16 2使用 SELinux提升内核安全性 2.2 SELinuX能够干什么 a SELinux provides the following benefits All processes and files are labeled. SELinux policy rules define how processes interact with files, as well as how processes interact with each other. Access is only allowed if an SELinux policy rule exists that specifically allows it a Fine-grained access control. Stepping beyond traditional UNIX permissions that are controlled at user discretion and based on Linux user and group IDs, SELinux access decisions are based on all available information such as an selinux user role, type, and, optionally, a security level SELinux policy is administratively-defined and enforced system-wide 河南中医药大学/阮晓龙713938213680/http://inux.xg.hactcm.edu.cn/http://www.5lxueweb.cn
河南中医药大学 / 阮晓龙 / 13938213680 / http://linux.xg.hactcm.edu.cn / http://www.51xueweb.cn 2.使用SELinux提升内核安全性 SELinux provides the following benefits: ◼ All processes and files are labeled. SELinux policy rules define how processes interact with files, as well as how processes interact with each other. Access is only allowed if an SELinux policy rule exists that specifically allows it. ◼ Fine-grained access control. Stepping beyond traditional UNIX permissions that are controlled at user discretion and based on Linux user and group IDs, SELinux access decisions are based on all available information, such as an SELinux user, role, type, and, optionally, a security level. ◼ SELinux policy is administratively-defined and enforced system-wide. 16 2.2 SELinux能够干什么
17 2使用 SELinux提升内核安全性 2.2 SELinuX能够干什么 a SELinux provides the following benefits a Improved mitigation for privilege escalation attacks. Processes run in domains and are therefore separated from each other. SELinux policy rules define how processes access files and other processes. If a process is compromised, the attacker only has access to the normal functions of that process, and to files the process has been configured to have access to. For o example if the Apache Http Server is compromised an attacker cannot use that process to read files in user home directories, unless a specific SELinux policy rule was added or configured to allow such access SELinux can be used to enforce data confidentiality and integrity, as well as protecting processes from untrusted inputs 河南中医药大学/阮晓龙713938213680/http://inux.xg.hactcm.edu.cn/http://www.5lxueweb.cn
河南中医药大学 / 阮晓龙 / 13938213680 / http://linux.xg.hactcm.edu.cn / http://www.51xueweb.cn 2.使用SELinux提升内核安全性 SELinux provides the following benefits: ◼ Improved mitigation for privilege escalation attacks. Processes run in domains, and are therefore separated from each other. SELinux policy rules define how processes access files and other processes. If a process is compromised, the attacker only has access to the normal functions of that process, and to files the process has been configured to have access to. For example, if the Apache HTTP Server is compromised, an attacker cannot use that process to read files in user home directories, unless a specific SELinux policy rule was added or configured to allow such access. ◼ SELinux can be used to enforce data confidentiality and integrity, as well as protecting processes from untrusted inputs. 17 2.2 SELinux能够干什么
18 2使用 SELinux提升内核安全性 2.2 SELinuX能够干什么 口 SELinux is not: ■ antivirus software replacement for passwords, firewalls, and other security systems all-in-one security solution o SELinux is designed to enhance existing security solutions, not replace them Even when running SELinux, it is important to continue to follow good security practices, such as keeping software up-todate, using hard-to-guess passwords, and firewalls 河南中医药大学/阮晓龙713938213680/http://inux.xg.hactcm.edu.cn/http://www.5lxueweb.cn
河南中医药大学 / 阮晓龙 / 13938213680 / http://linux.xg.hactcm.edu.cn / http://www.51xueweb.cn 2.使用SELinux提升内核安全性 SELinux is not: ◼ antivirus software ◼ replacement for passwords, firewalls, and other security systems ◼ all-in-one security solution SELinux is designed to enhance existing security solutions, not replace them. Even when running SELinux, it is important to continue to follow good security practices, such as keeping software up-todate, using hard-to-guess passwords, and firewalls. 18 2.2 SELinux能够干什么
19 工作模式决定 SELinux是否启用 工作 enforcing:强制模式,启用 SELinux 模式 permIssive:宽容模式,启用 SELinux,但不阻止任何操 SELINUX 作,只提出警告信息 disabled:关闭模式,关闭 SELinux 工作 工作类型指定 SELinⅨX使用的安全政策(enos78) 类型 targeted:默认值,有限程序收到 SELinux的保护 minimum;: targeted的简化版,仅选定程序受保护 SELINUXTYPE mls: Multi- Level Security,多级安全限制,较严格
19 工作 模式 SELINUX 工作 类型 SELINUXTYPE 工作模式决定SELinux是否启用 • enforcing：强制模式，启用SELinux • permissive：宽容模式，启用SELinux，但不阻止任何操 作，只提出警告信息 • disabled：关闭模式，关闭SELinux 工作类型指定SELinux使用的安全政策（CentOS7/8） • targeted：默认值，有限程序收到SELinux的保护 • minimum：targeted的简化版，仅选定程序受保护 • mls：Multi-Level Security，多级安全限制，较严格
20 2使用 SELinux提升内核安全性 22 SeLinuX能够干什么 a SELinux can run in one of three modes: enforcing, permissive, or disabled Enforcing mode is the default, and recommended, mode of operation; in enforcing mode seLinux operates normally, enforcing the loaded security policy on the entire system a In permissive mode, the system acts as if SELinux is enforcing the loaded security policy, including labeling objects and emitting access denial entries in the logs, but it does not actually deny any operations. While not recommended for production systems, permissive mode can be helpful for SELinux policy development and debugging Disabled mode is strongly discouraged; not only does the system avoid enforcing the SELinux policy, it also avoids labeling any persistent objects such as files making it difficult to enable selinux in the future 河南中医药大学/阮晓龙713938213680/http://inux.xg.hactcm.edu.cn/http://www.5lxueweb.cn
河南中医药大学 / 阮晓龙 / 13938213680 / http://linux.xg.hactcm.edu.cn / http://www.51xueweb.cn 2.使用SELinux提升内核安全性 SELinux can run in one of three modes: enforcing, permissive, or disabled. ◼ Enforcing mode is the default, and recommended, mode of operation; in enforcing mode SELinux operates normally, enforcing the loaded security policy on the entire system. ◼ In permissive mode, the system acts as if SELinux is enforcing the loaded security policy, including labeling objects and emitting access denial entries in the logs, but it does not actually deny any operations. While not recommended for production systems, permissive mode can be helpful for SELinux policy development and debugging. ◼ Disabled mode is strongly discouraged; not only does the system avoid enforcing the SELinux policy, it also avoids labeling any persistent objects such as files, making it difficult to enable SELinux in the future. 20 2.2 SELinux能够干什么