# 查看SELinux状态
$ sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

# 查看当前模式
$ getenforce
Enforcing

# 临时设置模式
$ sudo setenforce 0 # Permissive
$ sudo setenforce 1 # Enforcing

# 永久设置模式
$ sudo sed -i ‘s/SELINUX=.*/SELINUX=enforcing/’ /etc/selinux/config

# SELinux模式说明
1. Enforcfrom PG视频:www.itpux.coming：强制模式，阻止违规操作
2. Permissive：宽容模式，记录但不阻止
3. Disabled：禁用模式，不启用SELinux

# 查看SELinux布尔值
$ getsebool -a | grep http
httpd_can_network_connect –> off
httpd_can_network_connect_db –> off
httpd_can_sendmail –> off
httpd_enable_cgi –> on
httpd_enable_homedirs –> off
httpd_unified –> off

# 设置SELinux布尔值
$ sudo setsebool -P httpd_can_network_connect on

# 查看SELinux上下文
$ ls -Z /var/www/html
unconfined_u:object_r:httpd_sys_content_t:s0 index.html

$ ps -Z | grep httpd
system_u:system_r:httpd_t:s0 1234 ? 00:00:00 httpd

# 查看端口上下文
$ sudo semanage port -l | grep http
http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
http_port_t tcp 学习交流加群风哥QQ113257174 80, 81, 443, 488, 8008, 8009, 8443, 9000

# 查看文件上下文
$ ls -Z /var/www/html/index.html
unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/index.html

# 上下文格式
user:role:type:level

# 修改文件上下文
$ sudo chcon -t httpd_sys_content_t /var/www/html/index.html
$ sudo chcon -R -t httpd_sys_content_t /var/www/html/

# 恢复默认上下文
$ sudo restorecon -v /var/www/html/index.html
$ sudo restorecon -R -v /var/www/html/

# 查看上下文规则
$ sudo semanage fcontext -l | grep httpd
/var/www(/.*)? all files system_u:object_r:httpd_sys_content_t:s0
/var/www/html(/.*)? all files system_u:object_r:httpd_sys_content_t:s0
/var/www/cgi-bin(/.*)? all files system_u:object_r:httpd_sys_script_exec_t:s0

# 添加上下文规则
$ sudo semanage fcontext -a -t httpd_sys_content_t “/webapp(/.*)?”
$ sudo restorecon -R -v /webapp

# 修改上下文规则
$ sudo semanage fcontext -m -t httpd_sys_content_t “/webapp(/.*)?”

# 删除上下文规则
$ sudo semanage fcontext -d “/webapp(/.*)?”

# 查看进程上下文
$ ps -eZ | grep httpd
system_u:system_r:httpd_t:s0 1234 ? 00:00:00 httpd
system_u:system_r:httpd_t:s0 1235 ? 00:00:00 httpd

# 查看用户上下文
$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

# 映射Linux用户到SELinux用户
$ sudo semanage login -a -s staff_u user1
$ sudo semanage login -l
Login Name SELinux User MLS/MCS Range Service

__default__ unconfined_u s0-s0:c0.c1023 *
root unconfined_u s0-s0:c0.c1023 *
user1 staff_u s0-s0:c0.c1023 *

# 查看策略模块
$ sudo semodule -l | grep httpd
httpd
httpd_can_network_connect_db
httpd_enable_cgi
httpd_unified

# 安装策略模块
$ sudo semodule -i mymodule.pp

# 移除策略模块
$ sudo semodule -r mymodule

# 创建自定义策略模块
$ sudo ausearch -c ‘httpd’ –raw | audit2allow -M myhttpd
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i myhttpd.pp

# 查看策略规则
$ sudo sesearch –allow -s httpd_t -t httpd_sys_content_t
Found 1 semantic av rules:
allow httpd_t httpd_sys_content_t : file { ioctl read getattr lock open } ;

# 查看所有允许规则
$ sudo sesearch –allow -s httpd_t | head -20

# 查看拒绝日志
$ sudo ausearch -m AVC -ts recent
—-
time->Fri Apr 4 02:45:00 2026
type=AVC msg=audit(1712205900.123:456): avc: denied { read } for pid=1234 comm=”httpd” name=”index.html” dev=”sda1″ ino=12345 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0

# 分析拒绝日志
$ sudo ausearch -m AVC -ts recent | audit2allow -w

# 生成策略模块
$ sudo ausearch -m AVC -ts recent | audit2allow -M mypolicy
$ sudo semodule -i mypolicy.pp

# 查看端口策略
$ sudo semanage port -l | grep -w 8080
http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000

# 添加端口策略
$ sudo semanage port -a -t http_port_t -p tcp 8080

# 修改端口策略
$ sudo semanage port -m -t http_port_t -p tcp 8080

# 删除端口策略
$ sudo semanage port -d -t http_port_t -p tcp 8080

# 安装故障排查工具
$ sudo dnf install -y setroubleshoot-server

# 查看SELinux拒绝
$ sudo sealert -a /var/log/audit/audit.log

# 查看详细建议
$ sudo sealert -l 12345678-1234-1234-1234-123456789012

# 手动排查步骤
1. 查看拒绝日志
$ sudo ausearch -m AVC -ts recent

2. 分析拒绝原因
$ sudo ausearch -m AVC -ts recent | audit2allow -w

3. 检查文件上下文
$ ls -Z /path/to/file

4. 恢复正确上下文
$ sudo restorecon -v /path/to/file

5. 检查布尔值
$ getsebool -a | grep service

6. 设置正确布尔值
$ sudo setsebool -P boolean_name on

7. 创建自定义策略
$ sudo ausearch -c ‘process’ –raw | audit2allow -M mypolicy
$ sudo semodule -i mypolicy.pp

# 常见问题解决
1. Web服务器无法访问文件
$ sudo restorecon -R -v /var/www/html
$ sudo setsebool -P httpd_can_network_connect on

2. 服务无法绑定端口
$ sudo semanage port -a -t service_port_t -p tcp 8080

3. 服务无法访问网络
$ sudo setsebool -P service_can_network_connect on

4. 服务无法执行脚本
$ sudo setsebool -P httpd_enable_cgi on
$ sudo chcon -t httpd_sys_script_exec_t /v学习交流加群风哥微信: itpux-comar/www/cgi-bin/script.cgi

# 查看所有布尔值说明
$ sudo semanage boolean -l | grep httpd
httpd_can_network_connect (on , on) Allow httpd to can network connect
httpd_can_network_connect_db (off , off) Allow httpd to can network connect db
httpd_can_sendmail (off , off) Allow httpd to can sendmail
httpd_enable_cgi (on , on) Allow httpd to enable cgi