\u7b80\u4ecb<\/strong><\/div>\n
Semanage\u662f\u7528\u4e8e\u914d\u7f6eSELinux\u7b56\u7565\u67d0\u4e9b\u5143\u7d20\u800c\u65e0\u9700\u4fee\u6539\u6216\u91cd\u65b0\u7f16\u8bd1\u7b56\u7565\u6e90\u7684\u5de5\u5177\u3002 \u8fd9\u5305\u62ec\u5c06Linux\u7528\u6237\u540d\u6620\u5c04\u5230SELinux\u7528\u6237\u8eab\u4efd\u4ee5\u53ca\u5bf9\u8c61\uff08\u5982\u7f51\u7edc\u7aef\u53e3\uff0c\u63a5\u53e3\u548c\u4e3b\u673a\uff09\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\u6620\u5c04\u3002<\/p>\n
\u5b9e\u9a8c\u73af\u5883<\/strong><\/div>\n
Centos7.7\u64cd\u4f5c\u7cfb\u7edf<\/p>\n
Selinux\u5df2\u7ecf\u5f00\u542f
\n\u5f00\u542f\u65b9\u5f0f\uff1a<\/p>\n
\r\n[root@localhost ~]# sed -i '\/^SELINUX\/s\/disabled\/enforcing\/g' \/etc\/selinux\/config\r\n# \u7136\u540e\u91cd\u542f\u4e00\u4e0b\u64cd\u4f5c\u7cfb\u7edf\r\n[root@localhost ~]# reboot\r\n# \u91cd\u542f\u5b8c\u6210\u4e4b\u540e\u68c0\u67e5\u4e00\u4e0b\u662f\u5426\u662fenforcing\u6a21\u5f0f\r\n[root@localhost ~]# getenforce \r\nEnforcing\r\n<\/pre>\n
\u5e38\u7528\u53c2\u6570<\/strong><\/div>\n
\n
port<\/span>: \u7ba1\u7406\u5b9a\u4e49\u7684\u7f51\u7edc\u7aef\u53e3\u7c7b\u578b<\/li>\n
fcontext<\/span>: \u7ba1\u7406\u5b9a\u4e49\u7684\u6587\u4ef6\u4e0a\u4e0b\u6587<\/li>\n
-l<\/span>: \u5217\u51fa\u6240\u6709\u8bb0\u5f55<\/li>\n
-a<\/span>: \u6dfb\u52a0\u8bb0\u5f55<\/li>\n
-m<\/span>: \u4fee\u6539\u8bb0\u5f55<\/li>\n
-d<\/span>: \u5220\u9664\u8bb0\u5f55<\/li>\n
-t<\/span>: \u6dfb\u52a0\u7684\u7c7b\u578b<\/li>\n
-p<\/span>: \u6307\u5b9a\u6dfb\u52a0\u7684\u7aef\u53e3\u662ftcp\u6216udp\u534f\u8bae\u7684\uff0cport\u5b50\u547d\u4ee4\u4e0b\u4f7f\u7528<\/li>\n
-e<\/span>: \u76ee\u6807\u8def\u5f84\u53c2\u8003\u539f\u8def\u5f84\u7684\u4e0a\u4e0b\u6587\u7c7b\u578b\uff0cfcontext\u5b50\u547d\u4ee4\u4e0b\u4f7f\u7528<\/li>\n<\/ul>\n
\u5217\u51fa\u6240\u6709\u5b9a\u4e49\u7684\u7aef\u53e3<\/strong><\/div>\n
\u4f7f\u7528semanage port\u547d\u4ee4\u5217\u51fa\u6240\u6709\u7aef\u53e3<\/p>\n
\r\n[root@localhost ~]# semanage port -l\r\nSELinux Port Type Proto Port Number\r\n\r\nafs3_callback_port_t tcp 7001\r\nafs3_callback_port_t udp 7001\r\nafs_bos_port_t udp 7007\r\nafs_fs_port_t tcp 2040\r\nafs_fs_port_t udp 7000, 7005\r\nafs_ka_port_t udp 7004\r\nafs_pt_port_t tcp 7002\r\nafs_pt_port_t udp 7002\r\nafs_vl_port_t udp 7003\r\nagentx_port_t tcp 705\r\nagentx_port_t udp 705\r\namanda_port_t tcp 10080-10083\r\namanda_port_t udp 10080-10082\r\n\u2026\r\n\u2026\r\n<\/pre>\n
$\"\"$
\n\u5217\u51fa\u6307\u5b9a\u7684\u7aef\u53e3\u7c7b\u578b\u7684\u7aef\u53e3<\/p>\n
\r\n[root@localhost ~]# semanage port -l|grep -w http_port_t\r\nhttp_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000\r\n<\/pre>\n
$\"\"$
\n\u901a\u8fc7\u67e5\u8be2\u7aef\u53e3\u53f7\u6765\u5217\u51fa\u7aef\u53e3\u7c7b\u578b<\/p>\n
\r\n[root@localhost ~]# semanage port -l|grep -w 53\r\ndns_port_t tcp 53\r\ndns_port_t udp 53\r\n[root@localhost ~]# semanage port -l|grep -w 20\r\nftp_data_port_t tcp 20\r\n[root@localhost ~]# semanage port -l|grep -w 21\r\nftp_port_t tcp 21, 989, 990\r\n<\/pre>\n
$\"\"$ <\/p>\n
\u521b\u5efa\u3001\u6dfb\u52a0\u3001\u4fee\u6539\u7aef\u53e3<\/strong><\/div>\n
\u901a\u8fc7\u4e0b\u9762\u7684\u547d\u4ee4\u4e3ahttp\u6dfb\u52a0\u65b0\u7aef\u53e3<\/p>\n
\r\n[root@localhost ~]# \r\n[root@localhost ~]# semanage port -a -t http_port_t -p tcp 8888\r\n[root@localhost ~]#\r\n# \u67e5\u770b\u65b0\u6dfb\u52a0\u7684\u7aef\u53e3\r\n[root@localhost ~]# semanage port -l|grep -w 8888\r\nhttp_port_t tcp 8888, 80, 81, 443, 488, 8008, 8009, 8443, 9000\r\n# \u4e5f\u53ef\u4ee5\u4f7f\u7528-C\u53c2\u6570\u67e5\u770b\u81ea\u5b9a\u4e49\u7684\u7aef\u53e3\u53f7\r\n[root@localhost ~]# semanage port -lC\r\nSELinux Port Type Proto Port Number\r\n\r\nhttp_port_t tcp 8888\r\n<\/pre>\n
$\"\"$
\n\u6dfb\u52a0\u4e00\u4e2a\u8303\u56f4\u7684\u7aef\u53e3<\/p>\n
\r\n[root@localhost ~]# semanage port -a -t http_port_t -p tcp 11180-11188\r\n[root@localhost ~]# \r\n[root@localhost ~]# semanage port -lC\r\nSELinux Port Type Proto Port Number\r\n\r\nhttp_port_t tcp 8888, 11180-11188\r\n<\/pre>\n
$\"\"$ <\/p>\n
\u5220\u9664\u7aef\u53e3<\/strong><\/div>\n
\r\n[root@localhost ~]# semanage port -d -t http_port_t -p tcp 8888\r\n[root@localhost ~]# \r\n[root@localhost ~]# semanage port -d -t http_port_t -p tcp 11180-11188\r\n[root@localhost ~]# \r\n# \u67e5\u770b\u4e00\u4e0b\uff0c\u5df2\u7ecf\u6ca1\u6709\u81ea\u5b9a\u4e49\u7684\u7aef\u53e3\u4e86\r\n[root@localhost ~]# semanage port -lC\r\n<\/pre>\n
$\"\"$ <\/p>\n
\u4fee\u6539\u5b89\u5168\u4e0a\u4e0b\u6587<\/strong><\/div>\n
\u4e3asamba\u5171\u4eab\u76ee\u5f55\u6dfb\u52a0\u5b89\u5168\u4e0a\u4e0b\u6587<\/p>\n
\r\n# \u6ca1\u6dfb\u52a0\u5b89\u5168\u4e0a\u4e0b\u6587\u4e4b\u524d\u662fdefault_t\r\n[root@localhost ~]# ll -dZ \/share\/\r\ndrwxr-xr-x. root root unconfined_u:object_r:default_t:s0 \/share\/\r\n[root@localhost ~]# semanage fcontext -a -t samba_share_t '\/share(\/.*)?'\r\n# \u6062\u590d\u6587\u4ef6\u9ed8\u8ba4\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\r\n[root@localhost ~]# restorecon -Rv \/share\r\nrestorecon reset \/share context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:samba_share_t:s0\r\n# \u67e5\u770b\u4e00\u4e0b\u6587\u4ef6\u5939\u5df2\u7ecf\u53d8\u6210samba_share_t\u4e86\r\n[root@localhost ~]# ll -dZ \/share\r\ndrwxr-xr-x. root root unconfined_u:object_r:samba_share_t:s0 \/share\r\n<\/pre>\n
$\"\"$
\n\u4e3anfs\u5171\u4eab\u76ee\u5f55\u6dfb\u52a0\u8bfb\u5199<\/p>\n
\r\n[root@localhost ~]# ll -dZ \/nfsshare\/\r\ndrwxr-xr-x. root root unconfined_u:object_r:default_t:s0 \/nfsshare\/\r\n[root@localhost ~]# \r\n[root@localhost ~]# semanage fcontext -a -t public_content_rw_t '\/nfsshare(\/.*)?'\r\n [root@localhost ~]# restorecon -Rv \/nfsshare\r\n[root@localhost ~]# ll -dZ \/nfsshare\/\r\ndrwxr-xr-x. root root unconfined_u:object_r:public_content_rw_t:s0 \/nfsshare\/\r\n<\/pre>\n
$\"\"$ <\/p>\n
\u603b\u7ed3<\/strong><\/div>\n
\u672c\u6587\u8bb2\u8ff0\u4e86\u6dfb\u52a0\u3001\u4fee\u6539\u548c\u5220\u9664\u7aef\u53e3\uff0c\u4fee\u6539\u5b89\u5168\u4e0a\u4e0b\u6587\u3002\u5982\u679c\u4f60\u7684\u7cfb\u7edf\u6709\u5b89\u88c5\u684c\u9762\uff0c\u53ef\u4ee5\u5b89\u88c5\u56fe\u5f62\u5316\u7ba1\u7406\u8f6f\u4ef6 policycoreutils-gui\u6765\u8fdb\u884c\u7ba1\u7406\u3002<\/p>\n
\r\n[root@localhost ~]# yum -y install policycoreutils-gui\r\n# system-config-selinux\u6267\u884c\u8be5\u547d\u4ee4\u6253\u5f00\u56fe\u5f62\u5316\u7ba1\u7406\u754c\u9762\r\n[root@localhost ~]# system-config-selinux\r\n<\/pre>\n
$\"\"$ <\/p>\n","protected":false},"excerpt":{"rendered":"
Semanage\u662f\u7528\u4e8e\u914d\u7f6eSELinux\u7b56\u7565\u67d0\u4e9b\u5143\u7d20\u800c\u65e0\u9700\u4fee\u6539\u6216\u91cd\u65b0\u7f16\u8bd1\u7b56\u7565\u6e90\u7684\u5de5\u5177\u3002 \u8fd9\u5305\u62ec\u5c06Linux\u7528\u6237 […]<\/p>\n","protected":false},"author":309,"featured_media":171033,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[55],"tags":[],"class_list":["post-171031","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-thread"],"acf":[],"_links":{"self":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/171031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/users\/309"}],"replies":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/comments?post=171031"}],"version-history":[{"count":3,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/171031\/revisions"}],"predecessor-version":[{"id":171046,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/posts\/171031\/revisions\/171046"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/media\/171033"}],"wp:attachment":[{"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/media?parent=171031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/categories?post=171031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lrxjmw.cn\/wp-json\/wp\/v2\/tags?post=171031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}