制限のあるサービスの管理

強制アクセス制御 (MAC)

$ ls -l file1
-rwxrw-r-- 1 user1 group1 0 2010-01-29 09:17 file1

$ ls -Z file1
-rwxrw-r--  user1 group1 unconfined_u:object_r:user_home_t:s0      file1

$ /usr/sbin/sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

-rw-r--r--  root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/testfile

# /sbin/service httpd start
Starting httpd:                                            [  OK  ]

--2009-12-01 11:40:28--  http://localhost/testfile
Resolving localhost... 127.0.0.1
Connecting to localhost|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 0 [text/plain]
Saving to: `testfile'

[ <=>                              ] 0     --.-K/s   in 0s

2009-12-01 11:40:28 (0.00 B/s) - `testfile' saved [0/0]

-rw-r--r--  root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/testfile

--2009-12-01 11:43:18--  http://localhost/testfile
Resolving localhost... 127.0.0.1
Connecting to localhost|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 403 Forbidden
2009-12-01 11:43:18 ERROR 403: Forbidden.

# /sbin/service httpd stop
Stopping httpd:                                            [  OK  ]

setroubleshoot: SELinux is preventing httpd (httpd_t) "getattr" to /var/www/html/testfile (samba_share_t). For complete SELinux messages run sealert -l c05911d3-e680-4e42-8e36-fe2ab9f8e654

[Tue Dec 01 11:43:18 2009] [error] [client 127.0.0.1] (13)Permission denied: access to /testfile denied

$ /usr/sbin/sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

-rw-r--r--  root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/test2file

-rw-r--r--  root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/test2file

$ /sbin/service httpd status
httpd is stopped

# /sbin/service httpd stop
Stopping httpd:                                            [  OK  ]

-rwxr-xr-x  root root system_u:object_r:unconfined_exec_t /usr/sbin/httpd

# /sbin/service httpd start
Starting httpd:                                            [  OK  ]

$ ps -eZ | grep httpd
unconfined_u:system_r:unconfined_t 7721 ?      00:00:00 httpd
unconfined_u:system_r:unconfined_t 7723 ?      00:00:00 httpd
unconfined_u:system_r:unconfined_t 7724 ?      00:00:00 httpd
unconfined_u:system_r:unconfined_t 7725 ?      00:00:00 httpd
unconfined_u:system_r:unconfined_t 7726 ?      00:00:00 httpd
unconfined_u:system_r:unconfined_t 7727 ?      00:00:00 httpd
unconfined_u:system_r:unconfined_t 7728 ?      00:00:00 httpd
unconfined_u:system_r:unconfined_t 7729 ?      00:00:00 httpd
unconfined_u:system_r:unconfined_t 7730 ?      00:00:00 httpd

--2009-12-01 11:55:47--  http://localhost/test2file
Resolving localhost... 127.0.0.1
Connecting to localhost|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 0 [text/plain]
Saving to: `test2file.1'

[ <=>                            ]--.-K/s   in 0s      

2009-12-01 11:55:47 (0.00 B/s) - `test2file.1' saved [0/0]

# /sbin/restorecon -v /usr/sbin/httpd
restorecon reset /usr/sbin/httpd context system_u:object_r:unconfined_exec_t:s0->system_u:object_r:httpd_exec_t:s0

$ ls -Z /usr/sbin/httpd
-rwxr-xr-x  root root system_u:object_r:httpd_exec_t   /usr/sbin/httpd

# /sbin/service httpd restart
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]
# ps -eZ | grep httpd
unconfined_u:system_r:httpd_t    8880 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t    8882 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t    8883 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t    8884 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t    8885 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t    8886 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t    8887 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t    8888 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t    8889 ?        00:00:00 httpd

# /sbin/service httpd stop
Stopping httpd:                                            [  OK  ]

yum install httpd

$ getenforce
Enforcing

# service httpd start
Starting httpd:                                            [  OK  ]

$ ps -eZ | grep httpd
unconfined_u:system_r:httpd_t:s0 2850 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 2852 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 2853 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 2854 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 2855 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 2856 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 2857 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 2858 ?        00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 2859 ?        00:00:00 httpd

# service httpd status
httpd is stopped

# service httpd stop
Stopping httpd:                                            [  OK  ]

# semanage port -l | grep -w http_port_t
http_port_t                    tcp      80, 443, 488, 8008, 8009, 8443

# Change this to Listen on specific IP addresses as shown below to 
# prevent Apache from glomming onto all bound IP addresses (0.0.0.0)
#
#Listen 12.34.56.78:80
Listen 127.0.0.1:12345

# service httpd start
Starting httpd: (13)Permission denied: make_sock: could not bind to address 127.0.0.1:12345
no listening sockets available, shutting down
Unable to open logs					   [FAILED]

setroubleshoot: SELinux is preventing the httpd (httpd_t) from binding to port 12345. For complete SELinux messages. run sealert -l f18bca99-db64-4c16-9719-1db89f0d8c77

# semanage port -a -t http_port_t -p tcp 12345

# service httpd start
Starting httpd:						   [  OK  ]

# telnet localhost 12345
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.1 200 OK
Date: Wed, 02 Dec 2009 14:36:34 GMT
Server: Apache/2.2.13 (Red Hat)
Accept-Ranges: bytes
Content-Length: 3985
Content-Type: text/html; charset=UTF-8
[...continues...]

$ ls -dZ /var/www/html
drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html

$ ls -Z /var/www/html/file1
-rw-r--r--  root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/file1

grep httpd /etc/selinux/targeted/contexts/files/file_contexts
$ ls -dZ /my
drwxr-xr-x  root root unconfined_u:object_r:default_t:s0 /my

# chcon -R -t httpd_sys_content_t /my/
# touch /my/website/index.html
# ls -Z /my/website/index.html
-rw-r--r--  root root unconfined_u:object_r:httpd_sys_content_t:s0 /my/website/index.html

semanage fcontext -a -t httpd_sys_content_t "/my(/.*)?"

# restorecon -R -v /my/
restorecon reset /my context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
restorecon reset /my/website context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
restorecon reset /my/website/index.html context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0

# setsebool -P allow_httpd_anon_write on
# setsebool -P allow_httpd_anon_write off
<html>
<h2>index.html from /mywebsite/</h2>
</html>

# semanage fcontext -a -t httpd_sys_content_t "/mywebsite(/.*)?"

# restorecon -R -v /mywebsite
restorecon reset /mywebsite context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
restorecon reset /mywebsite/index.html context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0

#DocumentRoot "/var/www/html"
DocumentRoot "/mywebsite"

index.html from /mywebsite/

setsebool -P httpd_use_nfs on

setsebool -P httpd_use_cifs on

$ ls -dZ /shares
drwxr-xr-x  root root unconfined_u:object_r:default_t:s0 /shares

<html>
<body>
<p>Hello</p>
</body>
</html>

semanage fcontext -a -t public_content_t "/shares(/.*)?"

# restorecon -R -v /shares/
restorecon reset /shares context unconfined_u:object_r:default_t:s0->system_u:object_r:public_content_t:s0
restorecon reset /shares/index.html context unconfined_u:object_r:default_t:s0->system_u:object_r:public_content_t:s0

$ rpm -q samba samba-common samba-client
samba-3.4.0-0.41.el6.3.i686
samba-common-3.4.0-0.41.el6.3.i686
samba-client-3.4.0-0.41.el6.3.i686

[shares]
comment = Documents for Apache HTTP Server, FTP, rsync, and Samba
path = /shares
public = yes
writeable = no

# smbpasswd -a testuser
New SMB password: Enter a password
Retype new SMB password: Enter the same password again
Added user testuser.

service smb start
Starting SMB services:                                     [  OK  ]

$ smbclient -U username -L localhost
Enter username's password:
Domain=[HOSTNAME] OS=[Unix] Server=[Samba 3.4.0-0.41.el6]

Sharename       Type      Comment
---------       ----      -------
shares          Disk      Documents for Apache HTTP Server, FTP, rsync, and Samba
IPC$            IPC       IPC Service (Samba Server Version 3.4.0-0.41.el6)
username        Disk      Home Directories
Domain=[HOSTNAME] OS=[Unix] Server=[Samba 3.4.0-0.41.el6]

Server               Comment
---------            -------

Workgroup            Master
---------            -------

mount //localhost/shares /test/ -o user=username
$ cat /test/index.html
<html>
<body>
<p>Hello</p>
</body>
</html>

$ rpm -q httpd
httpd-2.2.11-6.i386

ln -s /shares/ shares

service httpd start
Starting httpd:                                            [  OK  ]

# touch /shares/file{1,2,3}
# ls -Z /shares/
-rw-r--r--  root root system_u:object_r:public_content_t:s0 file1
-rw-r--r--  root root unconfined_u:object_r:public_content_t:s0 file2
-rw-r--r--  root root unconfined_u:object_r:public_content_t:s0 file3

# semanage port -l | grep -w http_port_t
http_port_t                    tcp      80, 443, 488, 8008, 8009, 8443

# Change this to Listen on specific IP addresses as shown below to 
# prevent Apache from glomming onto all bound IP addresses (0.0.0.0)
#
#Listen 12.34.56.78:80
Listen 10.0.0.1:12345

# semanage port -l | grep -w http_port_t
http_port_t                    tcp      12345, 80, 443, 488, 8008, 8009, 8443

yum install samba

$ getenforce
Enforcing

service smb start
Starting SMB services:                                     [  OK  ]

$ ps -eZ | grep smb
unconfined_u:system_r:smbd_t:s0 16420 ?        00:00:00 smbd
unconfined_u:system_r:smbd_t:s0 16422 ?        00:00:00 smbd

setroubleshoot: SELinux is preventing smbd (smbd_t) "read" to ./smb.conf (httpd_sys_content_t). For complete SELinux messages. run sealert -l deb33473-1069-482b-bb50-e4cd05ab18af

semanage fcontext -a -t samba_share_t "/myshare(/.*)?"

# restorecon -R -v /myshare
restorecon reset /myshare context unconfined_u:object_r:default_t:s0->system_u:object_r:samba_share_t:s0
restorecon reset /myshare/file1 context unconfined_u:object_r:default_t:s0->system_u:object_r:samba_share_t:s0

[myshare]
comment = My share
path = /myshare
public = yes
writeable = no

# smbpasswd -a testuser
New SMB password: (パスワードを入力)
Retype new SMB password: (もう一度同じパスワードを入力)
Added user testuser.

service smb start
Starting SMB services:                                     [  OK  ]

$ smbclient -U username -L localhost
Enter username's password:
Domain=[HOSTNAME] OS=[Unix] Server=[Samba 3.4.0-0.41.el6]

Sharename       Type      Comment
---------       ----      -------
myshare         Disk      My share
IPC$            IPC       IPC Service (Samba Server Version 3.4.0-0.41.el6)
username        Disk      Home Directories
Domain=[HOSTNAME] OS=[Unix] Server=[Samba 3.4.0-0.41.el6]

Server               Comment
---------            -------

Workgroup            Master
---------            -------

mount //localhost/myshare /test/ -o user=username
$ ls /test/
file1

<html>
<h2>File being shared through the Apache HTTP Server and Samba.</h2>
</html>

$ ls -Z /var/www/html/file1.html
-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/file1.html

service httpd start
Starting httpd:                                            [  OK  ]

$ wget http://localhost/file1.html
Resolving localhost... 127.0.0.1
Connecting to localhost|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 84 [text/html]
Saving to: `file1.html.1'

100%[=======================>] 84          --.-K/s   in 0s      

`file1.html.1' saved [84/84]

[website]
comment = Sharing a website
path = /var/www/html/
public = no
writeable = no

setsebool -P samba_export_all_ro on

service smb start
Starting SMB services:                                     [  OK  ]

$ rpm -q vsftpd

yum install vsftpd

# Uncomment this to allow local users to log in.
local_enable=YES

service vsftpd start
Starting vsftpd for vsftpd:                                [  OK  ]

$ ftp localhost
Connected to localhost (127.0.0.1).
220 (vsFTPd 2.1.0)
Name (localhost:username):
331 Please specify the password.
Password: Enter your password
500 OOPS: cannot change directory:/home/username
Login failed.
ftp>

setroubleshoot: SELinux is preventing the ftp daemon from reading users home directories (username). For complete SELinux messages. run sealert -l c366e889-2553-4c16-b73f-92f36a1730ce

# setsebool -P ftp_home_dir=1

# chown user1:root /myftp/pub
# chmod 775 /myftp/pub

semanage fcontext -a -t public_content_t /myftp

# restorecon -R -v /myftp/
restorecon reset /myftp context unconfined_u:object_r:default_t:s0->system_u:object_r:public_content_t:s0

$ ls -dZ /myftp/
drwxr-xr-x. root root system_u:object_r:public_content_t:s0 /myftp/
$ ls -dZ /myftp/pub/
drwxrwxr-x. user1 root unconfined_u:object_r:default_t:s0 /myftp/pub/

semanage fcontext -a -t public_content_rw_t "/myftp/pub(/.*)?"

# restorecon -R -v /myftp/pub
restorecon reset /myftp/pub context system_u:object_r:default_t:s0->system_u:object_r:public_content_rw_t:s0

setsebool -P allow_ftpd_anon_write on

File upload via FTP from a home directory.

$ getsebool allow_ftpd_anon_write
allow_ftpd_anon_write --> on

# service vsftpd start
Starting vsftpd for vsftpd:                                [  OK  ]

$ ftp localhost
Connected to localhost (127.0.0.1).
220 (vsFTPd 2.1.0)
Name (localhost:username):
331 Please specify the password.
Password: Enter the correct password
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd myftp
250 Directory successfully changed.
ftp> put ftpupload 
local: ftpupload remote: ftpupload
227 Entering Passive Mode (127,0,0,1,241,41).
150 Ok to send data.
226 File receive OK.
ftp> 221 Goodbye.

yum install nfs-utils

setsebool -P nfs_export_all_rw off
# chmod -R 777 /myshare
/myshare 	192.168.1.100(rw)

# service nfs start
Starting NFS services:		[  OK  ]
Starting NFS quotas:		[  OK  ]
Starting NFS daemon:		[  OK  ]
Starting NFS mountd:		[  OK  ]

# exportfs -rv
exporting 192.168.1.100:/myshare

# showmount -e
Export list for nfs-srv:
/myshare 192.168.1.100

[nfs-client]# mkdir /myshare
[nfs-client]# mount.nfs 192.168.1.1:/myshare /myshare
mount.nfs: access denied by server while mounting 192.168.1.1:/myshare/

[nfs-srv]# setsebool -P nfs_export_all_rw on

[nfs-srv]# service nfs restart

[nfs-client]# mount.nfs 192.168.1.1:/myshare /myshare
[nfs-client]#
[nfs-client]# ls /myshare
total 0
-rwxrwxrwx.  1 root root 0 2009-04-16 12:07 file1
[nfs-client]#

yum install bind

zone "testdomain.com" {
			type slave;
			masters { IP-address; };
			file "/var/named/slaves/db.testdomain.com";
		       };

named[PID]: dumping master file: rename: /var/named/dynamic/zone-name: permission denied

setroubleshoot: SELinux is preventing named (named_t) "unlink" to zone-name (named_zone_t)

yum install cvs

# yum install cvs

# yum install xinetd

cvspserver	2401/tcp			# CVS client/server operations
cvspserver	2401/udp			# CVS client/server operations

[root@cvs-srv]# mkdir /cvs

[root@cvs-srv]# chmod -R 777 /cvs

service cvspserver
{
	disable	= no
	port			= 2401
	socket_type		= stream
	protocol		= tcp
	wait			= no
	user			= root
	passenv			= PATH
	server			= /usr/bin/cvs
	env			= HOME=/cvs
	server_args		= -f --allow-root=/cvs pserver
#	bind			= 127.0.0.1

[cvsuser@cvs-client]$ cvs -d /cvs init

[cvsuser@cvs-client]$ export CVSROOT=:pserver:cvsuser@192.168.1.1:/cvs
[cvsuser@cvs-client]$
[cvsuser@cvs-client]$ cvs login
Logging in to :pserver:cvsuser@192.168.1.1:2401/cvs
CVS password: ********
cvs [login aborted]: unrecognized auth response from 192.168.100.1: cvs pserver: cannot open /cvs/CVSROOT/config: Permission denied

[root@cvs-srv]# semanage fcontext -a -t cvs_data_t '/cvs(/.*)?'
[root@cvs-srv]# restorecon -R -v /cvs

[cvsuser@cvs-client]$ export CVSROOT=:pserver:cvsuser@192.168.1.1:/cvs
[cvsuser@cvs-client]$
[cvsuser@cvs-client]$ cvs login
Logging in to :pserver:cvsuser@192.168.1.1:2401/cvs
CVS password: ********
[cvsuser@cvs-client]$

# yum install squid

$ getenforce
Enforcing

# service squid start
Starting squid:                                            [  OK  ]

$ ps -eZ | grep squid
unconfined_u:system_r:squid_t:s0 2522 ?        00:00:00 squid
unconfined_u:system_r:squid_t:s0 2524 ?        00:00:00 squid
unconfined_u:system_r:squid_t:s0 2526 ?        00:00:00 ncsa_auth
unconfined_u:system_r:squid_t:s0 2527 ?        00:00:00 ncsa_auth
unconfined_u:system_r:squid_t:s0 2528 ?        00:00:00 ncsa_auth
unconfined_u:system_r:squid_t:s0 2529 ?        00:00:00 ncsa_auth
unconfined_u:system_r:squid_t:s0 2530 ?        00:00:00 ncsa_auth
unconfined_u:system_r:squid_t:s0 2531 ?        00:00:00 unlinkd

# service squid status
squid is stopped

# service squid stop
Stopping squid:                                            [  OK  ]

semanage port -l | grep -w -i squid_port_t
squid_port_t                   tcp      3401, 4827
squid_port_t                   udp      3401, 4827

# Squid normally listens to port 3128
http_port 10000

setsebool -P squid_connect_any 0

# service squid start
Starting squid: ....................                       [FAILED]

localhost setroubleshoot: SELinux is preventing the squid (squid_t) from binding to port 10000. For complete SELinux messages. run sealert -l 97136444-4497-4fff-a7a7-c4d8442db982

# semanage port -a -t squid_port_t -p tcp 10000

# service squid start
Starting squid:						   [  OK  ]

cache_dir ufs /var/spool/squid 100 16 256

visible_hostname squid.example.com

# /sbin/service squid start
init_cache_dir /var/spool/squid... Starting squid: .       [  OK  ]

# ls -lZ /var/run/squid.pid 
-rw-r--r--. root squid unconfined_u:object_r:squid_var_run_t:s0 /var/run/squid.pid

SELinux is preventing the squid daemon from connecting to network port 10000

# setsebool -P squid_connect_any on
yum install mysql-server

$ getenforce
Enforcing

# service mysqld start
Initializing MySQL database:  Installing MySQL system tables... [  OK  ]
Starting MySQL:                                            	[  OK  ]

$ ps -eZ | grep mysqld
unconfined_u:system_r:mysqld_safe_t:s0 6035 pts/1 00:00:00 mysqld_safe
unconfined_u:system_r:mysqld_t:s0 6123 pts/1   00:00:00 mysqld

# ls -lZ /var/lib/mysql
drwx------. mysql mysql unconfined_u:object_r:mysqld_db_t:s0 mysql

# mysqlshow -u root -p
Enter password: *******
+--------------------+
|     Databases      |
+--------------------+
| information_schema |
| mysql              |
| test               |
| wikidb             |
+--------------------+

# service mysqld stop
Stopping MySQL:                                            [  OK  ]

# mkdir -p /mysql

# cp -R /var/lib/mysql/* /mysql/

# chown -R mysql:mysql /mysql

# ls -lZ /opt
drwxr-xr-x. mysql mysql unconfined_u:object_r:usr_t:s0   mysql

[mysqld]
datadir=/mysql

SELinux is preventing /usr/libexec/mysqld "write" access on /mysql. For complete SELinux messages. run sealert -l b3f01aff-7fa6-4ebe-ad46-abaef6f8ad71

semanage fcontext -a -t mysqld_db_t "/mysql(/.*)?"

# grep -i mysql /etc/selinux/targeted/contexts/files/file_contexts.local

/mysql(/.*)?    system_u:object_r:mysqld_db_t:s0

restorecon -R -v /mysql

# service mysqld start
Starting MySQL:                                            [  OK  ]

ls -lZ /opt
drwxr-xr-x. mysql mysql system_u:object_r:mysqld_db_t:s0 mysql

yum install postgresql-server

$ getenforce
Enforcing

service postgresql start
Starting postgresql service:                               [  OK  ]

ps -eZ | grep postgres
unconfined_u:system_r:postgresql_t:s0 395 ?    00:00:00 postmaster
unconfined_u:system_r:postgresql_t:s0 397 ?    00:00:00 postmaster
unconfined_u:system_r:postgresql_t:s0 399 ?    00:00:00 postmaster
unconfined_u:system_r:postgresql_t:s0 400 ?    00:00:00 postmaster
unconfined_u:system_r:postgresql_t:s0 401 ?    00:00:00 postmaster
unconfined_u:system_r:postgresql_t:s0 402 ?    00:00:00 postmaster

# ls -lZ /var/lib/pgsql
drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 data

# mkdir -p /opt/postgresql/data

# ls -lZ /opt/postgresql/
drwxr-xr-x. root root unconfined_u:object_r:usr_t:s0   data

# chown -R postgres:postgres /opt/postgresql

# vi /etc/rc.d/init.d/postgresql
PGDATA=/opt/postgresql/data
PGLOG=/opt/postgresql/data/pgstartup.log

su - postgres -c "initdb -D /opt/postgresql/data"

# service postgresql start
Starting postgresql service: 			[FAILED]

semanage fcontext -a -t postgresql_db_t "/opt/postgresql(/.*)?"

# grep -i postgresql /etc/selinux/targeted/contexts/files/file_contexts.local

/opt/postgresql(/.*)?    system_u:object_r:postgresql_db_t:s0

restorecon -R -v /opt/postgresql

# service postgresql start
Starting postgreSQL service:                                            [  OK  ]

ls -lZ /opt
drwxr-xr-x. root root system_u:object_r:postgresql_db_t:s0 postgresql

# ps aux | grep -i postmaster

postgres 21564  0.3  0.3  42308  4032 ?        S    10:13   0:00 /usr/bin/postmaster -p 5432 -D /opt/postgresql/data
yum install rsync

$ getenforce
Enforcing

$ which rsync
/usr/bin/rsync

log file = /var/log/rsync.log
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsync.lock
[files]
        path = /srv/files
        comment = file area
        read only = false
	timeout = 300

# rsync --daemon

# ps x | grep rsync
 8231 ?        Ss     0:00 rsync --daemon
 8233 pts/3    S+     0:00 grep rsync

# ps -eZ | grep rsync
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 8231 ? 00:00:00 rsync

#!/bin/bash

# Source function library.
. /etc/rc.d/init.d/functions

[ -f /usr/bin/rsync ] || exit 0

case "$1" in
start)
action "Starting rsyncd: " /usr/bin/rsync --daemon
;;
stop)
action "Stopping rsyncd: " killall rsync
;;
*)
echo "Usage: rsyncd {start|stop}"
exit 1
esac
exit 0

semanage fcontext -a -t initrc_exec_t "/etc/rc.d/init.d/rsyncd"

# grep rsync /etc/selinux/targeted/contexts/files/file_contexts.local

/etc/rc.d/init.d/rsyncd    system_u:object_r:initrc_exec_t:s0

restorecon -R -v /etc/rc.d/init.d/rsyncd

 ls -lZ /etc/rc.d/init.d/rsyncd
-rwxr-xr-x. root root system_u:object_r:initrc_exec_t:s0 /etc/rc.d/init.d/rsyncd

# service rsyncd start
Starting rsyncd:                                           [  OK  ]

ps -eZ | grep rsync
unconfined_u:system_r:rsync_t:s0 9794 ?        00:00:00 rsync

log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsync.lock
port = 10000
[files]
        path = /srv/files
        comment = file area
        read only = false
	timeout = 300

Jul 22 10:46:59 localhost setroubleshoot: SELinux is preventing the rsync (rsync_t) from binding to port 10000. For complete SELinux messages. run sealert -l c371ab34-639e-45ae-9e42-18855b5c2de8

# semanage port -a -t rsync_port_t -p tcp 10000

# service rsyncd start
Starting rsyncd:                                           [  OK  ]

# netstat -lnp | grep 10000
tcp        0      0 0.0.0.0:10000   0.0.0.0:*      LISTEN      9910/rsync

yum install postfix

$ getenforce
Enforcing

service postfix start
Starting postfix:                               [  OK  ]

ps -eZ | grep postfix
system_u:system_r:postfix_master_t:s0 1651 ?   00:00:00 master
system_u:system_r:postfix_pickup_t:s0 1662 ?   00:00:00 pickup
system_u:system_r:postfix_qmgr_t:s0 1663 ?     00:00:00 qmgr

$ grep postfix /etc/selinux/targeted/contexts/files/file_contexts

yum install spamassassin

# semanage port -l | grep spamd
spamd_port_t		tcp	783

# Options to spamd
SPAMDOPTIONS="-d -p 10000 -c m5 -H"

# service spamassassin start
Starting spamd: [2203] warn: server socket setup failed, retry 1: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
[2203] warn: server socket setup failed, retry 2: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
[2203] error: spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
spamd: could not create INET socket on 127.0.0.1:10000: Permission denied
                                                           [FAILED]

SELinux is preventing the spamd (spamd_t) from binding to port 10000.

semanage port -a -t spamd_port_t -p tcp 10000

# service spamassassin start
Starting spamd:					[ OK ]

# netstat -lnp | grep 10000
tcp	0	0 127.0.0.1:10000	0.0.0.0:*	LISTEN	2224/spamd.pid

yum install dhcp

$ getenforce
Enforcing

service dhcpd start
Starting dhcpd:                               [  OK  ]

ps -eZ | grep dhcpd
unconfined_u:system_r:dhcpd_t:s0 5483 ?        00:00:00 dhcpd

$ grep dhcp /etc/selinux/targeted/contexts/files/file_contexts

制限のあるサービスの管理

SELinux の制御下にあるサービスの設定について

Red Hat Engineering Content Services

第1章 はじめに

第2章 Targeted ポリシー

2.1. Type Enforcement

2.2. 制限のあるプロセス

2.3. 制限のないプロセス

第3章 Apache HTTP Server

3.1. Apache HTTP Server と SELinux

3.2. タイプ

3.3. Boolean

3.4. 設定の実例

3.4.1. 静的なサイトを実行する

3.4.2. NFS と CIFS ファイルシステムを共有する

3.4.3. サービス間でファイルを共有する

3.4.4. ポート番号を変更する

第4章 Samba

4.1. Samba と SELinux

4.2. タイプ

4.3. Boolean

4.4. 設定例

4.4.1. 作成したディレクトリを共有する

4.4.2. web サイトを共有する

第5章 ファイル転送プロトコル

5.1. FTP と SELinux

5.2. タイプ

5.3. Boolean

5.4. 設定例

5.4.1. FTP サイトにアップロードする

第6章 ネットワークファイルシステム

6.1. NFS と SELinux

6.2. タイプ

6.3. Boolean

6.4. 設定例

6.4.1. NFS を使ってディレクトリを共有する

6.4.1.1. サーバーのセットアップ

第7章 BIND (Berkeley Internet Name Domain)

7.1. BIND と SELinux

7.2. タイプ

7.3. Boolean

7.4. 設定例

7.4.1. ダイナミック DNS

第8章 CVS (Concurrent Versioning System)

8.1. CVS と SELinux

8.2. タイプ

8.3. Boolean

8.4. 設定例

8.4.1. CVS のセットアップ

第9章 Squid キャッシングプロキシ

9.1. Squid キャッシングプロキシと SELinux

9.2. タイプ

9.3. Boolean

9.4. 設定例

9.4.1. Squid を非標準のポートに接続させる

第10章 MySQL

10.1. MySQL と SELinux

10.2. タイプ

10.3. Boolean

10.4. 設定例

10.4.1. MySQL のデータベース格納場所を変更する

第11章 PostgreSQL

11.1. PostgreSQL と SELinux

11.2. タイプ

11.3. Boolean

11.4. 設定例

11.4.1. PostgreSQL のデータベース格納場所を変更する

第12章 rsync

12.1. rsync と SELinux

12.2. タイプ

12.3. Boolean

12.4. 設定例

12.4.1. デーモンとして rsync を使用する

第13章 Postfix

13.1. Postfix と SELinux

13.2. タイプ

13.3. Boolean

13.4. 設定例

13.4.1. SpamAssassin と Postfix

第14章 DHCP

第1章はじめに

第5章ファイル転送プロトコル

第6章ネットワークファイルシステム

第15章参考文献