Ukuphepha kwe-SELinux: Lawula uhlelo lwakho lwe-Linux kuze kufike ku-millimeter

Informatec Digital » Izinsiza » Ukuphepha kwe-SELinux: Lawula uhlelo lwakho lwe-Linux kuze kufike ku-millimeter

I-SELinux ingase izwakale njengobuchwepheshe obugcinelwe ama-kernel geeks, kodwa empeleni ingenye yamathuluzi okuphepha anamandla kakhulu atholakala ku-Linux namuhla . Uma uphatha amaseva, ukuphepha kwesitsha se-Docker , ingqalasizinda yamafu, noma ngisho namakhompyutha edeskithophu azwela kancane, ukuqonda ukuthi i-SELinux isebenza kanjani kwenza umehluko omkhulu phakathi kohlelo "olulungiselelwe kahle" kanye nolunzima ukuluvumelanisa, ngisho noma lunobuthakathaka bezinsuku ezingenalutho.

Naphezu kodumo lwayo lokuba "yinkimbinkimbi," i-SELinux inikeza imodeli enengqondo kakhulu: ichaza ukuthi inqubo ngayinye ingenzani nokuthi yiziphi izinto engaxhumana nazo, futhi uma kukhona okuphambukayo kuleyo script, i-kernel iyimisa ngokushesha . Esikhundleni sokuthemba ngokungaboni ukuthi impande izoziphatha noma ukuthi ama-daemons akho ngeke abe namaphutha, i-SELinux isebenzisa ukulawulwa kokufinyelela okuphoqelekile okusebenza ngisho nakumsebenzisi omkhulu, isebenzisa amalebula nezinqubomgomo ezinemininingwane eminingi.

Iyini i-SELinux futhi iyixazulula yiphi inkinga?

I-Security-Enhanced Linux (SELinux) iyimojuli yokuphepha ye-kernel ye-Linux esekelwe ku-LSM (Linux Security Modules). Ekuqaleni yathuthukiswa yi-NSA ngokubambisana ne-Red Hat nabanye ozakwethu, futhi kusukela kunguqulo ye-kernel 2.6, ibilokhu iyingxenye esemthethweni ye-kernel. Akuyona uhlelo lokusebenza oluhlukile, kodwa kunalokho isandiso se-kernel esengeza uhlelo lokulawula ukufinyelela okuphoqelekile (i-MAC) kanye nokulawula ukufinyelela okusekelwe ezindimeni (i-RBAC).

Ngokungafani ne-Unix discretionary access control (DAC) yakudala—owner , group, others, kanye nezimvume ze-rwx —ku-SELinux, izinqumo zokufinyelela azisekelwe ekukhetheni komnikazi wefayela, kodwa kunalokho kunqubomgomo yomhlaba wonke esungulwe umphathi wezokuphepha. I-DAC isekhona futhi ithatha indawo yokuqala: uma i-DAC iphika, i-SELinux ayingeneleli; kodwa noma i-DAC ivumela, i-SELinux isengavimba ukusebenza ngokwenqubomgomo yayo.

Ukwakhiwa kwe-SELinux kuhlukanisa ngokucacile izingxenye: ngakolunye uhlangothi, ikhodi ye-kernel eyenza izinqumo zokuphepha , kanti ngakolunye uhlangothi, amamojula enqubomgomo achaza okuvunyelwe nokungavunyelwe. Lokhu kuhlukaniswa kuvumela ukulungisa imithetho ngaphandle kokuhlanganisa kabusha i-kernel futhi kwenza kube lula inani lezingxenye ezingathinta ukuphepha kohlelo.

I-SELinux yamukelwe ngokuzenzakalelayo ekusakazweni okufana ne-Fedora, i-Red Hat Enterprise Linux, i-CentOS, kanye ne-Scientific Linux, futhi ihlanganiswe ngokujulile ezinhlelweni ezifana ne-Android, lapho isetshenziselwa ukuvalela izinqubo zesistimu kanye nezinhlelo zokusebenza ezizindeni ezithile kakhulu. Ezweni le-BSD kanye ne-GNU/Linux, kunezinye izindlela ezifana ne-AppArmor, i-TOMOYO, kanye ne-TrustedBSD (ku-macOS/FreeBSD), kodwa i-SELinux ivelele ngezinga le-granularity elinikezayo kuzo zonke izinto zesistimu.

Kusukela ku-DAC kuya ku-MAC: kungani imodeli yakudala ingasanele

Kuhlelo lwe-Unix lwendabuko, imodeli ye-Domain-Object iphathwa kusetshenziswa i-DAC: ifayela ngalinye noma isisetshenziswa sinomnikazi nezimvume, futhi noma iyiphi inqubo esebenza njengoba lowo msebenzisi engenza noma yini ayifunayo ngalezo zinsiza . Lokhu kusho ukuthi uma i-daemon isebenza njengempande, noma yisiphi isiphazamisi esisebenzisekayo singavula umnyango wokulawula ingxenye yesistimu ngomongo wayo wempande.

Izibonelo ezijwayelekile zifaka phakathi izizindalwazi lapho amafayela edatha azo kufanele ashintshwe kuphela nge-DBMS, kodwa empeleni angafundeka futhi aguqulwe yizinqubo ezine-root UID ; noma ama-daemon abalulekile asebenza ngamalungelo amaningi. Iphutha lokuhlela, ukugcwala kwe-buffer, noma ukuqinisekiswa kokufaka okubi kungashintsha isevisi ibe yindlela eya ohlelweni lonke.

I-SELinux ingeza ungqimba lwe -Mandatory Access Control (MAC) phezu kwe-DAC. "Okuphoqelekile" kusho ukuthi ukulawula ukufinyelela kuchazwa ngumlawuli ngezinqubomgomo, futhi abasebenzisi noma izinqubo azikwazi ukukhulula le mithetho zodwa. Uhlelo lokusebenza luqinisekisa lezi zinqubomgomo ngokuhlola ukusebenza ngakunye kwe-kernel okufanele ngaphambi kokukuvumela.

I-kernel, isebenzisa ama-hook e-LSM, ibuza i-SELinux kukho konke ukubiza kwesistimu okubucayi (ukuvula amafayela, ukudala amasokhethi, ukufaka izinhlelo zamafayela, ukuxhumana nge-IPC, njll.). Endaweni ngayinye yesinqumo, i-SELinux ihlola ukusebenza ngokusekelwe kunqubomgomo elayishiwe kanye nomongo wokuphepha wesihloko nento . Uma inqubomgomo inganikezi imvume ngokucacile, isenzo siyenqatshwa, kungakhathaliseki ukuthi inqubo iyimpande noma cha.

Izindlela zokusebenza: ukuphoqelela, ukuvumela, kanye nokukhutshaziwe

I-SELinux ingasebenza ezimweni ezintathu zokusebenza ezihlukaniswe ngokucacile, ezibalulekile ukuzazi ukuze ugweme ukuhlanya ekukhiqizeni:

• UkuphoqelelaI-SELinux inikwe amandla futhi iqinisekisa ngokugcwele inqubomgomo. Zonke izenzo ezingavunyelwe yimithetho ziyavinjelwa futhi ziyalogwa.
• UkuyekelelaI-SELinux iyasebenza, ilayisha inqubomgomo futhi ilebula uhlelo lwefayela, kodwa akuvimbeli Iqopha kuphela ukuthengiselana njengokungathi kwenqatshiwe. Lokhu kulungele ukulungisa amaphutha nokulungisa izinqubomgomo.
• AbakhubazekileI-SELinux ikhutshaziwe. Azikho izinqubomgomo ezisetshenziswayo futhi akukho ukumaka okwenziwayo. Uhlelo luthembele kumodeli ye-DAC yakudala.

Ukuze uthole izinguquko ezisheshayo nezesikhashana phakathi kwezindlela zokuphoqelela kanye nezindlela zokuvumela, kusetshenziswa umyalo othi `setenforce` , lapho imodi ichazwa njengo-0 (permissive) noma u-1 (enforce). Kubalulekile ukwazi ukuthi lolu shintsho aluguquguquki: ngemva kokuqalisa kabusha okulandelayo, imodi izobuyela kuleyo echazwe ekucushweni.

Uma udinga ushintsho oluhlala njalo, udinga ukuhlela ifayela. /njll/selinux/config (noma /etc/sysconfig/selinux kokunye ukusatshalaliswa) bese ulungisa inani lesiqondiso SELINUX=disabled|permissive|enforcingIzinguquko zizosetshenziswa ekuqaliseni okulandelayo futhi, ezimweni eziningi, zizohilela ukulebula kabusha uhlelo lwefayela.

Ukuze uhlole imodi esebenzayo, ungasebenzisa imiyalo efana ne -getenforce noma i-sestatus . Eyokuqala imane ibuyisele i-Enforce, i-Permissive, noma i-Disabled; eyesibili inikeza isifinyezo esiphelele sesimo se-SELinux, izinqubomgomo ezilayishiwe, namamojula asebenzayo.

Izimo zokuphepha kanye nesistimu yokulebula

Inhliziyo ye-SELinux uhlelo lwayo lwamalebula noma izimo zokuphepha . Ifayela ngalinye, inqubo, imbobo yenethiwekhi, isokhethi, idivayisi, njll., linomongo ohlobene ochaza ukuthi lingasetshenziswa kanjani. Lomongo wakhiwe izinkambu eziningana ezakha umbono we-SELinux ngaleyo nto.

Ifomethi evamile yomongo ithi user_u:role_r:type_t:level , enezici ezithile kuye ngenqubomgomo (ikakhulukazi uma kusetshenziswa i-MLS/MCS). Inkambu ngayinye inenhloso ethile: umsebenzisi we-SELinux, indima, uhlobo (olubizwa nangokuthi isizinda uma kubhekiselwa ezinqubweni), kanye nezinga lokuzwela noma isigaba.

Empeleni, into ebaluleke kakhulu uhlobo (insimu yesithathu), njengoba iningi lemithetho yenqubomgomo yakhiwe njengobudlelwano phakathi kwezinhlobo . Isibonelo, ukuvumela izinqubo zohlobo lwe-httpd_t ukuthi zifinyelele amafayela anelebula ethi httpd_sys_content_t, noma ukuvumela isizinda esithile ukuthi sixhumane nama-socket anelebula ethi http_port_t.

Lezi zimo zigcinwa njenge izimfanelo zesistimu yefayela enwetshiweNgakho-ke, kubalulekile ukusebenzisa izinhlelo zamafayela ezisekela i-xattrs (njenge-ext4, i-XFS, njll.). Endabeni yezinqubo, umongo wamanje kanye nezinye izimo ezihlobene zivezwa ngesistimu yamafayela mbumbulu. /proc/<pid>/attr/ kumafayela afana ne-current, exec, fscreate, prev, sockcreate noma keycreate.

Izibonelo ezijwayelekile zezimo ohlelweni olunenqubomgomo eqondiwe zingaba:

• uhlelo_u:object_r:httpd_sys_content_t:s0 kokuqukethwe kwewebhu okukhonzwa yi-Apache noma i-Nginx.
• uhlelo_u:object_r:home_user_t:s0 yezincwadi zasekhaya zabasebenzisi.
• uhlelo_u:system_r:httpd_t:s0 yesizinda sokusebenza seseva yewebhu uqobo.

Ukuhlahlela izingxenye zomongo we-SELinux

Uma uhlangana nomongo ofana no -unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 , kungase kubonakale sengathi yi-hieroglyphics, kodwa ingxenye ngayinye ihambisana nomqondo othize ngaphakathi kwe-SELinux kanye nenqubomgomo yayo yokubhekisela.

El Umsebenzisi we-SELinux (ngokuhlanganiswa nesijobelelo) _uLokhu akufani nomsebenzisi we-Unix ku-/etc/passwd. I-SELinux igcina isizindalwazi sayo somsebenzisi futhi ibaxhumanise nabasebenzisi be-Linux. Umsebenzisi we-SELinux angahlanganisa abasebenzisi abaningana be-Unix, ngoba umqondo uwukuthi ungqimba lwe-MAC luzimele ku-DAC.

El Indima ye-SELinux (nesimamva _rLokhu kuchaza ukuthi yiziphi izindima umsebenzisi noma isizinda esingazisebenzisa. Uma zisetshenziswa ngokuqinile, zibizwa ngokuthi i-RBAC ephelele. Izinto eziningi zefayela zisebenzisa indima ye-object_r, kuyilapho izindima ezifana ne-system_r, i-user_r, i-staff_r, noma i-sysadm_r zisetshenziswa ezinqubweni kuye ngomongo wokuphepha okumele zithathwe.

El Uhlobo noma isizinda se-SELinux (isijobelelo _tEmpeleni, uhlobo luyinto ebalulekile. Uhlobo luchaza uhlobo lwento noma isizinda sokwenziwa kwenqubo. Inqubomgomo icacisa ukuthi yikuphi ukusebenzisana okuvunyelwe phakathi kwezinhlobo: ukuthi yiziphi izizinda ezingafunda, zibhale, zisebenzise, ​​noma zixhumane nazo yiziphi ezinye izinhlobo zezinto.

Amazinga nezigaba kusetshenziswa uma izinqubomgomo zokuphepha zamazinga amaningi (i-MLS) noma zokuphepha kwezigaba eziningi (i-MCS) zivuliwe. Ukuzwela kungokwesigaba (isb., s0, s1, njll.), kuyilapho izigaba zingekho (c0, c1, c2, ...). Ezindaweni ezibucayi kakhulu—isibonelo, izinhlangano ezithile zikahulumeni—zisetshenziselwa ukuqinisekisa ukuthi idatha ingafundwa phansi kuphela futhi ibhalwe ezingeni elifanayo noma phezulu , kanye nokuhlukanisa idatha ngokwezigaba ezithile kakhulu.

Izinqubomgomo ze-SELinux: eziqondisiwe, eziqinile, i-MLS/MCS kanye ne-modularity

Ukuphepha okuphoqelelwa yi-SELinux kunqunywa yinqubomgomo elayishiwe . Inqubomgomo imane nje iyisethi enkulu yemithetho echaza ukuthi yiziphi izizinda ezingenza ini kuziphi izinhlobo, kanye nezinye izinto (ukuguqulwa, imithetho yokumaka, njll.). Ukusabalalisa kuvame ukupakisha izinqubomgomo ezijwayelekile ngakho akudingeki ubhale konke kusukela ekuqaleni.

Inqubomgomo evame kakhulu ibizwa ngokuthi i-targeted . Kule modi, izinqubo ezithile kuphela—ikakhulukazi izinsizakalo zenethiwekhi kanye nama-daemon anobungozi obukhulu njenge-Apache, i-Nginx, i-DNS, ama-proxies, i-SNMP, i-syslog, njll.—zisebenza ngaphakathi kwezizinda ezivalekile. Zonke ezinye izinqubo zomsebenzisi zisebenza kuzizinda "ezingavalekile", lapho ukuphepha kwe-Linux okujwayelekile kusetshenziswa khona ngokuyisisekelo, kanye nokubhaliswa kwezenzo ezithile.

Kukhona futhi inqubomgomo eqinile , lapho cishe zonke izinqubo zivinjelwe ngaphansi kwenqubomgomo ethile. Iphephile kakhulu, kodwa futhi kungaba nzima kakhulu ukuyigcina uma imodeli ingaqondakali kahle, ngoba noma yikuphi ukungafani ekulebheleni noma emithethweni kungaphazamisa ukuhamba komsebenzi okujwayelekile.

Ezindaweni zokuphepha okuphezulu, kunezinqubomgomo ze -MLS/MCS (Multi-Level/Multi-Category Security) ezisebenzisa ukuzwela kanye nezigaba ukuze zibeke izilawuli ezingcono kakhulu. Lezi zivame ezindaweni zempi noma zokuphatha eziqinile kakhulu futhi azivamile ukusetshenziswa ngaphandle kwezimo ezithile ngenxa yobunzima bazo obukhulu bokusebenza.

Izinqubomgomo zesimanje zisatshalaliswa ngendlela ye-modular . Esikhundleni sefayela elilodwa lenqubomgomo ye-monolithic, kusetshenziswa amamojula ahlukene ezinsizakalweni ezithile, okwenza kube lula kakhulu ukuphathwa kanye nezibuyekezo. Lawa mamojula aphathwa ngamathuluzi afana ne -semodule kanye ne-semanage module , akuvumela ukuthi ufake, ususe, unike amandla, noma ukhubaze izingxenye zenqubomgomo ngaphandle kokuhlanganisa kabusha yonke inqubomgomo isikhathi ngasinye.

Indlela i-SELinux enquma ngayo: izihloko, izinto, amakilasi, kanye nezimvume

Uma inqubo (isihloko) izama ukufinyelela umthombo (into), i-SELinux ibuza umbuzo ngomqondo: "Ingabe isizinda sohlobo X singenza umsebenzi u-Y entweni yohlobo Z engeyekilasi C?" . Impendulo isuke ifunwa kunqubomgomo ngemithetho echaziwe.

Kuzinqubomgomo ze-Type Enforcement (TE), ezisetshenziswa kakhulu yizinkampani eziningi zokusabalalisa kanye ne-Android, into ngayinye ingeyesigaba (ifayela, i -dir, i-fifo_file, i-tcp_socket, inqubo, njll.) futhi inqubomgomo ichaza ukuthi yiziphi izimvume ezingaba khona zesigaba ngasinye: ukufunda, ukubhala, ukusebenzisa, ukubopha, ukuxhuma, i-getattr, ukuvula, kanye ne-ede njll.

Imithetho ye-TE ichazwa ngqo. Isibonelo esiyisisekelo kungaba:

vumela i-httpd_t http_port_t:tcp_socket name_bind;

Ngalo mthetho, inqubomgomo ikhombisa ukuthi izinqubo kusizinda se-httpd_t zingenza umsebenzi we-name_bind kuma-socket e-TCP abhalwe ukuthi http_port_t. Le ndlela igxile ezinhlotsheni zezinto kanye namakilasi, hhayi ezindleleni ezithile , okuvimbela ukumangala lapho kuhanjiswa amafayela noma kushintsha izakhiwo zesikhombisi.

Ku-Android, isibonelo, izimfanelo ze-SELinux zisetshenziselwa ukuqoqa izinhlobo ngaphansi kwamalebula ajwayelekile njenge -`appdomain` , ukuze umthetho owodwa usebenze ezizindeni eziningi (`untrusted_app`, `isolated_app`, njll.) ngaphandle kokuphinda izincazelo. Ama-macro afana ne-`rw_file_perms` nawo asetshenziselwa ukuqoqa izimvume eziningi zefayela ezivamile nokunciphisa amaphutha abangelwa ukunganakwa.

Izimo zangaphakathi, i-AVC kanye nokubhaliswa kokuphika

Uma isicelo sokufinyelela sivela, i-SELinux iqala ngokubheka i- Access Vector Cache (AVC) , i-cache egcina izinqumo zokufinyelela zakamuva ukuze isheshise inqubo. Uma isinqumo sesivele siku-cache, sisetshenziswa ngqo; ngaphandle kwalokho, i-firewall (ingxenye yangaphakathi ye-SELinux ku-kernel) iyabuzwa, ehlola ukusebenza ngokusekelwe kunqubomgomo kanye nomongo wesihloko kanye nento.

Uma kungekho mthetho ovumela ngokusobala isenzo esiceliwe, isinqumo esizenzakalelayo ukuphika . Le filosofi "yokuphika ngokuzenzakalelayo" ingenye yezinsika ze-SELinux futhi yilokho okwenza ibe namandla ngokumelene namaphutha okucushwa okuvunyelwe.

Uma ukwenqatshwa kwenzeka kumodi yokuphoqelela, i-kernel ibhala umlayezo wohlobo avc: yenqatshiwe kumalogi esistimu. Kuye ngokusatshalaliswa, kungavela ku- /var/log/audit/audit.loge /var/log/messages noma ithathwe yi-audited daemon. Le milayezo ifaka phakathi umongo wenqubo (umongo), umongo wento (umongo we-t), ikilasi, umsebenzi oceliwe, kanye neminye imininingwane ewusizo kakhulu ekulungiseni amaphutha.

Kumodi evumelayo, ukusebenza kuvunyelwe kodwa i-event avc: denied isakhiqizwa , imakwe nge-permissive=1. Lokhu kuyigolide elimsulwa lokwakha nokulungisa izinqubomgomo, ngoba kukuvumela ukuthi ubone ukuthi yini engaphula uhlelo uma ukuphoqelela kungenziwa ngaphandle kokuphazamisa ukusebenza okuvamile.

Ukuhlanganisa i-SELinux ekusabalalisweni kanye ne-Android

Ku-ecosystem yeseva ye-Linux kanye nedeskithophu, i-SELinux inikwe amandla ngokuzenzakalelayo ku- I-Fedora, i-RHEL, i-CentOS kanye ne-derivativesI-Debian kanye ne-Ubuntu zinikeza ukwesekwa okugcwele kuma-kernel namaphakheji azo, yize ukusebenza kuvame ukuzikhethela futhi kudinga ukufaka amaphakheji afana ne-selinux-basics, i-selinux-policy-default, kanye ne-auditedd, kulandelwe yi-global re-tagging nge fixfiles relabel.

Ekuqaleni i-Android ifake i-SELinux kunguqulo 4.3 kwimodi evumelayo, yashintshelwa ekusetshenzisweni okungaphelele ku-4.4 (kuphela ezizindeni ezibalulekile njenge-installd, netd, vold, kanye ne-zygote), futhi ihlanganiswe ngokugcwele kusukela ku-Android 5.0 . Inqubomgomo ye-Android igxile ekuhlukaniseni izinhlelo zokusebenza, izinsizakalo zesistimu, kanye nezinqubo ezibucayi kusetshenziswa izinhlobo kanye nezimfanelo, ihlose ukunciphisa umthelela wokuyekethisa kunoma yiziphi zalezi zingxenye.

I-Android isebenzisa imiqondo efana nohlobo lwe-untrusted_app ezinqubweni ezivamile zohlelo lokusebenza, izimfanelo ze-appdomain ezizindeni zohlelo lokusebenza lweqembu, kanye nezigaba ze-MLS/MCS ukuhlukanisa idatha phakathi kwezinhlelo zokusebenza naphakathi kwabasebenzisi abangokoqobo. Konke lokhu kusebenza ndawonye ukuvimbela uhlelo lokusebenza olusengozini ukuthi lungaphumi ebhokisini lalo lesanti, noma ngabe lithola izimvume zomsebenzisi ezibanzi kakhulu.

Okubalulekile: I-Android yenza lula imodeli ye-SELinux ngokunganaki abasebenzisi, izindima, kanye nokuzwela okuthuthukile. Kukhona umsebenzisi oyedwa kuphela we-SELinux (u), izindima ezimbili eziyisisekelo (r wezihloko kanye ne-object_r wezinto), futhi ukuzwela kuhlala kungu-s0. Izigaba yizo ezenza umehluko ekuhlukanisweni kwedatha.

Ukuqhathaniswa ne-AppArmor kanye namanye ama-LSM

Ezingxoxweni eziningi, ukuqhathanisa phakathi kwe -SELinux ne-AppArmor kuvela ngokungenakugwenywa , njengoba womabili angamamojula okuphepha e-Linux futhi enikeza ama-MAC. Kodwa-ke, izindlela zawo zihlukile kakhulu, futhi kufanelekile ukukuqonda lokhu ngaphambi kokukhetha eyodwa noma enye endaweni yakho.

I-SELinux ichaza inqubomgomo egxile ezintweni nezinhlobo zazo: yonke into ohlelweni (amafayela, izinqubo, amasokhethi, amachweba, amadivayisi, ama-IPC, njll.) inikezwa ilebula. Izinqumo zokufinyelela zenziwa ngokusekelwe ezimweni zesihloko kanye nezinto, ngaphandle kokuncika endleleni eqondile yefayela. Lokhu kwenza uhlelo luzinze kakhulu lapho kubhekene nezinguquko zesakhiwo sesikhombisi noma ukubukwa kwesistimu yamafayela okuhlukile (i-chroot, iziqukathi, ama-bind mounts, njll.).

Ngakolunye uhlangothi, i-AppArmor isebenzisa inqubomgomo egxile emisebenzini , esekelwe endleleni. Ichaza amaphrofayili ohlelo ngalunye, icacisa ukuthi yiziphi izindlela zamafayela, amachweba, njll., ezingafinyelela kuzo nokuthi yiziphi izimvume. Kulula kakhulu ukumisa futhi ngokuvamile kulula kakhulu kubaphathi abangafuni ukuba ochwepheshe ku-SELinux, kodwa ukulawula kwayo akunawo ama-granular amaningi futhi kuncike kakhulu esakhiweni sesistimu yamafayela.

Bobabili babelana ngesimiso sokuphika ngokuzenzakalelayo, kodwa bakusebenzisa ngendlela ehlukile: I-AppArmor iyaphika ngokuzenzakalelayo imisebenzi eyimboza ngamaphrofayili kuphela, kuyilapho i-SELinux, uma ikwimodi eqinile, idlulisela kuyo yonke isistimu kanye nazo zonke izinto eziphawuliwe. Ngenxa yalokho, i-SELinux ivame ukunikeza izinga elijulile lokuvalelwa , ngezindleko zenqubomgomo ebanzi neyinkimbinkimbi.

Amathuluzi awusizo okuphatha i-SELinux

Ukusebenza ne-SELinux kuncike ochungechungeni lwamathuluzi omugqa wemiyalo enza kube lula ukuphathwa kwamamodi, ukumaka, ama-boolean, kanye namamojula enqubomgomo. Nakuba lokhu kungase kubonakale sengathi kuyinto exakile ekuqaleni, izinsiza ezimbalwa zimboza imisebenzi eminingi yansuku zonke.

Ukuze ubuke umongo wokuphepha wamafayela nezinqubo, ungasebenzisa inketho -Z emiyalweni evamile efana no-ls, ps, noma id. Isibonelo, ls -Z Ngaphezu kwezimvume ze-DAC, izobonisa umongo we-SELinux wefayela ngalinye, okukuvumela ukuthi uhlole ngokushesha ukuthi ukumaka kunjengoba kulindelekile.

Umyalo we -`chcon` ("shintsha umongo") ukuvumela ukuthi uguqule ngesandla umongo wonke wefayela noma izingxenye ezithile kuphela (indima, uhlobo, ububanzi) usebenzisa izinketho ezifana ne-`-r`, `-to`, kanye ne-`-l`. Uwusizo ekulungiseni okukodwa, kodwa kubalulekile ukukhumbula ukuthi izinguquko zakho zingase zilahleke uma ilebula lisetshenziswa kabusha ngokwenqubomgomo kusetshenziswa amathuluzi anjenge-`restorecon` noma i-`fixfiles`.

Ithuluzi le -semanage liwummese we-Swiss Army wokuphathwa kwenqubomgomo yesikhathi sokusebenza. Ngemiyalo ehlukahlukene engaphansi, ungaphatha izimo zefayela eziqhubekayo (i-fcontext), ukumepha kokungena phakathi kwabasebenzisi be-Linux nabakwa-SELinux (ukungena ngemvume), abasebenzisi be-SELinux kanye nezindima zabo (umsebenzisi), ama-port ane-tag (i-port), ama-boolean, ngisho namamojula enqubomgomo. Konke lokhu ngaphandle kokudinga ukuhlanganisa kabusha yonke inqubomgomo kusuka emthonjeni.

Ukuhlola nokushintsha isimo sama-boolean—izinkinobho ezincane ezivumela noma ezikhubaza amabhlogo emithetho ngaphakathi kwenqubomgomo— kusetshenziswa i-getsebool kanye ne -setsebool , ngaphezu kwe- setsebool boolean uqobo . I-boolean ejwayelekile yi-httpd_enable_homedirs, lapho, uma isebenza, ivumela iseva yewebhu ukufinyelela iziqondisi zasekhaya zabasebenzisi (eziwusizo ku-~user/public_html/).

Okokugcina, imiyalo efana ne -fixfiles ikuvumela ukuthi uphoqe ukulebula kabusha okuphelele kohlelo lwefayela ngokwemithetho echaziwe, futhi i-semodule inakekela ukufaka, ukufaka ohlwini, ukunika amandla noma ukukhubaza amamojula enqubomgomo (.pp) apakishwe futhi asatshalaliswa yinqubomgomo yokubhekisela noma ngumlawuli.

Ukudalwa nokulungiswa kwezinqubomgomo ezenziwe ngokwezifiso

Uma uhlelo lokusebenza lungenayo imojuli yalo ye-SELinux noma udinga ukuvinjelwa okuqondile, sekuyisikhathi sokuqala ibhizinisi bese udala izinqubomgomo ezenziwe ngokwezifiso . Kungase kuzwakale kuyinkimbinkimbi, kodwa ukuhamba komsebenzi kuchazwe kahle uma ulandela izinyathelo ezithile ngokucophelela.

Isinyathelo sokuqala ukuqinisekisa ukuthi izinto ezifanele (ama-executable, iziqondisi zedatha, amasokhethi, njll.) zilebula ngezinhlobo ezifanele. Lokhu kungafezwa ngokuchaza imithetho yomongo wefayela nge-` semanage fcontext` bese uyisebenzisa ne-`restorecon`, usebenzisa izinkulumo ezijwayelekile ukuhlanganisa yonke imithi yohlu lwemibhalo.

Uhlelo luvame ukufakwa kwimodi yokuvumela yalowo mshini (noma, kwezinye izimo, yesizinda esithile) futhi uhlelo lokusebenza luvunyelwe ukusebenza ngokujwayelekile ngenkathi i-SELinux ibhala zonke izitatimende ze-` avc: denied` ebezizokwenzeka. Lawa malogi, avame ukuhlaziywa ngamathuluzi afana ne- audit2allow , asetshenziselwa ukukhipha imithetho yokukhetha.

Izinqubomgomo zokubhekisela zivame ukuhlelwa ngamafayela amathathu ngohlelo lokusebenza ngalunye: ifayela le-.te eliqukethe imithetho ye-TE (vumela, thayipha, uhlobo_lwesizinda, njll.), ifayela le-.fc eliqukethe imithetho yomongo wefayela, kanye nefayela le-.if eliqukethe izixhumi zomphakathi ezinye amamojula ezingazisebenzisa kabusha. Konke lokhu kuhlanganiswe kumamojula e-.pp kusetshenziswa i-make futhi kulayishwe nge-semodule.

Kubalulekile ukungathembi konke okusikiselwa yi-audit2allow: kuvame ukuba nokuvumela kakhulu kunokudingeka kakhulu . Okungcono kakhulu, kufanele ubuyekeze imithetho ephakanyisiwe ngesandla, udale izinhlobo ezintsha lapho kufaneleka khona ukuze uhlukanise idatha ebucayi kudatha engabalulekile, futhi, lapho umsebenzi owenqatshiwe ungabalulekile, cabanga ukusebenzisa imithetho ye-dontaudit ukuze uyeke ukuqopha umsindo ngaphandle kokunikeza izimvume.

Ezindaweni ezifana ne-SUSE Linux Micro noma i-Android, kuhlinzekwa amathuluzi engeziwe (isibonelo, i-Udica yokukhiqiza izinqubomgomo zezitsha ezivela ezincazelweni ze-JSON) ezenza ingxenye yenqubo ibe ngokuzenzakalela ngokushintsha ngokushesha inqubomgomo ibe yizitsha ezithile ngaphandle kokufunda lonke ulimi lwenqubomgomo kusukela ekuqaleni.

Lonke lolu hlelo lokusebenza lwezimo, izinqubomgomo ze-modular, ama-boolean, namathuluzi okuphatha kwenza i-SELinux ibe yipulatifomu yokuphepha eqinile kakhulu futhi eguquguqukayo . Ngokutshala imali kokuqala ekufundeni, kuvumela ukulinganiselwa okunembile kwalokho isevisi noma uhlelo lokusebenza ngalunye olungakwenza, okuqinisa kakhulu indawo yokuhlasela yesistimu ngokumelene nokuxhashazwa, i-malware, kanye namaphutha abantu.