Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:centos:8:avance:l115 [2024/10/01 07:53] – admin | elearning:workbooks:centos:8:avance:l115 [2024/11/08 12:39] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | Version : **2021.01** | + | Version : **2024.01** |
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LRF607 | + | ======LCF607 |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LRF607 | + | * **LCF607 |
| * Contenu du Module | * Contenu du Module | ||
| - | * System Hardening Manuel | + | * Rôle du noyau |
| - | * Les compilateurs | + | * LAB #1 - Modules |
| - | * Les paquets | + | * LAB #2 - Compilation |
| - | * Les démons | + | * 2.1 - Déplacer /home |
| - | * Les fichiers | + | * 2.2 - Préparer l'Environnement |
| - | * Les fichiers et les repertoires sans proprietaire | + | * 2.3 - Préparer l'Arborescence Source du Noyau |
| - | * Interdire les connexions de root via le réseau | + | * Le Fichier .config |
| - | * Limiter le delai d'inactivite d'une session shell | + | * Le Fichier Makefile |
| - | * Renforcer la securite d'init | + | * 2.4 - Paramétrage |
| - | * Les Distributions SysVInit | + | * 2.5 - Compiler le Noyau |
| - | * Les Distributions Upstart | + | * 2.6 - Installer |
| - | * Renforcer la sécurité | + | * LAB #3 - Gestion |
| - | * La commande sysctl | + | * 3.1 - La Commande quotacheck |
| - | * LAB #1 - System Hardening à l'aide de l' | + | * 3.2 - La Commande edquota |
| - | * Présentation | + | * 3.3 - La Commande quotaon |
| - | * Installation | + | * 3.4 - La Commande repquota |
| - | * Utilisation | + | * 3.5 - La Commande quota |
| - | * LAB #2 - Mise en place de SELinux pour sécuriser | + | * 3.6 - La Commande warnquota |
| - | * Introducton | + | |
| - | * Définitions | + | |
| - | * Security Context | + | |
| - | * Domains et Types | + | |
| - | * Roles | + | |
| - | * Politiques de Sécurité | + | |
| - | * Langage de Politiques | + | |
| - | * allow | + | |
| - | * type | + | |
| - | * type_transition | + | |
| - | * Décisions de SELinux | + | |
| - | * Décisions d' | + | |
| - | * Décisions de Transition | + | |
| - | * Commandes SELinux | + | |
| - | * Les Etats de SELinux | + | |
| - | * Booléens | + | |
| - | * LAB #3 - Travailler avec SELinux | + | |
| - | * Copier et Déplacer | + | |
| - | * Vérifier les SC des Processus | + | |
| - | * Visualiser la SC d'un Utilisateur | + | |
| - | * Vérifier la SC d'un fichier | + | |
| - | * Troubleshooting SELinux | + | |
| - | * La commande chcon | + | |
| - | * La commande restorecon | + | |
| - | * Le fichier /.autorelabel | + | |
| - | * La commande semanage | + | |
| - | * La commande audit2allow | + | |
| - | =====System Hardening Manuel===== | + | =====Rôle du noyau===== |
| - | ====Les compilateurs==== | + | Le noyau ou //kernel// est la partie du système d' |
| - | Afin d'empêcher un pirate | + | * la diminution de la taille du noyau, |
| + | * la prise en charge de nouveau matériel, | ||
| + | * l'ajout de fonctionnalités, | ||
| + | * l' | ||
| + | * la correction de bogues, | ||
| + | * le besoin d'une fonctionnalité expérimentale. | ||
| + | |||
| + | Commencez par mettre à jour CentOS 8 : | ||
| - | ====Les paquets==== | + | < |
| + | [root@centos8 ~]# dnf update | ||
| + | ... | ||
| + | [root@centos8 ~]# reboot | ||
| + | </ | ||
| - | Il convient dans ce cas de passer en revue la liste des paquets installes puis de supprimer ceux qui sont juges être inutiles | + | Identifiez ensuite le noyau utilisé par votre machine virtuelle |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | libtalloc-2.1.9-1.el7.x86_64 | + | 4.18.0-305.7.1.el8_4.x86_64 |
| - | gnome-contacts-3.22.1-1.el7.x86_64 | + | |
| - | lrzsz-0.12.20-36.el7.x86_64 | + | |
| - | NetworkManager-team-1.8.0-11.el7_4.x86_64 | + | |
| - | opus-1.0.2-6.el7.x86_64 | + | |
| - | libsss_certmap-1.15.2-50.el7_4.11.x86_64 | + | |
| - | m17n-db-1.6.4-3.el7.noarch | + | |
| - | expat-2.1.0-10.el7_3.x86_64 | + | |
| - | gvfs-mtp-1.30.4-3.el7.x86_64 | + | |
| - | hypervfcopyd-0-0.30.20161211git.el7.x86_64 | + | |
| - | perl-parent-0.225-244.el7.noarch | + | |
| - | libreport-centos-2.1.11-38.el7.centos.x86_64 | + | |
| - | pixman-0.34.0-1.el7.x86_64 | + | |
| - | alsa-plugins-pulseaudio-1.1.1-1.el7.x86_64 | + | |
| - | libreoffice-graphicfilter-5.0.6.2-15.el7_4.x86_64 | + | |
| - | libreport-rhel-anaconda-bugzilla-2.1.11-38.el7.centos.x86_64 | + | |
| - | libXext-1.3.3-3.el7.x86_64 | + | |
| - | libtool-ltdl-2.4.2-22.el7_3.x86_64 | + | |
| - | NetworkManager-ppp-1.8.0-11.el7_4.x86_64 | + | |
| - | osinfo-db-20170423-2.el7.noarch | + | |
| - | fftw-libs-double-3.3.3-8.el7.x86_64 | + | |
| - | kernel-tools-libs-3.10.0-693.21.1.el7.x86_64 | + | |
| - | e2fsprogs-libs-1.42.9-10.el7.x86_64 | + | |
| - | --More-- | + | |
| </ | </ | ||
| - | ====Les démons et services==== | + | =====LAB #1 - Modules===== |
| - | Il convient dans ce cas de passer en revue la liste des démons et services actives puis de supprimer ceux qui sont juges être inutiles; | + | Dans le cas d'une utilisation courante |
| - | + | ||
| - | * ps aux | + | |
| - | | + | |
| - | | + | |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND | + | bls.conf |
| - | root | + | build modules.builtin.bin modules.order updates |
| - | ched-root --system --deserialize 21 | + | config |
| - | root | + | kernel |
| - | root | + | modules.alias modules.devname |
| - | root | + | modules.alias.bin modules.drm source |
| - | root | + | modules.block modules.modesetting |
| - | root | + | |
| - | root | + | |
| - | root | + | |
| - | root 10 0.0 0.0 0 0 ? S 14:58 0:00 [watchdog/ | + | |
| - | root 12 0.0 0.0 0 0 ? S 14:58 0:00 [kdevtmpfs] | + | |
| - | root 13 0.0 0.0 0 0 ? S< | + | |
| - | root 14 0.0 0.0 0 0 ? S 14:58 0:00 [khungtaskd] | + | |
| - | root 15 0.0 0.0 0 0 ? S< | + | |
| - | root 16 0.0 0.0 0 0 ? S< | + | |
| - | root 17 0.0 0.0 0 0 ? S< | + | |
| - | root 18 0.0 0.0 0 0 ? S< | + | |
| - | root 19 0.0 0.0 0 0 ? S< | + | |
| - | root 25 0.0 0.0 0 0 ? S 14:58 0:03 [kswapd0] | + | |
| - | root 26 0.0 0.0 0 0 ? SN | + | |
| - | root 27 0.0 0.0 0 0 ? S< | + | |
| - | root 35 0.0 0.0 0 0 ? S< | + | |
| - | --More-- | + | |
| </ | </ | ||
| - | < | + | Les commandes pour manipuler les modules sont : |
| - | [root@centos7 ~]# chkconfig --list | + | |
| - | Note: This output shows SysV services only and does not include native | + | * insmod |
| - | | + | * rmmod |
| - | | + | * lsmod |
| + | * modprobe | ||
| - | If you want to list systemd services use ' | + | Par exemple : |
| - | To see services enabled on particular target use | + | |
| - | ' | + | |
| - | livesys | + | < |
| - | livesys-late | + | [root@centos8 ~]# lsmod |
| - | netconsole | + | Module |
| - | network | + | xt_CHECKSUM |
| - | snortd | + | ipt_MASQUERADE |
| + | xt_conntrack | ||
| + | ipt_REJECT | ||
| + | nft_compat | ||
| + | nf_nat_tftp | ||
| + | nft_objref | ||
| + | nf_conntrack_tftp | ||
| + | nft_counter | ||
| + | tun 53248 1 | ||
| + | bridge | ||
| + | stp 16384 | ||
| + | llc 16384 | ||
| + | nft_fib_inet | ||
| + | nft_fib_ipv4 | ||
| + | nft_fib_ipv6 | ||
| + | nft_fib | ||
| + | nft_reject_inet | ||
| + | nf_reject_ipv4 | ||
| + | nf_reject_ipv6 | ||
| + | nft_reject | ||
| + | nft_ct | ||
| + | nf_tables_set | ||
| + | nft_chain_nat | ||
| + | nf_nat | ||
| + | nf_conntrack | ||
| + | nf_defrag_ipv6 | ||
| + | nf_defrag_ipv4 | ||
| + | ip_set | ||
| + | nf_tables | ||
| + | nfnetlink | ||
| + | sunrpc | ||
| + | ext4 761856 | ||
| + | mbcache | ||
| + | jbd2 131072 | ||
| + | virtio_balloon | ||
| + | pcspkr | ||
| + | i2c_piix4 | ||
| + | joydev | ||
| + | ip_tables | ||
| + | xfs 1515520 | ||
| + | libcrc32c | ||
| + | sr_mod | ||
| + | sd_mod | ||
| + | cdrom 65536 | ||
| + | t10_pi | ||
| + | sg | ||
| + | ata_generic | ||
| + | bochs_drm | ||
| + | drm_vram_helper | ||
| + | drm_kms_helper | ||
| + | syscopyarea | ||
| + | sysfillrect | ||
| + | sysimgblt | ||
| + | fb_sys_fops | ||
| + | drm_ttm_helper | ||
| + | ttm | ||
| + | drm | ||
| + | ahci | ||
| + | libahci | ||
| + | virtio_net | ||
| + | net_failover | ||
| + | ata_piix | ||
| + | serio_raw | ||
| + | failover | ||
| + | libata | ||
| + | dm_mirror | ||
| + | dm_region_hash | ||
| + | dm_log | ||
| + | dm_mod | ||
| + | fuse 151552 | ||
| </ | </ | ||
| + | |||
| + | Pour ajouter un module, on peut utiliser la commande **insmod** ou **modprobe**. Cette dernière ajoute non seulement le module passé en argument mais également ses dépendances : | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | UNIT FILE | + | [root@centos8 ~]# lsmod | more |
| - | proc-sys-fs-binfmt_misc.automount | + | Module |
| - | dev-hugepages.mount | + | bonding |
| - | dev-mqueue.mount | + | xt_CHECKSUM |
| - | proc-fs-nfsd.mount | + | ipt_MASQUERADE |
| - | proc-sys-fs-binfmt_misc.mount | + | xt_conntrack |
| - | sys-fs-fuse-connections.mount | + | ipt_REJECT |
| - | sys-kernel-config.mount | + | nft_compat |
| - | sys-kernel-debug.mount | + | nf_nat_tftp |
| - | tmp.mount | + | nft_objref |
| - | var-lib-nfs-rpc_pipefs.mount | + | nf_conntrack_tftp |
| - | brandbot.path | + | nft_counter |
| - | cups.path | + | tun 53248 1 |
| - | systemd-ask-password-console.path | + | bridge |
| - | systemd-ask-password-plymouth.path | + | stp 16384 1 bridge |
| - | systemd-ask-password-wall.path | + | llc 16384 2 bridge, |
| - | session-33.scope | + | nft_fib_inet |
| - | abrt-ccpp.service | + | nft_fib_ipv4 |
| - | abrt-oops.service | + | nft_fib_ipv6 |
| - | abrt-pstoreoops.service | + | nft_fib |
| - | abrt-vmcore.service | + | nft_reject_inet |
| - | abrt-xorg.service | + | nf_reject_ipv4 |
| - | abrtd.service | + | nf_reject_ipv6 |
| - | lines 1-23 | + | --More-- |
| </ | </ | ||
| - | ====Les fichiers | + | Pour supprimer un module, on peut utiliser la commande **rmmod** ou **modprobe -r**. Cette dernière essaie de supprimer les dépendances non-utilisées : |
| - | Le systeme rhosts presente une faille de securite importante pour un serveur Linux. Pour cette raison, il convient de supprimer les fichiers **.rhosts** des utilisateurs. Utilisez la commande suivante: | + | < |
| + | [root@centos8 ~]# modprobe -r bonding | ||
| + | [root@centos8 ~]# lsmod | more | ||
| + | Module | ||
| + | xt_CHECKSUM | ||
| + | ipt_MASQUERADE | ||
| + | xt_conntrack | ||
| + | ipt_REJECT | ||
| + | nft_compat | ||
| + | nf_nat_tftp | ||
| + | nft_objref | ||
| + | nf_conntrack_tftp | ||
| + | nft_counter | ||
| + | tun 53248 1 | ||
| + | bridge | ||
| + | stp 16384 1 bridge | ||
| + | llc 16384 2 bridge,stp | ||
| + | nft_fib_inet | ||
| + | nft_fib_ipv4 | ||
| + | nft_fib_ipv6 | ||
| + | nft_fib | ||
| + | nft_reject_inet | ||
| + | nf_reject_ipv4 | ||
| + | nf_reject_ipv6 | ||
| + | nft_reject | ||
| + | --More-- | ||
| + | </ | ||
| - | # find / -name " | + | Les dépendances des modules sont résolues par la commande **modprobe** grâce aux fichier **/lib/ |
| - | ====Les fichiers et les repertoires sans proprietaire==== | + | < |
| + | [root@centos8 ~]# more / | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | xz kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | kernel/ | ||
| + | _64.ko.xz | ||
| + | kernel/ | ||
| + | --More--(0%) | ||
| + | </ | ||
| - | Afin de dresser la liste des fichiers et des groupes sans proprietaires sur le serveur, il convient | + | Il est possible |
| - | + | ||
| - | # find / -nouser -exec ls -l \{\} \; 2> sans_pro.txt [Entree] | + | |
| - | + | ||
| - | # find / -nogroup -exec ls -l \{\} \; 2>> sans_pro.txt[Entree] | + | |
| - | + | ||
| - | Ces commandes produiront une liste éventuelle dans le fichier **sans_pro.txt**. | + | |
| - | + | ||
| - | L' | + | |
| - | + | ||
| - | * modifier le propriétaire a root | + | |
| - | * modifier le groupe a root | + | |
| - | * modifier les permissions a 700 | + | |
| - | + | ||
| - | ====Interdire les connexions de root via le reseau==== | + | |
| - | + | ||
| - | Le fichier de configuration des connexions de root est **/ | + | |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | console | + | filename: |
| - | vc/1 | + | author: |
| - | vc/2 | + | description: |
| - | vc/3 | + | license: |
| - | vc/4 | + | alias: |
| - | vc/5 | + | rhelversion: |
| - | vc/6 | + | srcversion: |
| - | vc/7 | + | depends: |
| - | vc/8 | + | intree: |
| - | vc/9 | + | name: |
| - | vc/10 | + | vermagic: |
| - | vc/11 | + | sig_id: |
| - | tty1 | + | signer: |
| - | tty2 | + | sig_key: |
| - | tty3 | + | sig_hashalgo: |
| - | tty4 | + | signature: |
| - | tty5 | + | |
| - | tty6 | + | 3F: |
| - | tty7 | + | BE: |
| - | tty8 | + | 44: |
| - | tty9 | + | DE: |
| - | tty10 | + | |
| - | tty11 | + | |
| - | ttyS0 | + | |
| - | ttysclp0 | + | |
| - | sclp_line0 | + | |
| - | 3270/tty1 | + | |
| - | hvc0 | + | |
| - | hvc1 | + | |
| - | hvc2 | + | |
| - | hvc3 | + | |
| - | hvc4 | + | |
| - | hvc5 | + | |
| - | hvc6 | + | |
| - | hvc7 | + | |
| - | hvsi0 | + | parm: |
| - | hvsi1 | + | parm: |
| - | hvsi2 | + | parm: |
| - | xvc0 | + | parm: |
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| + | parm: | ||
| </ | </ | ||
| - | Afin d' | + | Dernièrement, les fichiers dans le repertoire |
| - | + | ||
| - | ====Limiter | + | |
| - | + | ||
| - | Une session de shell laissee ouverte inutilement et d'une maniere sans surveillance est un risque de securite. Verifiez donc le contenu du fichier | + | |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | # / | + | firewalld-sysctls.conf |
| + | kvm.conf | ||
| - | # System wide environment and startup programs, for login setup | + | [root@centos8 ~]# cat /etc/modprobe.d/ |
| - | # Functions and aliases go in /etc/bashrc | + | # Setting modprobe kvm_intel/ |
| - | + | # only enables Nested Virtualization until the next reboot or | |
| - | # It's NOT a good idea to change this file unless you know what you | + | # module reload. Uncomment the option applicable |
| - | # are doing. It's much better to create a custom.sh shell script in | + | # to your system below to enable |
| - | # / | + | # |
| - | # will prevent | + | # User changes in this file are preserved across upgrades. |
| - | + | # | |
| - | pathmunge () { | + | # For Intel |
| - | case ": | + | #options kvm_intel nested=1 |
| - | *:" | + | # |
| - | ;; | + | # For AMD |
| - | *) | + | #options kvm_amd nested=1 |
| - | if [ " | + | |
| - | PATH=$PATH: | + | |
| - | else | + | |
| - | PATH=$1: | + | |
| - | fi | + | |
| - | esac | + | |
| - | } | + | |
| - | + | ||
| - | + | ||
| - | if [ -x /usr/bin/id ]; then | + | |
| - | if [ -z " | + | |
| - | | + | |
| - | EUID=`/ | + | |
| - | UID=`/ | + | |
| - | fi | + | |
| - | USER=" | + | |
| - | LOGNAME=$USER | + | |
| - | MAIL="/ | + | |
| - | fi | + | |
| - | + | ||
| - | # Path manipulation | + | |
| - | if [ " | + | |
| - | pathmunge /usr/sbin | + | |
| - | pathmunge / | + | |
| - | else | + | |
| - | pathmunge / | + | |
| - | pathmunge /usr/sbin after | + | |
| - | fi | + | |
| - | + | ||
| - | HOSTNAME=`/ | + | |
| - | HISTSIZE=1000 | + | |
| - | if [ " | + | |
| - | export HISTCONTROL=ignoreboth | + | |
| - | else | + | |
| - | export HISTCONTROL=ignoredups | + | |
| - | fi | + | |
| - | + | ||
| - | export PATH USER LOGNAME MAIL HOSTNAME HISTSIZE HISTCONTROL | + | |
| - | + | ||
| - | # By default, we want umask to get set. This sets it for login shell | + | |
| - | # Current threshold for system reserved uid/gids is 200 | + | |
| - | # You could check uidgid reservation validity in | + | |
| - | # / | + | |
| - | if [ $UID -gt 199 ] && [ " | + | |
| - | umask 002 | + | |
| - | else | + | |
| - | umask 022 | + | |
| - | fi | + | |
| - | + | ||
| - | for i in / | + | |
| - | if [ -r " | + | |
| - | if [ "${-#*i}" != " | + | |
| - | . " | + | |
| - | else | + | |
| - | . " | + | |
| - | fi | + | |
| - | fi | + | |
| - | done | + | |
| - | + | ||
| - | unset i | + | |
| - | unset -f pathmunge | + | |
| </ | </ | ||
| - | A ce fichier doivent etre ajoutées les deux lignes suivantes: | + | =====LAB #2 - Compilation et installation du noyau et des modules===== |
| - | < | + | Activez |
| - | Readonly TMOUT=300 | + | |
| - | Export TMOUT | + | |
| - | </ | + | |
| - | + | ||
| - | Par cette action, vous définissez | + | |
| - | + | ||
| - | Dernièrement, | + | |
| - | + | ||
| - | ====Renforcer la securite d' | + | |
| - | + | ||
| - | ===Les Distributions SysVInit=== | + | |
| - | + | ||
| - | Le fichier **/ | + | |
| - | + | ||
| - | La première modification à effectuer est de spécifier le niveau d’exécution par défaut a 3 au lieu de 5. Ceci permet de ne pas lancer les sessions graphiques sur une serveur de production. Cherchez donc la ligne suivante: | + | |
| - | + | ||
| - | < | + | |
| - | id: | + | |
| - | </ | + | |
| - | + | ||
| - | Modifiez-la en: | + | |
| - | + | ||
| - | < | + | |
| - | id: | + | |
| - | </ | + | |
| - | + | ||
| - | Le mode **single user** de démarrage de Linux n'est pas habituellement protégé par un mot de passe. Afin de remédier a cela, ajoutez les lignes suivantes: | + | |
| - | + | ||
| - | < | + | |
| - | # Single user mode | + | |
| - | ~~: | + | |
| - | </ | + | |
| - | + | ||
| - | Dernièrement, | + | |
| - | + | ||
| - | < | + | |
| - | # ca:: | + | |
| - | </ | + | |
| - | + | ||
| - | ===Les Distributions Upstart=== | + | |
| - | + | ||
| - | Afin d' | + | |
| - | + | ||
| - | < | + | |
| - | exec / | + | |
| - | </ | + | |
| - | + | ||
| - | en | + | |
| - | + | ||
| - | < | + | |
| - | #exec / | + | |
| - | </ | + | |
| - | + | ||
| - | ====Renforcer la sécurité du Noyau==== | + | |
| - | + | ||
| - | ===La commande sysctl=== | + | |
| - | + | ||
| - | Les fichiers dans le répertoire | + | |
| - | + | ||
| - | La commande **sysctl** applique les règles consignés dans le fichier **/ | + | |
| - | + | ||
| - | Saisissez la commande | + | |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | # System default settings live in /usr/lib/sysctl.d/00-system.conf. | + | [root@centos8 ~]# cat /etc/yum.repos.d/CentOS-Stream-PowerTools.repo |
| - | # To override those settings, enter new settings here, or in an / | + | # CentOS-PowerTools.repo |
| + | # | ||
| + | # The mirror | ||
| + | # update status of each mirror to pick mirrors that are updated to and | ||
| + | # geographically close to the client. You should use this for CentOS updates | ||
| + | # unless you are manually picking other mirrors. | ||
| + | # | ||
| + | # If the ### | ||
| + | # remarked out baseurl= line instead. | ||
| # | # | ||
| - | # For more information, | ||
| - | |||
| - | [root@centos7 ~]# cat / | ||
| - | # Kernel sysctl configuration file | ||
| # | # | ||
| - | # For binary values, 0 is disabled, 1 is enabled. | ||
| - | # sysctl.conf(5) for more details. | ||
| - | # Disable netfilter on bridges. | + | [Stream-PowerTools] |
| - | net.bridge.bridge-nf-call-ip6tables = 0 | + | name=CentOS-Stream |
| - | net.bridge.bridge-nf-call-iptables | + | ###mirrorlist=http: |
| - | net.bridge.bridge-nf-call-arptables = 0 | + | baseurl=http://vault.centos.org/$contentdir/$stream/PowerTools/$basearch/os/ |
| - | + | gpgcheck=1 | |
| - | # Controls the maximum shared segment size, in bytes | + | enabled=1 |
| - | kernel.shmmax = 4294967295 | + | gpgkey=file: |
| - | + | ||
| - | # Controls the maximum number of shared memory segments, in pages | + | |
| - | + | ||
| - | [root@centos7 ~]# ls -l /etc/sysctl.d/ | + | |
| - | total 0 | + | |
| - | lrwxrwxrwx. 1 root root 14 Jun 4 09:54 99-sysctl.conf -> ../sysctl.conf | + | |
| - | + | ||
| - | [root@centos7 ~]# cat /etc/sysctl.d/99-sysctl.conf | + | |
| - | # System default settings live in /usr/lib/sysctl.d/00-system.conf. | + | |
| - | # To override those settings, enter new settings here, or in an /etc/sysctl.d/< | + | |
| - | # | + | |
| - | # For more information, | + | |
| </ | </ | ||
| - | ==Options de la commande== | + | Installez maintenant les paquets necéssaires |
| - | + | ||
| - | Les options de la commande **sysctl** sont : | + | |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| + | ... | ||
| + | [root@centos8 ~]# dnf install asciidoc audit-libs-devel bash bc binutils binutils-devel bison diffutils elfutils elfutils-devel elfutils-libelf-devel findutils flex gawk gcc gettext gzip hmaccalc hostname make module-init-tools ncurses-devel net-tools newt-devel numactl-devel openssl patch pciutils-devel perl perl-ExtUtils-Embed pesign redhat-rpm-config rpm-build rpmdevtools sh-utils tar xmlto xz zlib-devel rpmdevtools clang dwarves java-devel kabi-dw libbabeltrace-devel libbpf-devel libcap-devel libmnl-devel libnl3-devel libtraceevent-devel llvm python3-devel python3-docutils | ||
| + | ... | ||
| + | </ | ||
| - | Usage: | + | ====2.1 - Déplacer /home==== |
| - | | + | |
| - | Options: | + | <WRAP center round alert 60%> |
| - | -a, --all display all variables | + | **Important** |
| - | -A alias of -a | + | </WRAP> |
| - | -X alias of -a | + | |
| - | --deprecated | + | |
| - | -b, --binary | + | |
| - | -e, --ignore | + | |
| - | -N, --names | + | |
| - | | + | |
| - | -p, --load[=<file>] read values from file | + | |
| - | -f alias of -p | + | |
| - | --system | + | |
| - | -r, --pattern < | + | |
| - | | + | |
| - | -q, --quiet | + | |
| - | -w, --write | + | |
| - | -o does nothing | + | |
| - | -x does nothing | + | |
| - | -d alias of -h | + | |
| - | -h, --help | + | <WRAP center round todo 60%> |
| - | -V, --version | + | **A faire** |
| + | </ | ||
| - | For more details see sysctl(8). | + | Créez ensuite une seule partition sur **/dev/sdc** : |
| - | </code> | + | |
| - | <WRAP center round important 50%> | + | <code> |
| - | **Important** : Consultez la page de la traduction du manuel de **sysctl** **[[http://www.delafond.org/ | + | [root@centos8 ~]# fdisk /dev/sdc |
| - | </ | + | |
| - | =====LAB #1 - System Hardening à l'aide de l' | + | Welcome to fdisk (util-linux 2.32.1). |
| + | Changes will remain in memory only, until you decide to write them. | ||
| + | Be careful before using the write command. | ||
| - | ====Présentation==== | + | Device does not contain a recognized partition table. |
| + | Created a new DOS disklabel with disk identifier 0xc321702b. | ||
| - | Bastille Linux est un script interactif de renforcement de la sécurité pour certaines distributions de Linux dont %%RHEL%%, %%CentOS%% et Debian. | + | Command (m for help): n |
| + | Partition type | ||
| + | | ||
| + | | ||
| + | Select (default p): | ||
| - | ====Installation==== | + | Using default response p. |
| + | Partition number (1-4, default 1): | ||
| + | First sector (2048-41943039, | ||
| + | Last sector, +sectors or +size{K, | ||
| - | Installez le dépôt EPEL : | + | Created a new partition 1 of type ' |
| - | < | + | Command (m for help): w |
| - | [root@centos7 ~]# wget http://dl.fedoraproject.org/ | + | The partition table has been altered. |
| - | [root@centos7 ~]# rpm -ivh epel-release-latest-7.noarch.rpm | + | Calling ioctl() to re-read partition table. |
| + | Syncing disks. | ||
| </ | </ | ||
| - | Commencez par installer la dépendance | + | Créez maintenant un système |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| + | mke2fs 1.45.6 (20-Mar-2020) | ||
| + | Discarding device blocks: done | ||
| + | Creating filesystem with 16776960 4k blocks and 4194304 inodes | ||
| + | Filesystem UUID: dc92c0d7-919b-4fff-8719-53e9e7e628dd | ||
| + | Superblock backups stored on blocks: | ||
| + | 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, | ||
| + | 4096000, 7962624, 11239424 | ||
| + | |||
| + | Allocating group tables: done | ||
| + | Writing inode tables: done | ||
| + | Creating journal (65536 blocks): done | ||
| + | Writing superblocks and filesystem accounting information: | ||
| </ | </ | ||
| - | Téléchargez et installez Bastille | + | Montez **/ |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| </ | </ | ||
| + | |||
| + | Copiez le contenu de /home vers /mnt : | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| </ | </ | ||
| - | Dernièrement créez un lien symbolique | + | Démontez /dev/sdc1 et déplacez /home vers /root : |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 ~]# umount |
| + | [root@centos8 ~]# mv /home /root | ||
| </ | </ | ||
| - | ===Utilisation=== | + | Identifiez |
| - | + | ||
| - | Pour démarrez bastille en mode texte, saisissez la commande suivante : | + | |
| - | + | ||
| - | # / | + | |
| - | + | ||
| - | Pour démarrez bastille en mode graphique, saisissez la commande suivante : | + | |
| - | + | ||
| - | # / | + | |
| - | + | ||
| - | <WRAP center round todo 50%> | + | |
| - | **A Faire** - Lancez Bastille et répondez aux questions posées. Ré-amorcez votre machine virtuelle et testez le résultat. | + | |
| - | </ | + | |
| - | + | ||
| - | =====LAB #2 - Mise en place de SELinux pour sécuriser le serveur===== | + | |
| - | + | ||
| - | ====Introducton==== | + | |
| - | + | ||
| - | L' | + | |
| - | ur | + | |
| - | ^ Type de Sécurité ^ Nom ^ Description ^ | + | |
| - | | TE | //Type enforcement// | + | |
| - | | RBAC | //Role Based Access Control// | + | |
| - | | MAC | //Mandatory Access Control// | + | |
| - | | MLS | | + | |
| - | + | ||
| - | Même quand le modèle %%SELinux%% de sécurité est actif, la sécurité type DAC est toujours active. Cependant dans le cas où la sécurité du type DAC autorise une action, %%SELinux%% va évaluer cette action par rapport à ses propres règles avant de l' | + | |
| - | + | ||
| - | %%SELinux%% évalue toujours des **// | + | |
| - | + | ||
| - | Dans le contexte de %%SELinux%% : | + | |
| - | + | ||
| - | * un **// | + | |
| - | * un **// | + | |
| - | * une **// | + | |
| - | + | ||
| - | Chaque **//classe d' | + | |
| - | + | ||
| - | ====Définitions==== | + | |
| - | + | ||
| - | ===Security Context=== | + | |
| - | + | ||
| - | %%SELinux%% associe un //Security Context// (SC) à chaque **// | + | |
| - | + | ||
| - | Un SC prend la forme **identité: | + | |
| - | + | ||
| - | ^ Nom ^ Descriptions ^ | + | |
| - | | Identité | Le nom du propriétaire de l' | + | |
| - | | Rôle | Essentiellement appliqué aux processus, le rôle est appelé une domaine. Dans le cas d'un rôle de fichier, celui-ci est toujours **object_r**. Un rôle se termine généralement par **_r**. | | + | |
| - | | Type | Définit la classification de sécurité de l' | + | |
| - | | Niveau | Un niveau est un attribut de MLS et MCS. Une plage MLS est une paire de niveaux exprimée en utilisant la syntaxe // | + | |
| - | + | ||
| - | Sous RHEL/CentOS 7, le fichier **/ | + | |
| < | < | ||
| - | [root@centos7 /]# cat /etc/selinux/targeted/setrans.conf | + | [root@centos8 ~]# ls -l /dev/disk/by-uuid/ | grep sdc1 |
| - | # | + | lrwxrwxrwx. 1 root root 10 Jul 19 12:02 f76d6b66-985b-4a91-af9c-4987e8c1443c -> ../../sdc |
| - | # Multi-Category Security translation table for SELinux | + | [root@centos8 ~]# |
| - | # | + | |
| - | # Uncomment the following to disable translation libary | + | |
| - | # disable=1 | + | |
| - | # | + | |
| - | # Objects can be categorized with 0-1023 categories defined by the admin. | + | |
| - | # Objects can be in more than one category at a time. | + | |
| - | # Categories are stored in the system as c0-c1023. Users can use this | + | |
| - | # table to translate the categories into a more meaningful output. | + | |
| - | # Examples: | + | |
| - | # s0: | + | |
| - | # s0: | + | |
| - | # s0: | + | |
| - | # s0: | + | |
| - | # s0: | + | |
| - | s0=SystemLow | + | |
| - | s0-s0: | + | |
| - | s0: | + | |
| </ | </ | ||
| - | Dans le contexte d'un SC pour un **//sujet//**, le champ **identité** indique les privilèges de l' | + | Editez |
| - | + | ||
| - | Dans le contexte d'un SC pour un **//objet//**, le champ **identité** indique à quel utilisateur %%SELinux%% appartient l' | + | |
| - | + | ||
| - | %%SELinux%% maintient sa propre liste d' | + | |
| < | < | ||
| - | [root@centos7 /]# /usr/sbin/semanage login -l | + | [root@centos8 ~]# vi /etc/fstab |
| + | [root@centos8 ~]# cat /etc/fstab | ||
| - | Login Name | + | # |
| - | + | # /etc/fstab | |
| - | __default__ | + | # Created by anaconda on Wed Jun 16 06:21:32 2021 |
| - | root unconfined_u | + | # |
| - | system_u | + | # Accessible filesystems, |
| + | # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info. | ||
| + | # | ||
| + | # After editing this file, run ' | ||
| + | # units generated from this file. | ||
| + | # | ||
| + | / | ||
| + | UUID=1c04981e-5317-4b73-9695-3ce25246835d /boot | ||
| + | / | ||
| + | UUID=f76d6b66-985b-4a91-af9c-4987e8c1443c /home | ||
| </ | </ | ||
| - | ===Domains et Types=== | + | Créez |
| - | + | ||
| - | Le **Domain** est l' | + | |
| - | + | ||
| - | Le **Domain** contient des **// | + | |
| - | + | ||
| - | Dans %%SELinux%% on utilise | + | |
| - | + | ||
| - | * **Domain** pour un processus, | + | |
| - | * **Type** pour un fichier. | + | |
| - | + | ||
| - | ===Roles=== | + | |
| - | + | ||
| - | Un **Rôle** est comme un utilisateur dans le système | + | |
| - | + | ||
| - | ===Politiques de Sécurité=== | + | |
| - | + | ||
| - | Une politique de sécurité définit les SC de chaque application. Elle définit des droits d' | + | |
| - | + | ||
| - | ^ Politique ^ Description ^ | + | |
| - | | targeted | Les politiques de sécurité ne s' | + | |
| - | | mls | Multi Level Security protection | | + | |
| - | + | ||
| - | Les politiques de sécurité se trouvent dans le répertoire **/etc/selinux** | + | |
| < | < | ||
| - | [root@centos7 /]# ls -lR / | + | [root@centos8 ~]# mkdir /home |
| - | / | + | |
| - | total 12 | + | |
| - | -rw-r--r--. 1 root root 547 Dec 10 2015 config | + | |
| - | drwx------. 2 root root 6 Apr 23 16:24 final | + | |
| - | -rw-r--r--. 1 root root 2321 Aug 4 2017 semanage.conf | + | |
| - | drwxr-xr-x. 7 root root 4096 Apr 23 16:24 targeted | + | |
| - | drwxr-xr-x. 2 root root 6 Aug 4 2017 tmp | + | |
| - | + | ||
| - | / | + | |
| - | total 0 | + | |
| - | + | ||
| - | / | + | |
| - | total 24 | + | |
| - | drwx------. 3 root root 4096 Apr 23 16:24 active | + | |
| - | -rw-r--r--. 1 root root 2623 Mar 7 15:19 booleans.subs_dist | + | |
| - | drwxr-xr-x. 4 root root 4096 Apr 23 16:20 contexts | + | |
| - | drwxr-xr-x. 2 root root 6 Mar 7 15:19 logins | + | |
| - | drwxr-xr-x. 3 root root 19 Apr 23 16:41 modules | + | |
| - | drwxr-xr-x. 2 root root 22 Apr 23 16:41 policy | + | |
| - | -rw-------. 1 root root 0 Mar 7 14:52 semanage.read.LOCK | + | |
| - | -rw-------. 1 root root 0 Mar 7 14:52 semanage.trans.LOCK | + | |
| - | -rw-r--r--. 1 root root 607 Mar 7 15:19 setrans.conf | + | |
| - | -rw-r--r--. 1 root root 176 Apr 23 16:24 seusers | + | |
| - | --More-- | + | |
| </ | </ | ||
| - | Afin d' | + | Montez |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| + | [root@centos8 ~]# mount | ||
| + | sysfs on /sys type sysfs (rw, | ||
| + | proc on /proc type proc (rw, | ||
| + | devtmpfs on /dev type devtmpfs (rw, | ||
| + | securityfs on / | ||
| + | tmpfs on /dev/shm type tmpfs (rw, | ||
| + | devpts on /dev/pts type devpts (rw, | ||
| + | tmpfs on /run type tmpfs (rw, | ||
| + | tmpfs on / | ||
| + | cgroup on / | ||
| + | pstore on / | ||
| + | bpf on /sys/fs/bpf type bpf (rw, | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | cgroup on / | ||
| + | none on / | ||
| + | configfs on / | ||
| + | / | ||
| + | selinuxfs on / | ||
| + | mqueue on /dev/mqueue type mqueue (rw, | ||
| + | hugetlbfs on / | ||
| + | debugfs on / | ||
| + | systemd-1 on / | ||
| + | fusectl on / | ||
| + | /dev/sda1 on /boot type ext4 (rw, | ||
| + | sunrpc on / | ||
| + | tmpfs on / | ||
| + | tmpfs on / | ||
| + | gvfsd-fuse on / | ||
| + | tmpfs on /run/user/0 type tmpfs (rw, | ||
| + | gvfsd-fuse on / | ||
| + | /dev/sdc1 on /home type ext4 (rw, | ||
| </ | </ | ||
| - | Pour consulter les statistiques | + | Notez la taille |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | + | Filesystem | |
| - | Statistics for policy file: /sys/fs/selinux/policy | + | devtmpfs |
| - | Policy Version & Type: v.28 (binary, mls) | + | tmpfs 1.9G |
| - | + | tmpfs 1.9G 9.4M 1.9G 1% /run | |
| - | | + | tmpfs 1.9G |
| - | | + | / |
| - | Types: | + | / |
| - | | + | tmpfs 374M |
| - | | + | tmpfs 374M 1.2M 373M |
| - | | + | / |
| - | Auditallow: | + | |
| - | | + | |
| - | Type_member: | + | |
| - | Role_trans: | + | |
| - | | + | |
| - | Initial SIDs: | + | |
| - | Genfscon: | + | |
| - | | + | |
| - | | + | |
| </ | </ | ||
| - | <WRAP center round important 50%> | + | <WRAP center round todo 60%> |
| - | **Important** : Notez ici le grand nombre | + | **A faire** - **Déconnectez-vous** de votre session **CentOS8_ROOT_10.0.2.45** et re-connectez-vous à la VM en tant que trainee en utilisant |
| </ | </ | ||
| - | ===Langage de Politiques=== | + | ====2.2 - Préparer l' |
| - | Un politique est composé | + | Pour créer l' |
| - | ==allow== | + | < |
| + | [trainee@centos8 ~]$ rpmdev-setuptree | ||
| + | ...> | ||
| + | [trainee@centos8 ~]$ ls -laR rpmbuild/ | ||
| + | rpmbuild/: | ||
| + | total 28 | ||
| + | drwxrwxr-x. | ||
| + | drwxr-xr-x. 17 trainee trainee 4096 Jul 19 12:10 .. | ||
| + | drwxrwxr-x. | ||
| + | drwxrwxr-x. | ||
| + | drwxrwxr-x. | ||
| + | drwxrwxr-x. | ||
| + | drwxrwxr-x. | ||
| - | **allow** autorise l' | + | rpmbuild/ |
| + | total 8 | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | ||
| + | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | ||
| - | allow user_t domaine_t | + | rpmbuild/ |
| + | total 8 | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | ||
| + | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | ||
| - | Dans cette directive | + | rpmbuild/ |
| + | total 8 | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | ||
| + | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | ||
| - | * user_t est le type de fichier, | + | rpmbuild/ |
| - | * domaine_t est le domaine des processus qui sont autorisés par allow, | + | total 8 |
| - | * file (droit1 droit2 etc) est la liste des permissions accordées. | + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . |
| + | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | ||
| - | Les permissions possibles sont : | + | rpmbuild/ |
| + | total 8 | ||
| + | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | ||
| + | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | ||
| + | </ | ||
| - | * read | + | Téléchargez le rpm source du noyau : |
| - | * write | + | |
| - | * append | + | |
| - | * execute | + | |
| - | * getattr | + | |
| - | * setattr | + | |
| - | * lock | + | |
| - | * link | + | |
| - | * unlink | + | |
| - | * rename | + | |
| - | * ioctl | + | |
| - | ==type== | + | < |
| + | [root@centos8 ~]# uname -a | ||
| + | Linux centos8.ittraining.loc 4.18.0-553.6.1.el8.x86_64 #1 SMP Thu May 30 04:13:58 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux | ||
| - | La directive **type** définit un type %%SELinux%%. Le type se termine généralement par **_t**. | + | [root@centos8 ~]# cat / |
| + | CentOS Stream release 8 | ||
| - | **auditallow, | + | [trainee@centos8 ~]$ wget https:// |
| + | </ | ||
| - | La directive **auditallow** demande l' | + | Installez maintenant |
| - | L' | + | < |
| + | [trainee@centos8 ~]$ su - | ||
| + | Mot de passe : fenestros | ||
| - | ===type_transition=== | + | [root@centos8 ~]# dnf install yum-utils |
| + | ... | ||
| - | Normalement quand un fichier est créé, il hérite du SC du répertoire parent. De même quand un processus %%SELinux%% active un nouveau processus, ce dernier s' | + | [root@centos8 ~]# yum-builddep / |
| + | ... | ||
| + | </ | ||
| - | ===Décisions de SELinux=== | + | Installez maintenant le paquet **kernel-4.18.0-553.16.1.el8_10.src.rpm** : |
| - | Il existe deux types de décisions auxquelles | + | < |
| + | [root@centos8 ~]# exit | ||
| + | logout | ||
| + | [trainee@centos8 ~]$ rpm -Uvh kernel-4.18.0-553.16.1.el8_10.src.rpm | ||
| + | Updating / installing... | ||
| + | | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | ################################# | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | warning: user mockbuild does not exist - using root | ||
| + | warning: group mockbuild does not exist - using root | ||
| + | </ | ||
| - | | + | <WRAP center round important 60%> |
| - | * **Décisions de Transition** | + | **Important** - Les erreurs sont sans importance. |
| + | </ | ||
| - | ==Décisions d'Accès== | + | ====2.3 - Préparer l'Arborescence Source du Noyau==== |
| - | Dans ce type de décision %%SELinux%% doit décider d' | + | Naviguez vers le repertoire |
| - | + | ||
| - | * un **//sujet//** de faire quelque chose à un **// | + | |
| - | * un **// | + | |
| - | + | ||
| - | ==Décisions de Transition== | + | |
| - | + | ||
| - | Dans ce type de décision %%SELinux%% doit décider d' | + | |
| - | + | ||
| - | | + | |
| - | * de créer des **// | + | |
| - | + | ||
| - | ====Commandes SELinux==== | + | |
| - | + | ||
| - | ^ Commande ^ Description ^ | + | |
| - | | chcon | Changer le SC d'un fichier | | + | |
| - | | audit2allow | Générer la source | + | |
| - | | restorecon | Restaurer le SC par défaut à un ou plusieurs fichiers | | + | |
| - | | setfiles -n | Vérifier si les SC sont corrects | + | |
| - | | semodule | Gèrer les modules de politiques | | + | |
| - | | semodule -i | Installer un module de politiques | | + | |
| - | | checkmodule | Compiler un module | | + | |
| - | | semodule_package | Créer un module installable par semodule | | + | |
| - | | semanage | Administrer une politique | | + | |
| - | | audit2allow -M | Créer un module à partir d'un message d' | + | |
| - | | sesearch | Recherche des règles %%SELinux%% | | + | |
| - | | seinfo | Effectuer des recherches dans la politique | | + | |
| - | | getsebool | Affiche l' | + | |
| - | | getsebool -a | Affiche l' | + | |
| - | | sestatus -b | Affiche l' | + | |
| - | | setsebool | Modifie l' | + | |
| - | | togglesebool | Bascule la valeur d'un booléen | | + | |
| - | + | ||
| - | ====Les Etats de SELinux==== | + | |
| - | + | ||
| - | %%SELinux%% connait trois états : | + | |
| - | + | ||
| - | ^ Etat ^ Description ^ | + | |
| - | | disabled | %%SELinux%% est inactif. | | + | |
| - | | permissive | %%SELinux%% est actif mais tout est permis. Des interdictions ne font que de générer des messages d' | + | |
| - | | enforcing | %%SELinux%% est actif. | | + | |
| - | + | ||
| - | L' | + | |
| - | + | ||
| - | ^ Valeur ^ Description ^ | + | |
| - | | 0 | %%SELinux%% est en mode // | + | |
| - | | 1 | %%SELinux%% est en mode // | + | |
| - | + | ||
| - | La configuration de l' | + | |
| < | < | ||
| - | [root@centos7 | + | [trainee@centos7 |
| - | + | [trainee@centos7 SPECS]$ rpmbuild | |
| - | # This file controls the state of SELinux on the system. | + | ... |
| - | # SELINUX= can take one of these three values: | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | SELINUX=enforcing | + | |
| - | # SELINUXTYPE= can take one of three two values: | + | |
| - | # | + | |
| - | # | + | |
| - | # mls - Multi Level Security protection. | + | |
| - | SELINUXTYPE=targeted | + | |
| </ | </ | ||
| - | Afin de connaître | + | A l'issu du processus, examinez l'arborescence |
| < | < | ||
| - | [root@centos7 /]# getenforce | + | [trainee@centos8 SPECS]$ ls -la ~/ |
| - | Enforcing | + | total 812 |
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. 119 trainee trainee | ||
| + | drwxr-xr-x. 137 trainee trainee | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | -rw-r--r--. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. | ||
| </ | </ | ||
| - | Pour modifier l' | + | ===Le Fichier .config=== |
| + | |||
| + | Changez | ||
| < | < | ||
| - | [root@centos7 /]# setenforce permissive | + | [trainee@centos8 SPECS]$ cd ~/ |
| - | [root@centos7 | + | |
| - | Permissive | + | |
| </ | </ | ||
| - | La commande | + | Copiez le fichier |
| < | < | ||
| - | [root@centos7 /]# sestatus | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ cp configs/kernel-4.18.0-`uname -m`.config .config |
| - | SELinux status: | + | |
| - | SELinuxfs mount: | + | |
| - | SELinux root directory: | + | |
| - | Loaded policy name: | + | |
| - | Current mode: | + | |
| - | Mode from config | + | |
| - | Policy MLS status: | + | |
| - | Policy deny_unknown status: | + | |
| - | Max kernel policy version: | + | |
| </ | </ | ||
| - | Les différentes versions de politiques évolue en même temps que le noyau Linux. | + | Mettez à jour le fichier |
| - | + | ||
| - | La commande sestatus peut aussi prendre l' | + | |
| < | < | ||
| - | [root@centos7 /]# sestatus -v | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ make oldconfig |
| - | SELinux status: | + | scripts/kconfig/conf |
| - | SELinuxfs mount: | + | # |
| - | SELinux root directory: | + | # configuration written to .config |
| - | Loaded policy name: | + | # |
| - | Current mode: | + | |
| - | Mode from config file: enforcing | + | |
| - | Policy MLS status: | + | |
| - | Policy deny_unknown status: | + | |
| - | Max kernel policy version: | + | |
| - | + | ||
| - | Process contexts: | + | |
| - | Current context: | + | |
| - | Init context: | + | |
| - | / | + | |
| - | + | ||
| - | File contexts: | + | |
| - | Controlling terminal: | + | |
| - | /etc/passwd | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | / | + | |
| - | /lib/libc.so.6 system_u: | + | |
| - | / | + | |
| </ | </ | ||
| - | ====Booléens==== | + | <WRAP center round important 60%> |
| + | **Important** - Cette commande lit le fichier .config du noyau actuel et le compare avec celui des sources du noyau. S'il existent des nouvelles configurations à effectuer dans les sources du noyau, la commande vous pose des questions. | ||
| + | </ | ||
| - | Les booléens permettent à des ensembles de règles d'être utilisées d'une manière alternative. | + | La configuration du noyau se trouve dans un fichier dénommé **.config**. Le fichier **.config** est généré par une des trois commandes suivantes et ne doit **pas** |
| - | Pour visualiser l' | + | * make config |
| + | * make menuconfig | ||
| + | * make xconfig | ||
| + | |||
| + | Exécutez | ||
| < | < | ||
| - | [root@centos7 /]# getsebool | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ make menuconfig |
| - | abrt_anon_write | + | |
| - | abrt_handle_event | + | |
| - | abrt_upload_watch_anon_write --> on | + | |
| - | antivirus_can_scan_system --> off | + | |
| - | antivirus_use_jit --> off | + | |
| - | auditadm_exec_content --> on | + | |
| - | authlogin_nsswitch_use_ldap --> off | + | |
| - | authlogin_radius --> off | + | |
| - | authlogin_yubikey --> off | + | |
| - | awstats_purge_apache_log_files --> off | + | scripts/ |
| - | boinc_execmem --> on | + | |
| - | cdrecord_read_content --> off | + | |
| - | cluster_can_network_connect --> off | + | |
| - | cluster_manage_all_files --> off | + | |
| - | cluster_use_execmem --> off | + | |
| - | cobbler_anon_write --> off | + | |
| - | cobbler_can_network_connect --> off | + | |
| - | cobbler_use_cifs --> off | + | |
| - | cobbler_use_nfs --> off | + | |
| - | collectd_tcp_network_connect --> off | + | |
| - | condor_tcp_network_connect --> off | + | |
| - | conman_can_network --> off | + | |
| - | container_connect_any --> off | + | |
| - | --More-- | + | |
| </ | </ | ||
| - | ou la commande **sestatus -b** : | + | Dans l' |
| - | < | + | * **y**, |
| - | [root@centos7 /]# sestatus -b | more | + | * la fonctionalité est incluse dans le noyau monolithique ou dans le cas d'une dépendance d'un module, dans le module concerné, |
| - | SELinux status: | + | * **m**, |
| - | SELinuxfs mount: | + | * la fonctionalité est incluse en tant que module, |
| - | SELinux root directory: | + | * **n**, |
| - | Loaded policy name: | + | * la fonctionalité n'est pas incluse. |
| - | Current mode: | + | |
| - | Mode from config file: enforcing | + | |
| - | Policy MLS status: | + | |
| - | Policy deny_unknown status: | + | |
| - | Max kernel policy version: | + | |
| - | Policy booleans: | + | <WRAP center round important 60%> |
| - | abrt_anon_write | + | **Important** |
| - | abrt_handle_event | + | </WRAP> |
| - | abrt_upload_watch_anon_write | + | |
| - | antivirus_can_scan_system | + | Sauvegardez simplement la configuration actuelle et sortez de l'interface |
| - | antivirus_use_jit | + | |
| - | auditadm_exec_content | + | |
| - | authlogin_nsswitch_use_ldap | + | |
| - | authlogin_radius | + | |
| - | authlogin_yubikey | + | |
| - | awstats_purge_apache_log_files | + | |
| - | boinc_execmem | + | |
| - | cdrecord_read_content | + | |
| - | --More-- | + | |
| - | </code> | + | |
| - | + | ||
| - | Pour fixer l'état d'un booléen, il convient d' | + | |
| < | < | ||
| - | [root@centos7 /]# setsebool antivirus_can_scan_system 1 | + | *** End of the configuration. |
| - | [root@centos7 /]# getsebool antivirus_can_scan_system | + | *** Execute ' |
| - | antivirus_can_scan_system --> on | + | |
| - | [root@centos7 /]# setsebool antivirus_can_scan_system 0 | + | |
| - | [root@centos7 /]# getsebool antivirus_can_scan_system | + | |
| - | antivirus_can_scan_system --> off | + | |
| </ | </ | ||
| - | =====LAB #3 - Travailler avec SELinux===== | + | Vérifiez que le fichier **.config** a été" créé par l' |
| - | Afin reconstruire la politique actuelle **sans** les règles **dontaudit**, | ||
| - | |||
| < | < | ||
| - | [root@centos7 ~]# semodule | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ ls -a |
| + | . | ||
| + | .. .gitlab-ci.yml | ||
| + | .clang-format | ||
| + | .cocciconfig | ||
| + | .config | ||
| + | .config.old | ||
| + | .get_maintainer.ignore | ||
| </ | </ | ||
| - | Vérifiez qu'il ne reste aucune règle de type **dontaudit** | + | Consultez ce fichier |
| < | < | ||
| - | [root@centos7 ~]# seinfo | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ more .config |
| + | # | ||
| + | # Automatically generated file; DO NOT EDIT. | ||
| + | # Linux/x86 4.18.0 Kernel Configuration | ||
| + | # | ||
| - | Statistics for policy file: / | + | # |
| - | Policy Version & Type: v.28 (binary, mls) | + | # Compiler: gcc (GCC) 8.5.0 20210514 |
| - | + | # | |
| - | Classes: | + | CONFIG_64BIT=y |
| - | Sensitivities: | + | CONFIG_X86_64=y |
| - | Types: | + | CONFIG_X86=y |
| - | Users: | + | CONFIG_INSTRUCTION_DECODER=y |
| - | Booleans: | + | CONFIG_OUTPUT_FORMAT=" |
| - | Allow: | + | CONFIG_ARCH_DEFCONFIG=" |
| - | Auditallow: | + | CONFIG_LOCKDEP_SUPPORT=y |
| - | Type_trans: | + | CONFIG_STACKTRACE_SUPPORT=y |
| - | Type_member: | + | CONFIG_MMU=y |
| - | Role_trans: | + | CONFIG_ARCH_MMAP_RND_BITS_MIN=28 |
| - | Constraints: | + | CONFIG_ARCH_MMAP_RND_BITS_MAX=32 |
| - | Initial SIDs: | + | CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8 |
| - | Genfscon: | + | CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 |
| - | Netifcon: | + | CONFIG_GENERIC_ISA_DMA=y |
| - | | + | CONFIG_GENERIC_BUG=y |
| + | --More--(0%) | ||
| </ | </ | ||
| - | ====Copier et Déplacer des Fichiers==== | + | ===Le Fichier Makefile=== |
| - | Créez deux fichiers | + | Le fichier |
| - | < | + | * VERSION, |
| - | [root@centos7 /]# exit | + | * PATCHLEVEL, |
| - | logout | + | * SUBLEVEL, |
| - | [trainee@centos7 ~]$ touch file1 file2 | + | * EXTRAVERSION. |
| - | [trainee@centos7 ~]$ ls -Z file* | + | |
| - | -rw-rw-r--. trainee trainee unconfined_u: | + | |
| - | -rw-rw-r--. trainee trainee unconfined_u: | + | |
| - | </ | + | |
| - | + | ||
| - | Notez que le type des deux fichiers est **user_home_t**. | + | |
| - | Copiez maintenant le fichier | + | Les trois premières informations sont gérées par **kernel.org** et Linus Torvalds |
| < | < | ||
| - | [trainee@centos7 ~]$ cp file1 /tmp | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ more Makefile |
| - | [trainee@centos7 ~]$ ls -Z / | + | # SPDX-License-Identifier: GPL-2.0 |
| - | -rw-rw-r--. trainee trainee unconfined_u: | + | VERSION = 4 |
| - | </ | + | PATCHLEVEL = 18 |
| + | SUBLEVEL = 0 | ||
| + | EXTRAVERSION = | ||
| + | NAME = Merciless Moray | ||
| - | Notez que le fichier ainsi copié a hérité du **type** du répertoire parent, à savoir **tmp_t**. | + | # |
| + | # DRM backport version | ||
| + | # | ||
| + | RHEL_DRM_VERSION = 6 | ||
| + | RHEL_DRM_PATCHLEVEL = 3 | ||
| + | RHEL_DRM_SUBLEVEL = | ||
| + | RHEL_DRM_EXTRAVERSION = | ||
| - | Déplacez maintenant le fichier **file2** dans le répertoire | + | # *DOCUMENTATION* |
| + | # To see a list of typical targets execute "make help" | ||
| + | # More info can be located in ./README | ||
| + | # Comments in this file are targeted only to the developer, do not | ||
| + | # expect to learn how to build the kernel reading this file. | ||
| - | < | + | # That's our default target when none is given on the command line |
| - | [trainee@centos7 ~]$ mv file2 /tmp | + | PHONY := _all |
| - | [trainee@centos7 ~]$ ls -Z / | + | --More--(0%) |
| - | -rw-rw-r--. trainee trainee unconfined_u: | + | |
| </ | </ | ||
| - | Notez que la commande | + | <WRAP center round important 60%> |
| + | **Important** - La version 2.6 du noyau a vu le jour en **2003**. Les **SUBLEVEL** se suivaient régulièrement. Avec la version 2.6 du noyau, la valeur paire du **PATCHLEVEL** indiquait que le noyau était stable. Quand vous recompilez le noyau à partir des sources, vous devez modifier la valeur de l'EXTRAVERSION. | ||
| + | </ | ||
| - | ====Vérifier les SC des Processus==== | + | ====2.4 - Paramétrage du noyau==== |
| - | Il convient d' | + | Insérez la sortie de la commande **uname -i** sur la première ligne du fichier .config |
| < | < | ||
| - | [trainee@centos7 ~]$ ps auxZ | more | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ uname -i |
| - | LABEL | + | x86_64 |
| - | system_u: | + | |
| - | deserialize 24 | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | system_u: | + | |
| - | --Plus-- | + | |
| - | </ | + | |
| - | ====Visualiser la SC d'un Utilisateur==== | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ vi .config |
| - | Utilisez l' | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ head .config |
| + | # x86_64 | ||
| + | # | ||
| + | # Automatically generated file; DO NOT EDIT. | ||
| + | # Linux/x86 4.18.0 Kernel Configuration | ||
| + | # | ||
| - | < | + | # |
| - | [trainee@centos7 ~]$ id -Z | + | # Compiler: gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-22) |
| - | unconfined_u:unconfined_r: | + | # |
| + | CONFIG_64BIT=y | ||
| </ | </ | ||
| - | Notez que vous ne pouvez pas consulter | + | Renommez |
| < | < | ||
| - | [trainee@centos7 ~]$ id root | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ cp .config ~/ |
| - | uid=0(root) gid=0(root) groupes=0(root) | + | |
| - | [trainee@centos7 ~]$ id -Z root | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ ls ~/ |
| - | id: impossible d' | + | Module.kabi_aarch64 |
| + | Module.kabi_dup_aarch64 | ||
| + | Module.kabi_dup_ppc64le | ||
| + | Module.kabi_dup_s390x | ||
| + | Module.kabi_dup_x86_64 | ||
| + | Module.kabi_ppc64le | ||
| + | Module.kabi_s390x | ||
| + | Module.kabi_x86_64 | ||
| + | centossecureboot201.cer | ||
| + | centossecurebootca2.cer | ||
| + | check-kabi | ||
| + | config-x86_64-generic | ||
| + | cpupower.config | ||
| + | cpupower.service | ||
| + | filter-aarch64.sh | ||
| + | filter-modules.sh | ||
| + | filter-ppc64le.sh | ||
| </ | </ | ||
| - | ====Vérifier la SC d'un fichier==== | + | Copiez le contenu du répertoire |
| - | + | ||
| - | Il convient d' | + | |
| < | < | ||
| - | [trainee@centos7 ~]$ cd /etc | + | [trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ cp configs/* ~/rpmbuild/SOURCES/ |
| - | [trainee@centos7 etc]$ ls -Z l* -d | + | |
| - | -rw-r--r--. root root unconfined_u: | + | |
| - | -rw-r--r--. root root system_u: | + | |
| - | drwxr-xr-x. root root system_u: | + | |
| - | -rw-r-----. root root system_u: | + | |
| - | drwxr-xr-x. root root system_u: | + | |
| - | drwxr-xr-x. root root system_u: | + | |
| - | -rw-r--r--. root root unconfined_u: | + | |
| - | -rw-r--r--. root root unconfined_u: | + | |
| - | lrwxrwxrwx. root root unconfined_u: | + | |
| - | -rw-r--r--. root root unconfined_u: | + | |
| - | -rw-r--r--. root root system_u: | + | |
| - | drwxr-xr-x. root root system_u: | + | |
| - | drwxr-xr-x. root root system_u: | + | |
| - | drwxr-xr-x. root root system_u: | + | |
| </ | </ | ||
| - | ====Troubleshooting SELinux==== | + | Editez la directive **buildid** dans le fichier **~/ |
| - | L' | + | < |
| + | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ cd ~/ | ||
| - | Si le démon **auditd** est démarré, les messages de %%SELinux%% sont consignés dans le fichier **/ | + | [trainee@centos8 SPECS]$ vi kernel.spec |
| - | ===La commande chcon=== | + | [trainee@centos8 SPECS]$ head -n 50 kernel.spec |
| + | # We have to override the new %%install behavior because, well... the kernel is special. | ||
| + | %global __spec_install_pre %{___build_pre} | ||
| - | La commande **chcon** permet de modifier | + | # At the time of this writing (2019-03), RHEL8 packages use w2.xzdio |
| + | # compression for rpms (xz, level 2). | ||
| + | # Kernel has several large (hundreds of mbytes) rpms, they take ~5 mins | ||
| + | # to compress by single-threaded xz. Switch to threaded compression, | ||
| + | # and from level 2 to 3 to keep compressed sizes close to " | ||
| + | # | ||
| + | # NB: if default compression in /usr/lib/rpm/redhat/ | ||
| + | # this one might need tweaking (e.g. if default changes to w3.xzdio, | ||
| + | # change below to w4T.xzdio): | ||
| + | %define _binary_payload w3T.xzdio | ||
| - | < | + | %global distro_build 553 |
| - | [trainee@centos7 etc]$ cd ~ | + | |
| - | [trainee@centos7 ~]$ chcon --help | + | |
| - | Utilisation : | + | |
| - | ou : chcon [OPTION]... [-u USER] [-r ROLE] [-l RANGE] [-t TYPE] FILE... | + | |
| - | ou : chcon [OPTION]... --reference=RFILE FILE... | + | |
| - | Modifier le contexte de sécurité SELinux de chaque FILE en CONTEXT. | + | |
| - | Avec --reference, | + | |
| - | celui de RFILE. | + | |
| - | Les arguments obligatoires pour les options longues le sont aussi pour les | + | # Sign the x86_64 kernel for secure boot authentication |
| - | options courtes. | + | %ifarch x86_64 aarch64 s390x ppc64le |
| - | | + | %global signkernel 1 |
| - | défaut), au lieu du lien symbolique lui-même | + | %else |
| - | -h, --no-dereference | + | %global signkernel 0 |
| - | référencés | + | %endif |
| - | -u, --user=USER | + | |
| - | | + | |
| - | -r, --role=ROLE | + | |
| - | -t, --type=TYPE | + | |
| - | -l, --range=RANGE | + | |
| - | | + | |
| - | --no-preserve-root ne pas traiter « / » de manière spéciale (par défaut) | + | |
| - | --preserve-root | + | |
| - | --reference=RFILE | + | |
| - | | + | |
| - | -R, --recursive | + | |
| - | -v, --verbose | + | |
| - | Les options suivantes modifient la façon de parcourir la hiérarchie lorsque | + | # Sign modules on all arches |
| - | l' | + | %global signmodules 1 |
| - | dernière sera prise en compte. | + | |
| - | -H si l' | + | # Compress modules only for architectures that build modules |
| - | symbolique vers un répertoire, | + | %ifarch noarch |
| - | | + | %global zipmodules 0 |
| - | répertoire | + | %else |
| - | | + | %global zipmodules 1 |
| + | %endif | ||
| - | | + | %if %{zipmodules} |
| - | | + | %global zipsed |
| + | %endif | ||
| - | Aide en ligne de GNU coreutils : | + | %define buildid |
| - | Signalez les problèmes de traduction de « chcon » à : < | + | |
| - | Utilisez « info coreutils 'chcon invocation' | + | |
| - | </ | + | |
| - | Prenons le cas de la création d'un répertoire à la racine du système de fichiers afin d'y stocker les pages web du serveur apache : | + | %define specversion 4.18.0 |
| + | %define pkgrelease 553.16.1.el8_10 | ||
| - | < | + | # allow pkg_release to have configurable %%{?dist} tag |
| - | [trainee@centos7 ~]$ su - | + | %define specrelease 553.16.1%{? |
| - | Mot de passe : | + | |
| - | Dernière connexion : dimanche 17 juin 2018 à 20:21:42 CEST sur pts/1 | + | |
| - | [root@centos7 ~]# mkdir /www | + | |
| - | [root@centos7 ~]# touch /www/index.html | + | |
| - | </ | + | |
| - | Installez maintenant le serveur Apache : | + | %define pkg_release %{specrelease}%{? |
| - | < | + | # libexec dir is not used by the linker, so the shared object there |
| - | [root@centos7 ~]# yum install httpd | + | # should not be exported to RPM provides |
| + | %global __provides_exclude_from ^%{_libexecdir}/ | ||
| </ | </ | ||
| - | Modifiez ensuite la directive **%%DocumentRoot%%** dans le fichier **/ | + | ====2.5 - Compiler le Noyau==== |
| - | < | + | La compilation du noyau peut prendre beaucoup de temps (~5 heures). La commande utilisée est la suivante : |
| - | [...] | + | |
| - | # | + | |
| - | DocumentRoot "/ | + | |
| - | [...] | + | |
| - | </ | + | |
| - | Ajoutez les section **<Directory "/ | + | <code> |
| - | + | [trainee@centos8 SPECS]$ rpmbuild -bb --target=`uname -m` kernel.spec 2> build-err.log | tee build-out.log & | |
| - | <file> | + | [1] 96990 |
| + | [trainee@centos8 SPECS]$ Building target platforms: x86_64 | ||
| + | Building for target x86_64 | ||
| ... | ... | ||
| - | < | ||
| - | AllowOverride None | ||
| - | # Allow open access: | ||
| - | Require all granted | ||
| - | </ | ||
| - | |||
| - | < | ||
| - | Options Indexes FollowSymLinks | ||
| - | AllowOverride None | ||
| - | Require all granted | ||
| - | </ | ||
| - | |||
| - | # Further relax access to the default document root: | ||
| - | < | ||
| - | ... | ||
| - | </ | ||
| - | |||
| - | Créez le fichier **/ | ||
| - | |||
| - | < | ||
| - | [root@centos7 ~]# vi / | ||
| - | [root@centos7 ~]# cat / | ||
| - | < | ||
| - | < | ||
| - | This is a test | ||
| - | </ | ||
| - | < | ||
| - | www test page | ||
| - | </ | ||
| - | </ | ||
| </ | </ | ||
| - | Modifiez ensuite le propriétaire et le groupe du répertoire | + | <WRAP center round important 60%> |
| + | **Important** - La compilation peut prendre des heures. | ||
| + | </ | ||
| - | < | + | A l'issu du processus, les RPMs se trouvent |
| - | [root@centos7 ~]# chown -R apache: | + | |
| - | </ | + | |
| - | + | ||
| - | Dernièrement, créez un fichier index.html **vide** | + | |
| < | < | ||
| - | [root@centos7 ~]# touch /var/www/html/index.html | + | ... |
| - | </ | + | Wrote: |
| + | ... | ||
| - | Redémarrez maintenant le service httpd : | + | [1]+ Done rpmbuild -bb --target=`uname -m` kernel.spec 2> build-err.log | tee build-out.log |
| - | + | ||
| - | < | + | |
| - | [root@centos7 ~]# systemctl restart httpd.service | + | |
| </ | </ | ||
| - | Consultez le site localhost en utilisant **lynx** | + | Notez que la génération du nouveau noyau peut consommer jusqu' |
| < | < | ||
| - | [root@centos7 ~]# lynx localhost | + | [trainee@centos8 x86_64]$ df -h |
| + | Filesystem | ||
| + | devtmpfs | ||
| + | tmpfs 1.9G | ||
| + | tmpfs 1.9G 9.4M 1.9G 1% /run | ||
| + | tmpfs 1.9G | ||
| + | / | ||
| + | / | ||
| + | tmpfs 374M | ||
| + | tmpfs 374M 1.2M 373M 1% / | ||
| + | / | ||
| </ | </ | ||
| - | Pour consulter les messages d' | + | ====2.6 - Installer le Nouveau Noyau==== |
| - | Installez | + | Installez |
| < | < | ||
| - | [root@centos7 ~]# yum install setroubleshoot-server | + | [trainee@centos8 SPECS]$ cd ../RPMS/x86_64 |
| - | </code> | + | |
| - | La commande **sealert** possède à la fois une interface graphique **et** un mode en ligne de commande : | + | [root@centos8 x86_64]# dnf localinstall kernel-*.rpm |
| - | + | ||
| - | < | + | |
| - | [root@centos7 ~]# sealert | + | |
| - | type=AVC msg=audit(1524491216.546: | + | |
| - | + | ||
| - | **** Invalid AVC allowed in current policy *** | + | |
| - | + | ||
| - | type=AVC msg=audit(1524491220.766:622): avc: denied | + | |
| - | + | ||
| - | **** Invalid AVC allowed in current policy *** | + | |
| </ | </ | ||
| - | Consultez le fichier **/ | + | A l'issu de l' |
| < | < | ||
| - | [root@centos7 ~]# more / | + | [root@centos7 ~]# reboot |
| - | + | ||
| - | found 3 alerts in / | + | |
| - | -------------------------------------------------------------------------------- | + | |
| - | + | ||
| - | SELinux is preventing / | + | |
| - | + | ||
| - | ***** Plugin catchall (100. confidence) suggests | + | |
| - | + | ||
| - | you believe that dbus-daemon-launch-helper should be allowed rlimitinh access on processes labeled unconfined_service_t by default. | + | |
| - | Then you should report this as a bug. | + | |
| - | You can generate a local policy module to allow this access. | + | |
| - | Do | + | |
| - | allow this access for now by executing: | + | |
| - | # ausearch -c ' | + | |
| - | # semodule -i my-dbusdaemonlau.pp | + | |
| - | + | ||
| - | + | ||
| - | Additional Information: | + | |
| - | Source Context | + | |
| - | Target Context | + | |
| - | 023 | + | |
| - | Target Objects | + | |
| - | Source | + | |
| - | Source Path / | + | |
| - | Port < | + | |
| - | Host < | + | |
| - | Source RPM Packages | + | |
| - | Target RPM Packages | + | |
| - | Policy RPM selinux-policy-3.13.1-166.el7_4.9.noarch | + | |
| - | Selinux Enabled | + | |
| - | Policy Type | + | |
| - | Enforcing Mode Permissive | + | |
| - | Host Name | + | |
| - | Platform | + | |
| - | 3.10.0-693.21.1.el7.x86_64 #1 SMP Wed Mar 7 | + | |
| - | 19:03:37 UTC 2018 x86_64 x86_64 | + | |
| - | Alert Count 1 | + | |
| - | First Seen 2020-01-23 16:04:33 CET | + | |
| - | Last Seen | + | |
| - | --More--(4%) | + | |
| </ | </ | ||
| - | Cherchez dans le fichier | + | Connectez-vous en tant que trainee et devenez root. Constatez l' |
| < | < | ||
| - | ***** Plugin catchall (17.1 confidence) suggests | + | [root@centos8 ~]# grep ittraining |
| - | + | saved_entry=95bd69e34a7444a7b58cb74fbfb86df2-4.18.0-553.16.1.el8.ittraining.x86_64 | |
| - | you believe that httpd should be allowed getattr access on the index.html file by default. | + | |
| - | Then you should report this as a bug. | + | |
| - | You can generate a local policy module to allow this access. | + | |
| - | Do | + | |
| - | allow this access for now by executing: | + | |
| - | # ausearch -c ' | + | |
| - | # semodule -i my-httpd.pp | + | |
| - | + | ||
| - | + | ||
| - | Additional Information: | + | |
| - | Source Context | + | |
| - | Target Context | + | |
| - | Target Objects | + | |
| - | Source | + | |
| - | Source Path /usr/sbin/httpd | + | |
| - | Port < | + | |
| - | Host < | + | |
| - | Source RPM Packages | + | |
| - | Target RPM Packages | + | |
| - | Policy RPM selinux-policy-3.13.1-166.el7_4.9.noarch | + | |
| - | Selinux Enabled | + | |
| - | Policy Type | + | |
| - | Enforcing Mode Permissive | + | |
| - | Host Name | + | |
| - | Platform | + | |
| - | 3.10.0-693.21.1.el7.x86_64 #1 SMP Wed Mar 7 | + | |
| - | 19:03:37 UTC 2018 x86_64 x86_64 | + | |
| - | Alert Count 1 | + | |
| - | First Seen 2020-01-23 16:04:30 CET | + | |
| - | Last Seen | + | |
| - | Local ID 096941d6-1c72-49bd-862b-9bfc3aad32e5 | + | |
| - | + | ||
| - | Raw Audit Messages | + | |
| - | type=AVC msg=audit(1579791870.276:244): avc: denied | + | |
| - | + | ||
| - | + | ||
| - | type=SYSCALL msg=audit(1579791870.276: | + | |
| - | + | ||
| - | Hash: httpd, | + | |
| </ | </ | ||
| - | Ce message a été généré parce que le repertoire /www ainsi que le fichier index.html ne possèdent pas le **type** nécessaire pour que le service apache puisse les utiliser | + | Dernièrement, |
| < | < | ||
| - | [root@centos6 | + | [root@centos8 |
| - | -rw-r--r--. root root unconfined_u: | + | 4.18.0-553.16.1.el8.ittraining.x86_64 |
| </ | </ | ||
| - | < | + | =====LAB |
| - | [root@centos7 ~]# ls -Z / | + | |
| - | -rw-r--r--. root root unconfined_u: | + | |
| - | </ | + | |
| - | L'exemple ci-dessus nous montre clairement que le type pour **/www/ | + | Sous Linux il est possible de mettre en place des quotas par utilisateur et par groupe. Ceci étant, Linux ne sait pas gérer des quotas par répertoire, |
| + | quotas par partition. | ||
| - | Modifiez donc la SC de /www et / | + | Déconnectez-vous |
| < | < | ||
| - | [root@centos7 | + | root@computeXX:~# ssh -l root 10.0.2.45 |
| - | changing security context of ‘/ | + | root@10.0.2.45' |
| - | changing security context of ‘/www’ | + | Activate the web console with: systemctl enable --now cockpit.socket |
| - | [root@centos7 | + | Last login: Wed Jul 21 11:14:31 2021 |
| - | -rw-r--r--. root root unconfined_u: | + | [root@centos8 |
| </ | </ | ||
| - | Afin de maintenir ces SC lors d'une **restauration | + | Avant de mettre en place des quotas, configurer SELINUX en mode **permissive** afin de ne pas avoir d'erreurs de ce dernier |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 ~]# getenforce |
| + | Enforcing | ||
| + | [root@centos8 ~]# setenforce permissive | ||
| + | [root@centos8 ~]# getenforce | ||
| + | Permissive | ||
| + | [root@centos8 | ||
| </ | </ | ||
| - | ====La commande restorecon==== | + | Editez ensuite le fichier / |
| - | <file> | + | <code> |
| - | usage: | + | [root@centos8 ~]# vi / |
| - | </file> | + | [root@centos8 ~]# cat /etc/ |
| - | Pour illustrer l' | + | # This file controls the state of SELinux on the system. |
| + | # SELINUX= can take one of these three values: | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | SELINUX=permissive | ||
| + | # SELINUXTYPE= can take one of these three values: | ||
| + | # | ||
| + | # | ||
| + | # mls - Multi Level Security protection. | ||
| + | SELINUXTYPE=targeted | ||
| - | < | ||
| - | [root@centos7 ~]# cd /tmp ; touch copy.html move.html | ||
| - | [root@centos7 tmp]# ls -Z | grep html | ||
| - | -rw-r--r--. root root unconfined_u: | ||
| - | -rw-r--r--. root root unconfined_u: | ||
| </ | </ | ||
| - | **Copiez** | + | Commencez par vérifiez que le paquet |
| < | < | ||
| - | [root@centos7 tmp]# cp copy.html / | + | [root@centos8 ~]# rpm -qa | grep quota |
| - | [root@centos7 tmp]# mv move.html / | + | quota-4.04-12.el8.x86_64 |
| - | [root@centos7 tmp]# ls -Z / | + | quota-nls-4.04-12.el8.noarch |
| - | -rw-r--r--. root root unconfined_u: | + | |
| - | -rw-r--r--. root root unconfined_u: | + | |
| - | -rw-r--r--. root root unconfined_u: | + | |
| </ | </ | ||
| - | <WRAP center round important 50%> | + | Editez le fichier |
| - | **Important** : Notez ici que copy.html a pris le type du répertoire de destination tandis que move.html retient le type obtenu lors de la création. | + | |
| - | </ | + | |
| - | + | ||
| - | Restaurez maintenant la SC par défaut de move.html compte tenu de son emplacement | + | |
| < | < | ||
| - | [root@centos7 tmp]# restorecon -v /var/www/ | + | [root@centos8 ~]# vi /etc/fstab |
| - | restorecon reset /var/www/html/move.html context unconfined_u: | + | [root@centos8 ~]# cat /etc/fstab |
| - | [root@centos7 tmp]# ls -Z /var/www/html | + | # |
| - | -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t: | + | # /etc/fstab |
| - | -rw-r--r--. root root unconfined_u: | + | # Created by anaconda on Wed Jun 16 06:21:32 2021 |
| - | -rw-r--r--. root root unconfined_u: | + | # |
| + | # Accessible filesystems, | ||
| + | # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info. | ||
| + | # | ||
| + | # After editing this file, run ' | ||
| + | # units generated from this file. | ||
| + | # | ||
| + | / | ||
| + | UUID=1c04981e-5317-4b73-9695-3ce25246835d /boot | ||
| + | / | ||
| + | UUID=f76d6b66-985b-4a91-af9c-4987e8c1443c /home | ||
| </ | </ | ||
| - | ====Le fichier / | + | Redémarrez |
| - | + | ||
| - | En cas de besoin il est intéressant de pouvoir restaurer les SC par défaut sur l' | + | |
| < | < | ||
| - | [root@centos7 tmp]# touch / | + | [root@centos8 ~]# reboot |
| - | [root@centos7 tmp]# shutdown -r now | + | |
| </ | </ | ||
| - | ====La commande semanage==== | + | Reconnectez-vous |
| - | + | ||
| - | La commande | + | |
| < | < | ||
| - | [root@centos7 tmp]# semanage | + | root@computeXX:~# ssh -l root 10.0.2.45 |
| - | usage: semanage [-h] | + | root@10.0.2.45's password: fenestros |
| - | + | Activate the web console with: systemctl enable --now cockpit.socket | |
| - | {import, | + | |
| - | | + | |
| - | semanage is used to configure certain elements of SELinux policy with-out | + | Last login: Wed Jul 21 11:19:46 2021 |
| - | requiring modification to or recompilation from policy source. | + | [root@centos8 ~]# |
| + | </ | ||
| - | positional arguments: | + | Vérifiez ensuite que les options **usrquota** et **grpquota** soient prises en compte |
| - | {import, | + | |
| - | import | + | |
| - | export | + | |
| - | login | + | |
| - | confined users | + | |
| - | user Manage SELinux confined users (Roles and levels for an | + | |
| - | SELinux user) | + | |
| - | port Manage network port type definitions | + | |
| - | interface | + | |
| - | module | + | |
| - | node Manage network node type definitions | + | |
| - | fcontext | + | |
| - | boolean | + | |
| - | permissive | + | |
| - | dontaudit | + | |
| - | optional arguments: | + | < |
| - | -h, --help | + | [root@centos8 ~]# cat /etc/mtab | grep /home |
| + | /dev/sdc1 /home ext4 rw, | ||
| </ | </ | ||
| - | Pour illustrer l' | + | ====3.1 - La Commande quotacheck==== |
| - | %%SELinux%% gère aussi l' | + | Pour activer |
| < | < | ||
| - | [root@centos7 tmp]# semanage port -l | + | [root@centos8 ~]# quotacheck |
| - | SELinux Port Type Proto Port Number | + | quotacheck: Your kernel probably supports journaled quota but you are not using it. Consider switching to journaled quota to avoid running quotacheck after an unclean shutdown. |
| - | + | quotacheck: Scanning /dev/sdc1 [/home] done | |
| - | afs3_callback_port_t | + | quotacheck: Cannot stat old user quota file / |
| - | afs3_callback_port_t | + | quotacheck: Cannot stat old group quota file / |
| - | afs_bos_port_t | + | quotacheck: Cannot stat old user quota file / |
| - | afs_fs_port_t | + | quotacheck: Cannot stat old group quota file / |
| - | afs_fs_port_t | + | quotacheck: Checked 6763 directories and 129772 files |
| - | afs_ka_port_t | + | quotacheck: Old file not found. |
| - | afs_pt_port_t | + | quotacheck: Old file not found. |
| - | afs_pt_port_t | + | |
| - | afs_vl_port_t | + | |
| - | agentx_port_t | + | |
| - | agentx_port_t | + | |
| - | amanda_port_t | + | |
| - | amanda_port_t | + | |
| - | amavisd_recv_port_t | + | |
| - | amavisd_send_port_t | + | |
| - | amqp_port_t | + | |
| - | amqp_port_t | + | |
| - | aol_port_t | + | |
| - | aol_port_t | + | |
| - | apc_port_t | + | |
| - | apc_port_t | + | |
| - | apcupsd_port_t | + | |
| - | apcupsd_port_t | + | |
| - | apertus_ldp_port_t | + | |
| - | apertus_ldp_port_t | + | |
| - | asterisk_port_t | + | |
| - | asterisk_port_t | + | |
| - | audit_port_t | + | |
| - | auth_port_t | + | |
| - | bacula_port_t | + | |
| - | bacula_port_t | + | |
| - | bctp_port_t | + | |
| - | bctp_port_t | + | |
| - | bgp_port_t | + | |
| - | bgp_port_t | + | |
| - | boinc_client_port_t | + | |
| - | boinc_client_port_t | + | |
| - | boinc_port_t | + | |
| - | brlp_port_t | + | |
| - | certmaster_port_t | + | |
| - | chronyd_port_t | + | |
| - | clamd_port_t | + | |
| - | clockspeed_port_t | + | |
| - | cluster_port_t | + | |
| - | cluster_port_t | + | |
| - | cma_port_t | + | |
| - | cma_port_t | + | |
| - | cobbler_port_t | + | |
| - | collectd_port_t | + | |
| - | commplex_link_port_t | + | |
| - | commplex_link_port_t | + | |
| - | commplex_main_port_t | + | |
| - | commplex_main_port_t | + | |
| - | comsat_port_t | + | |
| - | condor_port_t | + | |
| - | condor_port_t | + | |
| - | conman_port_t | + | |
| - | conman_port_t | + | |
| - | connlcli_port_t | + | |
| - | connlcli_port_t | + | |
| - | couchdb_port_t | + | |
| - | couchdb_port_t | + | |
| - | ctdb_port_t | + | |
| - | ctdb_port_t | + | |
| - | cvs_port_t | + | |
| - | cvs_port_t | + | |
| - | cyphesis_port_t | + | |
| - | cyphesis_port_t | + | |
| - | cyrus_imapd_port_t | + | |
| - | daap_port_t | + | |
| - | daap_port_t | + | |
| - | dbskkd_port_t | + | |
| - | dcc_port_t | + | |
| - | dccm_port_t | + | |
| - | dccm_port_t | + | |
| - | dey_keyneg_port_t | + | |
| - | dey_keyneg_port_t | + | |
| - | dey_sapi_port_t | + | |
| - | dhcpc_port_t | + | |
| - | dhcpc_port_t | + | |
| - | dhcpd_port_t | + | |
| - | dhcpd_port_t | + | |
| - | dict_port_t | + | |
| - | distccd_port_t | + | |
| - | dns_port_t | + | |
| - | dns_port_t | + | |
| - | dnssec_port_t | + | |
| - | dogtag_port_t | + | |
| - | echo_port_t | + | |
| - | echo_port_t | + | |
| - | efs_port_t | + | |
| - | embrace_dp_c_port_t | + | |
| - | embrace_dp_c_port_t | + | |
| - | ephemeral_port_t | + | |
| - | ephemeral_port_t | + | |
| - | epmap_port_t | + | |
| - | epmap_port_t | + | |
| - | epmd_port_t | + | |
| - | epmd_port_t | + | |
| - | fac_restore_port_t | + | |
| - | fac_restore_port_t | + | |
| - | fingerd_port_t | + | |
| - | flash_port_t | + | |
| - | flash_port_t | + | |
| - | fmpro_internal_port_t | + | |
| - | fmpro_internal_port_t | + | |
| - | freeipmi_port_t | + | |
| - | freeipmi_port_t | + | |
| - | ftp_data_port_t | + | |
| - | ftp_port_t | + | |
| - | ftp_port_t | + | |
| - | gatekeeper_port_t | + | |
| - | gatekeeper_port_t | + | |
| - | gdomap_port_t | + | |
| - | gdomap_port_t | + | |
| - | gds_db_port_t | + | |
| - | gds_db_port_t | + | |
| - | gear_port_t | + | |
| - | gear_port_t | + | |
| - | geneve_port_t | + | |
| - | giftd_port_t | + | |
| - | git_port_t | + | |
| - | git_port_t | + | |
| - | glance_port_t | + | |
| - | glance_port_t | + | |
| - | glance_registry_port_t | + | |
| - | glance_registry_port_t | + | |
| - | gluster_port_t | + | |
| - | gluster_port_t | + | |
| - | gopher_port_t | + | |
| - | gopher_port_t | + | |
| - | gpsd_port_t | + | |
| - | hadoop_datanode_port_t | + | |
| - | hadoop_namenode_port_t | + | |
| - | hddtemp_port_t | + | |
| - | hi_reserved_port_t | + | |
| - | hi_reserved_port_t | + | |
| - | howl_port_t | + | |
| - | howl_port_t | + | |
| - | hplip_port_t | + | |
| - | http_cache_port_t | + | |
| - | http_cache_port_t | + | |
| - | http_port_t | + | |
| - | ... | + | |
| </ | </ | ||
| - | Notez par exemple que le serveur apache est autorisé d' | + | Les options de la commande quotacheck sont : |
| - | <file> | + | <code> |
| - | http_port_t | + | [root@centos8 ~]# quotacheck --help |
| - | </file> | + | Utility for checking and repairing quota files. |
| + | quotacheck [-gucbfinvdmMR] [-F <quota-format>] filesystem|-a | ||
| - | Dans le cas où on souhaite qu' | + | -u, --user |
| + | -g, --group | ||
| + | -c, --create-files | ||
| + | -b, --backup | ||
| + | -f, --force | ||
| + | -i, --interactive | ||
| + | -n, --use-first-dquot | ||
| + | -v, --verbose | ||
| + | -d, --debug | ||
| + | -m, --no-remount | ||
| + | -M, --try-remount | ||
| + | continue even if it fails | ||
| + | -R, --exclude-root | ||
| + | -F, --format=formatname | ||
| + | -a, --all check all filesystems | ||
| + | -h, --help | ||
| + | -V, --version | ||
| - | < | + | Bugs to jack@suse.cz |
| - | [root@centos7 ~]# semanage port -a -t http_port_t -p tcp 8090 | + | |
| </ | </ | ||
| - | Vous noterez que le port 8090 a été ajouté à la liste des ports reconnus comme valides par %%SELinux%% | + | Les quotas ont été activés et les fichier **aquota.user** et **aquota.group** ont été créés dans le répertoire /home : |
| < | < | ||
| - | [root@centos7 tmp]# semanage port -l | grep http | + | [root@centos8 ~]# ls -la /home |
| - | http_cache_port_t | + | total 40 |
| - | http_cache_port_t | + | drwxr-xr-x. 4 root root 4096 Jul 21 11:27 . |
| - | http_port_t | + | dr-xr-xr-x. 17 root root 224 Jul 19 12:05 .. |
| - | pegasus_http_port_t | + | -rw-------. |
| - | pegasus_https_port_t | + | -rw-------. |
| + | drwx------. | ||
| + | drwxr-xr-x. 17 trainee trainee | ||
| </ | </ | ||
| - | ====La commande audit2allow==== | + | Créez maintenant un utilisateur **fenestros** avec le mot de passe **fenestros** : |
| < | < | ||
| - | [root@centos7 tmp]# audit2allow | + | [root@centos8 ~]# groupadd fenestros && useradd fenestros |
| - | Usage: audit2allow [options] | + | [root@centos8 ~]# passwd fenestros |
| - | + | Changing password | |
| - | Options: | + | New password: |
| - | | + | BAD PASSWORD: The password contains |
| - | -h, --help | + | Retype new password: |
| - | -b, --boot | + | passwd: all authentication tokens updated successfully. |
| - | -a, --all read input from audit log - conflicts with -i | + | |
| - | -p POLICY, --policy=POLICY | + | |
| - | | + | |
| - | -d, --dmesg | + | |
| - | | + | |
| - | -i INPUT, --input=INPUT | + | |
| - | read input from < | + | |
| - | -l, --lastreload | + | |
| - | -r, --requires | + | |
| - | -m MODULE, --module=MODULE | + | |
| - | set the module | + | |
| - | -M MODULE_PACKAGE, | + | |
| - | | + | |
| - | -o OUTPUT, --output=OUTPUT | + | |
| - | append output to < | + | |
| - | -D, --dontaudit | + | |
| - | -R, --reference | + | |
| - | -N, --noreference | + | |
| - | -v, --verbose | + | |
| - | -e, --explain | + | |
| - | -t TYPE, --type=TYPE | + | |
| - | regex | + | |
| - | --perm-map=PERM_MAP | + | |
| - | --interface-info=INTERFACE_INFO | + | |
| - | file name of interface information | + | |
| - | --debug | + | |
| - | -w, --why | + | |
| - | of why the access was denied | + | |
| </ | </ | ||
| - | La création d'un module de politique personnalisé se fait en utilisant la commande **audit2allow**. L' | + | ====3.2 - La Commande edquota==== |
| - | + | ||
| - | * la résolution du problème n'est pas possible en utilisant une des commandes précédemment citées, | + | |
| - | * il n' | + | |
| - | Pour illustrer l' | + | Mettez en place maintenant un quota de 10Mo pour l'utilisateur **fenestros** |
| < | < | ||
| - | [root@centos7 tmp]# mkdir /www1 | + | [root@centos8 ~]# edquota -u fenestros -f /home |
| - | [root@centos7 tmp]# touch / | + | |
| </ | </ | ||
| - | Éditez le fichier | + | L' |
| < | < | ||
| - | [...] | + | Disk quotas for user fenestros (uid 1001): |
| - | # | + | |
| - | DocumentRoot "/ | + | |
| - | [...] | + | |
| </ | </ | ||
| - | Ajoutez les section **< | + | Modifiez ce fichier ainsi : |
| < | < | ||
| - | ... | + | Disk quotas for user fenestros (uid 1001): |
| - | < | + | |
| - | AllowOverride None | + | |
| - | # Allow open access: | + | </file> |
| - | Require all granted | + | |
| - | </Directory> | + | |
| - | < | + | Sauvegardez et quittez le fichier. |
| - | Options Indexes FollowSymLinks | + | |
| - | AllowOverride None | + | |
| - | Require all granted | + | |
| - | </ | + | |
| - | + | ||
| - | # Further relax access to the default document root: | + | |
| - | < | + | |
| - | ... | + | |
| - | </ | + | |
| - | Créez le fichier | + | Les options de la commande |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | [root@centos7 ~]# vi /www1/index.html | + | edquota: Usage: |
| - | [root@centos7 ~]# cat /www1/index.html | + | |
| - | < | + | |
| - | < | + | |
| - | This is a test | + | |
| - | </ | + | |
| - | < | + | |
| - | www test page | + | |
| - | </ | + | |
| - | </ | + | |
| - | </ | + | |
| - | Modifiez ensuite le propriétaire et le groupe du répertoire **/www1** et son contenu : | + | -u, --user |
| + | -g, --group | ||
| + | -P, --project | ||
| + | -r, --remote | ||
| + | -m, --no-mixed-pathnames | ||
| + | -F, --format=formatname | ||
| + | -p, --prototype=name | ||
| + | --always-resolve | ||
| + | composed only of digits | ||
| + | -f, --filesystem=filesystem | ||
| + | -t, --edit-period | ||
| + | -T, --edit-times | ||
| + | -h, --help | ||
| + | -V, --version | ||
| - | < | + | Bugs to: jack@suse.cz |
| - | [root@centos7 ~]# chown -R apache:apache /www1 | + | |
| </ | </ | ||
| - | Redémarrez le service httpd : | + | <WRAP center round important 60%> |
| + | **Important** - Pour mettre en place un quota par group, la procédure est similaire. Il suffit d' | ||
| + | </ | ||
| - | < | + | ====3.3 - La Commande quotaon==== |
| - | [root@centos7 ~]# systemctl restart httpd.service | + | |
| - | </ | + | |
| - | Consultez le site localhost en utilisant **lynx** | + | Appliquez maintenant les quotas |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| </ | </ | ||
| - | Le fichier **/ | + | Les options |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | type=USER_AVC msg=audit(1462020229.957:425): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u: | + | quotaon: Usage: |
| - | type=AVC msg=audit(1524491216.546: | + | |
| - | type=AVC msg=audit(1524491220.766:622): avc: denied | + | |
| - | type=AVC msg=audit(1529418883.052:818): avc: denied | + | |
| - | type=AVC msg=audit(1529418883.052: | + | |
| - | type=AVC msg=audit(1529418919.091: | + | |
| - | type=AVC msg=audit(1529418919.092: | + | |
| - | type=AVC msg=audit(1529418954.500: | + | |
| - | type=AVC msg=audit(1529418954.500: | + | |
| - | type=AVC msg=audit(1529419054.949: | + | |
| - | type=AVC msg=audit(1529419054.949: | + | |
| - | type=USER_AVC msg=audit(1529421001.608: | + | |
| - | type=USER_AVC msg=audit(1529421602.007: | + | |
| - | type=AVC msg=audit(1529422368.058: | + | |
| - | type=AVC msg=audit(1529422368.058: | + | |
| - | </ | + | |
| - | A l'aide de la commande grep, il convient maintenant d' | + | -a, --all turn quotas on for all filesystems |
| - | + | -f, --off turn quotas off | |
| - | < | + | -u, --user |
| - | [root@centos7 ~]# grep httpd_t / | + | -g, --group |
| + | -P, --project | ||
| + | -p, --print-state | ||
| + | -x, --xfs-command=cmd | ||
| + | -F, --format=formatname | ||
| + | -v, --verbose | ||
| + | -h, --help | ||
| + | -V, --version | ||
| </ | </ | ||
| - | L' | + | De cette manière vous avez mis en place un quota **souple** pour fenestros |
| - | < | + | Quand l' |
| - | [root@centos7 ~]# cat httpdlocal.te | + | |
| - | module httpdlocal 1.0; | + | Il est à noter que vous pouvez soit mettre en place un quota en taille, soit mettre en place un quota basé sur le nombre d' |
| - | require { | + | <WRAP center round important 60%> |
| - | type httpd_t; | + | **important** - La commande pour désactivez les quotas est **quotaoff**. |
| - | type default_t; | + | </ |
| - | class file getattr; | + | |
| - | } | + | |
| - | # | + | ====3.4 - La Commande repquota==== |
| - | #!!!! WARNING: ' | + | Pour visualiser les quotas utilisez la commande **repquota** |
| - | #!!!! The file '/www/ | + | |
| - | #!!!! Fix with $ restorecon -R -v /www/index.html | + | < |
| - | allow httpd_t default_t:file getattr; | + | [root@centos8 ~]# repquota |
| + | *** Report for user quotas on device | ||
| + | Block grace time: 7days; Inode grace time: 7days | ||
| + | Block limits | ||
| + | User used soft hard grace used soft hard grace | ||
| + | ---------------------------------------------------------------------- | ||
| + | root -- 20 | ||
| + | trainee | ||
| + | |||
| </ | </ | ||
| - | L'audit du fichier terminé, il faut maintenant utiliser audit2allow | + | <WRAP center round important 60%> |
| + | **Important** - Notez que l'utilisateur fenestros ne figure pas dans la liste. Sous RHEL / CentOS, le quota n'est pas visible tant que l' | ||
| + | </ | ||
| + | |||
| + | Les options | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | ******************** IMPORTANT *********************** | + | repquota: Utility for reporting quotas. |
| - | To make this policy package active, execute: | + | Usage: |
| + | repquota [-vugsi] [-c|C] [-t|n] [-F quotaformat] [-O (default | xml | csv)] (-a | mntpoint) | ||
| - | semodule | + | -v, --verbose |
| + | -u, --user | ||
| + | -g, --group | ||
| + | -P, --project | ||
| + | -s, --human-readable | ||
| + | -t, --truncate-names | ||
| + | -p, --raw-grace | ||
| + | -n, --no-names | ||
| + | -i, --no-autofs | ||
| + | -c, --cache | ||
| + | -C, --no-cache | ||
| + | -F, --format=formatname | ||
| + | -O, --output=format | ||
| + | -a, --all | ||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | Bugs to jack@suse.cz | ||
| </ | </ | ||
| - | Chargez maintenant le module dans la politique %%SELinux%% | + | ====3.5 - La Commande quota==== |
| + | |||
| + | Pour visualiser les quotas d'un utilisateur spécifique, | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| + | Disk quotas for user fenestros (uid 1001): no limited resources used | ||
| + | [root@centos8 ~]# su - fenestros | ||
| + | [fenestros@centos8 ~]$ touch test | ||
| + | [fenestros@centos8 ~]$ exit | ||
| + | logout | ||
| + | [root@centos8 ~]# quota fenestros | ||
| + | Disk quotas for user fenestros (uid 1001): | ||
| + | | ||
| + | / | ||
| </ | </ | ||
| - | Vérifiez que le module est chargé | + | Les options de la commande **quota** sont : |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | httpdlocal 1.0 | + | quota: Usage: quota [-guPqvswim] [-l | [-Q | -A]] [-F quotaformat] |
| - | </ | + | quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -u username ... |
| + | quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -g groupname ... | ||
| + | quota [-qvswugPQm] [-F quotaformat] -f filesystem ... | ||
| - | Redémarrez le service httpd : | + | -u, --user |
| + | -g, --group | ||
| + | -P, --project | ||
| + | -q, --quiet | ||
| + | -v, --verbose | ||
| + | -s, --human-readable | ||
| + | --always-resolve | ||
| + | composed of only digits | ||
| + | -w, --no-wrap | ||
| + | -p, --raw-grace | ||
| + | -l, --local-only | ||
| + | -Q, --quiet-refuse | ||
| + | not respond | ||
| + | -i, --no-autofs | ||
| + | -F, --format=formatname | ||
| + | -f, --filesystem-list | ||
| + | -A, --all-nfs | ||
| + | -m, --no-mixed-pathnames | ||
| + | --show-mntpoint | ||
| + | --hide-device | ||
| + | -h, --help | ||
| + | -V, --version | ||
| - | < | + | Bugs to: jack@suse.cz |
| - | [root@centos7 ~]# systemctl restart httpd.service | + | |
| </ | </ | ||
| - | Videz le fichier | + | ====3.6 - La Commande warnquota==== |
| + | |||
| + | La commande | ||
| + | |||
| + | Sous RHEL/ | ||
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| + | /usr/bin/which: no warnquota in (/usr/ | ||
| </ | </ | ||
| - | Consultez | + | Installez donc le paquet **quota-warnquota** |
| < | < | ||
| - | [root@centos7 ~]# lynx localhost | + | [root@centos7 ~]# dnf install quota-warnquota |
| + | ... | ||
| </ | </ | ||
| - | Constatez que la consultation ne génère plus de messages de type **AVC** : | + | Les options de la commande |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | [root@centos7 ~]# | + | warnquota: Usage: |
| + | warnquota | ||
| + | |||
| + | -u, --user | ||
| + | -g, --group | ||
| + | -s, --human-readable | ||
| + | -i, --no-autofs | ||
| + | -d, --no-details | ||
| + | -F, --format=formatname | ||
| + | -c, --config=config-file | ||
| + | -q, --quota-tab=quotatab-file | ||
| + | -a, --admins-file=admins-file | ||
| + | -h, --help | ||
| + | -v, --version | ||
| + | |||
| + | warnquota: Bugs to jack@suse.cz | ||
| </ | </ | ||
| ----- | ----- | ||
| - | < | + | Copyright © 2024 Hugh Norris. |
| - | <div align=" | + | |
| - | Copyright © 2021 Hugh Norris.< | + | |
| - | </ | + | |
| - | </ | + | |
