SELinux就是Security-Enhanced Linux的簡稱，安全加強的linux。傳統的linux權限是對文件和目錄的owner, group和other的rwx進行控制，而SELinux采用的是委任式訪問控制，也就是控制一個進程對具體文件系統上面的文件和目錄的訪問，SELinux規定了很多的規則，來決定哪個進程可以訪問哪些文件和目錄。
SELinux是根據進程或文件的security context來決定進程是否有權限訪問文件系統的，security context由Identify:role:type三部分組成，當selinux的類型為SELINUXTYPE=targeted的時候，只有security context的type是有用的。selinux的配置文件在這裡：/etc/selinux/config，內容如下：
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - SELinux is fully disabled.
SELINUX=enforcing
# SELINUXTYPE= type of policy in use. Possible values are:
# targeted - Only targeted network daemons are protected.
# strict - Full SELinux protection.
SELINUXTYPE=targeted
需要安裝必要的SELinux的相關工具：
yum install policycoreutils-python setools-console setroubleshoot setroubleshoot-server查看當前SELinux的狀態：
[root@CentOS ~]# getenforce
Enforcing狀態為Enforcing就代表打開了SELinux，為disabled或permissive則需要使用下面的命令開啟（permissive代表如果不符合SELinux的權限控制，則會出現warning提示信息，不會真的block進程的訪問）：
設置SELinux為Enforcing:
[root@centos ~]# setenforce 1之後，重啟電腦，並等待SELinux相關文件建立完成。
查看進程的security context：
[root@centos ~]# ps aux -Z | grep httpd
unconfined_u:system_r:httpd_t:s0 root 6056 0.0 0.3 11672 3504 ? Ss 15:31 0:03 /usr/sbin/httpd
unconfined_u:system_r:httpd_t:s0 apache 6061 0.0 0.2 11804 2664 ? S 15:31 0:00 /usr/sbin/httpd
unconfined_u:system_r:httpd_t:s0 apache 6062 0.0 0.2 11672 2132 ? S 15:31 0:00 /usr/sbin/httpd
unconfined_u:system_r:httpd_t:s0 apache 6063 0.0 0.2 11804 2664 ? S 15:31 0:00 /usr/sbin/httpd
unconfined_u:system_r:httpd_t:s0 apache 6064 0.0 0.2 11804 2780 ? S 15:31 0:00 /usr/sbin/httpd
unconfined_u:system_r:httpd_t:s0 apache 6065 0.0 0.2 11672 2132 ? S 15:31 0:00 /usr/sbin/httpd
unconfined_u:system_r:httpd_t:s0 apache 6066 0.0 0.2 11672 2132 ? S 15:31 0:00 /usr/sbin/httpd
unconfined_u:system_r:httpd_t:s0 apache 6067 0.0 0.2 11672 2132 ? S 15:31 0:00 /usr/sbin/httpd
unconfined_u:system_r:httpd_t:s0 apache 6068 0.0 0.2 11672 2132 ? S 15:31 0:00 /usr/sbin/httpd
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 6845 0.0 0.0 4340 752 pts/0 S+ 18:16 0:00 grep httpd查看目錄的security context：
[root@centos ~]# ls -dZ /var/www/
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/列出SELinux的統計信息，包括security context中的user，role和type，還有規則（Booleans）：
[root@centos ~]# seinfo
Statistics for policy file: /etc/selinux/targeted/policy/policy.24
Policy Version & Type: v.24 (binary, mls)
Classes: 81 Permissions: 235
Sensitivities: 1 Categories: 1024
Types: 3488 Attributes: 273
Users: 9 Roles: 12
Booleans: 187 Cond. Expr.: 222
Allow: 273920 Neverallow: 0
Auditallow: 96 Dontaudit: 199904
Type_trans: 23469 Type_change: 38
Type_member: 48 Role allow: 20
Role_trans: 291 Range_trans: 3993
Constraints: 87 Validatetrans: 0
Initial SIDs: 27 Fs_use: 22
Genfscon: 81 Portcon: 426
Netifcon: 0 Nodecon: 0
Permissives: 59 Polcap: 2
查看所有的規則名字：
[root@centos ~]# seinfo -b
Conditional Booleans: 187
allow_domain_fd_use
allow_ftpd_full_access
allow_sysadm_exec_content
allow_user_exec_content
allow_zebra_write_config
cdrecord_read_content
fcron_crond
httpd_manage_ipa
httpd_use_openstack
mmap_low_allowed
samba_share_fusefs
sepgsql_enable_users_ddl
abrt_handle_event
allow_ftpd_use_cifs
allow_httpd_mod_auth_pam
allow_java_execstack
cron_can_relabel
.......
查看一個規則是否打開：
[root@centos ~]# getsebool httpd_enable_homedirs
httpd_enable_homedirs --> off
打開一個規則：
[root@centos ~]# setsebool -P httpd_enable_homedirs=1
[root@centos ~]# getsebool httpd_enable_homedirs
httpd_enable_homedirs --> on
查看一個規則的具體信息(也就是allow或者deny某個進程的security context的type訪問某個文件系統的security context的type）：
[root@centos ~]# sesearch -b httpd_enable_homedirs --all
ERROR: Cannot get avrules: Neverallow rules requested but not available
Found 46 semantic av rules:
allow httpd_sys_script_t home_root_t : dir { getattr search open } ;
allow httpd_sys_script_t home_root_t : lnk_file { read getattr } ;
allow httpd_suexec_t user_home_dir_t : dir { getattr search open } ;
allow httpd_suexec_t user_home_dir_t : lnk_file { read getattr } ;
allow httpd_suexec_t autofs_t : dir { ioctl read getattr lock search open } ;
allow httpd_suexec_t cifs_t : file { ioctl read getattr lock execute execute_no_trans open } ;
allow httpd_suexec_t cifs_t : dir { ioctl read getattr lock search open } ;
allow httpd_suexec_t cifs_t : lnk_file { read getattr } ;
allow httpd_suexec_t nfs_t : file { ioctl read getattr lock execute execute_no_trans open } ;
allow httpd_suexec_t nfs_t : dir { ioctl read getattr lock search open } ;
allow httpd_suexec_t nfs_t : lnk_file { read getattr } ;
allow httpd_t user_home_t : file { ioctl read getattr lock open } ;
.............
selinux在文件系統中是存在很多的默認設置的，可以通過semanage來查看系統中所有目錄的默認security context:
