☰

SELinux：如何显示某种类型的所有允许规则？

tag-icon • tag-icon redhat selinux
SELinux：如何显示某种类型的所有允许规则？

对于任意对象类型，例如user_tmp_t，我想知道哪些进程被允许访问此标签。如何找到所有引用的允许规则user_tmp_t？

答案1

你不能直接地找到可以转换为给定类型的过程，但您可以间接地进行。

现在该熟悉一下这个sesearch工具了。这个工具可以让你以多种方式查询 SELinux 策略。

在这里，我们将看到哪些类型可以转换为该user_tmp_t类型。其中将包括您感兴趣的流程的类型。如您所见，这也为您提供了一些提示什么该流程将被允许执行。

# sesearch -T -t user_tmp_t
Found 44 semantic te rules:
   type_transition staff_sudo_t user_tmp_t : process staff_t; 
   type_transition auditadm_sudo_t user_tmp_t : process auditadm_t; 
   type_transition thumb_t user_tmp_t : file thumb_tmp_t; 
   type_transition thumb_t user_tmp_t : dir thumb_tmp_t; 
   type_transition thumb_t user_tmp_t : sock_file thumb_tmp_t; 
   type_transition mozilla_plugin_t user_tmp_t : file mozilla_plugin_tmp_t; 
   type_transition telepathy_msn_t user_tmp_t : file telepathy_msn_tmp_t; 
   type_transition mozilla_plugin_t user_tmp_t : dir mozilla_plugin_tmp_t; 
   type_transition telepathy_msn_t user_tmp_t : dir telepathy_msn_tmp_t; 
   type_transition mozilla_plugin_t user_tmp_t : sock_file mozilla_plugin_tmp_t; 
   type_transition telepathy_msn_t user_tmp_t : sock_file telepathy_msn_tmp_t; 
   type_transition mozilla_plugin_t user_tmp_t : fifo_file mozilla_plugin_tmp_t; 
   type_transition alsa_t user_tmp_t : file alsa_tmp_t; 
   type_transition staff_gkeyringd_t user_tmp_t : dir gkeyringd_tmp_t; 
   type_transition user_gkeyringd_t user_tmp_t : dir gkeyringd_tmp_t; 
   type_transition alsa_t user_tmp_t : dir alsa_tmp_t; 
   type_transition staff_gkeyringd_t user_tmp_t : sock_file gkeyringd_tmp_t; 
   type_transition user_gkeyringd_t user_tmp_t : sock_file gkeyringd_tmp_t; 
   type_transition dbadm_sudo_t user_tmp_t : process dbadm_t; 
   type_transition secadm_sudo_t user_tmp_t : process secadm_t; 
   type_transition gpg_pinentry_t user_tmp_t : sock_file gpg_pinentry_tmp_t; 
   type_transition mozilla_plugin_config_t user_tmp_t : file mozilla_plugin_tmp_t; 
   type_transition mozilla_plugin_config_t user_tmp_t : dir mozilla_plugin_tmp_t; 
   type_transition sysadm_sudo_t user_tmp_t : process sysadm_t; 
   type_transition virt_qemu_ga_unconfined_t user_tmp_t : file svirt_tmp_t; 
   type_transition svirt_t user_tmp_t : file svirt_tmp_t; 
   type_transition virt_qemu_ga_unconfined_t user_tmp_t : dir svirt_tmp_t; 
   type_transition secadm_gkeyringd_t user_tmp_t : dir gkeyringd_tmp_t; 
   type_transition httpd_t user_tmp_t : dir httpd_tmp_t; 
   type_transition svirt_t user_tmp_t : dir svirt_tmp_t; 
   type_transition virt_qemu_ga_unconfined_t user_tmp_t : lnk_file svirt_tmp_t; 
   type_transition svirt_t user_tmp_t : lnk_file svirt_tmp_t; 
   type_transition secadm_gkeyringd_t user_tmp_t : sock_file gkeyringd_tmp_t; 
   type_transition svirt_tcg_t user_tmp_t : file svirt_tmp_t; 
   type_transition svirt_tcg_t user_tmp_t : dir svirt_tmp_t; 
   type_transition auditadm_gkeyringd_t user_tmp_t : dir gkeyringd_tmp_t; 
   type_transition xguest_gkeyringd_t user_tmp_t : dir gkeyringd_tmp_t; 
   type_transition svirt_tcg_t user_tmp_t : lnk_file svirt_tmp_t; 
   type_transition auditadm_gkeyringd_t user_tmp_t : sock_file gkeyringd_tmp_t; 
   type_transition xguest_gkeyringd_t user_tmp_t : sock_file gkeyringd_tmp_t; 
   type_transition chrome_sandbox_t user_tmp_t : file chrome_sandbox_tmp_t; 
   type_transition chrome_sandbox_t user_tmp_t : dir chrome_sandbox_tmp_t; 
   type_transition gconfd_t user_tmp_t : file gconf_tmp_t; 
   type_transition gconfd_t user_tmp_t : dir gconf_tmp_t; 

Found 298 named file transition filename_trans:
----(omitted)----

相关内容