MAC provides full control over all interactions of software. Administratively defined policy closely controls user and process interactions with the system, and can provide protection from broken software or malware running as any user.
目前 SELinux 支持三种模式，分别如下：
enforcing ：强制模式，代表 SELinux 运作中，且已经正确的开始限制 domain/type 了；
permissive：宽容模式：代表 SELinux 运作中，不过仅会有警告讯息并不会实际限制 domain/type 的存取。这种模式可以
用来作为 SELinux 的 debug 之用；
disabled ：关闭，SELinux 并没有实际运作
在Linux下查看是否开启了SeLinux，可以用下面两种方法
1： 可以使用下面命令sestatus，SELinux status 为enabled表示开启了SeLinux功能
[[email protected] ~]# /usr/sbin/sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 21
Policy from config file: targeted
[[email protected] ~]#
[[email protected] ~]# /usr/sbin/sestatus -v
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 21
Policy from config file: targeted
Process contexts:
Current context: root:system_r:unconfined_t:SystemLow-SystemHigh
Init context: system_u:system_r:init_t
/sbin/mingetty system_u:system_r:getty_t
/usr/sbin/sshd system_u:system_r:unconfined_t:SystemLow-SystemHigh
File contexts:
Controlling term: root:object_r:devpts_t
/etc/passwd system_u:object_r:etc_t
/etc/shadow system_u:object_r:shadow_t
/bin/bash system_u:object_r:shell_exec_t
/bin/login system_u:object_r:login_exec_t
/bin/sh system_u:object_r:bin_t -> system_u:object_r:shell_exec_t
/sbin/agetty system_u:object_r:getty_exec_t
/sbin/init system_u:object_r:init_exec_t
/sbin/mingetty system_u:object_r:getty_exec_t
/usr/sbin/sshd system_u:object_r:sshd_exec_t
/lib/libc.so.6 system_u:object_r:lib_t -> system_u:object_r:lib_t
/lib/ld-linux.so.2 system_u:object_r:lib_t -> system_u:object_r:ld_so_t
You have new mail in /var/spool/mail/root
[[email protected] ~]#
2：使用命令getenforce
[[email protected] ~]# getenforce
Enforcing
如何开启、关闭SeLinux呢？最简单的方式使用setenforce，这样不用重启服务器. 但是该命令只能将SeLinux在enforcing、permissive这两种模式之间切换.服务器重启后,又会恢复到/etc/selinux/config 下,也就是说setenforce的修改是不能持久的。
[[email protected] ~]# setenforce 0
[[email protected] ~]# getenforce
Permissive
[[email protected] ~]# setenforce 1
[[email protected] ~]# getenforce;
Enforcing
[[email protected] ~]#
另外就是修改/etc/selinux/config ，如下所示，可以配置SELINUX为enforcing、permissive、disabled三个值，修改后必须重启系统才能生效
[[email protected] ~]# more /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - SELinux is fully disabled.
SELINUX=enforcing
# SELINUXTYPE= type of policy in use. Possible values are:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted
You have new mail in /var/spool/mail/root
[[email protected] ~]#
如果由 enforcing 或 permissive 改成 disabled ，或由 disabled 改成其他两个，那也必须要重新开机。这是因为 SELinux 是整合到核心里面去的， 你只可以在SELinux 运作下切换成为强制 (enforcing) 或宽容 (permissive) 模式，不能够直接关闭 SELinux 的！同时，由 SELinux 关闭 (disable) 的状态到开启的状态也需要重新开机啦！