API tools faq
paste
sandervanvugt

selinux dec21

sandervanvugt
Dec 7th, 2021
192
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.40 KB | None | 0 0
raw download clone embed print report
  1. 1 ls -lZ /var/www
  2. 2 dnf install -y httpd
  3. 3 systemctl enable --now httpd
  4. 4 ps Zaux | grep http
  5. 5 getenforce
  6. 6 setenforce permissive
  7. 7 getenforce
  8. 8 vim /etc/sysconfig/selinux
  9. 9 reboot
  10. 10 getenforce
  11. 11 ls -Za
  12. 12 vim /etc/sysconfig/selinux
  13. 13 useradd linda
  14. 14 vim /etc/default/grub
  15. 15 grub2-mkconfig -o /boot/grub2/grub.cfg
  16. 16 reboot
  17. 17 id -Z
  18. 18 useradd anna
  19. 19 exit
  20. 20 cd /etc/selinux/
  21. 21 ls
  22. 22 cd targeted/
  23. 23 ls
  24. 24 tree contexts/
  25. 25 cd
  26. 26 dnf install -y git
  27. 27 git clone https://github.com/sandervanvugt/selinux
  28. 28 cd selinux/
  29. 29 ls
  30. 30 ./countdown 12
  31. 31 pwd
  32. 32 cd ..
  33. 33 git clone https://github.com/SELinuxProject/refpolicy
  34. 34 cd refpolicy/
  35. 35 ls
  36. 36 id linda
  37. 37 ls -Z /etc
  38. 38 sestatus
  39. 39 cd /etc/selinux/
  40. 40 ls
  41. 41 ls -l
  42. 42 cat config
  43. 43 dnf search policy
  44. 44 dnf install -y selinux-policy-minimum
  45. 45 ls
  46. 46 dnf install -y selinux-policy-minimum
  47. 47 dnf search policy
  48. 48 cd
  49. 49 mkdir /web
  50. 50 vim /web/index.html
  51. 51 vim /etc/httpd/conf/httpd.conf
  52. 52 systemctl restart httpd
  53. 53 systemctl status httpd
  54. 54 grep AVC /var/log/audit/audit.log
  55. 55 curl http://localhost
  56. 56 systemctl status httpd
  57. 57 grep AVC /var/log/audit/audit.log | grep http
  58. 58 setenforce Permissive
  59. 59 curl http://localhost
  60. 60 grep AVC /var/log/audit/audit.log | grep http
  61. 61 grep AVC /var/log/audit/audit.log
  62. 62 vim /etc/httpd/conf/httpd.conf
  63. 63 systemctl restart httpd
  64. 64 systemctl status httpd
  65. 65 curl localhost
  66. 66 getenforce
  67. 67 setenforce enforcing
  68. 68 curl localhost
  69. 69 grep AVC /var/log/audit/audit.log
  70. 70 semanage --help
  71. 71 man semanage-fcontext
  72. 72 semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
  73. 73 cd /etc/selinux/targeted/contexts/files/
  74. 74 ls
  75. 75 ls -l
  76. 76 cat file_contexts.local
  77. 77 ls -dZ /web
  78. 78 restorecon -Rv /web
  79. 79 getenforce
  80. 80 curl localhost
  81. 81 cd
  82. 82 selinux/countdown 1
  83. 83 history
  84. 84 cd /var/www/
  85. 85 ls -Z
  86. 86 ps -eZ | grep dbus
  87. 87 semanage fcontext -l
  88. 88 semanage fcontext -l | grep http
  89. 89 seinfo -t
  90. 90 seinfo -t | grep http
  91. 91 dnf install selinux-policy-doc
  92. 92 mandb
  93. 93 man -k _selinux
  94. 94 man -k _selinux | wc
  95. 95 man -k _selinux | grep http
  96. 96 man httpd_selinux
  97. 97 cd
  98. 98 selinux/countdown 12
  99. 99 ls -Z /etc/hosts
  100. 100 cp /etc/hosts /tmp/
  101. 101 ls -Z /tmp/hosts
  102. 102 ls -Zd /tmp
  103. 103 mv /tmp/hosts .
  104. 104 ls -Z
  105. 105 systemctl status auditd
  106. 106 vim /etc/ssh/sshd_config
  107. 107 systemctl restart sshd
  108. 108 systemctl status sshd
  109. 109 grep AVC /var/log/audit/audit.log
  110. 110 journalctl | grep sealert
  111. 111 sealert -l ccebf57e-e354-42e1-8a75-cc59e5251685 | less
  112. 112 semanage port -a -t ssh_port_t -p tcp 2022
  113. 113 systemctl restart sshd
  114. 114 systemctl status sshd
  115. 115 journalctl | grep sealert
  116. 116 sealert -l 102c93df-48ca-4623-b8e4-3f5729560b66 | less
  117. 117 # ausearch -c 'httpd' --raw | audit2allow -M my-httpd
  118. 118 # semodule -X 300 -i my-httpd.pp
  119. 119 ausearch -c 'httpd' --raw
  120. 120 ausearch -c 'httpd' --raw | grep AVC
  121. 121 # ausearch -c 'httpd' --raw | audit2allow -M my-httpd
  122. 122 ausearch -c 'httpd' --raw | audit2allow -M my-httpd
  123. 123 semodule -i my-httpd.pp
  124. 124 getsebool -a
  125. 125 getsebool -a | wc
  126. 126 getsebool -a | grep http
  127. 127 setsebool -P httpd_use_nfs
  128. 128 setsebool -P httpd_use_nfs=on
  129. 129 dnf provides */sealert
  130. 130 rpm -ql setroubleshoot-server | grep bin
  131. 131 dnf install vsftpd
  132. 132 ls -lZd /var/ftp/pub
  133. 133 chmod 777 /var/ftp/pub
  134. 134 vim /etc/vsftpd/vsftpd.conf
  135. 135 systemctl enable --now vsftpd
  136. 136 dnf install -y lftp
  137. 137 lftp localhost
  138. 138 grep AVC /var/log/audit/audit.log
  139. 139 journalctl | grep sealert
  140. 140 sealert -l 38f6d3a0-362a-4899-8aee-7f6ea55b5111 | less
  141. 141 sesearch -b ftpd_anon_write -A
  142. 142 sesearch -b ftpd_full_access -A
  143. 143 sesearch -s httpd_t -t user_home_t -p read -A
  144. 144 ps Zaux | grep ftp
  145. 145 sesearch -A | grep ftpd_t
  146. 146 sesearch -A | grep ftpd_t | wc
  147. 147 ldd $(which vsftpd)
  148. 148 ldd $(which httpd)
  149. 149 semanage permissive -l
  150. 150 echo Dan Walsh
  151. 151 seinfo -aunconfined_domain_type -x
  152. 152 seinfo -tunconfined_t
  153. 153 selinux/countdown 18
  154. 154 dnf module install -y container-tools
  155. 155 podman run --env container=podman -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it ubi8 bash
  156. 156 podman run --env container=podman -v /home:/home:ro -v /var/spool:/var/spool:rw -it ubi8 bash
  157. 157 podman ps
  158. 158 podman ps -a
  159. 159 podman inspect 47988f834c8c > ubi8.json
  160. 160 vim ubi8.json
  161. 161 udica -j ubi8.json ubi8pol
  162. 162 semodule -i ubi8pol.cil /usr/share/udica/templates/{base_container.cil,home_container.cil}
  163. 163 podman run --security-opt label=type:ubi8pol.process -v /home:/home:ro -v /var/spool:/var/spool:rw -it ubi8 bash
  164. 164 podman run -v /home:/home:Z -v /var/spool:/var/spool:Z -it ubi8 bash
  165. 165 podman run -v /dummy:/dummy:Z -it ubi8 bash
  166. 166 mkdir /dummy
  167. 167 podman run -v /dummy:/dummy:Z -it ubi8 bash
  168. 168 ls -dZ /dummy/
  169. 169 semodule -l
  170. 170 ls
  171. 171 grep http /var/log/audit/audit.log | grep AVC | audit2allow -M mypolicy
  172. 172 vim mypolicy.te
  173. 173 ls
  174. 174 semodule -l | grep my-
  175. 175 semodule -d my-httpd
  176. 176 cd refpolicy/
  177. 177 ls
  178. 178 cd policy/
  179. 179 ls
  180. 180 cd modules/
  181. 181 ls
  182. 182 cd services/
  183. 183 ls
  184. 184 vim ftp.te
  185. 185 history
  186. 186 seinfo -c
  187. 187 seinfo -cipx_socket -x
  188. 188 seinfo -csocket -x
  189. 189 seinfo -cfile -x
  190. 190 grep AVC /var/log/audit/audit.log | grep http | audit2allow > myfile.txt
  191. 191 vim myfile.t
  192. 192 grep AVC /var/log/audit/audit.log | grep http > myfile.txt
  193. 193 cat myfile.txt
  194. 194 cat myfile.txt | audit2allow
  195. 195 cd
  196. 196 vim sander.te
  197. 197 vim sander.fc
  198. 198 checkmodule -M -m -o sander.mod sander.te
  199. 199 semodule_package -o sander.pp -m sander.mod -f sander.fc
  200. 200 semodule -i sander.pp
  201. 201 mkdir /opt/sander
  202. 202 ls -Zd /opt/sander
  203. 203 restorecon -Rv /opt/sander
  204. 204 grep AVC /var/log/audit/audit.log | grep http
  205. 205 semanage user -l
  206. 206 semanage login -l
  207. 207 selinux/countdown 12
  208. 208 semanage user -l
  209. 209 useradd linda
  210. 210 passwd linda
  211. 211 useradd -Z sysadm_u -G wheel lisa
  212. 212 passwd lisa
  213. 213 semanage login -l
  214. 214 ssh linda@localhost
  215. 215 vim /etc/ssh/sshd_config
  216. 216 systemctl restart sshd
  217. 217 ssh linda@localhost
  218. 218 id -Z
  219. 219 getsebool -a | grep ssh
  220. 220 setsebool -P selinuxuser_use_ssh_chroot on
  221. 221 ssh linda@localhost
  222. 222 ssh lisa@localhost
  223. 223 exit
  224. 224 cd selinux/
  225. 225 ls
  226. 226 vim setup-rot.sh
  227. 227 ./setup-rot.sh
  228. 228 ls
  229. 229 vim rot13.service
  230. 230 cat startrot13
  231. 231 dnf provides */sepolgen
  232. 232 dnf install policycoreutils-devel
  233. 233 sepolgen --application startrot13
  234. 234 cat startrot13.te
  235. 235 cat startrot13.fc
  236. 236 ls
  237. 237 vim startrot13.sh
  238. 238 vim startrot13.te
  239. 239 ./startrot13.sh
  240. 240 seinfo -t | grep start
  241. 241 systemctl stop vsftpd
  242. 242 runcon -u system -r system -t httpd_t vsftpd
  243. 243 runcon -u system_u -r system_r -t httpd_t vsftpd
  244. 244 grep AVC /var/log/audit/audit.log
  245. 245 journalctl | grep sealert
  246. 246 sealert -l b26f55c7-c963-4b01-ab1e-6fb579a77a52 | less
  247. 247 getenforce
  248. 248 setenforce permissive
  249. 249 runcon -u system_u -r system_r -t httpd_t vsftpd
  250. 250 journalctl | grep sealert
  251. 251 sealert -l 7b515e22-d08d-486d-87da-869fa9d522fb | less
  252. 252 # ausearch -c 'vsftpd' --raw | audit2allow -M my-vsftpd
  253. 253 # semodule -X 300 -i my-vsftpd.pp
  254. 254 ausearch -c 'vsftpd' --raw | audit2allow -M my-vsftpd
  255. 255 semodule -X 300 -i my-vsftpd.pp
  256. 256 setenforce enforcing
  257. 257 systemctl start vsftpd
  258. 258 journalctl | grep sealert
  259. 259 systemctl status vsftpd
  260. 260 grep AVC /var/log/audit/audit.log
  261. 261 ausearch -c 'vsftpd' --raw | audit2allow -M my-vsftpd
  262. 262 semodule -d my-vsftpd.pp
  263. 263 semodule -i my-vsftpd.pp
  264. 264 ausearch -c 'vsftpd' --raw | audit2allow -M your-vsftpd
  265. 265 semodule -i your-vsftpd.pp
  266. 266 systemctl stop vsftpd
  267. 267 systemctl sto vsftpd
  268. 268 systemctl start vsftpd
  269. 269 history
  270.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!