Centos
如何查看 SELinux 策略包的內容
如標題所述,如何查看 SELinux 策略包的內容?生成的文件以 .pp 結尾。我在 centos 6 上執行,但我想在“所有”發行版上都是一樣的。
例如
cp /usr/share/selinux/targeted/cobbler.pp.bz2 ~ bunzip2 cobbler.pp.bz2 MAGIC_SELINUX_CMD cobbler.pp
SELinux 策略模組通過以下步驟建構:
- 生成一組策略規則:
audit2allow
- 編譯:
checkmodule
- 建造:
semodule_package
http://wiki.centos.org/HowTos/SELinux
假設我有一個
postgreylocal.te
包含以下內容的文件:module postgreylocal 1.0; require { type postfix_smtpd_t; type postfix_spool_t; type initrc_t; class sock_file write; class unix_stream_socket connectto; } #============= postfix_smtpd_t ============== allow postfix_smtpd_t initrc_t:unix_stream_socket connectto; allow postfix_smtpd_t postfix_spool_t:sock_file write;
postgreylocal.pp
策略模組將使用以下內容創建:# checkmodule -M -m -o postgreylocal.mod postgreylocal.te # semodule_package -m postgreylocal.mod -o postgreylocal.pp
要解壓此策略模組,您需要一個名為semodule_unpackage的工具來提取
.mod
文件,然後使用dismod
將二進制模組反彙編為文本表示。在我的 Gentoo 上,需要安裝以下軟體包:
[I] sys-apps/policycoreutils Available versions: [M]2.0.82 [M](~)2.0.82-r1 [M](~)2.0.85 [M](~)2.1.0 {M}(~)2.1.0-r1 Installed versions: 2.1.0-r1(05:12:27 PM 10/14/2011) Homepage: http://userspace.selinuxproject.org Description: SELinux core utilities [I] sys-apps/checkpolicy Available versions: [M]2.0.21 [M](~)2.0.23 {M}(~)2.1.0 {debug} Installed versions: 2.1.0(01:27:53 PM 10/14/2011)(-debug) Homepage: http://userspace.selinuxproject.org Description: SELinux policy compiler [I] sys-libs/libsepol Available versions: [M]2.0.41!t [M](~)2.0.42!t {M}(~)2.1.0!t Installed versions: 2.1.0!t(01:25:43 PM 10/14/2011) Homepage: http://userspace.selinuxproject.org Description: SELinux binary policy representation library
.pp
首先,從文件中提取模組:# semodule_unpackage postgreylocal.pp postgreylocal.mod
其次,拆卸
dismod
:# cd checkpolicy-2.1.0/test/ # ls dismod.c dispol.c Makefile # make cc -g -Wall -O2 -pipe -I/usr/include -c -o dispol.o dispol.c dispol.c: In function ‘main’: dispol.c:438:8: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result dispol.c:465:9: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result dispol.c:476:9: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result dispol.c:500:9: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result cc dispol.o -lfl -lsepol -lselinux /usr/lib/libsepol.a -L/usr/lib -o dispol cc -g -Wall -O2 -pipe -I/usr/include -c -o dismod.o dismod.c dismod.c: In function ‘main’: dismod.c:913:8: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result dismod.c:982:9: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result dismod.c: In function ‘link_module’: dismod.c:787:7: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result cc dismod.o -lfl -lsepol -lselinux /usr/lib/libsepol.a -L/usr/lib -o dismod # ls dismod dismod.c dismod.o dispol dispol.c dispol.o Makefile
./dismod postgreylocal.pp Reading policy... libsepol.policydb_index_others: security: 0 users, 1 roles, 3 types, 0 bools libsepol.policydb_index_others: security: 0 sens, 0 cats libsepol.policydb_index_others: security: 2 classes, 0 rules, 0 cond rules libsepol.policydb_index_others: security: 0 users, 1 roles, 3 types, 0 bools libsepol.policydb_index_others: security: 0 sens, 0 cats libsepol.policydb_index_others: security: 2 classes, 0 rules, 0 cond rules Binary policy module file loaded. Module name: postgreylocal Module version: 1.0 Select a command: 1) display unconditional AVTAB 2) display conditional AVTAB 3) display users 4) display bools 5) display roles 6) display types, attributes, and aliases 7) display role transitions 8) display role allows 9) Display policycon 0) Display initial SIDs a) Display avrule requirements b) Display avrule declarations c) Display policy capabilities l) Link in a module u) Display the unknown handling setting F) Display filename_trans rules f) set output file m) display menu q) quit
Command ('m' for menu): 1 unconditional avtab: --- begin avrule block --- decl 1: allow [postfix_smtpd_t] [initrc_t] : [unix_stream_socket] { connectto }; allow [postfix_smtpd_t] [postfix_spool_t] : [sock_file] { write }; Command ('m' for menu): a avrule block requirements: --- begin avrule block --- decl 1: commons: <empty> classes: sock_file{ write } unix_stream_socket{ connectto } roles : <empty> types : postfix_smtpd_t postfix_spool_t initrc_t users : <empty> bools : <empty> levels : <empty> cats : <empty> Command ('m' for menu):