SELinux相关的操作.docVIP

SELinux相关的操作 前言 最近经常碰到SELinux的相关问题，稍微用到了一些SELinux的相关命令，这里稍作整理 SELinux介绍 blabla 查看当前SELinux设置和状态 sestatus命令 # 当前SELinux开启设为启动，permissive模式，在当前状态下，可以使用setenforce 1改变为enforcing模式 [root@CentOS5 ~]# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: disabled Policy version: 21 Policy from config file: targeted 上面的输出是CentOS5中的，这里说明一下，sestatus这个命令在CentOS4/RHEL4（policycoreutils-1.18）和CentOS5/RHEL5（policycoreutils-1.33）中的默认输出不一样，在旧版本中，默认会同时输出详细的规则布尔值，而在新版本中默认不输出，使用-b开关可以打印这些布尔值，下面是旧版本（policycoreutils-1.18）中的输出样例[root@CentOS4 ~]# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: disabled Policy version: 18 Policy from config file:targeted Policy booleans: allow_ypbind inactive dhcpd_disable_trans inactive httpd_builtin_scripting active httpd_disable_trans inactive httpd_enable_cgi active httpd_enable_homedirs active httpd_ssi_exec active httpd_tty_comm inactive httpd_unified active mysqld_disable_trans inactive named_disable_trans inactive named_write_master_zonesinactive nscd_disable_trans inactive ntpd_disable_trans inactive pegasus_disable_trans inactive portmap_disable_trans inactive postgresql_disable_transinactive snmpd_disable_trans inactive squid_disable_trans inactive syslogd_disable_trans inactive use_nfs_home_dirs inactive use_samba_home_dirs inactive use_syslogng inactive winbind_disable_trans inactive ypbind_disable_trans inactive 使用getenforce也可以查看当前状态 # 使用getenforce只能得到当前实际的SELinux模式，结果无非三种 [root@localhost ~]# getenforce Enforcing 设置和修改SELinux状态 setenforce setenforce 1 # 设定selinux模式为enforcing setenforce 0 # 设定selinux模式为permissive # 注：当前SElinux为Disabled状态时，setenforce会执行失败，并警告：setenforce: SELinux is disabled 修改/etc/sysconfig/se