{"id":89426,"date":"2026-08-03T00:32:39","date_gmt":"2026-08-02T16:32:39","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/89426.html"},"modified":"2026-08-03T00:32:39","modified_gmt":"2026-08-02T16:32:39","slug":"linux%ef%bc%88centos%ef%bc%89%e7%b3%bb%e7%bb%9f%e7%ae%a1%e7%90%86%e5%85%a5%e9%97%a8%e7%ac%94%e8%ae%b0%ef%bc%88%e7%ac%ac%e4%ba%8c%e5%8d%81%e4%ba%8c%e6%9c%9f%ef%bc%89-selinux-%e5%ae%89","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/89426.html","title":{"rendered":"Linux\uff08CentOS\uff09\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0\uff08\u7b2c\u4e8c\u5341\u4e8c\u671f\uff09\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5"},"content":{"rendered":"<h2>Linux&#xff08;CentOS&#xff09;\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0&#xff08;\u7b2c\u4e8c\u5341\u4e8c\u671f&#xff09;\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5<\/h2>\n<p>Linux\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7cfb\u5217\u66f4\u591a\u6587\u7ae0\u6b22\u8fce\u8bbf\u95ee&#xff1a;<\/p>\n<p>Linux\u5165\u95e8\u2014\u2014\u7cfb\u7edf\u7ba1\u74061\u3001Linux\u5165\u95e8\u2014\u2014\u7cfb\u7edf\u7ba1\u74062<\/p>\n<p>\u6211\u7684\u4e3b\u9875&#xff1a;AOwhisky&#xff0c;\u8fd9\u91cc\u6709\u66f4\u591a\u8fd0\u7ef4\u7cfb\u7edf\u6027\u77e5\u8bc6\u6574\u7406\u548c\u5176\u4ed6\u6709\u8da3\u5185\u5bb9&#xff0c;\u6b22\u8fce\u4e0e\u6211\u4e00\u8d77\u63a2\u8ba8\u5b66\u4e60~<\/p>\n<h3>\u5f15\u8a00&#xff1a;Linux \u5b89\u5168\u7684\u201c\u7b2c\u4e8c\u9053\u9501\u201d\u2014\u2014\u5f53\u6587\u4ef6\u6743\u9650\u4e0d\u591f\u7528\u7684\u65f6\u5019<\/h3>\n<p>\u6211\u4eec\u5b66\u4e60\u4e86\u6587\u4ef6\u6743\u9650&#xff08;rwx&#xff09;\u3001\u7528\u6237\u7ba1\u7406&#xff08;UID\/GID&#xff09;\u548c\u9632\u706b\u5899&#xff08;firewalld&#xff09;\u3002\u8fd9\u4e9b\u90fd\u662f Linux \u5b89\u5168\u4f53\u7cfb\u7684\u91cd\u8981\u7ec4\u6210\u90e8\u5206\u3002\u4f46\u6709\u4e00\u4e2a\u95ee\u9898\u59cb\u7ec8\u5b58\u5728&#xff1a;\u6587\u4ef6\u6743\u9650\u53ea\u80fd\u63a7\u5236\u201c\u8c01\u80fd\u8bbf\u95ee\u201d&#xff0c;\u65e0\u6cd5\u63a7\u5236\u201c\u600e\u4e48\u8bbf\u95ee\u201d\u3002<\/p>\n<p>\u60f3\u8c61\u4e00\u4e0b&#xff1a;\u4f60\u6709\u4e00\u680b\u5927\u697c&#xff0c;\u6bcf\u95f4\u529e\u516c\u5ba4\u90fd\u6709\u95e8\u9501&#xff08;\u6587\u4ef6\u6743\u9650&#xff09;\u2014\u2014\u53ea\u6709\u7279\u5b9a\u7684\u4eba&#xff08;\u7528\u6237\/\u7ec4&#xff09;\u624d\u80fd\u8fdb\u5165\u3002\u4f46\u5982\u679c\u67d0\u4e2a\u5458\u5de5\u88ab\u9ed1\u5ba2\u63a7\u5236\u4e86&#xff0c;\u9ed1\u5ba2\u5047\u626e\u6210\u8fd9\u4e2a\u5458\u5de5\u8fdb\u5165\u5927\u697c&#xff0c;\u4ed6\u5c31\u80fd\u81ea\u7531\u8bbf\u95ee\u8fd9\u4e2a\u5458\u5de5\u6709\u6743\u8fdb\u5165\u7684\u6240\u6709\u623f\u95f4\u3002<\/p>\n<p>\u8fd9\u5c31\u662f Linux \u6587\u4ef6\u6743\u9650\u6a21\u578b\u7684\u672c\u8d28\u7f3a\u9677\u2014\u2014\u6743\u9650\u7ed1\u5b9a\u7684\u662f\u201c\u8eab\u4efd\u201d&#xff0c;\u800c\u4e0d\u662f\u201c\u884c\u4e3a\u201d\u3002<\/p>\n<ul>\n<li>Web \u670d\u52a1\u5668\u8fdb\u7a0b&#xff08;\u4ee5 apache \u7528\u6237\u8fd0\u884c&#xff09;\u53ef\u4ee5\u8bbf\u95ee \/var\/www\/html\u2014\u2014\u8fd9\u662f\u6b63\u5e38\u7684<\/li>\n<li>\u4f46\u5982\u679c\u9ed1\u5ba2\u653b\u7834\u4e86 Web \u670d\u52a1\u5668&#xff0c;\u540c\u6837\u7684 apache \u8fdb\u7a0b\u8fd8\u53ef\u80fd\u8bbf\u95ee \/tmp\u3001\/var\/tmp&#xff0c;\u751a\u81f3\u901a\u8fc7\u6f0f\u6d1e\u8bfb\u53d6 \/etc\/passwd\u2014\u2014\u8fd9\u662f\u707e\u96be&#xff01;<\/li>\n<\/ul>\n<p>SELinux&#xff08;Security-Enhanced Linux&#xff0c;\u5b89\u5168\u589e\u5f3a Linux&#xff09; \u89e3\u51b3\u4e86\u8fd9\u4e2a\u95ee\u9898\u3002\u5b83\u4e3a\u6bcf\u4e2a\u8fdb\u7a0b\u3001\u6587\u4ef6\u3001\u76ee\u5f55\u3001\u7aef\u53e3\u90fd\u6253\u4e0a\u4e86\u4e00\u4e2a\u201c\u5b89\u5168\u6807\u7b7e\u201d&#xff08;SELinux \u4e0a\u4e0b\u6587&#xff09;&#xff0c;\u5e76\u5b9a\u4e49\u4e86\u4e00\u5957\u4e25\u683c\u7684\u8bbf\u95ee\u89c4\u5219\u2014\u2014\u5373\u4f7f\u4f60\u662f root&#xff0c;\u5982\u679c SELinux \u7b56\u7565\u4e0d\u5141\u8bb8&#xff0c;\u4f60\u4e5f\u65e0\u6cd5\u6267\u884c\u67d0\u4e2a\u64cd\u4f5c\u3002<\/p>\n<p>\u4f20\u7edf DAC&#xff08;\u81ea\u4e3b\u8bbf\u95ee\u63a7\u5236&#xff09;&#xff1a;        SELinux MAC&#xff08;\u5f3a\u5236\u8bbf\u95ee\u63a7\u5236&#xff09;&#xff1a;<br \/>\n\u201c\u4f60\u662f\u8c01&#xff0c;\u51b3\u5b9a\u4e86\u4f60\u80fd\u5e72\u4ec0\u4e48\u201d       \u201c\u4f60\u7684\u6807\u7b7e\u662f\u4ec0\u4e48&#xff0c;\u51b3\u5b9a\u4e86\u4f60\u80fd\u5e72\u4ec0\u4e48\u201d<br \/>\n     \u2193                                      \u2193<br \/>\n  \u7528\u6237\u8eab\u4efd&#xff08;UID&#xff09;                     \u5b89\u5168\u4e0a\u4e0b\u6587&#xff08;\u4e0a\u4e0b\u6587&#xff09;<\/p>\n<p>SELinux \u4e0d\u662f\u66ff\u4ee3\u6587\u4ef6\u6743\u9650&#xff0c;\u800c\u662f\u5728\u5176\u4e4b\u4e0a\u6784\u5efa\u7684\u7b2c\u4e8c\u9053\u9632\u7ebf\u3002\u5b83\u4ee5 \u6700\u5c0f\u6743\u9650\u539f\u5219 \u4e3a\u6838\u5fc3\u2014\u2014\u9ed8\u8ba4\u62d2\u7edd\u6240\u6709\u64cd\u4f5c&#xff0c;\u53ea\u6709\u660e\u786e\u5141\u8bb8\u7684\u624d\u80fd\u6267\u884c\u3002<\/p>\n<p>\u672c\u671f\u5c06\u7cfb\u7edf\u5b66\u4e60 SELinux \u7684\u6838\u5fc3\u6982\u5ff5\u4e0e\u5b9e\u6218\u7ba1\u7406&#xff1a;<\/p>\n<ul>\n<li>SELinux \u6982\u8ff0&#xff1a;DAC vs MAC\u3001SELinux \u7684\u76ee\u6807<\/li>\n<li>SELinux \u6a21\u5f0f&#xff1a;Enforcing \/ Permissive \/ Disabled<\/li>\n<li>\u5b89\u5168\u4e0a\u4e0b\u6587\u7ba1\u7406&#xff1a;\u6587\u4ef6\u3001\u8fdb\u7a0b\u3001\u7aef\u53e3\u7684\u6807\u7b7e<\/li>\n<li>SELinux \u5e03\u5c14\u503c&#xff1a;\u5f00\u5173\u5f0f\u7b56\u7565\u8c03\u6574<\/li>\n<li>\u6545\u969c\u6392\u67e5&#xff1a;setroubleshoot \u4e0e sealert \u8bca\u65ad\u5de5\u5177<\/li>\n<\/ul>\n<p>\u8bfb\u5b8c\u8fd9\u4e00\u671f&#xff0c;\u4f60\u5c06\u638c\u63e1 Linux \u5b89\u5168\u4f53\u7cfb\u4e2d\u6700\u6df1\u5c42\u7684\u9632\u5fa1\u673a\u5236\u2014\u2014\u4ece\u201c\u80fd\u8bbf\u95ee\u201d\u5230\u201c\u80fd\u5b89\u5168\u8bbf\u95ee\u201d\u7684\u8dc3\u5347\u3002<\/p>\n<p>  \u2014 Compiled and Authored by Whisky \u2014 Augest 2<br \/>\n nd, 2026 <\/p>\n<h3>\u76ee\u5f55<\/h3>\n<li>SELinux \u6982\u8ff0&#xff1a;\u6587\u4ef6\u6743\u9650\u4e4b\u5916\u7684\u201c\u884c\u4e3a\u7ba1\u63a7\u201d\n<ul>\n<li>1.1 DAC vs MAC<\/li>\n<li>1.2 SELinux \u7684\u76ee\u6807<\/li>\n<\/ul>\n<\/li>\n<li>SELinux \u5de5\u4f5c\u6a21\u5f0f\n<ul>\n<li>2.1 \u4e09\u79cd\u6a21\u5f0f\u8be6\u89e3<\/li>\n<li>2.2 \u67e5\u770b\u4e0e\u8bbe\u7f6e\u6a21\u5f0f<\/li>\n<li>2.3 \u6a21\u5f0f\u5207\u6362\u6ce8\u610f\u4e8b\u9879<\/li>\n<\/ul>\n<\/li>\n<li>SELinux \u5b89\u5168\u4e0a\u4e0b\u6587\n<ul>\n<li>3.1 \u4e0a\u4e0b\u6587\u7684\u7ed3\u6784\u4e0e -Z \u9009\u9879<\/li>\n<li>3.2 \u65b0\u6587\u4ef6\u7684\u9ed8\u8ba4\u4e0a\u4e0b\u6587<\/li>\n<li>3.3 chcon&#xff1a;\u4e34\u65f6\u4fee\u6539\u4e0a\u4e0b\u6587<\/li>\n<li>3.4 restorecon&#xff1a;\u6062\u590d\u9ed8\u8ba4\u4e0a\u4e0b\u6587<\/li>\n<li>3.5 semanage fcontext&#xff1a;\u6c38\u4e45\u5b9a\u4e49\u9ed8\u8ba4\u4e0a\u4e0b\u6587<\/li>\n<li>3.6 \u5b9e\u6218&#xff1a;\u914d\u7f6e\u81ea\u5b9a\u4e49 Web \u76ee\u5f55<\/li>\n<\/ul>\n<\/li>\n<li>SELinux \u7aef\u53e3\u7ba1\u7406\n<ul>\n<li>4.1 \u7aef\u53e3\u6807\u7b7e\u7684\u6982\u5ff5<\/li>\n<li>4.2 \u67e5\u770b\u4e0e\u6dfb\u52a0\u7aef\u53e3\u6807\u7b7e<\/li>\n<li>4.3 \u5b9e\u6218&#xff1a;Web \u670d\u52a1\u4f7f\u7528\u81ea\u5b9a\u4e49\u7aef\u53e3<\/li>\n<\/ul>\n<\/li>\n<li>SELinux \u5e03\u5c14\u503c\n<ul>\n<li>5.1 \u4ec0\u4e48\u662f\u5e03\u5c14\u503c<\/li>\n<li>5.2 \u67e5\u770b\u4e0e\u8bbe\u7f6e\u5e03\u5c14\u503c<\/li>\n<li>5.3 \u5b9e\u6218&#xff1a;\u5141\u8bb8 httpd \u8bbf\u95ee\u7528\u6237\u5bb6\u76ee\u5f55<\/li>\n<\/ul>\n<\/li>\n<li>SELinux \u6545\u969c\u6392\u67e5\n<ul>\n<li>6.1 setroubleshoot-server&#xff1a;\u81ea\u52a8\u8bca\u65ad<\/li>\n<li>6.2 sealert&#xff1a;\u8be6\u7ec6\u6392\u67e5\u5de5\u5177<\/li>\n<li>6.3 SELinux \u95ee\u9898\u5904\u7406\u601d\u8def<\/li>\n<\/ul>\n<\/li>\n<li>\u603b\u7ed3\u4e0e\u901f\u67e5\u624b\u518c<\/li>\n<h3>1. SELinux \u6982\u8ff0&#xff1a;\u6587\u4ef6\u6743\u9650\u4e4b\u5916\u7684\u201c\u884c\u4e3a\u7ba1\u63a7\u201d<\/h3>\n<h4>1.1 DAC vs MAC<\/h4>\n<table>\n<tr>\u8bbf\u95ee\u63a7\u5236\u6a21\u578b\u5168\u79f0\u63a7\u5236\u4f9d\u636e\u4ee3\u8868<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">DAC<\/td>\n<td align=\"left\">Discretionary Access Control&#xff08;\u81ea\u4e3b\u8bbf\u95ee\u63a7\u5236&#xff09;<\/td>\n<td align=\"left\">\u7528\u6237\u8eab\u4efd&#xff08;UID\/GID&#xff09;<\/td>\n<td align=\"left\">Linux \u6587\u4ef6\u6743\u9650&#xff08;rwx&#xff09;<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">MAC<\/td>\n<td align=\"left\">Mandatory Access Control&#xff08;\u5f3a\u5236\u8bbf\u95ee\u63a7\u5236&#xff09;<\/td>\n<td align=\"left\">\u5b89\u5168\u6807\u7b7e\/\u4e0a\u4e0b\u6587<\/td>\n<td align=\"left\">SELinux\u3001AppArmor<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>DAC \u7684\u672c\u8d28&#xff1a;\u7531\u6587\u4ef6\u6240\u6709\u8005\u81ea\u4e3b\u51b3\u5b9a\u8c01\u53ef\u4ee5\u8bbf\u95ee&#xff08;chmod\/chown&#xff09;\u3002root \u7528\u6237\u53ef\u4ee5\u8bbf\u95ee\u4efb\u4f55\u6587\u4ef6\u2014\u2014\u8fd9\u5bf9\u5b89\u5168\u6765\u8bf4\u662f\u5de8\u5927\u7684\u98ce\u9669\u3002<\/p>\n<p>MAC \u7684\u672c\u8d28&#xff1a;\u7531\u7cfb\u7edf\u7b56\u7565\u5f3a\u5236\u89c4\u5b9a\u2014\u2014\u5373\u4f7f\u4f60\u662f root&#xff0c;\u5982\u679c\u6ca1\u6709\u5339\u914d\u7684\u5b89\u5168\u6807\u7b7e&#xff0c;\u64cd\u4f5c\u4e5f\u4f1a\u88ab\u62d2\u7edd\u3002<\/p>\n<p><span class=\"token comment\"># \u5373\u4f7f root \u7528\u6237&#xff0c;SELinux \u7b56\u7565\u4e5f\u53ef\u4ee5\u963b\u6b62\u64cd\u4f5c<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># echo test &gt; \/var\/www\/html\/index.html<\/span><br \/>\n-bash: \/var\/www\/html\/index.html: Permission denied<br \/>\n<span class=\"token comment\"># \u660e\u660e\u662f root&#xff0c;\u5374\u88ab\u62d2\u7edd\u4e86\u2014\u2014\u8fd9\u5c31\u662f SELinux \u5728\u8d77\u4f5c\u7528&#xff01;<\/span><\/p>\n<h4>1.2 SELinux \u7684\u76ee\u6807<\/h4>\n<p>\u4e3b\u8981\u76ee\u6807&#xff1a;\u9632\u6b62\u5df2\u906d\u6cc4\u9732\u7684\u7cfb\u7edf\u670d\u52a1\u8bbf\u95ee\u7528\u6237\u6570\u636e\u3002<\/p>\n<p>\u573a\u666f&#xff1a;\u9ed1\u5ba2\u653b\u7834\u4e86 Web \u670d\u52a1\u5668&#xff08;apache \u8fdb\u7a0b&#xff09;&#xff0c;\u83b7\u5f97\u4e86 apache \u7528\u6237\u7684\u6743\u9650\u3002\u5728\u4f20\u7edf\u7684 DAC \u6a21\u578b\u4e0b&#xff0c;apache \u7528\u6237\u53ef\u80fd\u80fd\u8bbf\u95ee \/tmp\u3001\/var\/tmp \u751a\u81f3\u8bfb\u53d6 \/etc\/passwd\u3002<\/p>\n<p>\u5728 SELinux \u7684\u4fdd\u62a4\u4e0b&#xff1a;<\/p>\n<ul>\n<li>apache \u8fdb\u7a0b\u7684\u6807\u7b7e\u662f httpd_t<\/li>\n<li>\/var\/www\/html \u6587\u4ef6\u7684\u6807\u7b7e\u662f httpd_sys_content_t<\/li>\n<li>\/tmp \u76ee\u5f55\u7684\u6807\u7b7e\u662f tmp_t<\/li>\n<li>SELinux \u7b56\u7565\u89c4\u5b9a&#xff1a;httpd_t \u53ea\u5141\u8bb8\u8bbf\u95ee httpd_sys_content_t \u6807\u7b7e\u7684\u6587\u4ef6<\/li>\n<li>\u5373\u4f7f apache \u7528\u6237\u6709\u6743\u9650\u8bbf\u95ee \/tmp&#xff0c;SELinux \u7b56\u7565\u4e5f\u4f1a\u963b\u6b62\u2014\u2014\u56e0\u4e3a\u6807\u7b7e\u4e0d\u5339\u914d&#xff01;<\/li>\n<\/ul>\n<p>&#x1f4a1; \u767d\u8bdd\u7406\u89e3&#xff1a;\u6587\u4ef6\u6743\u9650\u662f\u201c\u95e8\u7981\u5361\u201d&#xff08;\u8c01\u6709\u5361\u80fd\u8fdb\u95e8&#xff09;&#xff0c;SELinux \u662f\u201c\u4fdd\u5b89\u201d&#xff08;\u5373\u4f7f\u6709\u5361&#xff0c;\u4fdd\u5b89\u4e0d\u6279\u51c6\u4e5f\u4e0d\u80fd\u8fdb&#xff0c;\u4e5f\u4e0d\u80fd\u53bb\u4e0d\u8be5\u53bb\u7684\u5730\u65b9&#xff09;\u3002<\/p>\n<h3>2. SELinux \u5de5\u4f5c\u6a21\u5f0f<\/h3>\n<h4>2.1 \u4e09\u79cd\u6a21\u5f0f\u8be6\u89e3<\/h4>\n<table>\n<tr>\u6a21\u5f0f\u8bbf\u95ee\u63a7\u5236\u8fdd\u89c4\u8bb0\u5f55\u63a8\u8350\u573a\u666f<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">Enforcing&#xff08;\u5f3a\u5236&#xff09;<\/td>\n<td align=\"left\">\u2705 \u5f3a\u5236\u6267\u884c<\/td>\n<td align=\"left\">\u2705 \u8bb0\u5f55<\/td>\n<td align=\"left\">\u751f\u4ea7\u73af\u5883<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">Permissive&#xff08;\u5141\u8bb8&#xff09;<\/td>\n<td align=\"left\">\u274c \u4e0d\u5f3a\u5236&#xff08;\u4ec5\u8b66\u544a&#xff09;<\/td>\n<td align=\"left\">\u2705 \u8bb0\u5f55<\/td>\n<td align=\"left\">\u8c03\u8bd5\/\u6d4b\u8bd5<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">Disabled&#xff08;\u7981\u7528&#xff09;<\/td>\n<td align=\"left\">\u274c \u5b8c\u5168\u5173\u95ed<\/td>\n<td align=\"left\">\u274c \u4e0d\u8bb0\u5f55<\/td>\n<td align=\"left\">\u274c \u4e0d\u63a8\u8350<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span class=\"token comment\"># \u67e5\u770b\u5f53\u524d\u6a21\u5f0f<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># getenforce<\/span><br \/>\nEnforcing<\/p>\n<h4>2.2 \u67e5\u770b\u4e0e\u8bbe\u7f6e\u6a21\u5f0f<\/h4>\n<p><span class=\"token comment\"># \u67e5\u770b\u5f53\u524d\u6a21\u5f0f<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># getenforce<\/span><\/p>\n<p><span class=\"token comment\"># \u4e34\u65f6\u5207\u6362\u6a21\u5f0f&#xff08;\u7acb\u5373\u751f\u6548&#xff0c;\u65e0\u9700\u91cd\u542f&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce 0      # \u5207\u6362\u5230 Permissive<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce 1      # \u5207\u6362\u5230 Enforcing<\/span><br \/>\n<span class=\"token comment\"># \u6216\u4f7f\u7528\u540d\u79f0<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce Permissive<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setenforce Enforcing<\/span><\/p>\n<p><span class=\"token comment\"># \u6c38\u4e45\u8bbe\u7f6e&#xff08;\u4fee\u6539\u914d\u7f6e\u6587\u4ef6&#xff0c;\u9700\u91cd\u542f&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># vim \/etc\/selinux\/config<\/span><br \/>\n<span class=\"token assign-left variable\">SELINUX<\/span><span class=\"token operator\">&#061;<\/span>enforcing          <span class=\"token comment\"># \u53ef\u9009&#xff1a;enforcing \/ permissive \/ disabled<\/span><br \/>\n<span class=\"token assign-left variable\">SELINUXTYPE<\/span><span class=\"token operator\">&#061;<\/span>targeted       <span class=\"token comment\"># \u7b56\u7565\u7c7b\u578b&#xff1a;targeted \u662f\u9ed8\u8ba4<\/span><\/p>\n<p>\u6a21\u5f0f\u5207\u6362\u6ce8\u610f\u4e8b\u9879&#xff1a;<\/p>\n<table>\n<tr>\u5207\u6362\u65b9\u5411\u662f\u5426\u9700\u8981\u91cd\u542f<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">Enforcing \u2194 Permissive<\/td>\n<td align=\"left\">\u274c \u4e0d\u9700\u8981<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">Enforcing \u2192 Disabled<\/td>\n<td align=\"left\">\u2705 \u9700\u8981\u91cd\u542f<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">Disabled \u2192 Enforcing\/Permissive<\/td>\n<td align=\"left\">\u2705 \u9700\u8981\u91cd\u542f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>2.3 \u5185\u6838\u53c2\u6570\u542f\u52a8\u65f6\u8bbe\u7f6e SELinux \u6a21\u5f0f<\/h4>\n<p>\u5728 GRUB2 \u542f\u52a8\u83dc\u5355\u4e2d\u53ef\u901a\u8fc7\u5185\u6838\u53c2\u6570\u63a7\u5236 SELinux \u6a21\u5f0f&#xff08;\u5e38\u7528\u4e8e\u6545\u969c\u4fee\u590d&#xff09;&#xff1a;<\/p>\n<table>\n<tr>\u5185\u6838\u53c2\u6570\u6548\u679c<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">enforcing&#061;0<\/td>\n<td align=\"left\">\u542f\u52a8\u65f6\u8fdb\u5165 Permissive \u6a21\u5f0f<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">enforcing&#061;1<\/td>\n<td align=\"left\">\u542f\u52a8\u65f6\u8fdb\u5165 Enforcing \u6a21\u5f0f&#xff08;\u9ed8\u8ba4&#xff09;<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">selinux&#061;0<\/td>\n<td align=\"left\">\u5b8c\u5168\u7981\u7528 SELinux<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>3. SELinux \u5b89\u5168\u4e0a\u4e0b\u6587<\/h3>\n<h4>3.1 \u4e0a\u4e0b\u6587\u7684\u7ed3\u6784\u4e0e -Z \u9009\u9879<\/h4>\n<p>SELinux \u5b89\u5168\u4e0a\u4e0b\u6587\u683c\u5f0f&#xff1a;<\/p>\n<p>\u7528\u6237:\u89d2\u8272:\u7c7b\u578b:\u654f\u611f\u5ea6<\/p>\n<table>\n<tr>\u90e8\u5206\u542b\u4e49\u793a\u4f8b<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">\u7528\u6237&#xff08;user&#xff09;<\/td>\n<td align=\"left\">SELinux \u7528\u6237\u8eab\u4efd&#xff0c;\u4e0e Linux \u7528\u6237\u4e0d\u540c<\/td>\n<td align=\"left\">unconfined_u\u3001system_u<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u89d2\u8272&#xff08;role&#xff09;<\/td>\n<td align=\"left\">\u8fdb\u7a0b\u89d2\u8272&#xff08;\u8fdb\u7a0b\u662f _r&#xff0c;\u6587\u4ef6\u662f _r&#xff09;<\/td>\n<td align=\"left\">object_r<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u7c7b\u578b&#xff08;type&#xff09;<\/td>\n<td align=\"left\">\u6838\u5fc3\u90e8\u5206&#xff0c;\u4ee5 _t \u7ed3\u5c3e&#xff0c;\u7b56\u7565\u57fa\u4e8e\u7c7b\u578b\u5339\u914d<\/td>\n<td align=\"left\">httpd_t\u3001httpd_sys_content_t<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u654f\u611f\u5ea6&#xff08;level&#xff09;<\/td>\n<td align=\"left\">MLS\/MCS \u5b89\u5168\u7ea7\u522b&#xff08;\u591a\u7ea7\u5b89\u5168&#xff09;<\/td>\n<td align=\"left\">s0\u3001s0-s0:c0.c1023<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u4f7f\u7528 -Z \u67e5\u770b\u5b89\u5168\u4e0a\u4e0b\u6587&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u8fdb\u7a0b\u7684\u5b89\u5168\u4e0a\u4e0b\u6587<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ps -Z<\/span><br \/>\nLABEL                               PID TTY          TIME CMD<br \/>\nsystem_u:system_r:sshd_t:s0-s0:c0.c1023 <span class=\"token number\">951<\/span> ?    00:00:00 sshd<br \/>\nunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 <span class=\"token number\">1276<\/span> pts\/0 00:00:00 <span class=\"token function\">bash<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u6587\u4ef6\u7684\u5b89\u5168\u4e0a\u4e0b\u6587<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls -Z \/etc\/hosts<\/span><br \/>\nsystem_u:object_r:net_conf_t:s0 \/etc\/hosts<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u76ee\u5f55\u7684\u5b89\u5168\u4e0a\u4e0b\u6587<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls -Zd \/var\/www\/html<\/span><br \/>\nsystem_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html<\/p>\n<p>\u26a0\ufe0f \u5173\u952e\u7406\u89e3&#xff1a;SELinux \u57fa\u4e8e \u7c7b\u578b&#xff08;type&#xff09; \u505a\u8bbf\u95ee\u63a7\u5236&#xff0c;\u800c\u4e0d\u662f\u7528\u6237\u6216\u89d2\u8272\u3002httpd_t \u80fd\u8bbf\u95ee httpd_sys_content_t&#xff0c;\u4f46\u4e0d\u80fd\u8bbf\u95ee tmp_t\u3002<\/p>\n<h4>3.2 \u65b0\u6587\u4ef6\u7684\u9ed8\u8ba4\u4e0a\u4e0b\u6587<\/h4>\n<p>\u65b0\u6587\u4ef6\u901a\u5e38\u4ece\u7236\u76ee\u5f55\u7ee7\u627f SELinux \u4e0a\u4e0b\u6587\u3002<\/p>\n<p><span class=\"token comment\"># \u5728 \/tmp \u4e2d\u521b\u5efa\u6587\u4ef6&#xff08;\u7ee7\u627f tmp_t&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># touch \/tmp\/testfile<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls -Z \/tmp\/testfile<\/span><br \/>\nunconfined_u:object_r:user_tmp_t:s0 \/tmp\/testfile<\/p>\n<p><span class=\"token comment\"># \u590d\u5236\u5230 \/root&#xff08;\u7ee7\u627f admin_home_t&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># cp \/tmp\/testfile \/root\/<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls -Z \/root\/testfile<\/span><br \/>\nunconfined_u:object_r:admin_home_t:s0 \/root\/testfile<\/p>\n<p>\u4e24\u79cd\u60c5\u51b5\u4e0a\u4e0b\u6587\u4fdd\u6301\u4e0d\u53d8&#xff1a;<\/p>\n<table>\n<tr>\u64cd\u4f5cSELinux \u4e0a\u4e0b\u6587\u53d8\u5316<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">cp -a&#xff08;\u4fdd\u7559\u5c5e\u6027&#xff09;<\/td>\n<td align=\"left\">\u274c \u4e0d\u53d8<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">mv&#xff08;\u79fb\u52a8&#xff09;<\/td>\n<td align=\"left\">\u274c \u4e0d\u53d8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span class=\"token comment\"># \u79fb\u52a8\u6587\u4ef6&#xff0c;\u4e0a\u4e0b\u6587\u4e0d\u53d8&#xff08;\u4ecd\u662f user_tmp_t&#xff0c;\u4f46\u4f4d\u7f6e\u5728 \/root&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># mv \/tmp\/testfile \/root\/testfile-mv<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls -Z \/root\/testfile-mv<\/span><br \/>\nunconfined_u:object_r:user_tmp_t:s0 \/root\/testfile-mv<br \/>\n<span class=\"token comment\"># \u8fd9\u53ef\u80fd\u5bfc\u81f4 SELinux \u95ee\u9898\u2014\u2014\u6587\u4ef6\u5728 root \u5bb6\u76ee\u5f55&#xff0c;\u4f46\u6807\u7b7e\u662f tmp_t&#xff01;<\/span><\/p>\n<h4>3.3 chcon&#xff1a;\u4e34\u65f6\u4fee\u6539\u4e0a\u4e0b\u6587<\/h4>\n<p>chcon \u7528\u4e8e\u76f4\u63a5\u4fee\u6539\u6587\u4ef6\u7684 SELinux \u4e0a\u4e0b\u6587&#xff0c;\u9002\u7528\u4e8e\u6d4b\u8bd5\u548c\u8c03\u8bd5\u3002<\/p>\n<p><span class=\"token comment\"># \u521b\u5efa\u76ee\u5f55\u5e76\u67e5\u770b\u4e0a\u4e0b\u6587<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># mkdir \/www<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls -Zd \/www<\/span><br \/>\nunconfined_u:object_r:default_t:s0 \/www<\/p>\n<p><span class=\"token comment\"># \u4fee\u6539\u4e0a\u4e0b\u6587&#xff08;\u6539\u4e3a httpd_sys_content_t&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># chcon -t httpd_sys_content_t \/www<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># ls -Zd \/www<\/span><br \/>\nunconfined_u:object_r:httpd_sys_content_t:s0 \/www<\/p>\n<p><span class=\"token comment\"># \u4f7f\u7528 -R \u9012\u5f52\u4fee\u6539<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># chcon -R -t httpd_sys_content_t \/www<\/span><\/p>\n<p>\u26a0\ufe0f \u91cd\u8981&#xff1a;chcon \u7684\u4fee\u6539\u4e0d\u4f1a\u4fdd\u5b58\u5230 SELinux \u7b56\u7565\u6570\u636e\u5e93\u3002\u5f53\u7cfb\u7edf\u6267\u884c restorecon \u6216\u5b8c\u6574 relabel \u65f6&#xff0c;\u4fee\u6539\u4f1a\u88ab\u91cd\u7f6e\u3002<\/p>\n<h4>3.4 restorecon&#xff1a;\u6062\u590d\u9ed8\u8ba4\u4e0a\u4e0b\u6587<\/h4>\n<p>restorecon \u6839\u636e SELinux \u7b56\u7565\u6570\u636e\u5e93\u4e2d\u7684\u89c4\u5219&#xff0c;\u6062\u590d\u6587\u4ef6\u7684\u9ed8\u8ba4\u4e0a\u4e0b\u6587\u3002<\/p>\n<p><span class=\"token comment\"># \u6062\u590d\u5355\u4e2a\u6587\u4ef6\u7684\u4e0a\u4e0b\u6587<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># restorecon -v \/www<\/span><br \/>\nRelabeled \/www from unconfined_u:object_r:httpd_sys_content_t:s0 to unconfined_u:object_r:default_t:s0<br \/>\n<span class=\"token comment\"># -v&#xff1a;\u663e\u793a\u6062\u590d\u8fc7\u7a0b<\/span><\/p>\n<p><span class=\"token comment\"># \u9012\u5f52\u6062\u590d\u76ee\u5f55\u4e0b\u6240\u6709\u6587\u4ef6<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># restorecon -Rv \/www\/<\/span><\/p>\n<h4>3.5 semanage fcontext&#xff1a;\u6c38\u4e45\u5b9a\u4e49\u9ed8\u8ba4\u4e0a\u4e0b\u6587<\/h4>\n<p>semanage fcontext \u5728 SELinux \u7b56\u7565\u6570\u636e\u5e93\u4e2d\u6dfb\u52a0\/\u5220\u9664\/\u4fee\u6539\u4e0a\u4e0b\u6587\u89c4\u5219&#xff0c;restorecon \u5c06\u4f9d\u636e\u8fd9\u4e9b\u89c4\u5219\u6062\u590d\u4e0a\u4e0b\u6587\u3002<\/p>\n<p><span class=\"token comment\"># \u5b89\u88c5 semanage \u5de5\u5177<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># yum install -y policycoreutils-python-utils<\/span><\/p>\n<p><span class=\"token comment\"># \u4e3a \/www \u76ee\u5f55\u5b9a\u4e49\u9ed8\u8ba4\u4e0a\u4e0b\u6587&#xff08;\u4f7f\u7528\u6b63\u5219\u8868\u8fbe\u5f0f\u5339\u914d\u6240\u6709\u5b50\u6587\u4ef6&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage fcontext -a -t httpd_sys_content_t &#039;\/www(\/.*)?&#039;<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u81ea\u5b9a\u4e49\u89c4\u5219<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage fcontext -lC<\/span><br \/>\nSELinux fcontext  <span class=\"token builtin class-name\">type<\/span>      Context<br \/>\n\/www<span class=\"token punctuation\">(<\/span>\/.*<span class=\"token punctuation\">)<\/span>?     all files    system_u:object_r:httpd_sys_content_t:s0<\/p>\n<p><span class=\"token comment\"># \u6062\u590d\u4e0a\u4e0b\u6587<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># restorecon -Rv \/www\/<\/span><br \/>\nRelabeled \/www from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0<\/p>\n<p><span class=\"token comment\"># \u5220\u9664\u81ea\u5b9a\u4e49\u89c4\u5219<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage fcontext -d -t httpd_sys_content_t &#039;\/www(\/.*)?&#039;<\/span><\/p>\n<p><span class=\"token comment\"># \u9a8c\u8bc1\u5220\u9664<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage fcontext -lC<\/span><br \/>\n<span class=\"token comment\"># \u65e0\u8f93\u51fa<\/span><\/p>\n<h4>3.6 \u5b9e\u6218&#xff1a;\u914d\u7f6e\u81ea\u5b9a\u4e49 Web \u76ee\u5f55<\/h4>\n<p>\u573a\u666f&#xff1a;\u5c06 Web \u670d\u52a1\u7684\u4e3b\u76ee\u5f55\u4ece \/var\/www\/html \u6539\u4e3a \/www\u3002<\/p>\n<p><span class=\"token comment\"># 1. \u521b\u5efa\u81ea\u5b9a\u4e49 Web \u76ee\u5f55<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># mkdir \/www<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># echo &#034;&lt;h1&gt;Hello SELinux&lt;\/h1&gt;&#034; &gt; \/www\/index.html<\/span><\/p>\n<p><span class=\"token comment\"># 2. \u914d\u7f6e httpd \u4e3b\u76ee\u5f55<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># vim \/etc\/httpd\/conf\/httpd.conf<\/span><br \/>\nDocumentRoot <span class=\"token string\">&#034;\/www&#034;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>Directory <span class=\"token string\">&#034;\/www&#034;<\/span><span class=\"token operator\">&gt;<\/span><br \/>\n    AllowOverride None<br \/>\n    Require all granted<br \/>\n<span class=\"token operator\">&lt;<\/span>\/Directory<span class=\"token operator\">&gt;<\/span><\/p>\n<p><span class=\"token comment\"># 3. \u5c1d\u8bd5\u542f\u52a8&#xff08;\u5931\u8d25&#xff01;SELinux \u963b\u6b62&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># systemctl start httpd<\/span><br \/>\nJob <span class=\"token keyword\">for<\/span> httpd.service failed because the control process exited with error code.<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># tail \/var\/log\/messages<\/span><br \/>\n<span class=\"token punctuation\">..<\/span>. SELinux is preventing httpd from getattr access on the directory \/www <span class=\"token punctuation\">..<\/span>.<\/p>\n<p><span class=\"token comment\"># 4. \u6c38\u4e45\u4fee\u6539 SELinux \u4e0a\u4e0b\u6587<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage fcontext -a -t httpd_sys_content_t &#039;\/www(\/.*)?&#039;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># restorecon -Rv \/www\/<\/span><\/p>\n<p><span class=\"token comment\"># 5. \u542f\u52a8\u6210\u529f<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># systemctl start httpd<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># curl http:\/\/localhost\/<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>h<span class=\"token operator\"><span class=\"token file-descriptor important\">1<\/span>&gt;<\/span>Hello SELinux<span class=\"token operator\">&lt;<\/span>\/h<span class=\"token operator\"><span class=\"token file-descriptor important\">1<\/span>&gt;<\/span><\/p>\n<h3>4. SELinux \u7aef\u53e3\u7ba1\u7406<\/h3>\n<h4>4.1 \u7aef\u53e3\u6807\u7b7e\u7684\u6982\u5ff5<\/h4>\n<p>SELinux \u4e0d\u4ec5\u7ed9\u6587\u4ef6\u6253\u6807\u7b7e&#xff0c;\u8fd8\u7ed9\u7f51\u7edc\u7aef\u53e3\u6253\u6807\u7b7e\u3002\u5f53\u670d\u52a1\u8fdb\u7a0b\u5c1d\u8bd5\u7ed1\u5b9a\u5230\u67d0\u4e2a\u7aef\u53e3\u65f6&#xff0c;SELinux \u68c0\u67e5&#xff1a;<\/p>\n<ul>\n<li>\u8fdb\u7a0b\u7684\u57df&#xff08;\u5982 httpd_t&#xff09;\u662f\u5426\u88ab\u5141\u8bb8\u7ed1\u5b9a\u5230\u8be5\u7aef\u53e3\u6807\u7b7e&#xff08;\u5982 http_port_t&#xff09;<\/li>\n<\/ul>\n<p><span class=\"token comment\"># \u67e5\u770b\u7aef\u53e3\u6807\u7b7e<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage port -l | grep http_port_t<\/span><br \/>\nhttp_port_t                    tcp      <span class=\"token number\">80<\/span>, <span class=\"token number\">81<\/span>, <span class=\"token number\">443<\/span>, <span class=\"token number\">488<\/span>, <span class=\"token number\">8008<\/span>, <span class=\"token number\">8009<\/span>, <span class=\"token number\">8443<\/span>, <span class=\"token number\">9000<\/span><br \/>\n<span class=\"token comment\"># \u6ce8\u610f&#xff1a;httpd \u670d\u52a1\u53ef\u4ee5\u7ed1\u5b9a\u5230\u8fd9\u4e9b\u7aef\u53e3<\/span><\/p>\n<h4>4.2 \u67e5\u770b\u4e0e\u6dfb\u52a0\u7aef\u53e3\u6807\u7b7e<\/h4>\n<p><span class=\"token comment\"># \u67e5\u770b\u6240\u6709\u7aef\u53e3\u6807\u7b7e&#xff08;\u4ec5\u67e5\u770b\u81ea\u5b9a\u4e49\u7684\u7528 -lC&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage port -l<\/span><\/p>\n<p><span class=\"token comment\"># \u6dfb\u52a0\u7aef\u53e3\u6807\u7b7e&#xff08;\u5c06 18020 \u7aef\u53e3\u6807\u8bb0\u4e3a http_port_t&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage port -a -t http_port_t -p tcp 18020<\/span><\/p>\n<p><span class=\"token comment\"># \u4fee\u6539\u7aef\u53e3\u6807\u7b7e&#xff08;\u5c06 18020 \u6539\u4e3a ssh_port_t&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage port -m -t ssh_port_t -p tcp 18020<\/span><\/p>\n<p><span class=\"token comment\"># \u5220\u9664\u7aef\u53e3\u6807\u7b7e<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage port -d -t ssh_port_t -p tcp 18020<\/span><\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u81ea\u5b9a\u4e49\u7684\u7aef\u53e3\u6807\u7b7e<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage port -lC<\/span><br \/>\nSELinux Port Type              Proto    Port Number<br \/>\nhttp_port_t                    tcp      <span class=\"token number\">18020<\/span><\/p>\n<h4>4.3 \u5b9e\u6218&#xff1a;Web \u670d\u52a1\u4f7f\u7528\u81ea\u5b9a\u4e49\u7aef\u53e3<\/h4>\n<p>\u573a\u666f&#xff1a;\u8ba9 httpd \u76d1\u542c\u5728 18020 \u7aef\u53e3\u3002<\/p>\n<p><span class=\"token comment\"># 1. \u4fee\u6539 httpd \u914d\u7f6e\u6587\u4ef6<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># vim \/etc\/httpd\/conf\/httpd.conf<\/span><br \/>\nListen <span class=\"token number\">18020<\/span><\/p>\n<p><span class=\"token comment\"># 2. \u5c1d\u8bd5\u542f\u52a8&#xff08;\u5931\u8d25\u2014\u2014SELinux \u963b\u6b62\u7ed1\u5b9a\u975e\u6807\u51c6\u7aef\u53e3&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># systemctl restart httpd<\/span><br \/>\nJob <span class=\"token keyword\">for<\/span> httpd.service failed<span class=\"token punctuation\">..<\/span>.<br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># tail \/var\/log\/messages<\/span><br \/>\n<span class=\"token punctuation\">..<\/span>. AH00072: make_sock: could not <span class=\"token builtin class-name\">bind<\/span> to address <span class=\"token number\">0.0<\/span>.0.0:18020<\/p>\n<p><span class=\"token comment\"># 3. \u5c06\u7aef\u53e3\u6dfb\u52a0\u5230 http_port_t \u6807\u7b7e<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage port -a -t http_port_t -p tcp 18020<\/span><\/p>\n<p><span class=\"token comment\"># 4. \u518d\u6b21\u542f\u52a8\u6210\u529f<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># systemctl restart httpd<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># curl http:\/\/localhost:18020\/<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>h<span class=\"token operator\"><span class=\"token file-descriptor important\">1<\/span>&gt;<\/span>Hello SELinux<span class=\"token operator\">&lt;<\/span>\/h<span class=\"token operator\"><span class=\"token file-descriptor important\">1<\/span>&gt;<\/span><\/p>\n<h3>5. SELinux \u5e03\u5c14\u503c<\/h3>\n<h4>5.1 \u4ec0\u4e48\u662f\u5e03\u5c14\u503c<\/h4>\n<p>SELinux \u5e03\u5c14\u503c\u662f\u53ef\u4ee5\u5728\u8fd0\u884c\u65f6\u52a8\u6001\u5f00\u542f\/\u5173\u95ed\u7684\u7b56\u7565\u5f00\u5173&#xff0c;\u7528\u4e8e\u8c03\u6574\u7279\u5b9a\u529f\u80fd\u7684\u884c\u4e3a&#xff0c;\u800c\u65e0\u9700\u4fee\u6539\u590d\u6742\u7684\u7b56\u7565\u89c4\u5219\u3002<\/p>\n<p>\u5e03\u5c14\u503c\u5c31\u50cf\u662f SELinux \u7b56\u7565\u7684\u201c\u5f00\u5173\u9762\u677f\u201d<br \/>\n&#8211; \u6bcf\u4e2a\u5f00\u5173\u63a7\u5236\u4e00\u4e2a\u7279\u5b9a\u7684\u529f\u80fd<br \/>\n&#8211; \u53ef\u4ee5\u968f\u65f6\u6253\u5f00\u6216\u5173\u95ed<br \/>\n&#8211; \u65e0\u9700\u91cd\u542f\u7cfb\u7edf<\/p>\n<h4>5.2 \u67e5\u770b\u4e0e\u8bbe\u7f6e\u5e03\u5c14\u503c<\/h4>\n<p><span class=\"token comment\"># \u67e5\u770b\u6240\u6709\u5e03\u5c14\u503c<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># getsebool -a<\/span><br \/>\nhttpd_enable_homedirs &#8212;<span class=\"token operator\">&gt;<\/span> off<br \/>\nhttpd_unified &#8212;<span class=\"token operator\">&gt;<\/span> off<br \/>\n<span class=\"token punctuation\">..<\/span>.<\/p>\n<p><span class=\"token comment\"># \u67e5\u770b\u7279\u5b9a\u5e03\u5c14\u503c<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># getsebool httpd_enable_homedirs<\/span><br \/>\nhttpd_enable_homedirs &#8212;<span class=\"token operator\">&gt;<\/span> off<\/p>\n<p><span class=\"token comment\"># \u4e34\u65f6\u8bbe\u7f6e\u5e03\u5c14\u503c&#xff08;\u8fd0\u884c\u65f6\u751f\u6548&#xff0c;\u91cd\u542f\u540e\u6062\u590d&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setsebool httpd_enable_homedirs&#061;1<\/span><br \/>\n<span class=\"token comment\"># \u6216\u4f7f\u7528 on\/off\/true\/false<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setsebool httpd_enable_homedirs on<\/span><\/p>\n<p><span class=\"token comment\"># \u6c38\u4e45\u8bbe\u7f6e&#xff08;\u5199\u5165\u7b56\u7565\u6570\u636e\u5e93&#xff0c;\u91cd\u542f\u540e\u4ecd\u751f\u6548&#xff09;-P<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setsebool -P httpd_enable_homedirs&#061;1<\/span><\/p>\n<p><span class=\"token comment\"># \u4f7f\u7528 semanage \u7ba1\u7406\u5e03\u5c14\u503c<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage boolean -l                  # \u67e5\u770b\u6240\u6709<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage boolean -lC                 # \u53ea\u67e5\u770b\u81ea\u5b9a\u4e49\u7684<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage boolean -m &#8211;on httpd_enable_homedirs  # \u542f\u7528<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># semanage boolean -m &#8211;off httpd_enable_homedirs # \u7981\u7528<\/span><\/p>\n<h4>5.3 \u5b9e\u6218&#xff1a;\u5141\u8bb8 httpd \u8bbf\u95ee\u7528\u6237\u5bb6\u76ee\u5f55<\/h4>\n<p>\u573a\u666f&#xff1a;\u5141\u8bb8\u7528\u6237\u901a\u8fc7 ~username URL \u8bbf\u95ee\u81ea\u5df1\u7684 public_html \u76ee\u5f55\u3002<\/p>\n<p><span class=\"token comment\"># 1. \u914d\u7f6e httpd \u542f\u7528 UserDir<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># vim \/etc\/httpd\/conf.d\/userdir.conf<\/span><br \/>\nUserDir enabled<br \/>\nUserDir public_html<\/p>\n<p><span class=\"token comment\"># 2. \u7528\u6237\u521b\u5efa public_html \u76ee\u5f55\u5e76\u5199\u5165\u6587\u4ef6<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>whisky&#064;centos7 ~<span class=\"token punctuation\">]<\/span>$ <span class=\"token function\">mkdir<\/span> ~\/public_html<br \/>\n<span class=\"token punctuation\">[<\/span>whisky&#064;centos7 ~<span class=\"token punctuation\">]<\/span>$ <span class=\"token builtin class-name\">echo<\/span> <span class=\"token string\">&#034;Welcome to whisky&#039;s home&#034;<\/span> <span class=\"token operator\">&gt;<\/span> ~\/public_html\/index.html<\/p>\n<p><span class=\"token comment\"># 3. \u786e\u4fdd\u7528\u6237\u5bb6\u76ee\u5f55\u6709\u6267\u884c\u6743\u9650&#xff08;\u5176\u4ed6\u4eba\u53ef\u8fdb\u5165&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>whisky&#064;centos7 ~<span class=\"token punctuation\">]<\/span>$ <span class=\"token function\">chmod<\/span> <span class=\"token number\">711<\/span> ~<\/p>\n<p><span class=\"token comment\"># 4. \u5c1d\u8bd5\u8bbf\u95ee&#xff08;SELinux \u963b\u6b62&#xff01;&#xff09;<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># curl http:\/\/localhost\/~whisky\/<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span><span class=\"token operator\">!<\/span>DOCTYPE HTML PUBLIC <span class=\"token string\">&#034;-\/\/IETF\/\/DTD HTML 2.0\/\/EN&#034;<\/span><span class=\"token operator\">&gt;<\/span><br \/>\n<span class=\"token operator\">&lt;<\/span>html<span class=\"token operator\">&gt;<\/span><span class=\"token operator\">&lt;<\/span>head<span class=\"token operator\">&gt;<\/span><span class=\"token operator\">&lt;<\/span>title<span class=\"token operator\">&gt;<\/span><span class=\"token number\">403<\/span> Forbidden<span class=\"token operator\">&lt;<\/span>\/title<span class=\"token operator\">&gt;<\/span><span class=\"token operator\">&lt;<\/span>\/head<span class=\"token operator\">&gt;<\/span><span class=\"token operator\">&lt;<\/span>body<span class=\"token operator\">&gt;<\/span><span class=\"token punctuation\">..<\/span>.<\/p>\n<p><span class=\"token comment\"># 5. \u542f\u7528 httpd_enable_homedirs \u5e03\u5c14\u503c<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># setsebool -P httpd_enable_homedirs&#061;1<\/span><\/p>\n<p><span class=\"token comment\"># 6. \u518d\u6b21\u8bbf\u95ee<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># curl http:\/\/localhost\/~whisky\/<\/span><br \/>\nWelcome to whisky&#039;s home<\/p>\n<h3>6. SELinux \u6545\u969c\u6392\u67e5<\/h3>\n<h4>6.1 setroubleshoot-server&#xff1a;\u81ea\u52a8\u8bca\u65ad<\/h4>\n<p>setroubleshoot-server \u670d\u52a1\u4f1a\u81ea\u52a8\u76d1\u63a7 SELinux \u62d2\u7edd\u4e8b\u4ef6&#xff08;AVC \u6d88\u606f&#xff09;&#xff0c;\u5e76\u5c06\u8bca\u65ad\u6458\u8981\u53d1\u9001\u5230 \/var\/log\/messages\u3002<\/p>\n<p><span class=\"token comment\"># \u5b89\u88c5<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># yum install -y setroubleshoot-server<\/span><\/p>\n<p><span class=\"token comment\"># \u670d\u52a1\u5df2\u96c6\u6210&#xff0c;\u65e0\u9700\u989d\u5916\u542f\u52a8<\/span><\/p>\n<p><span class=\"token comment\"># \u89e6\u53d1\u4e00\u4e2a SELinux \u9519\u8bef\u540e\u67e5\u770b\u65e5\u5fd7<\/span><br \/>\n<span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># tail -f \/var\/log\/messages<\/span><br \/>\nNov <span class=\"token number\">30<\/span> <span class=\"token number\">10<\/span>:39:34 server setroubleshoot<span class=\"token punctuation\">[<\/span><span class=\"token number\">4035<\/span><span class=\"token punctuation\">]<\/span>: SELinux is preventing \/usr\/sbin\/httpd from getattr access on the <span class=\"token function\">file<\/span> \/home\/whisky\/public_html\/index.html. For complete SELinux messages run: sealert <span class=\"token parameter variable\">-l<\/span> bb10b03c-bed2-4853-85cb-92c1824fd75d<\/p>\n<h4>6.2 sealert&#xff1a;\u8be6\u7ec6\u6392\u67e5\u5de5\u5177<\/h4>\n<p>\u6839\u636e \/var\/log\/messages \u4e2d\u7684\u63d0\u793a&#xff0c;\u4f7f\u7528 sealert \u83b7\u53d6\u5b8c\u6574\u8bca\u65ad\u4fe1\u606f&#xff1a;<\/p>\n<p><span class=\"token punctuation\">[<\/span>root&#064;centos7 ~<span class=\"token punctuation\">]<\/span><span class=\"token comment\"># sealert -l bb10b03c-bed2-4853-85cb-92c1824fd75d<\/span><br \/>\nSELinux is preventing \/usr\/sbin\/httpd from getattr access on the <span class=\"token function\">file<\/span> \/home\/whisky\/public_html\/index.html.<\/p>\n<p>*****  Plugin public_content <span class=\"token punctuation\">(<\/span><span class=\"token number\">32.5<\/span> confidence<span class=\"token punctuation\">)<\/span> suggests   ********************<br \/>\nIf you want to treat index.html as public content<br \/>\nThen you need to change the label on index.html to public_content_t or public_content_rw_t.<br \/>\nDo<br \/>\n<span class=\"token comment\"># semanage fcontext -a -t public_content_t &#039;\/home\/whisky\/public_html\/index.html&#039;<\/span><br \/>\n<span class=\"token comment\"># restorecon -v &#039;\/home\/whisky\/public_html\/index.html&#039;<\/span><\/p>\n<p>*****  Plugin catchall_boolean <span class=\"token punctuation\">(<\/span><span class=\"token number\">32.5<\/span> confidence<span class=\"token punctuation\">)<\/span> suggests   ******************<br \/>\nIf you want to allow httpd to <span class=\"token builtin class-name\">enable<\/span> homedirs<br \/>\nThen you must tell SELinux about this by enabling the <span class=\"token string\">&#039;httpd_enable_homedirs&#039;<\/span> boolean.<br \/>\nDo<br \/>\nsetsebool <span class=\"token parameter variable\">-P<\/span> httpd_enable_homedirs <span class=\"token number\">1<\/span><br \/>\n<span class=\"token punctuation\">..<\/span>.<\/p>\n<p>sealert \u7ed9\u51fa\u4e86\u5177\u4f53\u7684\u89e3\u51b3\u65b9\u6848&#xff0c;\u901a\u5e38\u6709\u591a\u4e2a\u9009\u9879&#xff1a;<\/p>\n<table>\n<tr>\u89e3\u51b3\u65b9\u6848\u9002\u7528\u573a\u666f<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">\u4fee\u6539\u6587\u4ef6\u4e0a\u4e0b\u6587&#xff08;semanage fcontext &#043; restorecon&#xff09;<\/td>\n<td align=\"left\">\u6587\u4ef6\u6807\u7b7e\u4e0d\u6b63\u786e<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u8c03\u6574\u5e03\u5c14\u503c&#xff08;setsebool -P&#xff09;<\/td>\n<td align=\"left\">\u529f\u80fd\u5f00\u5173\u672a\u542f\u7528<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u4fee\u6539\u7aef\u53e3\u6807\u7b7e&#xff08;semanage port&#xff09;<\/td>\n<td align=\"left\">\u670d\u52a1\u4f7f\u7528\u975e\u6807\u51c6\u7aef\u53e3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>6.3 SELinux \u95ee\u9898\u5904\u7406\u601d\u8def<\/h4>\n<p>1. \u786e\u8ba4\u662f\u5426 SELinux \u5f15\u8d77\u7684<br \/>\n   \u2514\u2500 tail -f \/var\/log\/messages \u6216 audit2why &lt; \/var\/log\/audit\/audit.log<\/p>\n<p>2. \u5224\u65ad\u8fd9\u4e2a\u62d2\u7edd\u662f\u6b63\u5e38\u7684\u8fd8\u662f\u8bef\u62a5<br \/>\n   \u2514\u2500 \u5982\u679c\u662f\u6b63\u5e38\u7684\u963b\u6b62&#xff08;\u5982 httpd \u8bbf\u95ee \/home&#xff09;&#xff0c;\u8bf4\u660e SELinux \u5728\u6b63\u786e\u5de5\u4f5c<br \/>\n   \u2514\u2500 \u5982\u679c\u662f\u8bef\u62a5&#xff08;\u9700\u8981\u88ab\u5141\u8bb8&#xff09;&#xff0c;\u7ee7\u7eed\u2193<\/p>\n<p>3. \u6700\u5e38\u89c1\u7684 SELinux \u95ee\u9898&#xff1a;\u6587\u4ef6\u4e0a\u4e0b\u6587\u4e0d\u6b63\u786e<br \/>\n   \u2514\u2500 \u6587\u4ef6\u4ece\u5176\u4ed6\u5730\u65b9\u79fb\u52a8\u8fc7\u6765&#xff0c;\u4e0a\u4e0b\u6587\u4e0d\u5339\u914d<br \/>\n   \u2514\u2500 \u89e3\u51b3\u65b9\u6cd5&#xff1a;restorecon -Rv \/path<\/p>\n<p>4. \u5e03\u5c14\u503c\u8bbe\u7f6e\u4e0d\u5f53<br \/>\n   \u2514\u2500 \u5982 httpd_enable_homedirs\u3001ftpd_anon_write \u7b49<br \/>\n   \u2514\u2500 \u89e3\u51b3\u65b9\u6cd5&#xff1a;setsebool -P \u5e03\u5c14\u503c&#061;1<\/p>\n<p>5. \u7aef\u53e3\u4e0a\u4e0b\u6587\u4e0d\u5339\u914d<br \/>\n   \u2514\u2500 \u670d\u52a1\u7ed1\u5b9a\u5230\u975e\u6807\u51c6\u7aef\u53e3<br \/>\n   \u2514\u2500 \u89e3\u51b3\u65b9\u6cd5&#xff1a;semanage port -a -t \u6807\u7b7e -p \u534f\u8bae \u7aef\u53e3<\/p>\n<p>6. SELinux \u7b56\u7565 Bug&#xff08;\u6781\u5c11\u89c1&#xff09;<br \/>\n   \u2514\u2500 \u4f7f\u7528 audit2allow \u751f\u6210\u81ea\u5b9a\u4e49\u7b56\u7565\u6a21\u5757<\/p>\n<h3>7. \u603b\u7ed3\u4e0e\u901f\u67e5\u624b\u518c<\/h3>\n<h4>7.1 \u6838\u5fc3\u77e5\u8bc6\u70b9\u4e00\u89c8<\/h4>\n<table>\n<tr>\u4e3b\u9898\u5173\u952e\u70b9<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">SELinux \u76ee\u6807<\/td>\n<td align=\"left\">\u9632\u6b62\u5df2\u906d\u6cc4\u9732\u7684\u7cfb\u7edf\u670d\u52a1\u8bbf\u95ee\u7528\u6237\u6570\u636e<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u4e09\u79cd\u6a21\u5f0f<\/td>\n<td align=\"left\">Enforcing&#xff08;\u5f3a\u5236&#xff09;\u3001Permissive&#xff08;\u5141\u8bb8&#xff09;\u3001Disabled&#xff08;\u7981\u7528&#xff09;<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u5b89\u5168\u4e0a\u4e0b\u6587<\/td>\n<td align=\"left\">\u7528\u6237:\u89d2\u8272:\u7c7b\u578b:\u654f\u611f\u5ea6&#xff0c;\u57fa\u4e8e \u7c7b\u578b&#xff08;type&#xff09; \u505a\u8bbf\u95ee\u63a7\u5236<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">chcon<\/td>\n<td align=\"left\">\u4e34\u65f6\u4fee\u6539\u4e0a\u4e0b\u6587&#xff08;\u4e0d\u6301\u4e45\u5316&#xff09;<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">restorecon<\/td>\n<td align=\"left\">\u6839\u636e\u7b56\u7565\u6570\u636e\u5e93\u6062\u590d\u9ed8\u8ba4\u4e0a\u4e0b\u6587<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">semanage fcontext<\/td>\n<td align=\"left\">\u6c38\u4e45\u5b9a\u4e49\u9ed8\u8ba4\u4e0a\u4e0b\u6587\u89c4\u5219<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">semanage port<\/td>\n<td align=\"left\">\u7ba1\u7406\u7aef\u53e3\u6807\u7b7e<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u5e03\u5c14\u503c<\/td>\n<td align=\"left\">\u5f00\u5173\u5f0f\u8c03\u6574 SELinux \u7b56\u7565\u884c\u4e3a<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">setroubleshoot<\/td>\n<td align=\"left\">\u81ea\u52a8\u8bca\u65ad SELinux \u95ee\u9898<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>7.2 \u547d\u4ee4\u901f\u67e5\u8868<\/h4>\n<table>\n<tr>\u547d\u4ee4\u4f5c\u7528<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">getenforce<\/td>\n<td align=\"left\">\u67e5\u770b\u5f53\u524d\u6a21\u5f0f<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">&#096;setenforce 0<\/td>\n<td align=\"left\">1&#096;<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\/etc\/selinux\/config<\/td>\n<td align=\"left\">\u6c38\u4e45\u914d\u7f6e<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">ls -Z \/ ps -Z<\/td>\n<td align=\"left\">\u67e5\u770b\u5b89\u5168\u4e0a\u4e0b\u6587<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">chcon -t \u7c7b\u578b \u6587\u4ef6<\/td>\n<td align=\"left\">\u4e34\u65f6\u4fee\u6539\u4e0a\u4e0b\u6587<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">restorecon -Rv \u76ee\u5f55<\/td>\n<td align=\"left\">\u6062\u590d\u9ed8\u8ba4\u4e0a\u4e0b\u6587<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">semanage fcontext -a -t \u7c7b\u578b &#039;\u6b63\u5219&#039;<\/td>\n<td align=\"left\">\u6dfb\u52a0\u9ed8\u8ba4\u4e0a\u4e0b\u6587\u89c4\u5219<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">semanage fcontext -lC<\/td>\n<td align=\"left\">\u67e5\u770b\u81ea\u5b9a\u4e49\u4e0a\u4e0b\u6587\u89c4\u5219<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">semanage port -a -t \u7c7b\u578b -p \u534f\u8bae \u7aef\u53e3<\/td>\n<td align=\"left\">\u6dfb\u52a0\u7aef\u53e3\u6807\u7b7e<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">semanage port -lC<\/td>\n<td align=\"left\">\u67e5\u770b\u81ea\u5b9a\u4e49\u7aef\u53e3\u6807\u7b7e<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">getsebool -a<\/td>\n<td align=\"left\">\u67e5\u770b\u6240\u6709\u5e03\u5c14\u503c<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">setsebool -P \u5e03\u5c14\u503c&#061;1<\/td>\n<td align=\"left\">\u6c38\u4e45\u542f\u7528\u5e03\u5c14\u503c<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">sealert -l UUID<\/td>\n<td align=\"left\">\u67e5\u770b SELinux \u95ee\u9898\u8be6\u60c5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>7.3 \u5e38\u7528 SELinux \u7c7b\u578b\u901f\u67e5<\/h4>\n<table>\n<tr>\u7c7b\u578b\u7528\u9014<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">httpd_t<\/td>\n<td align=\"left\">httpd \u8fdb\u7a0b\u57df<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">httpd_sys_content_t<\/td>\n<td align=\"left\">Web \u670d\u52a1\u5668\u7684\u6587\u6863\u5185\u5bb9<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">httpd_sys_script_exec_t<\/td>\n<td align=\"left\">CGI \u811a\u672c<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">http_port_t<\/td>\n<td align=\"left\">httpd \u7ed1\u5b9a\u7684\u7aef\u53e3<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">ssh_port_t<\/td>\n<td align=\"left\">SSH \u7aef\u53e3<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">tmp_t<\/td>\n<td align=\"left\">\/tmp \u76ee\u5f55\u4e2d\u7684\u6587\u4ef6<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">user_home_dir_t<\/td>\n<td align=\"left\">\u7528\u6237\u5bb6\u76ee\u5f55<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">public_content_t<\/td>\n<td align=\"left\">\u516c\u5171\u5185\u5bb9&#xff08;\u5982\u533f\u540d FTP&#xff09;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>7.4 SELinux \u5de5\u4f5c\u6a21\u5f0f\u901f\u67e5<\/h4>\n<table>\n<tr>\u6a21\u5f0f\u662f\u5426\u5f3a\u5236\u6267\u884c\u662f\u5426\u8bb0\u5f55\u8fdd\u89c4\u91cd\u542f\u8981\u6c42<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">Enforcing<\/td>\n<td align=\"left\">\u2705<\/td>\n<td align=\"left\">\u2705<\/td>\n<td align=\"left\">\u8bbe\u4e3a\u9ed8\u8ba4\u9700\u91cd\u542f<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">Permissive<\/td>\n<td align=\"left\">\u274c<\/td>\n<td align=\"left\">\u2705<\/td>\n<td align=\"left\">\u8bbe\u4e3a\u9ed8\u8ba4\u9700\u91cd\u542f<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">Disabled<\/td>\n<td align=\"left\">\u274c<\/td>\n<td align=\"left\">\u274c<\/td>\n<td align=\"left\">\u5fc5\u987b\u91cd\u542f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>7.5 \u5e38\u89c1\u9519\u8bef\u6392\u67e5<\/h4>\n<table>\n<tr>\u95ee\u9898\u539f\u56e0\u89e3\u51b3\u65b9\u6848<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">\u670d\u52a1\u542f\u52a8\u5931\u8d25&#xff0c;\u65e5\u5fd7\u6709 Permission denied<\/td>\n<td align=\"left\">SELinux \u963b\u6b62<\/td>\n<td align=\"left\">\u67e5\u770b \/var\/log\/messages&#xff0c;\u7528 sealert \u8bca\u65ad<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u6587\u4ef6\u8bbf\u95ee\u88ab\u62d2<\/td>\n<td align=\"left\">\u4e0a\u4e0b\u6587\u4e0d\u5339\u914d<\/td>\n<td align=\"left\">restorecon -Rv \/path<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u670d\u52a1\u65e0\u6cd5\u7ed1\u5b9a\u7aef\u53e3<\/td>\n<td align=\"left\">\u7aef\u53e3\u6807\u7b7e\u672a\u6dfb\u52a0<\/td>\n<td align=\"left\">semanage port -a -t \u6807\u7b7e -p tcp \u7aef\u53e3<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u529f\u80fd\u9700\u8981\u7279\u6b8a\u6743\u9650<\/td>\n<td align=\"left\">\u5e03\u5c14\u503c\u672a\u542f\u7528<\/td>\n<td align=\"left\">getsebool \u67e5\u627e&#xff0c;setsebool -P \u542f\u7528<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u7981\u7528 SELinux \u540e\u60f3\u91cd\u65b0\u542f\u7528<\/td>\n<td align=\"left\">config \u4e2d\u8bbe\u4e3a disabled<\/td>\n<td align=\"left\">\u5c06 SELINUX&#061;disabled \u6539\u4e3a enforcing&#xff0c;\u91cd\u542f&#xff0c;\u7cfb\u7edf\u4f1a\u91cd\u65b0\u6807\u8bb0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>7.6 \u601d\u8003\u4e0e\u62d3\u5c55&#xff08;\u539f\u8bfe\u540e\u4f5c\u4e1a\u8f6c\u5316&#xff09;<\/h4>\n<li>SELinux \u7684 Enforcing \u548c Permissive \u6a21\u5f0f\u6709\u4ec0\u4e48\u533a\u522b&#xff1f; \u2192 Enforcing&#xff1a;SELinux \u7b56\u7565\u88ab\u5f3a\u5236\u6267\u884c&#xff0c;\u8fdd\u89c4\u64cd\u4f5c\u88ab\u62d2\u7edd&#xff1b;Permissive&#xff1a;\u7b56\u7565\u88ab\u52a0\u8f7d\u4f46\u4e0d\u5f3a\u5236\u6267\u884c&#xff0c;\u4ec5\u8bb0\u5f55\u8fdd\u89c4\u65e5\u5fd7\u3002Permissive \u7528\u4e8e\u6d4b\u8bd5\u548c\u8c03\u8bd5\u3002<\/li>\n<li>\u4e3a\u4ec0\u4e48 chcon \u4fee\u6539\u4e0a\u4e0b\u6587\u540e&#xff0c;restorecon \u4f1a\u5c06\u5176\u6062\u590d&#xff1f; \u2192 chcon \u53ea\u4fee\u6539\u6587\u4ef6\u672c\u8eab\u7684\u6807\u7b7e&#xff0c;\u4e0d\u4fee\u6539\u7b56\u7565\u6570\u636e\u5e93\u3002restorecon \u4ece\u7b56\u7565\u6570\u636e\u5e93\u4e2d\u8bfb\u53d6\u9ed8\u8ba4\u89c4\u5219&#xff0c;\u5c06\u6587\u4ef6\u6062\u590d\u5230\u89c4\u5219\u5b9a\u4e49\u7684\u6807\u7b7e\u3002<\/li>\n<li>SELinux \u5e03\u5c14\u503c\u7684\u4f5c\u7528\u662f\u4ec0\u4e48&#xff1f; \u2192 \u5e03\u5c14\u503c\u63d0\u4f9b\u4e86\u5f00\u5173\u5f0f\u8c03\u6574 SELinux \u7b56\u7565\u7684\u80fd\u529b&#xff0c;\u65e0\u9700\u7f16\u5199\u590d\u6742\u7b56\u7565\u3002\u4f8b\u5982 httpd_enable_homedirs \u63a7\u5236 httpd \u662f\u5426\u80fd\u8bbf\u95ee\u7528\u6237\u5bb6\u76ee\u5f55\u3002<\/li>\n<li>\u4ec0\u4e48\u65f6\u5019\u5e94\u8be5\u7981\u7528 SELinux&#xff1f; \u2192 \u6781\u5c11\u60c5\u51b5\u4e0b\u624d\u5efa\u8bae\u7981\u7528\u3002\u5982\u679c\u786e\u5b9e\u9700\u8981&#xff0c;\u5e94\u5148\u8bbe\u7f6e\u4e3a Permissive \u6a21\u5f0f\u8fd0\u884c\u4e00\u6bb5\u65f6\u95f4&#xff0c;\u6536\u96c6\u6240\u6709\u8fdd\u89c4\u8bb0\u5f55&#xff0c;\u7136\u540e\u6839\u636e\u65e5\u5fd7\u8c03\u6574\u7b56\u7565&#xff0c;\u6700\u7ec8\u518d\u542f\u7528 Enforcing\u3002<\/li>\n<li>\u5982\u4f55\u5224\u65ad\u4e00\u4e2a\u95ee\u9898\u662f SELinux \u5f15\u8d77\u7684\u8fd8\u662f\u6587\u4ef6\u6743\u9650\u5f15\u8d77\u7684&#xff1f; \u2192 \u67e5\u770b \/var\/log\/messages \u662f\u5426\u6709 SELinux is preventing \u6216 AVC \u5b57\u6837&#xff0c;\u6216\u4f7f\u7528 sealert \u8bca\u65ad\u3002\u5982\u679c\u65e5\u5fd7\u65e0 SELinux \u76f8\u5173\u8bb0\u5f55&#xff0c;\u53ef\u80fd\u662f\u6587\u4ef6\u6743\u9650\u95ee\u9898\u3002<\/li>\n<h4>7.7 \u751f\u4ea7\u73af\u5883\u6700\u4f73\u5b9e\u8df5<\/h4>\n<table>\n<tr>\u573a\u666f\u5efa\u8bae<\/tr>\n<tbody>\n<tr>\n<td align=\"left\">\u751f\u4ea7\u73af\u5883<\/td>\n<td align=\"left\">\u4fdd\u6301 SELINUX&#061;enforcing&#xff0c;\u4e0d\u8981\u7981\u7528<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u5e94\u7528\u90e8\u7f72<\/td>\n<td align=\"left\">\u9075\u5faa\u6807\u51c6\u7684\u76ee\u5f55\u548c\u4e0a\u4e0b\u6587\u89c4\u8303&#xff0c;\u5fc5\u8981\u65f6\u4f7f\u7528 semanage fcontext \u5b9a\u4e49\u81ea\u5b9a\u4e49\u89c4\u5219<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u6545\u969c\u6392\u67e5<\/td>\n<td align=\"left\">\u5148\u5207\u6362\u5230 Permissive \u6a21\u5f0f\u786e\u8ba4\u662f SELinux \u95ee\u9898&#xff0c;\u4fee\u590d\u540e\u5207\u56de Enforcing<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u65b0\u670d\u52a1\u90e8\u7f72<\/td>\n<td align=\"left\">\u4f7f\u7528 sealert \u83b7\u53d6\u6b63\u786e\u7684\u4fee\u590d\u5efa\u8bae&#xff0c;\u800c\u975e\u76f2\u76ee\u7981\u7528 SELinux<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u8f6f\u4ef6\u5347\u7ea7<\/td>\n<td align=\"left\">\u5347\u7ea7\u540e\u68c0\u67e5 SELinux \u7b56\u7565\u66f4\u65b0&#xff0c;\u5fc5\u8981\u65f6\u6267\u884c restorecon -Rv \/<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">\u76d1\u63a7<\/td>\n<td align=\"left\">\u76d1\u63a7 \/var\/log\/messages \u4e2d\u7684 SELinux \u544a\u8b66&#xff0c;\u53ca\u65f6\u5904\u7406<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>\u7cfb\u5217\u7ed3\u8bed<\/h3>\n<p>\u81f3\u6b64&#xff0c;Linux&#xff08;CentOS&#xff09;\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0 \u7cfb\u5217\u5168\u90e8 22 \u671f\u5185\u5bb9\u5df2\u5b8c\u6574\u5448\u73b0\u3002\u6211\u4eec\u4ece Linux \u7684\u5386\u53f2\u54f2\u5b66\u51fa\u53d1&#xff0c;\u8d70\u8fc7\u4e86\u547d\u4ee4\u884c\u57fa\u7840\u3001\u6587\u4ef6\u7cfb\u7edf\u7ba1\u7406\u3001\u7528\u6237\u6743\u9650\u4f53\u7cfb\u3001\u5b58\u50a8\u7ba1\u7406&#xff08;\u5206\u533a\/RAID\/LVM\/Swap&#xff09;\u3001\u542f\u52a8\u539f\u7406\u4e0e\u6545\u969c\u6062\u590d\u3001\u9632\u706b\u5899\u548c SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u8986\u76d6\u4e86 Linux \u7cfb\u7edf\u7ba1\u7406\u5458\u4ece\u5165\u95e8\u5230\u5b9e\u6218\u6240\u9700\u7684\u5b8c\u6574\u77e5\u8bc6\u4f53\u7cfb\u3002<\/p>\n<p>\u8fd9\u4e2a\u7cfb\u5217\u7684\u7279\u70b9\u662f&#xff1a;<\/p>\n<ul>\n<li>\u7406\u8bba\u4e0e\u5b9e\u8df5\u5e76\u91cd&#xff1a;\u6bcf\u4e2a\u6982\u5ff5\u90fd\u6709\u53ef\u6267\u884c\u7684\u547d\u4ee4\u548c\u6e05\u6670\u7684\u8f93\u51fa\u89e3\u8bfb<\/li>\n<li>\u5faa\u5e8f\u6e10\u8fdb&#xff1a;\u4ece\u96f6\u5230\u4e00&#xff0c;\u4ece\u201c\u4f1a\u6572\u547d\u4ee4\u201d\u5230\u201c\u61c2\u7cfb\u7edf\u539f\u7406\u201d<\/li>\n<li>\u751f\u4ea7\u5bfc\u5411&#xff1a;\u6bcf\u671f\u7ed3\u5c3e\u90fd\u6709\u751f\u4ea7\u73af\u5883\u6700\u4f73\u5b9e\u8df5\u548c\u5e38\u89c1\u95ee\u9898\u6392\u67e5<\/li>\n<\/ul>\n<p>\u8bb0\u4f4f&#xff0c;\u771f\u6b63\u7684 Linux \u7ba1\u7406\u5458\u4e0d\u662f\u201c\u8bb0\u4f4f\u6240\u6709\u547d\u4ee4\u7684\u4eba\u201d&#xff0c;\u800c\u662f\u201c\u77e5\u9053\u53bb\u54ea\u91cc\u67e5\u3001\u600e\u4e48\u7ec4\u5408\u5de5\u5177\u3001\u5982\u4f55\u6392\u67e5\u95ee\u9898\u201d\u7684\u4eba\u3002<\/p>\n<p>\u613f\u4f60\u5728 Linux \u7684\u4e16\u754c\u91cc&#xff0c;\u8d8a\u8d70\u8d8a\u8fdc&#xff0c;\u8d8a\u8d70\u8d8a\u6df1\u3002<\/p>\n<p>\u4e0b\u4e2a\u7cfb\u5217\u9884\u544a&#xff1a;\u81f3\u6b64&#xff0c;\u4f60\u5df2\u7ecf\u638c\u63e1\u4e86 Linux \u7cfb\u7edf\u7ba1\u7406\u7684\u5b8c\u6574\u6280\u80fd\u2014\u2014\u4ece\u547d\u4ee4\u884c\u57fa\u7840\u3001\u6587\u4ef6\u7cfb\u7edf\u3001\u7528\u6237\u6743\u9650&#xff0c;\u5230\u8fdb\u7a0b\u7ba1\u7406\u3001\u5b58\u50a8\u7ba1\u7406\u3001\u7cfb\u7edf\u542f\u52a8\u3001\u9632\u706b\u5899\u4e0e SELinux \u5b89\u5168\u52a0\u56fa\u3002\u8fd9\u662f\u4e00\u540d\u5408\u683c\u7cfb\u7edf\u7ba1\u7406\u5458\u7684\u6838\u5fc3\u80fd\u529b\u3002<\/p>\n<p>\u4f46\u7cfb\u7edf\u7ba1\u7406\u7684\u7ec8\u70b9&#xff0c;\u6b63\u662f\u7f51\u7edc\u670d\u52a1\u67b6\u8bbe\u7684\u8d77\u70b9\u3002\u7ba1\u7406\u7cfb\u7edf\u662f\u4e3a\u4e86\u8fd0\u884c\u670d\u52a1\u2014\u2014DHCP \u52a8\u6001\u5206\u914d\u5730\u5740\u3001DNS \u89e3\u6790\u57df\u540d\u3001NFS\/SMB \u5171\u4eab\u6587\u4ef6\u3001Apache\/Nginx \u63d0\u4f9b Web \u670d\u52a1\u3001MariaDB\/MySQL \u5b58\u50a8\u6570\u636e\u3001TLS \u52a0\u5bc6\u901a\u4fe1\u2026\u2026<\/p>\n<p>\u4e0b\u4e00\u4e2a\u7cfb\u5217&#xff0c;\u6211\u4eec\u5c06\u8fdb\u5165 Linux \u7f51\u7edc\u670d\u52a1\u67b6\u8bbe\u5b66\u4e60\u7b14\u8bb0 \u7684\u4e16\u754c&#xff0c;\u4ece DHCP \u670d\u52a1\u5668 \u5f00\u59cb\u2014\u2014\u5b66\u4e60\u5982\u4f55\u4e3a\u7f51\u7edc\u4e2d\u7684\u8bbe\u5907\u81ea\u52a8\u5206\u914d IP \u5730\u5740\u3001\u914d\u7f6e\u7f51\u5173\u548c DNS&#xff0c;\u4ee5\u53ca\u5982\u4f55\u90e8\u7f72 DHCP \u4e2d\u7ee7\u5b9e\u73b0\u8de8\u7f51\u6bb5\u5206\u914d\u3002\u656c\u8bf7\u671f\u5f85&#xff01;<\/p>\n<p>\u613f\u4f60\u5728 Linux \u7684\u4e16\u754c\u91cc&#xff0c;\u8d8a\u8d70\u8d8a\u8fdc&#xff0c;\u8d8a\u8d70\u8d8a\u6df1\u3002<\/p>\n<p>  \u2014 Linux&#xff08;CentOS&#xff09;\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0 \u5168\u7cfb\u5217\u5b8c \u2014 <\/p>\n<p>  \u2014 Compiled and Authored by Whisky \u2014 Augest 2<br \/>\n nd, 2026 <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Linux&#xff08;CentOS&#xff09;\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0&#xff08;\u7b2c\u4e8c\u5341\u4e8c\u671f&#xff09;\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5 Linux\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7cfb\u5217\u66f4\u591a\u6587\u7ae0\u6b22\u8fce\u8bbf\u95ee&#xff1a; Linux\u5165\u95e8\u2014\u2014\u7cfb\u7edf\u7ba1\u74061\u3001Linux\u5165\u95e8\u2014\u2014\u7cfb\u7edf\u7ba1\u74062 \u6211\u7684\u4e3b\u9875&#xff1a;AOwhisky&#xff0c;\u8fd9\u91cc\u6709\u66f4\u591a\u8fd0\u7ef4\u7cfb\u7edf\u6027\u77e5\u8bc6\u6574\u7406\u548c\u5176\u4ed6\u6709\u8da3\u5185\u5bb9&#xff0c;\u6b22\u8fce\u4e0e\u6211\u4e00\u8d77\u63a2\u8ba8\u5b66\u4e60~ \u5f15\u8a00&#xff1a;Linux \u5b89\u5168\u7684\u201c\u7b2c\u4e8c\u9053\u9501\u201d\u2014<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[59,58,61,305,44],"topic":[],"class_list":["post-89426","post","type-post","status-publish","format-standard","hentry","category-server","tag-centos","tag-linux","tag-61","tag-305","tag-44"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Linux\uff08CentOS\uff09\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0\uff08\u7b2c\u4e8c\u5341\u4e8c\u671f\uff09\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/89426.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Linux\uff08CentOS\uff09\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0\uff08\u7b2c\u4e8c\u5341\u4e8c\u671f\uff09\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"Linux&#xff08;CentOS&#xff09;\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0&#xff08;\u7b2c\u4e8c\u5341\u4e8c\u671f&#xff09;\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5 Linux\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7cfb\u5217\u66f4\u591a\u6587\u7ae0\u6b22\u8fce\u8bbf\u95ee&#xff1a; Linux\u5165\u95e8\u2014\u2014\u7cfb\u7edf\u7ba1\u74061\u3001Linux\u5165\u95e8\u2014\u2014\u7cfb\u7edf\u7ba1\u74062 \u6211\u7684\u4e3b\u9875&#xff1a;AOwhisky&#xff0c;\u8fd9\u91cc\u6709\u66f4\u591a\u8fd0\u7ef4\u7cfb\u7edf\u6027\u77e5\u8bc6\u6574\u7406\u548c\u5176\u4ed6\u6709\u8da3\u5185\u5bb9&#xff0c;\u6b22\u8fce\u4e0e\u6211\u4e00\u8d77\u63a2\u8ba8\u5b66\u4e60~ \u5f15\u8a00&#xff1a;Linux \u5b89\u5168\u7684\u201c\u7b2c\u4e8c\u9053\u9501\u201d\u2014\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/89426.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-02T16:32:39+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/89426.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/89426.html\",\"name\":\"Linux\uff08CentOS\uff09\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0\uff08\u7b2c\u4e8c\u5341\u4e8c\u671f\uff09\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-08-02T16:32:39+00:00\",\"dateModified\":\"2026-08-02T16:32:39+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/89426.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/89426.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/89426.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Linux\uff08CentOS\uff09\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0\uff08\u7b2c\u4e8c\u5341\u4e8c\u671f\uff09\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Linux\uff08CentOS\uff09\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0\uff08\u7b2c\u4e8c\u5341\u4e8c\u671f\uff09\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/89426.html","og_locale":"zh_CN","og_type":"article","og_title":"Linux\uff08CentOS\uff09\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0\uff08\u7b2c\u4e8c\u5341\u4e8c\u671f\uff09\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"Linux&#xff08;CentOS&#xff09;\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0&#xff08;\u7b2c\u4e8c\u5341\u4e8c\u671f&#xff09;\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5 Linux\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7cfb\u5217\u66f4\u591a\u6587\u7ae0\u6b22\u8fce\u8bbf\u95ee&#xff1a; Linux\u5165\u95e8\u2014\u2014\u7cfb\u7edf\u7ba1\u74061\u3001Linux\u5165\u95e8\u2014\u2014\u7cfb\u7edf\u7ba1\u74062 \u6211\u7684\u4e3b\u9875&#xff1a;AOwhisky&#xff0c;\u8fd9\u91cc\u6709\u66f4\u591a\u8fd0\u7ef4\u7cfb\u7edf\u6027\u77e5\u8bc6\u6574\u7406\u548c\u5176\u4ed6\u6709\u8da3\u5185\u5bb9&#xff0c;\u6b22\u8fce\u4e0e\u6211\u4e00\u8d77\u63a2\u8ba8\u5b66\u4e60~ \u5f15\u8a00&#xff1a;Linux \u5b89\u5168\u7684\u201c\u7b2c\u4e8c\u9053\u9501\u201d\u2014","og_url":"https:\/\/www.wsisp.com\/helps\/89426.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-08-02T16:32:39+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"10 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/89426.html","url":"https:\/\/www.wsisp.com\/helps\/89426.html","name":"Linux\uff08CentOS\uff09\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0\uff08\u7b2c\u4e8c\u5341\u4e8c\u671f\uff09\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-08-02T16:32:39+00:00","dateModified":"2026-08-02T16:32:39+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/89426.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/89426.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/89426.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"Linux\uff08CentOS\uff09\u7cfb\u7edf\u7ba1\u7406\u5165\u95e8\u7b14\u8bb0\uff08\u7b2c\u4e8c\u5341\u4e8c\u671f\uff09\u2014\u2014SELinux \u5b89\u5168\u52a0\u56fa\u2014\u2014\u4e0a\u4e0b\u6587\u3001\u5e03\u5c14\u503c\u4e0e\u6545\u969c\u6392\u67e5"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/89426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=89426"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/89426\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=89426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=89426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=89426"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=89426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}