Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию, Страница: 794 / 848

Chapter 45. Working With SELinux
768
togglesebool boolean ...
This command toggles the setting of one or more booleans. This effects boolean settings in
memory only; changes are not persistent across reboots.
45.2.13. Changing to a Different Role
You use the
newrole
command to run a new shell with the specified type and/or role. Changing roles
is typically only meaningful in the strict policy; the targeted policy is generally restricted to a single role.
Changing types may be useful for testing, validation, and development purposes.
newrole -r <role_r> -t <type_t> [-- [ARGS]...]
The
ARGS
are passed directly to the shell specified in the user's entry in the
/etc/passwd
file.
Note
The
newrole
command is part of the
policycoreutils-newrole
package, which
is required if you install the strict or MLS policy. It is not installed by default in Red Hat
Enterprise Linux.
45.2.14. When to Reboot
The primary reason for rebooting the system from an SELinux perspective is to completely relabel the
file system. On occasion you might need to reboot the system to enable or disable SELinux.
45.3. Analyst Control of SELinux
This section describes some common tasks that a security analyst might need to perform on an
SELinux system.
45.3.1. Enabling Kernel Auditing
As part of an SELinux analysis or troubleshooting exercise, you might choose to enable complete
kernel-level auditing. This can be quite verbose, because it generates one or more additional audit
messages for each AVC audit message. To enable this level of auditing, append the
audit=1
parameter to your kernel boot line, either in the
/etc/grub.conf
file or on the GRUB menu at boot
time.
This is an example of a full audit log entry when
httpd
is denied access to
~/public_html
because
the directory is not labeled as Web content. Notice that the time and serial number stamps in the
audit(...) field are identical in each case. This makes it easier to track a specific event in the audit logs:
Jan 15 08:03:56 hostname kernel: audit(1105805036.075:2392892): \
avc: denied { getattr } for pid=2239 exe=/usr/sbin/httpd \
path=/home/auser/public_html dev=hdb2 ino=921135 \
scontext=user_u:system_r:httpd_t \
tcontext=system_u:object_r:user_home_t tclass=dir
The following audit message tells more about the source, including the kind of system call involved,
showing that httpd tried to stat the directory: