Linux Cloud Automation Operations Basics (SELinux primary management)

1. What is SELinux
SELinux, kernel-level enhanced firewall
Elinux provides a flexible, mandatory access control (MAC) system embedded in the Linux kernel. SELinux defines the access and transformation permissions for each user, process, application, and file in the system, and then it uses a security policy to control the interaction between these entities (users, processes, applications, and files), and the security policy specifies how to check strictly or loosely.

SELinux is transparent to system users, and only system administrators need to consider how to develop strict policies on their servers. Policies can be strict or loose as needed

2. How to manage SELinux levels
SELinux turned on or off)
Vim/etc/sysconfig/selinux
selinux=disabled # #关闭状态
Selinux=enforcing # #强制状态
Selinux=permissive # #警告状态

650) this.width=650; "src=" Https://s3.51cto.com/wyfs02/M00/9D/D2/wKioL1mG8ruj9NoIAAC-OLrA88A559.png "title=" Screenshot from 2017-08-06 18-31-29.png "alt=" Wkiol1mg8ruj9noiaac-olra88a559.png "/>

Getenforce # #查看状态
When SELinux is turned on
Setenforce 0|1 # #更改selinux运行级别 0 for warning mode, 1 for Force mode

650) this.width=650; "src=" Https://s5.51cto.com/wyfs02/M02/9D/D2/wKiom1mG8s2Res3oAAC2lNPSWNg181.png "style=" float : none; "title=" screenshot from 2017-08-06 06:31:05.png "alt=" Wkiom1mg8s2res3oaac2lnpswng181.png "/>

650) this.width=650; "src=" Https://s5.51cto.com/wyfs02/M02/9D/D2/wKioL1mG8s3TYXboAABSo3GT58o818.png "style=" float : none; "title=" screenshot from 2017-08-06 06:34:48.png "alt=" Wkiol1mg8s3tyxboaabso3gt58o818.png "/>

4. How to control the SELinux switch to the service function
getsebool-a | grep Service Name
getsebool-a | grep FTP
setsebool-p function bool Value On|off
Setsebool-p Ftpd_anon_write on

5. Monitor the SELinux error message
Setroubleshoot-server

This article is from the "13122425" blog, please be sure to keep this source http://13132425.blog.51cto.com/13122425/1954052

Linux Cloud Automation Operations Basics (SELinux primary management)