我是 CentOS 新手,尝试启用 SELinux,但重启后它不起作用,如所述https://www.digitalocean.com/community/tutorials/an-introduction-to-selinux-on-centos-7-part-1-basic-concepts。
每次重启后我收到的唯一错误消息是:
master:~# cat /var/log/messages | grep "SELinux"
Jul 14 22:11:48 master kernel: SELinux: Disabled at boot.
据 Google 所知,这意味着我的配置文件中有 SELINUX=0 / SELINUX=disabled。但我的配置文件应该是正确的:
master:~# cat /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of three two values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
我发现奇怪的是所描述的 /etc/sysconfig/selinux 符号链接不存在,所以它创建了指向 /etc/selinux/config 的符号链接:
master:~# ls -l /etc/sysconfig/ | grep selinux
lrwxrwxrwx 1 root root 19 Jul 14 22:18 selinux -> /etc/selinux/config
系统详细信息:全新安装的最低限度 CentOS 7,包含最新更新:
master:~# uname -a
Linux master 3.10.0-229.el7.x86_64 #1 SMP Fri Mar 6 11:36:42 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
我还安装了上面链接中描述的软件包:
yum install policycoreutils policycoreutils-python selinux-policy selinux-policy-targeted libselinux-utils setroubleshoot-server setools setools-console mcstrans
知道如何调试吗?除了更改配置文件并重新启动之外,我找不到任何其他启用 SELinux 的方法,这可能是哪里出了问题?内核模块是否丢失了?
编辑:
罪魁祸首:
master:~# cat /etc/sysconfig/grub
GRUB_TIMEOUT=5
GRUB_DEFAULT=""
GRUB_DISABLE_SUBMENU=true
GRUB_TERMINAL_OUTPUT="console"
GRUB_CMDLINE_LINUX="rootflags=uquota,gquota acpi=ht crashkernel=auto selinux=0 nodmraid rhgb quiet"
GRUB_DISABLE_RECOVERY="true"
答案1
有人在您的内核命令行上插入了 SELinux,导致其被禁用selinux=0
。
要解决此问题,请从 中删除此内容/etc/sysconfig/grub
,重新生成 grub 配置,然后重新启动。
你还应该向制作这张图片的人投诉,因为这是一个非常恶劣的伎俩……