Ограничение доступа к объектам при помощи SELinux

unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 fjoe 32743 0.0  0.0 116988 4 pts/48 Ss+ Feb27   0:00 /bin/bash

system_u:system_r:httpd_t:s0    apache   15802  0.0  0.0 416808  1220 ?        S    Mar04   0:00 /usr/sbin/httpd -DFOREGROUND

[admin@localhost ~]# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28

   
SELinux status:                 enabled
SELinuxfs mount:                /selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             ubuntu
Current mode:                   enforcing
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     denied
Max kernel policy version:      28

 
$sesearch --allow --target fz_fs_allow_write_t

   allow kernel_t fz_fs_allow_write_t : lnk_file { read getattr } ; 
   allow kernel_t fz_fs_allow_write_t : lnk_file { read create getattr setattr unlink rename } ; 
   allow puppet_t fz_fs_allow_write_t : lnk_file { read create getattr setattr unlink rename } ; 
   allow nmbd_t fz_fs_allow_write_t : lnk_file { read create getattr setattr unlink rename } ; 
   allow kernel_t fz_fs_allow_write_t : sock_file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow puppet_t fz_fs_allow_write_t : sock_file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow nmbd_t fz_fs_allow_write_t : sock_file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow kernel_t fz_fs_allow_write_t : fifo_file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow puppet_t fz_fs_allow_write_t : fifo_file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow nmbd_t fz_fs_allow_write_t : fifo_file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow ftpd_t fz_fs_allow_write_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow ftpd_t fz_fs_allow_write_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open } ; 
   allow ftpd_t fz_fs_allow_write_t : lnk_file { read create getattr setattr unlink rename } ; 
   allow ftpd_t fz_fs_allow_write_t : sock_file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow ftpd_t fz_fs_allow_write_t : fifo_file { ioctl read write create getattr setattr lock append unlink link rename open } ;
.... там еще много...

$sesearch --allow --target fz_fs_allow_write_t | grep xdm_t
   allow xdm_t file_type : filesystem getattr ; 

[root@four selinux]# cat ./test.te 
module fz_fs_allow 1.0.0;

require {
  attribute file_type;
  type httpd_t;
  class file read;
  class file write;
};

type fz_fs_allow_all_t, file_type;
type fz_fs_allow_read_t, file_type;
type fz_fs_allow_write_t, file_type;
type fz_fs_deny_all_t, file_type;

allow httpd_t fz_fs_allow_all_t:file { read write};
allow httpd_t fz_fs_allow_read_t:file { read };
allow httpd_t fz_fs_allow_write_t:file { write };

[root@four selinux]# make -f /usr/share/selinux/devel/Makefile
Compiling targeted test module
/usr/bin/checkmodule:  loading policy configuration from tmp/test.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 17) to tmp/test.mod
Creating targeted test.pp policy package
rm tmp/test.mod.fc tmp/test.mod

[root@four selinux]# semodule -i test.pp 
[root@four selinux]# semodule -l | grep fz_fs_allow
fz_fs_allow	1.0.0	

[root@four selinux]# sesearch --allow | fgrep 'fz_fs_allow_write_t'
   allow fz_fs_allow_write_t fz_fs_allow_write_t : filesystem associate ; 
   allow httpd_t fz_fs_allow_write_t : file write ; 

[root@four default]# chcon -v -t fz_fs_allow_write_t ./test.txt 
changing security context of ‘./test.txt’
[root@four default]# ll -Z ./test.txt 
-rw-r--r--. root root unconfined_u:object_r:fz_fs_allow_write_t:s0 ./test.txt

type=AVC msg=audit(1394096067.672:175339): avc:  denied  { getattr } for  pid=4651 comm="httpd" path="/var/www/html/default/test.txt" dev="sda2" ino=395394 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:fz_fs_allow_write_t:s0 tclass=file

module fz_fs_allow 1.0.2;

require {
  attribute file_type;
  type httpd_t;
  class file read;
  class file write;
  class file getattr;
  class file open;
};

type fz_fs_allow_all_t, file_type;
type fz_fs_allow_read_t, file_type;
type fz_fs_allow_write_t, file_type;
type fz_fs_deny_all_t, file_type;

allow httpd_t fz_fs_allow_all_t:file getattr;
allow httpd_t fz_fs_allow_write_t:file getattr;

allow httpd_t fz_fs_allow_all_t:file open;
allow httpd_t fz_fs_allow_write_t:file open;

allow httpd_t fz_fs_allow_all_t:file { read write };
allow httpd_t fz_fs_allow_read_t:file { read };
allow httpd_t fz_fs_allow_write_t:file { write }

[root@localhost ~]# ps -auxZ | fgrep '/usr/lib/systemd/systemd ' | fgrep -v 'fgrep'
system_u:system_r:init_t:s0     root         1  0.0  0.1  50068  3800 ?        Ss   Feb09  11:17 /usr/lib/systemd/systemd --switched-root --system --deserialize 27
system_u:system_r:init_t:s0     user         566  0.0  0.0  44644   624 ?        Ss   Feb09   0:03 /usr/lib/systemd/systemd --user
system_u:system_r:init_t:s0     root      1431  0.0  0.0  44652   596 ?        Ss   Feb09   0:04 /usr/lib/systemd/systemd --user

[root@localhost ~]# ll -Z /sbin/httpd 
-rwxr-xr-x. root root system_u:object_r:httpd_exec_t:s0 /sbin/httpd

[root@localhost ~]# sesearch -T -t httpd_exec_t -s init_t
Found 1 semantic te rules:
   type_transition init_t httpd_exec_t : process httpd_t;

[root@localhost ~]# ps -auxZ | fgrep 'httpd'
system_u:system_r:httpd_t:s0    root     12864  1.9  0.7 382540 14548 ?        Ss   22:57   0:00 /usr/sbin/httpd -DFOREGROUND
system_u:system_r:httpd_t:s0    apache   12865  0.0  0.3 382540  7004 ?        S    22:57   0:00 /usr/sbin/httpd -DFOREGROUND

[root@localhost ~]# ps -Z -C proftpd
LABEL                             PID TTY          TIME CMD
[root@localhost ~]# service proftpd start
Redirecting to /bin/systemctl start  proftpd.service
[root@localhost ~]# ps -Z -C proftpd
LABEL                             PID TTY          TIME CMD
system_u:system_r:ftpd_t:s0-s0:c0.c1023 3863 ? 00:00:00 proftpd
[root@localhost ~]# 

[root@localhost ~]# cat /etc/issue
Fedora release 20 (Heisenbug)
Kernel \r on an \m (\l)

[root@localhost ~]# rpm -qa | grep selinux-policy
selinux-policy-3.12.1-106.fc20.noarch
selinux-policy-targeted-3.12.1-106.fc20.noarch

[root@localhost ~]# ll -Z /sbin/proftpd
-rwxr-xr-x. root root system_u:object_r:ftpd_exec_t:s0 /sbin/proftpd
[root@localhost ~]# sesearch -T -t ftpd_exec_t -s init_t
Found 1 semantic te rules:
   type_transition init_t ftpd_exec_t : process ftpd_t;