SELinux refpolicy详解(4)

接前一篇文章:SELinux refpolicy详解(3)

三、refpolicy内容详解

1. README

文件路径:refpolicy源码根目录/README。

文件内容如下:

1) Reference Policy make targets:General Make targets:install-src		Install the policy sources into/etc/selinux/NAME/src/policy, where NAME is defined inthe Makefile.  If not defined, the TYPE, as defined inthe Makefile, is used.  The default NAME is refpolicy.A pre-existing source policy will be moved to/etc/selinux/NAME/src/policy.bak.conf			Regenerate policy.xml, and update/create modules.confand booleans.conf.  This should be done after addingor removing modules, or after running the bare target.If the configuration files exist, their settings willbe preserved.  This must be ran on policy sources thatare checked out from the CVS repository before they canbe used.clean			Delete all temporary files, compiled policies,and file_contexts.  Configuration files are left intact.bare			Do the clean make target and also delete configurationfiles, web page documentation, and policy.xml.html			Regenerate policy.xml and create web page documentationin the doc/html directory.Make targets specific to modular (loadable modules) policies:base			Compile and package the base module.  This is thedefault target for modular policies.modules			Compile and package all Reference Policy modulesconfigured to be built as loadable modules.MODULENAME.pp		Compile and package the MODULENAME Reference Policymodule.all			Compile and package the base module and all ReferencePolicy modules configured to be built as loadablemodules.install			Compile, package, and install the base module andReference Policy modules configured to be built asloadable modules.load			Compile, package, and install the base module andReference Policy modules configured to be built asloadable modules, then insert them into the modulestore.validate		Validate if the configured modules can successfullylink and expand.install-headers		Install the policy headers into /usr/share/selinux/NAME.The headers are sufficient for building a policymodule locally, without requiring the completeReference Policy sources.  The build.conf settingsfor this policy configuration should be set beforeusing this target.build-interface-db	Build the policy interface database with'sepolgen-ifgen'.  This database is required forreference style policy generation by'audit2allow --reference'.Make targets specific to monolithic policies:policy			Compile a policy locally for development and testing.This is the default target for monolithic policies.install			Compile and install the policy and file contexts.load			Compile and install the policy and file contexts, thenload the policy.enableaudit		Remove all dontaudit rules from policy.conf.relabel			Relabel the filesystem.checklabels		Check the labels on the filesystem, and report whena file would be relabeled, but do not change its label.restorelabels		Relabel the filesystem and report each file that isrelabeled.2) Reference Policy Build Options (build.conf)TYPE			String.  Available options are standard, mls, and mcs.For a type enforcement only system, set standard.This optionally enables multi-level security (MLS) ormulti-category security (MCS) features.  This optioncontrols enable_mls, and enable_mcs policy blocks.NAME			String (optional).  Sets the name of the policy; theNAME is used when installing files to e.g.,/etc/selinux/NAME and /usr/share/selinux/NAME.  If notset, the policy type (TYPE) is used.DISTRO			String (optional).  Enable distribution-specific policy.Available options are redhat, gentoo, and debian.This option controls distro_redhat, distro_gentoo, anddistro_debian build option policy blocks.MONOLITHIC		Boolean.  If set, a monolithic policy is built,otherwise a modular policy is built.DIRECT_INITRC		Boolean.  If set, sysadm will be allowed to directlyrun init scripts, instead of requiring the run_inittool.  This is a build option instead of a tunable sincerole transitions do not work in conditional policy.This option controls direct_sysadm_daemon policyblocks.OUTPUT_POLICY		Integer.  Set the version of the policy created whenbuilding a monolithic policy.  This option has no effecton modular policy.UNK_PERMS		String.  Set the kernel behavior for handling ofpermissions defined in the kernel but missing from thepolicy.  The permissions can either be allowed (allow),denied (deny), or the policy loading can be rejected(reject).UBAC			Boolean.  If set, the SELinux user will be usedadditionally for approximate role separation.SYSTEMD			Boolean.  If set, systemd will be assumed to be the initprocess provider.MLS_SENS		Integer.  Set the number of sensitivities in the MLSpolicy.  Ignored on standard and MCS policies.MLS_CATS		Integer.  Set the number of categories in the MLSpolicy.  Ignored on standard and MCS policies.MCS_CATS		Integer.  Set the number of categories in the MCSpolicy.  Ignored on standard and MLS policies.QUIET			Boolean.  If set, the build system will only displaystatus messages and error messages.  This option has noeffect on policy.WERROR			Boolean.  If set, the build system will treat warningsas errors.  If any warnings are encountered, the buildwill fail.3) Reference Policy Files and Directories
All directories relative to the root of the Reference Policy sources directory.Makefile		General rules for building the policy.Rules.modular		Makefile rules specific to building loadable modulepolicies.Rules.monolithic	Makefile rules specific to building monolithic policies.build.conf		Options which influence the building of the policy,such as the policy type and distribution.config/appconfig-*	Application configuration files for all configurationsof the Reference Policy (targeted/strict with or withoutMLS or MCS).  These are used by SELinux-aware programs.config/local.users	The file read by load policy for adding SELinux usersto the policy on the fly.doc/html/*		This contains the contents of the in-policy XMLdocumentation, presented in web page form.doc/policy.dtd		The doc/policy.xml file is validated against this DTD.doc/policy.xml		This file is generated/updated by the conf and html maketargets.  It contains the complete XML documentationincluded in the policy.doc/templates/*		Templates used for documentation web pages.policy/booleans.conf	This file is generated/updated by the conf make target.It contains the booleans in the policy, and theirdefault values.  If tunables are implemented asbooleans, tunables will also be included.  This filewill be installed as the /etc/selinux/NAME/booleansfile.policy/constraints	This file defines additional constraints on permissionsin the form of boolean expressions that must besatisfied in order for specified permissions to begranted.  These constraints are used to further refinethe type enforcement rules and the role allow rules.Typically, these constraints are used to restrictchanges in user identity or role to certain domains.policy/global_booleans	This file defines all booleans that have a global scope,their default value, and documentation.policy/global_tunables	This file defines all tunables that have a global scope,their default value, and documentation.policy/flask/initial_sids  This file has declarations for each initial SID.policy/flask/security_classes  This file has declarations for each security class.policy/flask/access_vectors  This file defines the access vectors.  Commonprefixes for access vectors may be defined at thebeginning of the file.  After the common prefixes aredefined, an access vector may be defined for eachsecurity class.policy/mcs		The multi-category security (MCS) configuration.policy/mls		The multi-level security (MLS) configuration.policy/modules/*	Each directory represents a layer in Reference Policyall of the modules are contained in one of these layers.policy/modules.conf	This file contains a listing of available modules, andhow they will be used when building Reference Policy. Toprevent a module from  being used, set the module to"off".  For monolithic policies, modules set to "base"and "module" will be included in the policy.  Formodular policies, modules set to "base"	will be includedin the base module; those set to "module" will becompiled as individual loadable	modules.policy/support/*	Support macros.policy/users		This file defines the users included in the policy.support/*		Tools used in the build process.4) Building policy modules using Reference Policy headers:The system must first have the Reference Policy headers installed, typically
by the distribution.  Otherwise, the headers can be installed using the
install-headers target from the full Reference Policy sources.To set up a directory to build a local module, one must simply place a .te
file in a directory.  A sample Makefile to use in the directory is the
Makefile.example in the doc directory.  This may be installed in
/usr/share/doc, under the directory for the distribution's policy.
Alternatively, the primary Makefile in the headers directory (typically
/usr/share/selinux/NAME/Makefile) can be called directly, using make's -f
option.Larger projects can set up a structure of layers, just as in Reference
Policy, by creating policy/modules/LAYERNAME directories.  Each layer also
must have a metadata.xml file which is an XML file with a summary tag and
optional desc (long description) tag.  This should describe the purpose of
the layer.Metadata.xml example:<summary>ABC modules for the XYZ components.</summary>Make targets for modules built from headers:MODULENAME.pp		Compile and package the MODULENAME local module.all			Compile and package the modules in the currentdirectory.load			Compile and package the modules in the currentdirectory, then insert them into the module store.refresh			Attempts to reinsert all modules that are currentlyin the module store from the local and system modulepackages.xml			Build a policy.xml from the XML included with thebase policy headers and any XML in the modules inthe current directory.

针对于各步骤一一进行说明和讲解。

(1)Reference Policy make targets(参考策略make targets)

1)通用的Make targets

  • install-src

将策略源安装到/etc/selinux/NAME/src/policy中,其中NAME在Makefile中定义。如果未定义,则使用Makefile中定义的TYPE。默认名称为refpolicy。预先(之前)存在的源策略将移动到/etc/selinux/NAME/src/policy.bak。

  • conf

重新生成policy.xml,并更新/创建modules.conf和booleans.conf。这应该在添加或删除模块之后,或者在运行bare target之后完成。如果配置文件存在,则其设置将被保留。这必须在从CVS存储库签出的策略源上运行,然后才能使用它们。

  • clean

删除所有临时文件、已编译的策略和file_context。配置文件完好无损(保留配置文件)。

  • bare

执行clean make target并删除配置文件、网页文档和policy.xml。

  • html

重新生成policy.xml并在doc/html目录中创建网页文档。

2)Make特定于模块化(可加载模块)策略的targets

  • base

编译并打包基本模块。这是模块化策略的默认目标。

  • modules

编译并打包所有参考策略模块,这些模块被配置为构建为可加载的模块。

  • MODULENAME.pp

编译并打包MODULENAME参考策略模块。

  • all

编译并打包基本模块和所有的参考策略模块,其(指参考策略模块)被配置成构建为可加载的模块。

  • install

编译、打包和安装基本模块和被配置成构建为可加载模块的参考策略模块。

  • load

编译、打包和安装基本模块和被配置成构建为可加载模块的参考策略模块,然后将它们插入到模块存储(module store)中。

  • validate

验证配置的模块是否可以成功链接和扩展。

  • install-headers

将策略头安装到/usr/share/selinux/NAME(如/usr/share/selinux/default)中。

头(headers)足以在本地构建策略模块,而不需要完整的参考策略源。在使用此目标之前,用于此策略配置的build.conf的设置应被设置。

  • build-interface-db

使用“sepolgen-ifgen”构建策略接口数据库。此数据库是被“audit2allow --reference”生成的参考样式策略所需要的。

3)Make特定于单一整体策略的targets

  • policy

在本地编译一个用于开发和测试的策略。这是单一策略的默认目标。

  • install

编译并安装策略和文件上下文。

  • load

编译并安装策略和文件上下文,然后加载策略。

  • enableaudit

从policy.conf中删除所有dontaudit规则。

  • relabel

重新标记文件系统。

  • checklabels

检查文件系统上的标签,并报告何时重新标记文件,但不要更改其标签。

  • restorelabels

重新标记文件系统并报告每个重新标记的文件。

下一回中继续解析README中的其它选项。

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://www.mzph.cn/news/191314.shtml

如若内容造成侵权/违法违规/事实不符,请联系多彩编程网进行投诉反馈email:809451989@qq.com,一经查实,立即删除!

相关文章

职位招聘管理与推荐系统Python+Django网页界面+协同过滤推荐算法

一、介绍 职位招聘管理与推荐系统。本系统使用Python作为主要开发语言&#xff0c;以WEB网页平台的方式进行呈现。前端使用HTML、CSS、Ajax、BootStrap等技术&#xff0c;后端使用Django框架处理用户请求。 系统创新点&#xff1a;相对于传统的管理系统&#xff0c;本系统使用…

《YOLOv8原创自研》专栏介绍 CSDN独家改进创新实战专栏目录

YOLOv8原创自研 https://blog.csdn.net/m0_63774211/category_12511737.html?spm1001.2014.3001.5482 &#x1f4a1;&#x1f4a1;&#x1f4a1;全网独家首发创新&#xff08;原创&#xff09;&#xff0c;适合paper &#xff01;&#xff01;&#xff01; &#x1f4a1;&a…

如何用Java实现扑克牌(附源码)

目录 一.扑克牌的数据结构 二.买牌(扑克牌的初始化) 三.洗牌 四.发牌 五.完整代码 Card.java CardList.java 六.测试 输出结果 一.扑克牌的数据结构 首先&#xff0c;扑克牌是一幅一幅的&#xff0c;除去大小王以外一共有52张&#xff0c;我们可以考虑用数组来存储…

解决 Python 中 TypeError: An Integer Is Required 错误

在 Python 代码中发生的另一个最常见的错误是 TypeError。 这是 Python 中的一个例外。 当您在操作中使用不适当的数据类型的对象时&#xff0c;您将收到此错误。 本文将展示我们如何在 Python 中得到 TypeError。 此外&#xff0c;我们将通过使用必要的示例和解释来讨论该主…

【Linux】命令行参数

文章目录 前言一、C语言main函数的参数二、环境变量总结 前言 我们在Linux命令行输入命令的时候&#xff0c;一般都会跟上一些参数选项&#xff0c;比如l命令&#xff0c;ls -a -l。以前我总是觉得这是理所当然的&#xff0c;没深究其本质究竟是什么&#xff0c;今天才终于知道…

春秋云镜ED01-CMS v20180505 存在任意文件上传漏洞

靶场介绍 春秋云镜ED01-CMS v20180505 存在任意文件上传漏洞 漏洞分析&#xff1a; 文件类型未校验可以任意上传执行文件&#xff0c;获取服务器权限 登录注册界面 Hi-Lo-Yohttp://eci-2ze2qm1cbaon2lylin0q.cloudeci1.ichunqiu.com/registration.php 注册了几个发现注册不…

【QT】Windows环境下,cmake引入QML

这里使用的QT库为5.7版本。 1、添加环境变量 QT库根目录环境变量 QTDIR QT库平台插件环境变量 QT_PLUGIN_PATH QML支持环境变量 QML2_IMPORT_PATH &#xff08;该环境变量仅在需要使用QML时添加&#xff09; QT库动态库环境变量&#xff0c;bin目录下包含了QT程序运行所需的dl…

跨链原子交换

原子交换的想法于 2013 年首次在 BitcoinTalk 论坛上提出&#xff0c;它可以实现两个区块链之间的代币交换。 这些交换是原子的&#xff0c;因为双方要么收到对方的硬币&#xff0c;要么都保留自己的硬币。 一方不可能欺骗另一方。 它不依赖任何可信赖的第三方&#xff0c;消除…

Hdoop学习笔记(HDP)-Part.10 创建集群

目录 Part.01 关于HDP Part.02 核心组件原理 Part.03 资源规划 Part.04 基础环境配置 Part.05 Yum源配置 Part.06 安装OracleJDK Part.07 安装MySQL Part.08 部署Ambari集群 Part.09 安装OpenLDAP Part.10 创建集群 Part.11 安装Kerberos Part.12 安装HDFS Part.13 安装Ranger …

【二叉树】常见题目解析(2)

题目1&#xff1a;104. 二叉树的最大深度 - 力扣&#xff08;LeetCode&#xff09; 题目1描述&#xff1a; 题目1分析及解决&#xff1a; &#xff08;1&#xff09;base case&#xff1a;当前节点为null时&#xff0c;以当前节点为根节点的树最大深度是0。 &#xff08;2&…

Redis使用increment方法返回null的原因以及解决方案

public static void main(String[] args) {redisTemplate.setEnableTransactionSupport(true); //开启事务支持redisTemplate.multi(); //标记事务块的开始redisTemplate.opsForValue().set("name","zs");redisTemplate.opsForValue().set("pass&qu…

使用系统ProgressBar实现三色进度条

使用系统ProgressBar实现如图三色进度条&#xff1a; //布局中<ProgressBarandroid:layout_width"0dp"android:layout_height"8dp"android:layout_marginLeft"16dp"app:layout_constraintBottom_toBottomOf"id/photo"app:layout_c…

Docker部署Plik临时文件上传系统并且实现远程访问

文章目录 1. Docker部署Plik2. 本地访问Plik3. Linux安装Cpolar4. 配置Plik公网地址5. 远程访问Plik6. 固定Plik公网地址7. 固定地址访问Plik8. 结语 本文介绍如何使用Linux docker方式快速安装Plik并且结合Cpolar内网穿透工具实现远程访问&#xff0c;实现随时随地在任意设备上…

为自己创建的游戏编程源码申请软件著作权详细流程(免费分享模板)

以为我这篇文章制作的游戏申请软件著作权为例 Ren‘py 视觉小说 交互式故事游戏制作过程学习笔记(Windows下实现)(多结局游戏)-CSDN博客 一、网站注册 申请软著时&#xff0c;所有的著作权人都需要在中国版权保护中心官网注册账号&#xff0c;并进行实名认证后&#xff0c;才…

ahk热字串:字符串输入后,按空格后,打开网址 or 不按空格直接打开网址

二、字符串输入后&#xff0c;按空格后&#xff0c;打开网址 ::aa:: { run "www.baidu.com" }三、字符串aa输入后&#xff0c;直接 打开网址 :*:aa:: { run "www.baidu.com" }一、字符串替换&#xff0c;按空格后替换。不按空格直接替换 ;输入name&…

SpringBoot2.x整合WebService实现远程接口调用

一、添加依赖 <!-- SpringBoot 2.4 以下版本--> <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web-services</artifactId> </dependency><dependency><groupId>org.apach…

Android 应用资源概览

关于作者&#xff1a;CSDN内容合伙人、技术专家&#xff0c; 从零开始做日活千万级APP。 专注于分享各领域原创系列文章 &#xff0c;擅长java后端、移动开发、商业变现、人工智能等&#xff0c;希望大家多多支持。 目录 一、导读二、概览三、资源类型分组四、配置限定符名称表…

口罩标准讲解及推荐

一、我国医用口罩质量标准 1、YY/T0969-2013《一次性使用医用口罩》 2、YY0469-2011《医用外科口罩》 3、GB19083-2010《医用防护口罩技术要求》三类医用口罩各项指标对比如下&#xff1a; 结论&#xff1a;防护效果来说&#xff1a;医用防护口罩>医用外科口罩>一次性…

【交换排序 简单选择排序 堆排序 归并排序】

文章目录 交换排序简单选择排序堆排序归并排序 交换排序 冒泡排序的算法分析&#xff1a; 冒泡排序最好的时间复杂度是O&#xff08;n&#xff09;冒泡排序最好的时间复杂度是O&#xff08;n平方&#xff09;冒泡排序平均时间复杂度为O&#xff08;n的平方&#xff09;冒泡排…

02数仓平台Zookeeper

概述 ZooKeeper是一种分布式协调服务&#xff0c;用于管理大型主机集。在分布式环境中协调和管理服务是一个复杂的过程。ZooKeeper通过其简单的架构和API解决了这个问题。ZooKeeper允许开发人员专注于核心应用程序逻辑&#xff0c;而不必担心应用程序的分布式性质。 Zookeepe…