9月3日 selinux练习

1、启用SELinux策略并安装httpd服务，改变网站的默认主目录为/website,添加SELinux文件标签规则，使网站可访问

开启selinux
安装httpd服务
[root@centos6 app]#mkdir website   ---创建一个website目录
[root@centos6 app]#cd website/
[root@centos6 website]#vim index.html   ---制作一个网页标签
  1 <h1>/app/website/index.html</h1>
[root@centos6 website]#vim /etc/httpd/conf/httpd.conf  ---修改httpd的配置文件，将默认主目录设置为新建的目录
 279 # UseCanonicalName: Determines how Apache constructs self-referencing 
 280 # URLs and the SERVER_NAME and SERVER_PORT variables.
 281 # When set "Off", Apache will use the Hostname and Port supplied
 282 # by the client.  When set "On", Apache will use the value of the
 283 # ServerName directive.
 284 #
 285 UseCanonicalName Off
 286 
 287 #
 288 # DocumentRoot: The directory out of which you will serve your
 289 # documents. By default, all requests are taken from this directory, but
 290 # symbolic links and aliases may be used to point to other locations.
 291 #
 292 #DocumentRoot "/var/www/html"   ---把这一行注释掉
 293 
 294 DocumentRoot "/app/website"    ---增加一个路径
 295 
 296 
 297 #
 298 # Each directory to which Apache has access can be configured with respect
 299 # to which services and features are allowed and/or disabled in that
 300 # directory (and its subdirectories). 
 301 #
 302 # First, we configure the "default" to be a very restrictive set of 
 303 # features.  
 304 #
 305 <Directory />
 306     Options FollowSymLinks
"/etc/httpd/conf/httpd.conf" 1012L, 34450C written  
[root@centos6 website]#service httpd restart ---重启网络服务，让配置文件生效，此时我们无法在访问网页了
[root@centos6 html]#ll -Z
-rw-r--r--. root root system_u:object_r:httpd_sys_content_t:s0 index.html   ---查看一下原来的安全标签
[root@centos6 html]#semanage fcontext -a -t httpd_sys_content_t "/app/website(/.*)?"    ---把website这个目录的安全标签也改为
和/var/www/httpd/目录一样，并添加到selinux数据库中，也就是变成
期望的安全标签
[root@centos6 html]#restorecon -R /app/website/   ---将这个目录设置为系统期望的安全标签
这样就可以访问了

2、修改上述网站的http端口为9527，增加SELinux端口标签，使网站可访问

[root@redhat7 html]#semanage port -l |grep "http"  ---查看一下系统期望的端口号
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t            tcp      5988
pegasus_https_port_t           tcp      5989
[root@redhat7 html]#semanage port -a -t http_port_t -p tcp 9527  ---添加端口9527到期望的端口号
[root@redhat7 html]#semanage port -l |grep "http"
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
http_port_t                    tcp      9527, 80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t            tcp      5988
pegasus_https_port_t           tcp      5989
[root@redhat7 html]#systemctl restart httpd  ---重启网络服务

3、启用相关的SELinux布尔值，使上述网站的用户student的家目录可通过http访问

[root@redhat7 html]#setsebool httpd_enable_homedirs on ---修改布尔值
[root@redhat7 html]#getsebool -a |grep home  ---查看布尔值
git_cgi_enable_homedirs --> off
git_system_enable_homedirs --> off
httpd_enable_homedirs --> on

4、编写脚本selinux.sh，实现开启或禁用SELinux功能

#!/bin/bash
#
#chkconfig:2345 90 10
selinuxon () {
                      setenforce 1
                  source /etc/init.d/functions
                      action "selinux start successful!" true
}
selinuxoff () {
                         setenforce 0
                  source /etc/init.d/functions
                      action "selinux stop successful!" true
}
case $1 in
      start) if [ `getenforce` == Permissive ];then
                  selinuxon
                
              else
                      echo "selinux is start before"
             fi
            ;;
      stop)    if [ `getenforce` == Enforcing ];then
                  selinuxoff
                  else
                      echo "selinux is stopped before"
                 fi
           ;;
       *) echo "the usage: start|stop"&&exit 100
             ;;
esac