SELinux refpolicy详解(5)
接前一篇文章:SELinux refpolicy详解(4)
三、refpolicy内容详解
1. README
文件路径:refpolicy源码根目录/README。
文件内容如下:
1) Reference Policy make targets:General Make targets:install-src Install the policy sources into/etc/selinux/NAME/src/policy, where NAME is defined inthe Makefile. If not defined, the TYPE, as defined inthe Makefile, is used. The default NAME is refpolicy.A pre-existing source policy will be moved to/etc/selinux/NAME/src/policy.bak.conf Regenerate policy.xml, and update/create modules.confand booleans.conf. This should be done after addingor removing modules, or after running the bare target.If the configuration files exist, their settings willbe preserved. This must be ran on policy sources thatare checked out from the CVS repository before they canbe used.clean Delete all temporary files, compiled policies,and file_contexts. Configuration files are left intact.bare Do the clean make target and also delete configurationfiles, web page documentation, and policy.xml.html Regenerate policy.xml and create web page documentationin the doc/html directory.Make targets specific to modular (loadable modules) policies:base Compile and package the base module. This is thedefault target for modular policies.modules Compile and package all Reference Policy modulesconfigured to be built as loadable modules.MODULENAME.pp Compile and package the MODULENAME Reference Policymodule.all Compile and package the base module and all ReferencePolicy modules configured to be built as loadablemodules.install Compile, package, and install the base module andReference Policy modules configured to be built asloadable modules.load Compile, package, and install the base module andReference Policy modules configured to be built asloadable modules, then insert them into the modulestore.validate Validate if the configured modules can successfullylink and expand.install-headers Install the policy headers into /usr/share/selinux/NAME.The headers are sufficient for building a policymodule locally, without requiring the completeReference Policy sources. The build.conf settingsfor this policy configuration should be set beforeusing this target.build-interface-db Build the policy interface database with'sepolgen-ifgen'. This database is required forreference style policy generation by'audit2allow --reference'.Make targets specific to monolithic policies:policy Compile a policy locally for development and testing.This is the default target for monolithic policies.install Compile and install the policy and file contexts.load Compile and install the policy and file contexts, thenload the policy.enableaudit Remove all dontaudit rules from policy.conf.relabel Relabel the filesystem.checklabels Check the labels on the filesystem, and report whena file would be relabeled, but do not change its label.restorelabels Relabel the filesystem and report each file that isrelabeled.2) Reference Policy Build Options (build.conf)TYPE String. Available options are standard, mls, and mcs.For a type enforcement only system, set standard.This optionally enables multi-level security (MLS) ormulti-category security (MCS) features. This optioncontrols enable_mls, and enable_mcs policy blocks.NAME String (optional). Sets the name of the policy; theNAME is used when installing files to e.g.,/etc/selinux/NAME and /usr/share/selinux/NAME. If notset, the policy type (TYPE) is used.DISTRO String (optional). Enable distribution-specific policy.Available options are redhat, gentoo, and debian.This option controls distro_redhat, distro_gentoo, anddistro_debian build option policy blocks.MONOLITHIC Boolean. If set, a monolithic policy is built,otherwise a modular policy is built.DIRECT_INITRC Boolean. If set, sysadm will be allowed to directlyrun init scripts, instead of requiring the run_inittool. This is a build option instead of a tunable sincerole transitions do not work in conditional policy.This option controls direct_sysadm_daemon policyblocks.OUTPUT_POLICY Integer. Set the version of the policy created whenbuilding a monolithic policy. This option has no effecton modular policy.UNK_PERMS String. Set the kernel behavior for handling ofpermissions defined in the kernel but missing from thepolicy. The permissions can either be allowed (allow),denied (deny), or the policy loading can be rejected(reject).UBAC Boolean. If set, the SELinux user will be usedadditionally for approximate role separation.SYSTEMD Boolean. If set, systemd will be assumed to be the initprocess provider.MLS_SENS Integer. Set the number of sensitivities in the MLSpolicy. Ignored on standard and MCS policies.MLS_CATS Integer. Set the number of categories in the MLSpolicy. Ignored on standard and MCS policies.MCS_CATS Integer. Set the number of categories in the MCSpolicy. Ignored on standard and MLS policies.QUIET Boolean. If set, the build system will only displaystatus messages and error messages. This option has noeffect on policy.WERROR Boolean. If set, the build system will treat warningsas errors. If any warnings are encountered, the buildwill fail.3) Reference Policy Files and Directories
All directories relative to the root of the Reference Policy sources directory.Makefile General rules for building the policy.Rules.modular Makefile rules specific to building loadable modulepolicies.Rules.monolithic Makefile rules specific to building monolithic policies.build.conf Options which influence the building of the policy,such as the policy type and distribution.config/appconfig-* Application configuration files for all configurationsof the Reference Policy (targeted/strict with or withoutMLS or MCS). These are used by SELinux-aware programs.config/local.users The file read by load policy for adding SELinux usersto the policy on the fly.doc/html/* This contains the contents of the in-policy XMLdocumentation, presented in web page form.doc/policy.dtd The doc/policy.xml file is validated against this DTD.doc/policy.xml This file is generated/updated by the conf and html maketargets. It contains the complete XML documentationincluded in the policy.doc/templates/* Templates used for documentation web pages.policy/booleans.conf This file is generated/updated by the conf make target.It contains the booleans in the policy, and theirdefault values. If tunables are implemented asbooleans, tunables will also be included. This filewill be installed as the /etc/selinux/NAME/booleansfile.policy/constraints This file defines additional constraints on permissionsin the form of boolean expressions that must besatisfied in order for specified permissions to begranted. These constraints are used to further refinethe type enforcement rules and the role allow rules.Typically, these constraints are used to restrictchanges in user identity or role to certain domains.policy/global_booleans This file defines all booleans that have a global scope,their default value, and documentation.policy/global_tunables This file defines all tunables that have a global scope,their default value, and documentation.policy/flask/initial_sids This file has declarations for each initial SID.policy/flask/security_classes This file has declarations for each security class.policy/flask/access_vectors This file defines the access vectors. Commonprefixes for access vectors may be defined at thebeginning of the file. After the common prefixes aredefined, an access vector may be defined for eachsecurity class.policy/mcs The multi-category security (MCS) configuration.policy/mls The multi-level security (MLS) configuration.policy/modules/* Each directory represents a layer in Reference Policyall of the modules are contained in one of these layers.policy/modules.conf This file contains a listing of available modules, andhow they will be used when building Reference Policy. Toprevent a module from being used, set the module to"off". For monolithic policies, modules set to "base"and "module" will be included in the policy. Formodular policies, modules set to "base" will be includedin the base module; those set to "module" will becompiled as individual loadable modules.policy/support/* Support macros.policy/users This file defines the users included in the policy.support/* Tools used in the build process.4) Building policy modules using Reference Policy headers:The system must first have the Reference Policy headers installed, typically
by the distribution. Otherwise, the headers can be installed using the
install-headers target from the full Reference Policy sources.To set up a directory to build a local module, one must simply place a .te
file in a directory. A sample Makefile to use in the directory is the
Makefile.example in the doc directory. This may be installed in
/usr/share/doc, under the directory for the distribution's policy.
Alternatively, the primary Makefile in the headers directory (typically
/usr/share/selinux/NAME/Makefile) can be called directly, using make's -f
option.Larger projects can set up a structure of layers, just as in Reference
Policy, by creating policy/modules/LAYERNAME directories. Each layer also
must have a metadata.xml file which is an XML file with a summary tag and
optional desc (long description) tag. This should describe the purpose of
the layer.Metadata.xml example:<summary>ABC modules for the XYZ components.</summary>Make targets for modules built from headers:MODULENAME.pp Compile and package the MODULENAME local module.all Compile and package the modules in the currentdirectory.load Compile and package the modules in the currentdirectory, then insert them into the module store.refresh Attempts to reinsert all modules that are currentlyin the module store from the local and system modulepackages.xml Build a policy.xml from the XML included with thebase policy headers and any XML in the modules inthe current directory.
上一回讲解了README文件的第一部分,本回继续针对于余下步骤一一进行说明和讲解。
(2)Reference Policy Build Options (build.conf)(参考策略构建选项 build.conf)
本小节内容是对于refpolicy源码根目录下的build.conf文件所进行的详细讲解,该文件内容如下:
########################################
#
# Policy build options
## Policy version
# By default, checkpolicy will create the highest
# version policy it supports. Setting this will
# override the version. This only has an
# effect for monolithic policies.
#OUTPUT_POLICY = 33# Policy Type
# standard, mls, mcs
TYPE = standard# Policy Name
# If set, this will be used as the policy
# name. Otherwise the policy type will be
# used for the name.
NAME = refpolicy# Distribution
# Some distributions have portions of policy
# for programs or configurations specific to the
# distribution. Setting this will enable options
# for the distribution.
# redhat, gentoo, debian, suse, and rhel4 are current options.
# Fedora users should enable redhat.
#DISTRO = redhat# Unknown Permissions Handling
# The behavior for handling permissions defined in the
# kernel but missing from the policy. The permissions
# can either be allowed, denied, or the policy loading
# can be rejected.
# allow, deny, and reject are current options.
UNK_PERMS = deny# Direct admin init
# Setting this will allow sysadm to directly
# run init scripts, instead of requiring run_init.
# This is a build option, as role transitions do
# not work in conditional policy.
DIRECT_INITRC = n# Systemd
# Setting this will configure systemd as the init system.
SYSTEMD = n# Build monolithic policy. Putting y here
# will build a monolithic policy.
MONOLITHIC = n# User-based access control (UBAC)
# Enable UBAC for role separations.
UBAC = y# Custom build options. This field enables custom
# build options. Putting foo here will enable
# build option blocks named foo. Options should be
# separated by spaces.
CUSTOM_BUILDOPT =# Number of MLS Sensitivities
# The sensitivities will be s0 to s(MLS_SENS-1).
# Dominance will be in increasing numerical order
# with s0 being lowest.
MLS_SENS = 16# Number of MLS Categories
# The categories will be c0 to c(MLS_CATS-1).
MLS_CATS = 1024# Number of MCS Categories
# The categories will be c0 to c(MLS_CATS-1).
MCS_CATS = 1024# Set this to y to only display status messages
# during build.
QUIET = n# Set this to treat warnings as errors.
WERROR = n
- TYPE
字符串(类型)。
可用选项包括standard、mls和mcs。对于只有类型增强(type enforcemeng)的系统,设置为standard。
此选项可选地启用(使能)多级安全(MLS)或多类别安全(MCS)功能特性。此选项控制enable_mls和enable_mcs策略块。
注:此项在build.conf中默认设置为standard。
- NAME
字符串(类型)。可选。
设置策略的名字。在将文件安装到诸如/etc/selinux/NAME和/usr/share/selinux/NAME时使用NAME。如果未设置,则使用策略类型(type)。
注:此项在build.conf中默认设置为refpolicy。
- DISTRO
字符串(类型)。可选。
启用特定于发布版的策略。可用的选项有redhat、gentoo和debian。
此选项控制distro_redhat、distro_gentoo和distro_debian构建选项策略块。
注:此项在build.conf中默认设置为default,但是被封掉了。
- MONOLITHIC
布尔(类型)。
如果设置(为y),则构建一个单一整体策略;否则(为n)构建一个模块化策略。
注:此项在build.conf中默认设置为n。
- DIRECT_INITRC
布尔(类型)。
如果设置(为y),sysadm将被允许直接运行init脚本,而不需要run_init工具。
这是一个构建选项,而不是可调的,因为角色转换在条件策略中不起作用。
此选项控制direct_sysadm_demon策略块。
注:此项在build.conf中默认设置为n。
- OUTPUT_POLICY
整数(类型)。
设置在构建单一整体策略时创建的策略的版本。
此选项对模块化策略没有影响。
注:此项在build.conf中默认设置为33,但是被封掉了。
- UNK_PERMS
字符串(类型)。
设置内核行为以处理在内核中定义但策略中所缺少的许可。
许可可以是允许(allow)、拒绝(deny),也可以是拒绝加载策略(reject)。
注:此项在build.conf中默认设置为deny。
- UBAC
布尔(类型)。
如果设置,SELinux用户将额外用于近似的角色分离。
注:此项在build.conf中默认设置为y。
- SYSTEMD
布尔(类型)。
如果设置,则systemd将被假定为init进程的提供者。
注:此项在build.conf中默认设置为n。
- MLS_SENS
整数(类型)。
设置MLS策略中的敏感度数量。在standard和MCS策略忽略此项。
注:此项在build.conf中默认设置为16。
- MLS_CATS
整数(类型)。
设置MLS策略中的类别数。在standard和MCS策略忽略此项。
注:此项在build.conf中默认设置为1024。
- MCS_CATS
整数(类型)。
设置MCS策略中的类别数。在standard和MLS策略中忽略此项。
注:此项在build.conf中默认设置为1024。
- QUIET
布尔(类型)。
如果设置,则构建系统将仅显示状态消息和错误消息。此选项对策略没有影响。
注:此项在build.conf中默认设置为n。
- WERROR
布尔(类型)。
如果设置,则构建系统将把警告视为错误。如果遇到任何警告,则构建将失败。
注:此项在build.conf中默认设置为n。
下一回中继续解析README中的其它选项。