ð Sid Gifari File Manager Pro
v8.0.5 | 2026-08-07 10:11:44 | PHP 8.2.32
ð
/ (Root)
/
usr
/
share
/
locale
/
ja
/
LC_MESSAGES
ð /usr/share/locale/ja/LC_MESSAGES
ð Refresh
âïž
Editing: setroubleshoot-plugins.mo
Read Only
ￜￜ ï¿œ 4 3 L ï¿œ 1 : 8 s V z g ï¿œ h 9 | ï¿œ ( E H ï¿œ ï¿œ - R ;! ï¿œ ï¿œ" t (# I ï¿œ# ~ ï¿œ$ ï¿œ f% , $& Q' [( m w) ï¿œ ï¿œ+ ï¿œ ï¿œ1 ï¿œ k2 / 3 M4 ï¿œ Z6 . X8 b ï¿œ: ï¿œ; ï¿œ = ï¿œ ï¿œ> ï¿œ QA ï¿œ JC ï¿œ ï¿œE ï¿œ ï¿œG ï¿œ I ï¿œ ï¿œJ 7 ï¿œL ï¿œ ï¿œN ï¿œ QP T BQ ï¿œ ï¿œR ï¿œ 9T ï¿œ ï¿œU S ï¿œW P ï¿œW MX N ^Z N ï¿œZ U ï¿œZ G R[ ] ï¿œ[ O ï¿œ[ k H\ R ï¿œ\ q ] f y] V ï¿œ] F 7^ K ~^ V ï¿œ^ E !_ S g_ j ï¿œ_ B &` T i` T ï¿œ` ^ c ï¿œ rc ï¿œ 4d t ï¿œe ï¿œ 4f Z ï¿œg ? .k Z nk ï¿œ ï¿œk Y |n U ï¿œn 6 ,q ï¿œ cr C ï¿œt ï¿œ 6w # ï¿œy X ï¿œ| 4} B~ S fï¿œ |ï¿œ ￜￜ ￜￜ z ￜￜ ï¿œ ï¿œ ï¿œ Õ ï¿œ pï¿œ ï¿œ ￜￜ ï¿œ ￜￜ ï¿œ ï¿œ 3 ￜￜ e )ï¿œ _ ￜￜ e ï¿œ f Uï¿œ ￜￜ ï¿œ Ù ï¿œ ￜￜ ï¿œ rï¿œ ï¿œ Jï¿œ ï¿œ ï¿œ I Õ ï¿œ ï¿œ ï¿œ ￜￜ ï¿œ ￜￜ ï¿œ Dï¿œ b Þ ï¿œ Aï¿œ \ Õ b 2ï¿œ \ ￜￜ + ï¿œ c ï¿œ 7 ￜￜ < ￜￜ ï¿œ ￜￜ ￜￜ ￜￜ ￜￜ % Å : ï¿œ * &ï¿œ Qï¿œ aï¿œ / rï¿œ : ￜￜ 8 Ý T ï¿œ 5 kï¿œ 4 ￜￜ x Ö t Oï¿œ y Ä T >ï¿œ 7 ￜￜ m Ë a 9ï¿œ U ￜￜ e ï¿œ f Wï¿œ N ￜￜ g ï¿œ : uï¿œ ￜￜ E ¢ N ï¿œ F Wï¿œ I ￜￜ 7 ï¿œ 6 ï¿œ c Wï¿œ ' ￜￜ p ï¿œ + Tï¿œ G ￜￜ G È¥ u ï¿œ ï¿œ ￜￜ f ï¿œ h ￜￜ l ï¿œ j ]ï¿œ h Èš 8 1ï¿œ ! jï¿œ / ￜￜ ￜￜ Ì© 4 Ü© $ ï¿œ . 6ï¿œ eï¿œ {ï¿œ , ￜￜ ê ? ߪ 0 ï¿œ 1 Pï¿œ ] ￜￜ 2 ï¿œ K ï¿œ 2 _ï¿œ ] ￜￜ c ï¿œ Tï¿œ , dï¿œ ￜￜ d ￜￜ N ï¿œ Xï¿œ ï¿œ pï¿œ _ -ï¿œ ] ￜￜ E ï¿œ - 1ï¿œ _ï¿œ 4 xï¿œ ! ￜￜ ' Ï° $ ￜￜ ï¿œ _ =ï¿œ R ￜￜ O ï¿œ 9 @ï¿œ : zï¿œ ￜￜ ï¿œ Ó² ï¿œ _ï¿œ #ï¿œ ï¿œ >ï¿œ B ï¿œ A .ï¿œ ^ pï¿œ s Ï· ï¿œ Cï¿œ ï¿œ Úž T ￜￜ ï¿œ ï¿œ ï¿œ ￜￜ : ￜￜ m ￜￜ ï¿œ -ï¿œ ï¿œ ￜￜ ï¿œ 6ï¿œ ï¿œ ￜￜ ï¿œ ￜￜ ￜￜ ï¿œ ￜￜ ï¿œ ￜￜ ï¿œ Vï¿œ ï¿œ )ï¿œ ï¿œ ￜￜ ï¿œ ￜￜ ï¿œ ï¿œ ï¿œ ï¿œ ï¿œ ￜￜ ï¿œ 6ï¿œ ï¿œ ￜￜ $ ￜￜ M ￜￜ N Bï¿œ ï¿œ ￜￜ ï¿œ /ï¿œ ï¿œ ï¿œ ï¿œ ￜￜ ￜￜ ï¿œ ï¿œ 9 {ï¿œ ￜￜ ï¿œ ï¿œ A ï¿œ @ ï¿œ % $ Q J W ï¿œ L ï¿œ ] A Z ï¿œ c ï¿œ ï¿œ ^ ï¿œ ï¿œ ^ ï¿œ! f G" ) ï¿œ" u ï¿œ% q N& ï¿œ ï¿œ& f C' ï¿œ ï¿œ' r L( ï¿œ ï¿œ( l Q) ï¿œ ï¿œ) ï¿œ X* | ï¿œ* R i+ W ï¿œ+ | , x ï¿œ, w - ï¿œ ï¿œ- \ . { |. ï¿œ ï¿œ. ï¿œ ï¿œ2 H 23 b {4 ï¿œ ï¿œ6 H ï¿œ7 ï¿œ9 q ? ï¿œ y? P -@ ï¿œ ~D (E ï¿œ 6I ï¿œ K g ï¿œN ï¿œ SR ï¿œ >V ï¿œ [ ï¿œ ï¿œ[ ï¿œ 4] ï¿œ ï¿œ^ ï¿œ d` ï¿œ 7b ï¿œ ï¿œc ï¿œ pe ï¿œ g ï¿œg ï¿œ ï¿œh ï¿œ ï¿œi ï¿œ gj ï¿œ .k c ï¿œk T Rm ï¿œ ï¿œm ï¿œ fn ï¿œ o ï¿œ ï¿œo / @p ï¿œ pp ï¿œ Jq ï¿œ @r ï¿œ 5s 5t ï¿œ :w R | J _} ï¿œ~ # ￜￜ b ï¿œ ï¿œ Dï¿œ \ ï¿œ b fï¿œ \ É + &ï¿œ ~ Rï¿œ c Ñ K 5ï¿œ ï¿œ ￜￜ 3 &ï¿œ Zï¿œ 3 mï¿œ : ￜￜ N Ü = +ï¿œ ! iï¿œ $ ￜￜ ? ￜￜ O ï¿œ a @ï¿œ | ￜￜ L ï¿œ = lï¿œ ï¿œ ￜￜ ï¿œ Zï¿œ ï¿œ ï¿œ e ￜￜ Y ￜￜ Sï¿œ p Ó s Dï¿œ ï¿œ ￜￜ ï¿œ Sï¿œ s ï¿œ y \ï¿œ l Ö Cï¿œ a Vï¿œ ^ ￜￜ T ï¿œ T lï¿œ U ￜￜ Q ï¿œ ï¿œ iï¿œ < ￜￜ ï¿œ 2ï¿œ < Å i ï¿œ c lï¿œ ï¿œ Ð ï¿œ ￜￜ y Rï¿œ ï¿œ Ì v iï¿œ | ï¿œ r ]ï¿œ E Ð * ï¿œ ] Aï¿œ ￜￜ ￜￜ V Ø ; /ï¿œ i kï¿œ $ Õ * ￜￜ E %ï¿œ 9 kï¿œ N ￜￜ A ï¿œ B 6ï¿œ x yï¿œ C ï¿œ g 6ï¿œ C ￜￜ ï¿œ ï¿œ ï¿œ ￜￜ 2ï¿œ 9 Bï¿œ |ï¿œ ï¿œ ￜￜ v ï¿œ 2 ￜￜ " Å¡ ï¿œ ï¿œ ï¿œ ￜￜ r Eï¿œ C ￜￜ 3 ￜￜ N 0ï¿œ E ï¿œ A Å¥ M ï¿œ J Uï¿œ } ￜￜ q ï¿œ d ￜￜ [ ￜￜ _ Qï¿œ 9 ￜￜ ï¿œ ï¿œ ï¿œ ￜￜ < ￜￜ ï¿œ ï¿œ [ Ê® Z &ï¿œ ï¿œ ￜￜ ï¿œ ï¿œ ï¿œ ￜￜ ï¿œ 8 ï¿œ ) w G ï¿œ ï¿œ D ^ $ ï¿œ ï¿œ o ï¿œ ï¿œ ï¿œ . ï¿œ ï¿œ 5 % z ; ï¿œ : T ï¿œ ï¿œ @ ï¿œ ï¿œ p R ï¿œ t ï¿œ ï¿œ ! ï¿œ u 6 C 3 x 0 W ï¿œ ï¿œ ` ï¿œ ï¿œ ï¿œ _ ï¿œ ~ ï¿œ + ' h ï¿œ J I ï¿œ ï¿œ ï¿œ e ï¿œ g ï¿œ B ï¿œ ï¿œ ï¿œ ï¿œ | Y * c ï¿œ i ï¿œ ï¿œ , ï¿œ y ï¿œ ï¿œ ï¿œ r ï¿œ ï¿œ ï¿œ H } N A ï¿œ ï¿œ 2 ï¿œ 1 s q 9 & ï¿œ ï¿œ ï¿œ k S ï¿œ ï¿œ ï¿œ ï¿œ ï¿œ 7 ï¿œ ï¿œ ï¿œ [ ï¿œ V ï¿œ ï¿œ ï¿œ ï¿œ ï¿œ - M U ï¿œ ï¿œ L ï¿œ ï¿œ ï¿œ ï¿œ ï¿œ ( ï¿œ F E ï¿œ ï¿œ ï¿œ K < v " f ï¿œ X > 4 ] ï¿œ n j ï¿œ m ï¿œ = ï¿œ ï¿œ ï¿œ # / { \ ï¿œ ? ï¿œ ï¿œ ï¿œ d ï¿œ P ï¿œ l a ï¿œ ï¿œ ï¿œ ï¿œ O ï¿œ ï¿œ b ï¿œ ï¿œ Q ï¿œ Z dac_override and dac_read_search capabilities usually indicates that the root process does not have access to a file based on the permission flags. This usually mean you have some file with the wrong ownership/permissions on it. SELinux denied access requested by $SOURCE. It is not expected that this access is required by $SOURCE and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. SELinux denied access requested by $SOURCE. The current boolean settings do not allow this access. If you have not setup $SOURCE to require this access this may signal an intrusion attempt. If you do intend this access you need to change the booleans on this system to allow the access. SELinux has denied $SOURCE "$ACCESS" access to device $TARGET_PATH. $TARGET_PATH is mislabeled, this device has the default label of the /dev directory, which should not happen. All Character and/or Block Devices should have a label. You can attempt to change the label of the file using restorecon -v '$TARGET_PATH'. If this device remains labeled device_t, then this is a bug in SELinux policy. Please file a bug report. If you look at the other similar devices labels, ls -lZ /dev/SIMILAR, and find a type that would work for $TARGET_PATH, you can use chcon -t SIMILAR_TYPE '$TARGET_PATH', If this fixes the problem, you can make this permanent by executing semanage fcontext -a -t SIMILAR_TYPE '$FIX_TARGET_PATH' If the restorecon changes the context, this indicates that the application that created the device, created it without using SELinux APIs. If you can figure out which application created the device, please file a bug report against this application. Attempt restorecon -v '$TARGET_PATH' or chcon -t SIMILAR_TYPE '$TARGET_PATH' Changing the "$BOOLEAN" boolean to true will allow this access: "setsebool -P $BOOLEAN=1" Changing the "$BOOLEAN" boolean to true will allow this access: "setsebool -P $BOOLEAN=1." Changing the "allow_ftpd_use_nfs" boolean to true will allow this access: "setsebool -P allow_ftpd_use_nfs=1." Changing the file_context to mnt_t will allow mount to mount the file system: "chcon -t mnt_t '$TARGET_PATH'." You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t mnt_t '$FIX_TARGET_PATH'" Confined domains should not require "sys_resource". This usually means that your system is running out some system resource like disk space, memory, quota etc. Please clear up the disk and this AVC message should go away. If this AVC continues after you clear up the disk space, please report this as a bug. Confined processes can be configured to run requiring different access, SELinux provides booleans to allow you to turn on/off access as needed. If httpd scripts should be allowed to write to public directories you need to turn on the $BOOLEAN boolean and change the file context of the public directory to public_content_rw_t. Read the httpd_selinux man page for further information: "setsebool -P $BOOLEAN=1; chcon -t public_content_rw_t <path>" You must also change the default file context labeling files on the system in order to preserve public directory labeling even on a full relabel. "semanage fcontext -a -t public_content_rw_t <path>" If you trust $TARGET_PATH to run correctly, you can change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t '$TARGET_PATH'" You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH'" If you want $SOURCE to continue, you must turn on the $BOOLEAN boolean. Note: This boolean will affect all applications on the system. If you want httpd to send mail you need to turn on the $BOOLEAN boolean: "setsebool -P $BOOLEAN=1" If you want to allow $SOURCE to bind to port $PORT_NUMBER, you can execute # semanage port -a -t PORT_TYPE -p %s $PORT_NUMBER where PORT_TYPE is one of the following: %s. If this system is running as an NIS Client, turning on the allow_ypbind boolean may fix the problem. setsebool -P allow_ypbind=1. If you want to allow $SOURCE to connect to $PORT_NUMBER, you can execute # sandbox -X -t sandbox_net_t $SOURCE If you want to allow $SOURCE to connect to $PORT_NUMBER, you can execute # semanage port -a -t PORT_TYPE -p %s $PORT_NUMBER where PORT_TYPE is one of the following: %s. If you want to change the file context of $TARGET_PATH so that the automounter can execute it you can execute "chcon -t bin_t $TARGET_PATH". If you want this to survive a relabel, you need to permanently change the file context: execute "semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'". SELinux denied $SOURCE access to $TARGET_PATH. If this is a swapfile, it has to have a file context label of swapfile_t. If you did not intend to use $TARGET_PATH as a swapfile, this message could indicate either a bug or an intrusion attempt. SELinux denied RSYNC access to $TARGET_PATH. If this is an RSYNC repository, it has to have a file context label of rsync_data_t. If you did not intend to use $TARGET_PATH as an RSYNC repository, this message could indicate either a bug or an intrusion attempt. SELinux denied access requested by $SOURCE. $SOURCE_PATH may be mislabeled. $SOURCE_PATH default SELinux type is <B>%s</B>, but its current type is <B>$SOURCE_TYPE</B>. Changing this file back to the default type may fix your problem. <p> This file could have been mislabeled either by user error, or if an normally confined application was run under the wrong domain. <p> However, this might also indicate a bug in SELinux because the file should not have been labeled with this type. <p> If you believe this is a bug, please file a bug report against this package. SELinux denied access requested by $SOURCE. $TARGET_PATH may be mislabeled. $TARGET_PATH default SELinux type is <B>%s</B>, but its current type is <B>$TARGET_TYPE</B>. Changing this file back to the default type may fix your problem. <p> File contexts can be assigned to a file in the following ways. <ul> <li>Files created in a directory receive the file context of the parent directory by default. <li>The SELinux policy might override the default label inherited from the parent directory by specifying a process running in context A which creates a file in a directory labeled B will instead create the file with label C. An example of this would be the dhcp client running with the dhcpc_t type and creating a file in the directory /etc. This file would normally receive the etc_t type due to parental inheritance but instead the file is labeled with the net_conf_t type because the SELinux policy specifies this. <li>Users can change the file context on a file using tools such as chcon, or restorecon. </ul> This file could have been mislabeled either by user error, or if an normally confined application was run under the wrong domain. <p> However, this might also indicate a bug in SELinux because the file should not have been labeled with this type. <p> If you believe this is a bug, please file a bug report against this package. SELinux denied access requested by $SOURCE. $TARGET_PATH may be mislabeled. openvpn is allowed to read content in home directory if it is labeled correctly. SELinux denied access requested by $SOURCE. $TARGET_PATH may be mislabeled. sshd is allowed to read content in /root/.ssh directory if it is labeled correctly. SELinux denied access requested by $SOURCE. It is not expected that this access is required by $SOURCE and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. SELinux denied access requested by $SOURCE. It is not expected that this access is required by $SOURCE and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. mozplugger and spice-xpi run applications within mozilla-plugins that require access to the desktop, that the mozilla_plugin lockdown will not allow, so either you need to turn off the mozilla_plugin lockdown or not use these packages. SELinux denied access requested by $SOURCE. It is not expected that this access is required by $SOURCE and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. spice-xpi run applications within mozilla-plugins that require access to the desktop, that the mozilla_plugin lockdown will not allow, so either you need to turn off the mozilla_plugin lockdown or not use these packages. SELinux denied access requested by the $SOURCE command. It looks like this is either a leaked descriptor or $SOURCE output was redirected to a file it is not allowed to access. Leaks usually can be ignored since SELinux is just closing the leak and reporting the error. The application does not use the descriptor, so it will run properly. If this is a redirection, you will not get output in the $TARGET_PATH. You should generate a bugzilla on selinux-policy, and it will get routed to the appropriate package. You can safely ignore this avc. SELinux denied access to $TARGET_PATH requested by $SOURCE. $TARGET_PATH has a context used for sharing by a different program. If you would like to share $TARGET_PATH from $SOURCE also, you need to change its file context to public_content_t. If you did not intend to allow this access, this could signal an intrusion attempt. SELinux denied cvs access to $TARGET_PATH. If this is a CVS repository it needs to have a file context label of cvs_data_t. If you did not intend to use $TARGET_PATH as a CVS repository it could indicate either a bug or it could signal an intrusion attempt. SELinux denied samba access to $TARGET_PATH. If you want to share this directory with samba it has to have a file context label of samba_share_t. If you did not intend to use $TARGET_PATH as a samba repository, this message could indicate either a bug or an intrusion attempt. Please refer to 'man samba_selinux' for more information on setting up Samba and SELinux. SELinux denied svirt access to $TARGET_PATH. If this is a virtualization image, it has to have a file context label of virt_image_t. The system is setup to label image files in directory./var/lib/libvirt/images correctly. We recommend that you copy your image file to /var/lib/libvirt/images. If you really want to have your image files in the current directory, you can relabel $TARGET_PATH to be virt_image_t using chcon. You also need to execute semanage fcontext -a -t virt_image_t '$FIX_TARGET_PATH' to add this new path to the system defaults. If you did not intend to use $TARGET_PATH as a virtualization image it could indicate either a bug or an intrusion attempt. SELinux denied svirt access to the block device $TARGET_PATH. If this is a virtualization image, it needs to be labeled with a virtualization file context (virt_image_t). You can relabel $TARGET_PATH to be virt_image_t using chcon. You also need to execute semanage fcontext -a -t virt_image_t '$FIX_TARGET_PATH' to add this new path to the system defaults. If you did not intend to use $TARGET_PATH as a virtualization image it could indicate either a bug or an intrusion attempt. SELinux denied xen access to $TARGET_PATH. If this is a XEN image, it has to have a file context label of xen_image_t. The system is setup to label image files in directory /var/lib/xen/images correctly. We recommend that you copy your image file to /var/lib/xen/images. If you really want to have your xen image files in the current directory, you can relabel $TARGET_PATH to be xen_image_t using chcon. You also need to execute semanage fcontext -a -t xen_image_t '$FIX_TARGET_PATH' to add this new path to the system defaults. If you did not intend to use $TARGET_PATH as a xen image it could indicate either a bug or an intrusion attempt. SELinux has denied $SOURCE from connecting to a network port $PORT_NUMBER which does not have an SELinux type associated with it. If $SOURCE should be allowed to connect on $PORT_NUMBER, use the <i>semanage</i> command to assign $PORT_NUMBER to a port type that $SOURCE_TYPE can connect to (%s). If $SOURCE is not supposed to connect to $PORT_NUMBER, this could signal an intrusion attempt. SELinux has denied $SOURCE from connecting to a network port $PORT_NUMBER within a sandbox. If $SOURCE should be allowed to connect on $PORT_NUMBER, you need to use a different sandbox type like sandbox_web_t or sandbox_net_t. # sandbox -X -t sandbox_net_t $SOURCE If $SOURCE is not supposed to connect to $PORT_NUMBER, this could signal an intrusion attempt. SELinux has denied the $SOURCE access to potentially mislabeled files $TARGET_PATH. This means that SELinux will not allow httpd to use these files. If httpd should be allowed this access to these files you should change the file context to one of the following types, %s. Many third party apps install html files in directories that SELinux policy cannot predict. These directories have to be labeled with a file context which httpd can access. SELinux has denied the $SOURCE from binding to a network port $PORT_NUMBER which does not have an SELinux type associated with it. If $SOURCE should be allowed to listen on $PORT_NUMBER, use the <i>semanage</i> command to assign $PORT_NUMBER to a port type that $SOURCE_TYPE can bind to (%s). If $SOURCE is not supposed to bind to $PORT_NUMBER, this could signal an intrusion attempt. SELinux has denied the $SOURCE the ability to mmap low area of the kernel address space. The ability to mmap a low area of the address space is configured by /proc/sys/kernel/mmap_min_addr. Preventing such mappings helps protect against exploiting null deref bugs in the kernel. All applications that need this access should have already had policy written for them. If a compromised application tries to modify the kernel, this AVC would be generated. This is a serious issue. Your system may very well be compromised. SELinux has denied the $SOURCE_PATH from executing potentially mislabeled files $TARGET_PATH. Automounter can be setup to execute configuration files. If $TARGET_PATH is an automount executable configuration file it needs to have a file label of bin_t. If automounter is trying to execute something that it is not supposed to, this could indicate an intrusion attempt. SELinux has denied the http daemon from sending mail. An httpd script is trying to connect to a mail port or execute the sendmail command. If you did not setup httpd to sendmail, this could signal an intrusion attempt. SELinux has prevented $SOURCE from loading a kernel module. All confined programs that need to load kernel modules should have already had policy written for them. If a compromised application tries to modify the kernel this AVC will be generated. This is a serious issue. Your system may very well be compromised. SELinux has prevented $SOURCE from modifying $TARGET. This denial indicates $SOURCE was trying to modify the selinux policy configuration. All applications that need this access should have already had policy written for them. If a compromised application tries to modify the SELinux policy this AVC will be generated. This is a serious issue. Your system may very well be compromised. SELinux has prevented $SOURCE from modifying $TARGET. This denial indicates $SOURCE was trying to modify the way the kernel runs or to actually insert code into the kernel. All applications that need this access should have already had policy written for them. If a compromised application tries to modify the kernel this AVC will be generated. This is a serious issue. Your system may very well be compromised. SELinux has prevented $SOURCE from writing to a file under /sys/fs/selinux. Files under /sys/fs/selinux control the way SELinux is configured. All programs that need to write to files under /sys/fs/selinux should have already had policy written for them. If a compromised application tries to turn off SELinux this AVC will be generated. This is a serious issue. Your system may very well be compromised. SELinux has prevented vbetool from performing an unsafe memory operation. SELinux has prevented wine from performing an unsafe memory operation. SELinux is preventing $SOURCE from creating a file with a context of $SOURCE_TYPE on a filesystem. Usually this happens when you ask the cp command to maintain the context of a file when copying between file systems, "cp -a" for example. Not all file contexts should be maintained between the file systems. For example, a read-only file type like iso9660_t should not be placed on a r/w system. "cp -p" might be a better solution, as this will adopt the default file context for the destination. SELinux is preventing $SOURCE_PATH "$ACCESS" access on $TARGET_PATH. SELinux is preventing $SOURCE_PATH "$ACCESS" access to $TARGET_PATH. SELinux is preventing $SOURCE_PATH "$ACCESS" access to device $TARGET_PATH. SELinux is preventing $SOURCE_PATH "$ACCESS" to $TARGET_PATH. SELinux is preventing $SOURCE_PATH access to a leaked $TARGET_PATH file descriptor. SELinux is preventing $SOURCE_PATH from binding to port $PORT_NUMBER. SELinux is preventing $SOURCE_PATH from changing the access protection of memory on the heap. SELinux is preventing $SOURCE_PATH from connecting to port $PORT_NUMBER. SELinux is preventing $SOURCE_PATH from creating a file with a context of $SOURCE_TYPE on a filesystem. SELinux is preventing $SOURCE_PATH from loading $TARGET_PATH which requires text relocation. SELinux is preventing $SOURCE_PATH from making the program stack executable. SELinux is preventing $SOURCE_PATH the "$ACCESS" capability. SELinux is preventing $SOURCE_PATH the "sys_resource" capability. SELinux is preventing Samba ($SOURCE_PATH) "$ACCESS" access to $TARGET_PATH. SELinux is preventing access to a file labeled unlabeled_t. SELinux is preventing cvs ($SOURCE_PATH) "$ACCESS" access to $TARGET_PATH SELinux is preventing the $SOURCE_PATH from executing potentially mislabeled files $TARGET_PATH. SELinux is preventing the http daemon from sending mail. SELinux is preventing xen ($SOURCE_PATH) "$ACCESS" access to $TARGET_PATH. SELinux permission checks on files labeled unlabeled_t are being denied. unlabeled_t is a context the SELinux kernel gives to files that do not have a label. This indicates a serious labeling problem. No files on an SELinux box should ever be labeled unlabeled_t. If you have just added a disk drive to the system, you can relabel it using the restorecon command. For example if you saved the home directory from a previous installation that did not use SELinux, 'restorecon -R -v /home' will fix the labels. Otherwise you should relabel the entire file system. SELinux policy is preventing an httpd script from writing to a public directory. SELinux policy is preventing an httpd script from writing to a public directory. If httpd is not setup to write to public directories, this could signal an intrusion attempt. SELinux prevented $SOURCE from mounting a filesystem on the file or directory "$TARGET_PATH" of type "$TARGET_TYPE". By default SELinux limits the mounting of filesystems to only some files or directories (those with types that have the mountpoint attribute). The type "$TARGET_TYPE" does not have this attribute. You can change the label of the file or directory. SELinux prevented $SOURCE from mounting on the file or directory "$TARGET_PATH" (type "$TARGET_TYPE"). SELinux prevented httpd $ACCESS access to $TARGET_PATH. httpd scripts are not allowed to write to content without explicit labeling of all files. If $TARGET_PATH is writable content. it needs to be labeled httpd_sys_rw_content_t or if all you need is append you can label it httpd_sys_ra_content_t. Please refer to 'man httpd_selinux' for more information on setting up httpd and selinux. SELinux prevented httpd $ACCESS access to http files. Ordinarily httpd is allowed full access to all files labeled with http file context. This machine has a tightened security policy with the $BOOLEAN turned off, this requires explicit labeling of all files. If a file is a cgi script it needs to be labeled with httpd_TYPE_script_exec_t in order to be executed. If it is read only content, it needs to be labeled httpd_TYPE_content_t. If it is writable content, it needs to be labeled httpd_TYPE_script_rw_t or httpd_TYPE_script_ra_t. You can use the chcon command to change these context. Please refer to the man page "man httpd_selinux" or <a href="http://fedora.redhat.com/docs/selinux-apache-fc3">FAQ</a> "TYPE" refers to one of "sys", "user" or "staff" or potentially other script types. SELinux prevented httpd $ACCESS access to http files. SELinux prevented the ftp daemon from $ACCESS files stored on a CIFS filesystem. SELinux prevented the ftp daemon from $ACCESS files stored on a CIFS filesystem. CIFS (Comment Internet File System) is a network filesystem similar to SMB (<a href="http://www.microsoft.com/mind/1196/cifs.asp">http://www.microsoft.com/mind/1196/cifs.asp</a>) The ftp daemon attempted to read one or more files or directories from a mounted filesystem of this type. As CIFS filesystems do not support fine-grained SELinux labeling, all files and directories in the filesystem will have the same security context. If you have not configured the ftp daemon to read files from a CIFS filesystem this access attempt could signal an intrusion attempt. SELinux prevented the ftp daemon from $ACCESS files stored on a NFS filesystem. SELinux prevented the ftp daemon from $ACCESS files stored on a NFS filesystem. NFS (Network Filesystem) is a network filesystem commonly used on Unix / Linux systems. The ftp daemon attempted to read one or more files or directories from a mounted filesystem of this type. As NFS filesystems do not support fine-grained SELinux labeling, all files and directories in the filesystem will have the same security context. If you have not configured the ftp daemon to read files from a NFS filesystem this access attempt could signal an intrusion attempt. Sometimes a library is accidentally marked with the execstack flag, if you find a library with this flag you can clear it with the execstack -c LIBRARY_PATH. Then retry your application. If the app continues to not work, you can turn the flag back on with execstack -s LIBRARY_PATH. The $SOURCE application attempted to change the access protection of memory on the heap (e.g., allocated using malloc). This is a potential security problem. Applications should not be doing this. Applications are sometimes coded incorrectly and request this permission. The <a href="http://people.redhat.com/drepper/selinux-mem.html">SELinux Memory Protection Tests</a> web page explains how to remove this requirement. If $SOURCE does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report against this package. The $SOURCE application attempted to load $TARGET_PATH which requires text relocation. This is a potential security problem. Most libraries do not need this permission. Libraries are sometimes coded incorrectly and request this permission. The <a href="http://people.redhat.com/drepper/selinux-mem.html">SELinux Memory Protection Tests</a> web page explains how to remove this requirement. You can configure SELinux temporarily to allow $TARGET_PATH to use relocation as a workaround, until the library is fixed. Please file a bug report. The $SOURCE application attempted to load $TARGET_PATH which requires text relocation. This is a potential security problem. Most libraries should not need this permission. The <a href="http://people.redhat.com/drepper/selinux-mem.html"> SELinux Memory Protection Tests</a> web page explains this check. This tool examined the library and it looks like it was built correctly. So setroubleshoot can not determine if this application is compromised or not. This could be a serious issue. Your system may very well be compromised. Contact your security administrator and report this issue. The $SOURCE application attempted to make its stack executable. This is a potential security problem. This should never ever be necessary. Stack memory is not executable on most OSes these days and this will not change. Executable stack memory is one of the biggest security problems. An execstack error might in fact be most likely raised by malicious code. Applications are sometimes coded incorrectly and request this permission. The <a href="http://people.redhat.com/drepper/selinux-mem.html">SELinux Memory Protection Tests</a> web page explains how to remove this requirement. If $SOURCE does not work and you need it to work, you can configure SELinux temporarily to allow this access until the application is fixed. Please file a bug report. Use a command like "cp -p" to preserve all permissions except SELinux context. You can alter the file context by executing chcon -R -t cvs_data_t '$TARGET_PATH' You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH'" You can alter the file context by executing chcon -R -t rsync_data_t '$TARGET_PATH' You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t rsync_data_t '$FIX_TARGET_PATH'" You can alter the file context by executing chcon -R -t samba_share_t '$TARGET_PATH' You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t samba_share_t '$FIX_TARGET_PATH'" You can alter the file context by executing chcon -t public_content_t '$TARGET_PATH' You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t public_content_t '$FIX_TARGET_PATH'" You can alter the file context by executing chcon -t swapfile_t '$TARGET_PATH' You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t swapfile_t '$FIX_TARGET_PATH'" You can alter the file context by executing chcon -t virt_image_t '$TARGET_PATH' You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t virt_image_t '$FIX_TARGET_PATH'" You can alter the file context by executing chcon -t xen_image_t '$TARGET_PATH' You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t xen_image_t '$FIX_TARGET_PATH'" You can execute the following command as root to relabel your computer system: "touch /.autorelabel; reboot" You can generate a local policy module to allow this access - see <a href="http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385">FAQ</a> Please file a bug report. You can generate a local policy module to allow this access - see <a href="http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385">FAQ</a> You can restore the default system context to this file by executing the restorecon command. # restorecon -R /root/.ssh You can restore the default system context to this file by executing the restorecon command. # restorecon -R /root/.ssh You can restore the default system context to this file by executing the restorecon command. restorecon '$SOURCE_PATH'. You can restore the default system context to this file by executing the restorecon command. restorecon '$TARGET_PATH', if this file is a directory, you can recursively restore using restorecon -R '$TARGET_PATH'. Your system may be seriously compromised! Your system may be seriously compromised! $SOURCE_PATH attempted to mmap low kernel memory. Your system may be seriously compromised! $SOURCE_PATH tried to load a kernel module. Your system may be seriously compromised! $SOURCE_PATH tried to modify SELinux enforcement. Your system may be seriously compromised! $SOURCE_PATH tried to modify kernel configuration. Disable IPV6 properly. Either remove the mozplluger package by executing 'yum remove mozplugger' Or turn off enforcement of SELinux over the Firefox plugins. setsebool -P unconfined_mozilla_plugin_transition 0 Either remove the mozplugger or spice-xpi package by executing 'yum remove mozplugger spice-xpi' or turn off enforcement of SELinux over the Firefox plugins. setsebool -P unconfined_mozilla_plugin_transition 0 Either remove the mozplugger or spice-xpi package by executing 'yum remove mozplugger spice-xpi', or turn off enforcement of SELinux over the Chrome plugins. setsebool -P unconfined_chrome_sandbox_transition 0 If you decide to continue to run the program in question you will need to allow this operation. This can be done on the command line by executing: # setsebool -P mmap_low_allowed 1 SELinux denied an operation requested by $SOURCE, a program used to alter video hardware state. This program is known to use an unsafe operation on system memory but so are a number of malware/exploit programs which masquerade as vbetool. This tool is used to reset video state when a machine resumes from a suspend. If your machine is not resuming properly your only choice is to allow this operation and reduce your system security against such malware. SELinux denied an operation requested by wine-preloader, a program used to run Windows applications under Linux. This program is known to use an unsafe operation on system memory but so are a number of malware/exploit programs which masquerade as wine. If you were attempting to run a Windows program your only choices are to allow this operation and reduce your system security against such malware or to refrain from running Windows applications under Linux. If you were not attempting to run a Windows application this indicates you are likely being attacked by some for of malware or program trying to exploit your system for nefarious purposes. Please refer to http://wiki.winehq.org/PreloaderPageZeroProblem Which outlines the other problems wine encounters due to its unsafe use of memory and solutions to those problems. Turn on full auditing # auditctl -w /etc/shadow -p w Try to recreate AVC. Then execute # ausearch -m avc -ts recent If you see PATH record check ownership/permissions on file, and fix it, otherwise report as a bugzilla. You tried to place a type on a %s that is not a file type. This is not allowed, you must assigne a file type. You can list all file types using the seinfo command. seinfo -afile_type -x Changing the "$BOOLEAN" and "$WRITE_BOOLEAN" booleans to true will allow this access: "setsebool -P $BOOLEAN=1 $WRITE_BOOLEAN=1". warning: setting the "$WRITE_BOOLEAN" boolean to true will allow the ftp daemon to write to all public content (files and directories with type public_content_t) in addition to writing to files and directories on CIFS filesystems. Changing the "allow_ftpd_use_nfs" and "ftpd_anon_write" booleans to true will allow this access: "setsebool -P allow_ftpd_use_nfs=1 ftpd_anon_write=1". warning: setting the "ftpd_anon_write" boolean to true will allow the ftp daemon to write to all public content (files and directories with type public_content_t) in addition to writing to files and directories on NFS filesystems. # ausearch -x $SOURCE_PATH --raw | audit2allow -D -M my-$SOURCE # semodule -X 300 -i my-$SOURCE.pp # semanage fcontext -a -t FILE_TYPE '$FIX_TARGET_PATH' where FILE_TYPE is one of the following: %s. Then execute: restorecon -v '$FIX_TARGET_PATH' # semanage fcontext -a -t SIMILAR_TYPE '$FIX_TARGET_PATH' # restorecon -v '$FIX_TARGET_PATH' # semanage fcontext -a -t samba_share_t '$FIX_TARGET_PATH%s' # restorecon %s -v '$FIX_TARGET_PATH' # semanage fcontext -a -t virt_image_t '$FIX_TARGET_PATH' # restorecon -v '$FIX_TARGET_PATH' # semanage port -a -t %s -p %s $PORT_NUMBER # semanage port -a -t PORT_TYPE -p %s $PORT_NUMBER where PORT_TYPE is one of the following: %s. A process might be attempting to hack into your system. Add net.ipv6.conf.all.disable_ipv6 = 1 to /etc/sysctl.conf Allow this access for now by executing: # ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME # semodule -X 300 -i my-$MODULE_NAME.pp Change file context. Change label Change label on the library. Change the file label to xen_image_t. Contact your security administrator and report this issue. Disable SELinux controls on Chrome plugins Enable booleans Enable booleans. If $TARGET_BASE_PATH is a virtualization target If $TARGET_BASE_PATH should be shared via the RSYNC daemon If $TARGET_BASE_PATH should be shared via the cvs daemon If you believe $SOURCE_BASE_PATH should be allowed to create $TARGET_BASE_PATH files If you believe $SOURCE_PATH tried to disable SELinux. If you believe that %s should not require execstack If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on $TARGET_CLASS labeled $TARGET_TYPE by default. If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on processes labeled $TARGET_TYPE by default. If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on the $TARGET_BASE_PATH $TARGET_CLASS by default. If you believe that $SOURCE_BASE_PATH should have the $ACCESS capability by default. If you did not directly cause this AVC through testing. If you do not believe that $SOURCE_PATH should be attempting to modify the kernel by loading a kernel module. If you do not believe your $SOURCE_PATH should be modifying the kernel, by loading kernel modules If you do not think $SOURCE_BASE_PATH should try $ACCESS access on $TARGET_BASE_PATH. If you do not think $SOURCE_PATH should need to map heap memory that is both writable and executable. If you do not think $SOURCE_PATH should need to map stack memory that is both writable and executable. If you do not think $SOURCE_PATH should need to mmap low memory in the kernel. If you do not want processes to require capabilities to use up all the system resources on your system; If you think this is caused by a badly mislabeled machine. If you want to %s If you want to allow $SOURCE_BASE_PATH to mount on $TARGET_BASE_PATH. If you want to allow $SOURCE_PATH to be able to write to shared public content If you want to allow $SOURCE_PATH to bind to network port $PORT_NUMBER If you want to allow $SOURCE_PATH to connect to network port $PORT_NUMBER If you want to allow ftpd to write to cifs file systems If you want to allow ftpd to write to nfs file systems If you want to allow httpd to execute cgi scripts and to unify HTTPD handling of all content files. If you want to allow httpd to send mail If you want to change the label of $TARGET_PATH to %s, you are not allowed to since it is not a valid file type. If you want to disable IPV6 on this machine If you want to fix the label. $SOURCE_PATH default label should be %s. If you want to fix the label. $TARGET_PATH default label should be %s. If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system If you want to ignore $SOURCE_BASE_PATH trying to $ACCESS access the $TARGET_BASE_PATH $TARGET_CLASS, because you believe it should not need this access. If you want to ignore this AVC because it is dangerous and your machine seems to be working correctly. If you want to ignore this AVC because it is dangerous and your wine applications are working correctly. If you want to modify the label on $TARGET_BASE_PATH so that $SOURCE_BASE_PATH can have $ACCESS access on it If you want to mv $TARGET_BASE_PATH to standard location so that $SOURCE_BASE_PATH can have $ACCESS access If you want to to continue using SELinux Firefox plugin containment rather then using mozplugger package If you want to treat $TARGET_BASE_PATH as public content If you want to use the %s package Relabel the whole file system. Includes reboot! Restore Context Restore Context SELinux is preventing $SOURCE_PATH "$ACCESS" access. Set the image label to virt_image_t. This is caused by a newly created file system. Try to fix the label. Turn off memory protection You can read '%s' man page for more details. You might have been hacked. You must tell SELinux about this by enabling the '%s' boolean. You need to change the label on $FIX_TARGET_PATH You need to change the label on $TARGET_BASE_PATH You need to change the label on $TARGET_BASE_PATH to public_content_t or public_content_rw_t. You need to change the label on $TARGET_BASE_PATH' You need to change the label on $TARGET_PATH to a type of a similar device. You need to change the label on '$FIX_TARGET_PATH' You should report this as a bug. You can generate a local policy module to allow this access. You should report this as a bug. You can generate a local policy module to dontaudit this access. execstack -c %s if you think that you might have been hacked setsebool -P %s %s turn on full auditing to get path information about the offending file and generate the error again. use a command like "cp -p" to preserve all permissions except SELinux context. you can run restorecon. you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly. you may be under attack by a hacker, since confined applications should never need this access. you may be under attack by a hacker, since confined applications should not need this access. you may be under attack by a hacker, this is a very dangerous access. you must change the labeling on $TARGET_PATH. you must fix the labels. you must move the cert file to the ~/.cert directory you must pick a valid file label. you must remove the mozplugger package. you must setup SELinux to allow this you must tell SELinux about this you must tell SELinux about this by enabling the 'httpd_unified' and 'http_enable_cgi' booleans you must tell SELinux about this by enabling the vbetool_mmap_zero_ignore boolean. you must tell SELinux about this by enabling the wine_mmap_zero_ignore boolean. you must turn off SELinux controls on the Chrome plugins. you must turn off SELinux controls on the Firefox plugins. you need to add labels to it. you need to change the label on $TARGET_PATH to public_content_rw_t, and potentially turn on the allow_httpd_sys_script_anon_write boolean. you need to diagnose why your system is running out of system resources and fix the problem. According to /usr/include/linux/capability.h, sys_resource is required to: /* Override resource limits. Set resource limits. */ /* Override quota limits. */ /* Override reserved space on ext2 filesystem */ /* Modify data journaling mode on ext3 filesystem (uses journaling resources) */ /* NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too */ /* Override size restrictions on IPC message queues */ /* Allow more than 64hz interrupts from the real-time clock */ /* Override max number of consoles on console allocation */ /* Override max number of keymaps */ you need to fully relabel. you need to modify the sandbox type. sandbox_web_t or sandbox_net_t. For example: sandbox -X -t sandbox_net_t $SOURCE_PATH Please read 'sandbox' man page for more details. you need to report a bug. This is a potentially dangerous access. you need to report a bug. This is a potentially dangerous access. you need to set /proc/sys/net/ipv6/conf/all/disable_ipv6 to 1 and do not blacklist the module' you need to use a different command. You are not allowed to preserve the SELinux context on the target file system. you should clear the execstack flag and see if $SOURCE_PATH works correctly. Report this as a bug on %s. You can clear the exestack flag by executing: Project-Id-Version: PACKAGE VERSION Report-Msgid-Bugs-To: POT-Creation-Date: 2021-09-07 17:26+0200 PO-Revision-Date: 2021-09-17 07:27+0000 Last-Translator: Ludek Janda <ljanda@redhat.com> Language-Team: Japanese <https://translate.fedoraproject.org/projects/setroubleshoot/plugins/ja/> Language: ja MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Plural-Forms: nplurals=1; plural=0; X-Generator: Weblate 4.8 dac_override ãš dac_read_search ã®æ©èœã¯éåžžãroot ããã»ã¹ãããŒããã·ã§ã³ãã©ã°ãåºã«ãããã¡ã€ã«ãžã®ã¢ã¯ã»ã¹ãæããªãããšã衚瀺ããŸããããã¯éåžžããŠãŒã¶ãŒããã®ãã¡ã€ã«ã«ééããæææš©/ããŒããã·ã§ã³ãæã£ãŠããããšãæå³ããŸãã SELinux ã¯ã$SOURCE ã«ããèŠæ±ãããã¢ã¯ã»ã¹ãæåŠããŸããã ãã®ã¢ã¯ã»ã¹ã¯ $SOURCE ã«å¿ èŠã§ãããšæ³å®ãããªããããäžæ£äŸµå ¥ ã®è©Šã¿ããªãããå¯èœæ§ããããŸãã ãŸãã ã¢ããªã±ãŒã·ã§ã³ã®ç¹å® ããŒãžã§ã³ãŸãã¯èšå®ãè¿œå ã¢ã¯ã»ã¹èŠæ±ã®åå ãšãªã£ãŠããå¯èœæ§ ããããŸãã SELinux 㯠$SOURCE ã«ããèŠæ±ãããã¢ã¯ã»ã¹ãæåŠããŸããã çŸåšã®ããŒãªã¢ã³èšå®ã§ã¯ããã®ã¢ã¯ã»ã¹ãèš±å¯ãããŠããŸããããã®ã¢ã¯ã»ã¹ã èŠæ±ããããã« $SOURCE ãèšå®ããŠããªãå Žåãäžæ£äŸµå ¥ã®è©Šã¿ããªããã å¯èœæ§ããããŸãã ã¢ã¯ã»ã¹ããå¿ èŠãããå Žåã¯ããã®ã·ã¹ãã äžã§ããŒãªã¢ã³å€ãå€æŽããã¢ã¯ã»ã¹ãèš±å¯ããå¿ èŠããããŸãã SELinux ã¯ãããã€ã¹ $TARGET_PATH ãžã® $SOURCE ã«ãã "$ACCESS" ã¢ã¯ã»ã¹ãæåŠããŠããŸãã $TARGET_PATH ã«ã¯èª€ã£ãã©ãã«ãä»ããããŠããŸãããã®ããã€ã¹ã«ã¯ /dev ãã£ã¬ã¯ããªãŒã®ããã©ã«ãã©ãã«ããããŸãããããã¯èª€ã£ãèšå®ã§ãããã¹ãŠã®ãã£ã©ã¯ã¿ãŒããã€ã¹ããã³ãããã¯ããã€ã¹ããŸãã¯ã©ã¡ããäžæ¹ã«ã¯ã©ãã«ããªããã°ãªããŸããã 以äžãå®è¡ããŠãã¡ã€ã«ã®ã©ãã«å€æŽãè©Šè¡ããããšãã§ããŸãã restorecon -v $TARGET_PATH ãã®ããã€ã¹ã®ã©ãã«ã device_t ã®ãŸãŸã§ããå Žåããã㯠SELinux ããªã·ãŒã®ãã°ãšããããšã«ãªããŸãã ãã°ã¬ããŒããæåºããŠãã ããã ä»ã«ãåæ§ã®ããã€ã¹ã©ãã«ã確èªããããã« ls -lZ /dev/SIMILAR ãå®è¡ãã $TARGET_PATH ã«å¯ŸããŠåäœãããšæ³å®ãããã¿ã€ããèŠã€ããã chcon -t SIMILAR_TYPE $TARGET_PATH ã䜿çšããŸããããã§åé¡ã解決ããå Žåã¯ã以äžãå®è¡ããŠæ°žç¶çã«å€æŽããŸãã emanage fcontext -a -t SIMILAR_TYPE $FIX_TARGET_PATH restorecon ãã³ã³ããã¹ããå€æŽããå Žåã¯ã ããã€ã¹ãäœæããã¢ããªã±ãŒã·ã§ã³ã SELinux API ã䜿çšããã«äœæãããšããããšã瀺ããŠããŸãã ããã€ã¹ãäœæããã¢ããªã±ãŒã·ã§ã³ãå€å¥ã§ããå Žåã¯ããã®ã¢ããªã±ãŒã·ã§ã³ã«ã€ããŠã®ãã°ã¬ããŒããæåºããŠãã ããã restorecon -v $TARGET_PATH ãŸã㯠chcon -t SIMILAR_TYPE $TARGET_PATH ãè©ŠããŠãã ããã "$BOOLEAN" boolean å€ã true ã«å€æŽãããšããã®ã¢ã¯ã»ã¹ãèš±å¯ããŸãïŒ "setsebool -P $BOOLEAN=1" "$BOOLEAN" boolean ã true ã«å€æŽãããšããã®ã¢ã¯ã»ã¹ãèš±å¯ãããŸã: "setsebool -P $BOOLEAN=1." "allow_ftpd_use_nfs" boolean ã true ã«å€æŽãããšããã®ã¢ã¯ã»ã¹ãèš±å¯ãããŸã: "setsebool -P allow_ftpd_use_nfs=1." file_context ã mnt_t ã«å€æŽãããšãmount ã«ãããã¡ã€ã«ã·ã¹ãã ã®ããŠã³ãã èš±å¯ãããŸã: "chcon -t mnt_t '$TARGET_PATH'" ãŸããå®å šã«ã©ãã«ãä»ãçŽããåŸã§ããã®ããŠã³ããä¿æã§ããããã«ãã·ã¹ãã ã§ããã©ã«ãã®ãã¡ã€ã«ã³ã³ããã¹ããã¡ã€ã«ãå€æŽããå¿ èŠããããŸãã"semanage fcontext -a -t mnt_t '$FIX_TARGET_PATH'" å¶éããããã¡ã€ã³ã§ã¯ "sys_resource" ãå¿ èŠãšããŸããã ã€ãŸãã éåžžã¯ãã£ã¹ã¯é åã ã¡ã¢ãªãŒã ã¯ã©ãŒã¿ãªã©ã®ã·ã¹ãã ãªãœãŒã¹ããã®ã·ã¹ãã ã«äžè¶³ããŠããããšã«ãªããŸãã ãã£ã¹ã¯é åã解æŸãããšããã® AVC ã¡ãã»ãŒãžã¯è¡šç€ºãããªããªãã¯ãã§ãã ãã£ã¹ã¯é åã解æŸããŠã AVC ã¡ãã»ãŒãžã衚瀺ãããå Žåã¯ããã®åé¡ããã°ãšããŠå ±åããŠãã ããã å¥ã®ã¢ã¯ã»ã¹ãå¿ èŠãšãããéå®ãããããã»ã¹ãå®è¡ããããã«èšå®ã§ããŸãã SELInux ã¯å¿ èŠã«å¿ããŠããŠãŒã¶ãŒãã¢ã¯ã»ã¹ããªã³/ãªãã«åãæ¿ãã§ãã ããŒãªã¢ã³å€ãæäŸããŸãã httpd ã¹ã¯ãªããã«ãããããªãã¯ãã£ã¬ã¯ããªãŒãžã®æžã蟌ã¿ãèš±å¯ããå Žåã $BOOLEAN boolean ããªã³ã«ããŠããããªãã¯ãã£ã¬ã¯ããªãŒã®ãã¡ã€ã«ã³ã³ããã¹ãã public_content_rw_t ã«å€æŽããå¿ èŠããããŸãã 詳现ã«ã€ããŠã¯ httpd_selinux ã® man ããŒãžãã芧ãã ãã: "setsebool -P $BOOLEAN=1; chcon -t public_content_rw_t<path>" ãŸãã å®å šãªåã©ãã«ä»ããè¡ãªã£ãåŸããããªãã¯ãã£ã¬ã¯ããªãŒã®ã©ãã«ãç¶æããããå Žåã¯ã ã·ã¹ãã ã®ããã©ã«ãã®ãã¡ã€ã«ã³ã³ããã¹ãã©ãã«èšå®ãã¡ã€ã«ãå€æŽããå¿ èŠããããŸãã "semanage fcontext -a -t public_content_rw_t <path>" $TARGET_PATH ãæ£ããå®è¡ããããšãä¿¡çšã§ããå Žåã¯ããã¡ã€ã«ã³ã³ããã¹ãã textrel_shlib_t ãžå€æŽããããšãã§ããŸãã"chcon -t textrel_shlib_t '$TARGET_PATH'" ãŸããã·ã¹ãã ã®ããã©ã«ããã¡ã€ã«ã³ã³ããã¹ãã®ãã¡ã€ã«ããå®å šãªåã©ãã«ã§ãä¿æããããã«ãå€æŽããªããã°ãªããŸããã"semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH'" $SOURCE ãç¶ç¶ãããå Žåã¯ã$BOOLEAN boolean ããªã³ã«ããå¿ èŠããã ãŸãã 泚èš: ãã® boolean ã¯ã·ã¹ãã äžã®å šã¢ããªã±ãŒã·ã§ã³ã«åœ±é¿ ããŸãã httpd ã«ã¡ãŒã«éä¿¡ããããå Žåã¯ã $BOOLEAN boolean ããªã³ã«ããå¿ èŠããããŸã: "setsebool -P $BOOLEAN=1" $SOURCE ãããŒã $PORT_NUMBER ã«ãã€ã³ãã§ããããã«ãããå Žåã以äžã³ãã³ããå®è¡ããŸãã # semanage port -a -t PORT_TYPE -p %s $PORT_NUMBER ãã㧠PORT_TYPE ã¯äžã®ããããã§ã: %s. 䜿çšã·ã¹ãã ã NIS ã¯ã©ã€ã¢ã³ããšããŠçšŒåããŠããå Žåã allow_ypbind boolean ããªã³ã«ãããšåé¡ã解決ããå¯èœæ§ããããŸããsetsebool -P allow_ypbind=1 $SOURCE ã«ãã $PORT_NUMBER ãžã®æ¥ç¶ãèš±å¯ããå Žåã¯ã以äžãå®è¡ããŸãã # sandbox -X -t sandbox_net_t $SOURCE $SOURCE ã«ãã $PORT_NUMBER ãžã®æ¥ç¶ãèš±å¯ããå Žåã¯ã 以äžãå®è¡ããŸãã # semanage port -a -t PORT_TYPE -p %s $PORT_NUMBER ããã§ãPORT_TYPE 㯠以äžã®ãããããšãªããŸã: %s ã èªåããŠã³ã¿ãŒã§å®è¡ã§ããããã« $TARGET_PATH ã®ãã¡ã€ã«ã³ã³ããã¹ããå€æŽããå Žåã¯ã "chcon -t bin_t $TARGET_PATH" ãå®è¡ããŸãã åã©ãã«åŸããã®å€æŽãç¶æãããå Žåã¯ã ãã¡ã€ã«ã³ã³ããã¹ããæ°žç¶çã«å€æŽããå¿ èŠããããŸãã "semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'" ãå®è¡ããŸãã SELinux ã¯ã$TARGET_PATH ãžã® $SOURCE ã¢ã¯ã»ã¹ãæåŠããŸããã ã¹ã¯ãããã¡ã€ã«ã®å Žåã¯ãswapfile_t ã®ãã¡ã€ã«ã³ã³ããã¹ãã©ãã«ã å¿ èŠã§ãã$TARGET_PATH ãã¹ã¯ãããã¡ã€ã«ãšããŠäœ¿çšããæå³ããªãã£ã å Žåããã®ã¡ãã»ãŒãžã¯ããã°ããäžæ£äŸµå ¥ãè©Šã¿ãããå¯èœæ§ã瀺ããŠããŸãã SELinux ã¯ãRSYNC ã $TARGET_PATH ã«ã¢ã¯ã»ã¹ããã®ãæåŠããŸããã ããã RSYNC ãªããžããªãŒã§ãããªããrsync_data_t ã®ãã¡ã€ã« ã³ã³ããã¹ãã©ãã«ãå¿ èŠã«ãªããŸãã$TARGET_PATH ã RSYNC ãªããžããªãŒãšããŠäœ¿çšããäºå®ã§ã¯ãªãã£ãå Žåã ãã®ã¡ãã»ãŒãžã¯ããã°ããäžæ£äŸµå ¥ãè©Šã¿ãããå¯èœæ§ã瀺ããŠããŸãã SELinux ã«ããã$SOURCE ãèŠæ±ããã¢ã¯ã»ã¹ãæåŠãããŸããã $SOURCE_PATH ã«èª€ã£ãã©ãã«ãä»ããããŠããå¯èœæ§ããããŸãã $SOURCE_PATH ã®ããã©ã«ãã® SELinux ã¿ã€ãã¯<B>%s</B> ã§ããã çŸåšã®ã¿ã€ã㯠<B>$SOURCE_TYPE</B> ã§ãã ãã®ãã¡ã€ã«ã®ã¿ã€ããããã©ã«ãã«æ»ããšãåé¡ã解決ããå ŽåããããŸãã <p> ãŠãŒã¶ãŒãšã©ãŒããéåžžã®å¶éãããã¢ããªã±ãŒã·ã§ã³ã誀ã£ããã¡ã€ã³ã§ å®è¡ãããããšã«ããããã®ãã¡ã€ã«ã«ã¯èª€ã£ãã©ãã«ãä»ããããå¯èœæ§ããããŸãã <p> ãããããã®ãã¡ã€ã«ã«ãã®ã¿ã€ãã®ã©ãã«ãä»ããããã¯ãããªãããã SELinux ã®ãã°ã§ããå¯èœæ§ããããŸãã <p> ããããã°ã ãšæãããå Žåã¯ããã®ããã±ãŒãžã«ã€ããŠãã°ã¬ããŒããæåºããŠãã ããã SELinux ã¯ã$SOURCE ã«ããèŠæ±ãããã¢ã¯ã»ã¹ãæåŠããŸããã$TARGET_PATH ã«ã¯ 誀ã£ãã©ãã«ãä»ããããŠããå¯èœæ§ããããŸãã$TARGET_PATH ã«ãããããã©ã«ãã® SELinux ã¿ã€ãã¯ã <B>%s</B> ã§ãããçŸåšã®ã¿ã€ã㯠<B>$TARGET_TYPE</B> ã§ãããã®ãã¡ã€ã«ã ããã©ã«ãã®ã¿ã€ãã«æ»ãããšã«ãããåé¡ã解決ãããå¯èœæ§ããããŸãã <p> ãã¡ã€ã«ã®ã³ã³ããã¹ãã¯ã以äžã®æ¹æ³ã§ 1 ã€ã®ãã¡ã€ã«ã«å²ãåœãŠãããšãã§ããŸãã <ul> <li>ãã£ã¬ã¯ããªãŒã«äœæããããã¡ã€ã«ã¯ãããã©ã«ãã§èŠªãã£ã¬ã¯ããªãŒã®ãã¡ã€ã«ã³ã³ããã¹ããåãåããŸãã <li>SELinux ããªã·ãŒã¯ãã©ãã« B ãä»ãããããã£ã¬ã¯ããªãŒã«ãã¡ã€ã«ãäœæããã³ã³ããã¹ã A ã§å®è¡ããŠããããã»ã¹ãæå®ããããšã«ããã 芪ãã£ã¬ã¯ããªãŒããç¶æ¿ããããã©ã«ãã®ã©ãã«ããªãŒããŒã©ã€ããã代ããã«ã©ãã« C ãæã€ãã¡ã€ã«ãäœæããããã«ãªããŸãã ãã®äŸãšããŠãdhclient_t ã¿ã€ãã§å®è¡ããŠããŠããã£ã¬ã¯ããªãŒ /etc å ã«ãã¡ã€ã«ãäœæãããã㪠dhcp ã¯ã©ã€ã¢ã³ãããããŸãããã®ãã¡ã€ã«ã¯ã éåžžã芪ããã®ç¶æ¿ã«ãã etc_t ã¿ã€ããåãåããŸãããSELinux ããªã·ãŒã®æå®ã«ããããã®ãã¡ã€ã«ã«ã¯ä»£ããã« net_conf_t ã¿ã€ãã§ã©ãã«ãä»ããããŸãã <li>chcon ã restorecon ãªã©ã®ããŒã«ã䜿çšããããšã§ããã¡ã€ã«äžã®ãã¡ã€ã«ã³ã³ããã¹ããå€æŽããããšãã§ããŸãã </ul> ãŠãŒã¶ãŒãšã©ãŒããéåžžã®å¶çŽãããã¢ããªã±ãŒã·ã§ã³ãééã£ããã¡ã€ã³ã§å®è¡ãããããšã«ããããã®ãã¡ã€ã«ã«ã¯èª€ã£ãã©ãã«ãä»ããããå¯èœæ§ããããŸãã <p> ãããããã®ãã¡ã€ã«ã«ãã®ã¿ã€ãã®ã©ãã«ãä»ããããã¯ãããªãããããã㯠SELinux å ã®ãã°ã§ããå¯èœæ§ããããŸãã <p> ããããã°ã ãšæãããå Žåã¯ããã®ããã±ãŒãžã«ã€ããŠãã°ã¬ããŒããäœæããŠãã ããã SELinux ã¯ã$SOURCE ãèŠæ±ããã¢ã¯ã»ã¹ãæåŠããŸããã$TARGET_PATH ã«ã¯èª€ã£ãã©ãã«ãä»ããããŠããå¯èœæ§ããããŸããã©ãã«ãé©åã«èšå®ãããŠããå Žåã openvpn ã¯ããŒã ãã£ã¬ã¯ããªãŒã®ã³ã³ãã³ããèªã¿èŸŒãããšãã§ããŸãã SELinux 㯠$SOURCE ã«ããèŠæ±ãããã¢ã¯ã»ã¹ãæåŠããŸããã$TARGET_PATH 㫠誀ã£ãã©ãã«ãä»ããããŠããå¯èœæ§ããããŸããã©ãã«ãé©åã«èšå®ãããŠããå Žåã sshd 㯠/root/.ssh ãã£ã¬ã¯ããªãŒã®ã³ã³ãã³ããèªã¿èŸŒãããšãã§ããŸãã SELinux ã¯ã$SOURCE ã«ããèŠæ±ãããã¢ã¯ã»ã¹ãæåŠããŸããã ãã®ã¢ã¯ã»ã¹ã¯ $SOURCE ã«å¿ èŠã§ãããšæ³å®ãããªããããäžæ£äŸµå ¥ ã®è©Šè¡ã瀺ããŠããå¯èœæ§ããããŸãã ãŸãã ã¢ããªã±ãŒã·ã§ã³ã®ç¹å® ããŒãžã§ã³ãŸãã¯èšå®ãè¿œå ã¢ã¯ã»ã¹èŠæ±ã®åå ãšãªã£ãŠããå¯èœæ§ ããããŸãã SELinux ã¯ã$SOURCE ãèŠæ±ããã¢ã¯ã»ã¹ãæåŠããŸããã$SOURCE ããã®ã¢ã¯ã»ã¹ãèŠæ±ããããšã¯æ³å®ãããŠããããäžæ£äŸµå ¥ã®è©Šã¿ã§ããå¯èœæ§ããããŸããã¢ããªã±ãŒã·ã§ã³ã§ç¹å®ã®ããŒãžã§ã³ãŸãã¯èšå®ã§ãè¿œå ã¢ã¯ã»ã¹ãå¿ èŠãšãªã£ãŠããå¯èœæ§ããããŸããmozplugger ããã³ spice-xpi ã¯ããã¹ã¯ããããžã®ã¢ã¯ã»ã¹ãå¿ èŠãšãã mozilla-plugins ã§ã¢ããªã±ãŒã·ã§ã³ãå®è¡ããmozilla_plugin ããã¯ããŠã³ã¯èš±å¯ãããªãããšãããmozilla_plugin ããã¯ããŠã³ããªãã«ãããããããã®ããã±ãŒãžã䜿çšããªãããã«ããå¿ èŠããããŸãã SELinux ã¯ã$SOURCE ãèŠæ±ããã¢ã¯ã»ã¹ãæåŠããŸããã$SOURCE ããã®ã¢ã¯ã»ã¹ãå¿ èŠãšããããšã¯æ³å®ãããŠãããããã®ã¢ã¯ã»ã¹ã¯äŸµå ¥ã®è©Šè¡ã§ããå¯èœæ§ããããŸããã¢ããªã±ãŒã·ã§ã³ã®ç¹å®ã®ããŒãžã§ã³ãŸãã¯èšå®ã«ãããè¿œå ã¢ã¯ã»ã¹ãå¿ èŠãšãªã£ãŠããå¯èœæ§ããããŸããspice-xpi ã¯ããã¹ã¯ããããžã®ã¢ã¯ã»ã¹ãå¿ èŠãšãã mozilla-plugins å ã§ã¢ããªã±ãŒã·ã§ã³ãå®è¡ããmozilla_plugin ããã¯ããŠã³ã¯èš±å¯ãããªãããšãããmozilla_plugin ããã¯ããŠã³ããªãã«ãããããããã®ããã±ãŒãžã䜿çšããªãããã«ããå¿ èŠããããŸãã SELinux ã¯ã$SOURCE ã³ãã³ããèŠæ±ããã¢ã¯ã»ã¹ãæåŠããŸãããããã¯ã ãã£ã¹ã¯ãªãã¿ãŒããªãŒã¯ããããã¢ã¯ã»ã¹ã®èš±å¯ããªããã¡ã€ã«ã« $SOURCE ã®åºåãå転éãããããã«èŠããŸããSELinux ã¯ããªãŒã¯ãéããŠãšã©ãŒãå ±åããããããªãŒã¯ã¯éåžžç¡èŠãããŸãããã®ã¢ããªã±ãŒã·ã§ã³ã¯ããã®ãã£ã¹ã¯ãªãã¿ãŒã䜿çšããªããããæ£åžžã«çšŒåããŸãããããå転éã§ãã£ãå Žåã$TARGET_PATH ã«ã¯åºåãããŸãããselinux-policy ã« bugzilla ãçæããå¿ èŠã«ãªããããã«ãããé©åãªããã±ãŒãžã«éãããŸãããã® avc ã¯ãç¡èŠããŠãåé¡ã¯ãããŸããã SELinux ã«ããã$SOURCE ãèŠæ±ãã $TARGET_PATH ãžã®ã¢ã¯ã»ã¹ãæåŠãããŸããã $TARGET_PATH ã«ã¯ã å¥ã®ããã°ã©ã ã§å ±æã«äœ¿çšãããã³ã³ããã¹ãããããŸãã $SOURCE ããã $TARGET_PATH ãå ±æãããå Žåããã®ãã¡ã€ã«ã³ã³ããã¹ãã public_content_t ã«å€æŽããå¿ èŠããããŸãããã®ã¢ã¯ã»ã¹ãæå³çã«èš±å¯ã㊠ããªãã£ãå Žåã¯ãäžæ£äŸµå ¥ãè¡ãªãããå¯èœæ§ããããŸãã SELinux ã¯ã$TARGET_PATH ãžã® cvs ã¢ã¯ã»ã¹ãæåŠããŸããã ããã CVS ãªããžããªãŒã®å Žåã¯ã cvs_data_t ã®ãã¡ã€ã«ã³ã³ããã¹ãã©ãã«ã å¿ èŠã§ããCVS ãªããžããªãŒãšã㊠$TARGET_PATH ã䜿çšããã€ããã§ã¯ãªãã£ãå Žåã ããã¯ãã°ã§ããããäžæ£äŸµå ¥ã®è©Šè¡ã瀺ããŠããå¯èœæ§ããããŸãã SELinux ã¯ãsamba ã $TARGET_PATH ãžã¢ã¯ã»ã¹ããã®ãæåŠããŸããã ãã®ãã£ã¬ã¯ããªãŒã samba ãšå ±æãããå Žåã¯ãsamba_share_t ã® ãã¡ã€ã«ã³ã³ããã¹ãã©ãã«ãå¿ èŠã§ãã$TARGET_PATH ã samba ãªããžããªãŒ ãšããŠäœ¿çšããæå³ã§ã¯ãªãã£ãå Žåããã®ã¡ãã»ãŒãžã¯ããã°ãã äžæ£äŸµå ¥ãè©Šã¿ãããå¯èœæ§ã瀺ããŠããŸãã Samba ãš SELinux ã®ã»ããã¢ããã«é¢ãã詳现㯠'man samba_selinux' ãåç §ããŠãã ããã SELinux ã«ããã$TARGET_PATH ãžã® svirt ã¢ã¯ã»ã¹ãæåŠãããŸããã ãããä»®æ³åã€ã¡ãŒãžã®å Žåã¯ãvirt_image_t ãšãããã¡ã€ã«ã³ã³ããã¹ãã©ãã«ã å¿ èŠã§ããã·ã¹ãã ã¯ã/var/lib/libvirt/images ãã£ã¬ã¯ããªãŒã§ã€ã¡ãŒãžãã¡ã€ã«ã«æ£åžž ã«ã©ãã«ä»ãããããã«èšå®ãããŠããŸããã䜿ãã®ã€ã¡ãŒãžãã¡ã€ã«ã /var/lib/libvirt/images ã«ã³ããŒãããããå§ãããŸããçŸåšã®ãã£ã¬ã¯ããªãŒã«ã€ã¡ãŒãžãã¡ã€ã«ãã©ãããŠãå¿ èŠãªå Žåã¯ãchcon ã䜿çšã㊠$TARGET_PATH ã®ã©ãã«ã virt_image_t ãžãšå€æŽã§ããŸãããŸããsemanage fcontext -a -t virt_image_t '$FIX_TARGET_PATH' ãå®è¡ããŠããã®æ°ãããã¹ã ã·ã¹ãã ããã©ã«ãã«è¿œå ããå¿ èŠããããŸãã$TARGET_PATH ãä»®æ³åã€ã¡ãŒãžãšããŠäœ¿çšãã æå³ããªãã£ãå Žåã¯ããã°ãŸãã¯äžæ£äŸµå ¥ã®è©Šè¡ã瀺ããŠããå¯èœæ§ããããŸãã SELinux ã«ããããããã¯ããã€ã¹ $TARGET_PATH ãžã® svirt ã¢ã¯ã»ã¹ãæåŠãããŸããã ãããä»®æ³åã€ã¡ãŒãžã®å Žåãä»®æ³åãã¡ã€ã«ã³ã³ããã¹ã (virt_image_t) ã§ã©ãã«ä»ãããå¿ èŠããããŸããchcon ã䜿çšããŠã$TARGET_PATH ã virt_image_t ãšãªãããã©ãã«ãå€æŽã§ããŸãããŸããsemanage fcontext -a -t virt_image_t '$FIX_TARGET_PATH' ãå®è¡ããŠã ãã®æ°ãããã¹ãã·ã¹ãã ããã©ã«ãã«è¿œå ããå¿ èŠããããŸãã$TARGET_PATH ãä»®æ³åã€ã¡ãŒãžãšããŠäœ¿çšããæå³ããªãå Žåã¯ã ãã°ãŸãã¯äžæ£äŸµå ¥ã®è©Šè¡ã瀺ããŠããå¯èœæ§ããããŸãã SELinux ã«ããã$TARGET_PATH ãžã® xen ã®ã¢ã¯ã»ã¹ãæåŠãããŸããã ããã XEN ã€ã¡ãŒãžã®å Žåã¯ã xen_image_t ã®ãã¡ã€ã«ã³ã³ããã¹ãã©ãã«ã å¿ èŠããããŸãã ã·ã¹ãã ã¯ã/var/lib/xen/images ãã£ã¬ã¯ããªå ã§ã€ã¡ãŒãžãã¡ã€ã« ã«ã©ãã«ä»ããè¡ãªãããæ£ããèšå®ãããŠããŸãã 䜿çšããã€ã¡ãŒãžãã¡ã€ã«ã /var/lib/xen/images ãã£ã¬ã¯ããªãŒã«ã³ããŒããããšããå§ãããŸãã ã©ãããŠã xen ã€ã¡ãŒãž ãã¡ã€ã«ãçŸåšã®ãã£ã¬ã¯ããªãŒã«é 眮ããå¿ èŠãããå Žåã¯ã chcon ã䜿çšã㊠$TARGET_PATH ã« xen_image_t ã®ã©ãã«ãä»ãçŽããŠãã ããã ãŸãã semanage fcontext -a -t xen_image_t '$FIX_TATGET_PATH' ãå®è¡ããŠã ãã®æ°ãã ãã¹ãã·ã¹ãã ã®ããã©ã«ãèšå®ã«è¿œå ããå¿ èŠããããŸãã $TARGET_PATH ã xen ã€ã¡ãŒãž ãšããŠäœ¿çšããæå³ããªãã£ãå Žåã¯ã ãã°ãŸãã¯äžæ£äŸµå ¥ã®è©Šè¡ã瀺ããŠããå¯èœæ§ããããŸãã $SOURCE ã«ãããããŒãã«é¢é£ä»ãããã SELinux ã¿ã€ããæããªããããã¯ãŒã¯ããŒã $PORT_NUMBER ãžã®æ¥ç¶ããSELinux ã¯æåŠããŸããã $SOURCE ã® $PORT_NUMBER ã§ã®æ¥ç¶ãèš±å¯ããå¿ èŠãããå Žåã¯ã<i>semanage</i> ã³ãã³ãã䜿çšããŠã$PORT_NUMBER ãã$SOURCE_TYPE ãæ¥ç¶ã§ããããŒãã¿ã€ãã«å²ãåœãŠãŸã (%s)ã $SOURCE ã«ãã $PORT_NUMBER ãžã®æ¥ç¶ãæ³å®ãããŠããªãå Žåã¯ã äžæ£äŸµå ¥ã®è©Šè¡ã瀺åãããå¯èœæ§ããããŸãã SELinux ã¯ã$SOURCE ãããµã³ãããã¯ã¹ã®äžã§ãããã¯ãŒã¯ããŒã $PORT_NUMBER ã«æ¥ç¶ããããšãæåŠããŸããã $SOURCE ã«ãã $PORT_NUMBER ãžã®æ¥ç¶ãèš±å¯ããå Žåã¯ãsandbox_web_t ã sandbox_net_t ãªã©ã®å¥ã®ãµã³ãããã¯ã¹ã¿ã€ãã䜿çšããå¿ èŠããããŸãã # sandbox -X -t sandbox_net_t $SOURCE $SOURCE ã«ãã $PORT_NUMBER ãžã®æ¥ç¶ããµããŒããããŠããªãå Žåã ããã¯ãäŸµå ¥ã®è©Šã¿ã§ããå¯èœæ§ããããŸãã SELinux ã«ããã誀ã£ãã©ãã«ä»ãã®å¯èœæ§ã®ãã $TARGET_PATH ãã¡ã€ã« ãžã® $SOURCE ã¢ã¯ã»ã¹ãæåŠãããŠããŸããããã¯ãSELinux ã§ã¯ httpd ã«ãããããã®ãã¡ã€ã«ã®äœ¿çšãèš±å¯ãããªããšããããšã«ãªããŸãã httpd ã«ããããããã¡ã€ã«ãžã®åæ§ã® ã¢ã¯ã»ã¹ãèš±å¯ããå Žåã¯ã ãã¡ã€ã«ã³ã³ããã¹ãã次ã®ããããã®ã¿ã€ãã«å€æŽããå¿ èŠããããŸãã%sã å€ãã®ãµãŒãããŒãã£ãŒã®ã¢ããªã±ãŒã·ã§ã³ã§ã¯ã SELinux ããªã·ãŒã§ã¯ äºæž¬ã§ããªããã£ã¬ã¯ããªãŒã«ãhtml ãã¡ã€ã«ãã€ã³ã¹ããŒã«ãããŸãã ãããã®ãã£ã¬ã¯ããªãŒã«ã¯ãhttpd ã«ããã¢ã¯ã»ã¹ãå¯èœãªãã¡ã€ã«ã³ã³ããã¹ã ã§ã©ãã«ä»ããè¡ãªãå¿ èŠããããŸãã $SOURCE ããããŒãã«é¢é£ä»ãããã SELinux ã¿ã€ããæããªããããã¯ãŒã¯ããŒã $PORT_NUMBER ã«ãã€ã³ãããããšããSELinux ã¯æåŠããŸããã $SOURCE ã®ã$PORT_NUMBER ã§ã®ãªãã¹ã³ãèš±å¯ããå¿ èŠãããå Žåã <i>semanage</i> ã³ãã³ãã䜿çšã㊠$PORT_NUMBER ã $SOURCE_TYPE ã ãã€ã³ãã§ããããŒãã¿ã€ããžå²ãåœãŠãŸã (%s) ã $SOURCE ã«ãã $PORT_NUMBER ãžã®ãã€ã³ããæ³å®ãããŠããªãå Žåã äžæ£äŸµå ¥ã®è©Šè¡ã瀺åãããå¯èœæ§ããããŸãã SELinux ã¯ãã«ãŒãã«ã®ã¢ãã¬ã¹ç©ºéã®äœäœçœ®ã mmap ãã $SOURCE ã®æ©èœã æåŠããŸãããã¢ãã¬ã¹é åã®äœäœçœ®ã mmap ããæ©èœã¯ã /proc/sys/kernel/mmap_min_addr ã§èšå®ãããŸãããã®ãããªãããã³ã°ãæåŠãããšã ã«ãŒãã«ã§ null deref ãã°ãæªçšããã®ãé²ãããšãã§ããŸãããã®ã¢ã¯ã»ã¹ã å¿ èŠãšããã¢ããªã±ãŒã·ã§ã³ã¯ããã¹ãŠç¬èªã®ããªã·ãŒãèšè¿°ãããŠããã¯ãã§ãã ã»ãã¥ãªãã£ãŒäŸµå®³ãããã¢ããªã±ãŒã·ã§ã³ãã«ãŒãã«ã®ä¿®æ£ãè©Šã¿ããšã ãã® AVC ãçæãããŸããããã¯æ·±å»ãªåé¡ã§ããã䜿çšã®ã·ã¹ãã ã¯ãéåžžã« é«ã確çã§ãã»ãã¥ãªãã£ã䟵害ãããŠããå¯èœæ§ããããŸãã SELinux ã¯ã$SOURCE_PATH ãééã£ãã©ãã«ãæã€å¯èœæ§ã®ãããã¡ã€ã« $TARGET_PATH ãå®è¡ããã®ãæåŠããŸãããèšå®ãã¡ã€ã«ãå®è¡ããããã«ã èªåããŠã³ã¿ãŒãèšå®ã§ããŸãã $TARGET_PATH ããèªåããŠã³ãã§å®è¡å¯èœãª èšå®ãã¡ã€ã«ã§ããå Žåã¯ãbin_t ã®ãã¡ã€ã«ã©ãã«ãæã€å¿ èŠããããŸãã èªåããŠã³ã¿ãŒãæ³å®ãããŠããªããã®ãå®è¡ããããšããŠããå Žåã¯ã ããã¯äžæ£äŸµå ¥ã瀺åããŠããå¯èœæ§ããããŸãã SELinux ã¯ãhttp ããŒã¢ã³ã«ããã¡ãŒã«éä¿¡ãæåŠããŸããã httpd ã¹ã¯ãªããããã¡ãŒã«ããŒããžã®æ¥ç¶ããŸã㯠sendmail ã³ãã³ãã®å®è¡ãè©Šè¡ããŠããŸãã httpd ã« sendmail ãèšå®ããŠããªãå Žåã¯ã äžæ£äŸµå ¥ãè©Šã¿ãããå¯èœæ§ããããŸãã SELinux 㯠$SOURCE ã«ãã ã«ãŒãã«ã¢ãžã¥ãŒã«ã®ããŒããé»æ¢ããŸããã ã«ãŒãã«ã¢ãžã¥ãŒã«ãããŒãããå¿ èŠã®ãããã¹ãŠã®å¶éãããããã°ã©ã ã§ãããããã®ããªã·ãŒãäºåã«äœæãããŠããå¿ èŠããããŸãããã»ãã¥ãªãã£ãŒã®ãªã¹ã¯ã«ãããããŠããã¢ããªã±ãŒã·ã§ã³ãã«ãŒãã«ãä¿®æ£ããããšãããšããã® AVC ãçæãããŸããããã¯é倧ãªåé¡ã§ããã䜿çšã®ã·ã¹ãã ã¯ã»ãã¥ãªãã£ãŒã®ãªã¹ã¯ã«ãããããŠããå¯èœæ§ããããŸãã SELinux ã¯ã$SOURCE ã«ãã $TARGET ã®ä¿®æ£ãé»æ¢ããŸããããã®é»æ¢ã¯ $SOURCE ããselinux ããªã·ãŒèšå®ãä¿®æ£ããããšããŠããããšã 瀺ããŸãã ãã®ã¢ã¯ã»ã¹ãå¿ èŠãšãããã¹ãŠã®ã¢ããªã±ãŒã·ã§ã³ã§ãããããã®ããªã·ãŒãäºåã«èšå®ãããŠããå¿ èŠããããŸãããã»ãã¥ãªãã£ãŒã®ãªã¹ã¯ã«ãããããŠããã¢ããªã±ãŒã·ã§ã³ã SELinux ããªã·ãŒãä¿®æ£ããããšãããšããã® AVC ãçæãããŸããããã¯é倧ãªåé¡ã§ãã ã䜿çšã®ã·ã¹ãã ã¯ãã»ãã¥ãªãã£ãŒã®ãªã¹ã¯ã«ãããããŠããå¯èœæ§ããããŸãã SELinux ã¯ã$SOURCE ã«ãã $TARGET ã®ä¿®æ£ãé»æ¢ããŸãããããã¯ã$SOURCE ãã«ãŒãã«ã® å®è¡æ¹æ³ãä¿®æ£ããããšããŠãããããŸãã¯ãã®ã«ãŒãã«ã«ã³ãŒããæ¿å ¥ããããšããŠããããšã 瀺ããŸãããã®ã¢ã¯ã»ã¹ãå¿ èŠãšãããã¹ãŠã®ã¢ããªã±ãŒã·ã§ã³ã§ãããããã®ããªã·ãŒãäºåã« äœæãããŠããå¿ èŠããããŸããã»ãã¥ãªãã£ãŒã®ãªã¹ã¯ã«ãããããŠããã¢ããªã±ãŒã·ã§ã³ ãã«ãŒãã«ãä¿®æ£ããããšãããšããã® AVC ãçæãããŸãã ããã¯æ·±å»ãªåé¡ã§ãã ã䜿çšã®ã·ã¹ãã ã¯ãã»ãã¥ãªãã£ãŒã®ãªã¹ã¯ã«ãããããŠããå¯èœæ§ããããŸãã SELinux ã¯ã$SOURCE ã /sys/fs/selinux å ã®ãã¡ã€ã«ã«æžã蟌ãã®ãé»æ¢ããŸããã /sys/fs/selinux ã®ãã¡ã€ã«ã¯ãSELinux ã«èšå®ãããæ¹æ³ã§å¶åŸ¡ãããŸãã /sys/fs/selinux ã®ãã¡ã€ã«ãžã®æžã蟌ã¿ãå¿ èŠãªãã¹ãŠã®ããã°ã©ã ã«ã¯ãããããã® ããªã·ãŒãäºåã«äœæãããŠããå¿ èŠããããŸãããã»ãã¥ãªãã£ãŒã®ãªã¹ã¯ã«ãããããŠãã ã¢ããªã±ãŒã·ã§ã³ã SELinux ãç¡å¹ã«ããããšãããšããã® AVC ãçæãããŸããããã¯éèŠãªåé¡ã§ãã ã䜿çšã®ã·ã¹ãã ã¯ãã»ãã¥ãªãã£ãŒã®ãªã¹ã¯ã«ãããããŠããå¯èœæ§ããããŸãã SELinux 㯠vbetool ã«ããå®å šã§ãªãã¡ã¢ãªãŒæäœãé»æ¢ ããŸãã SELinux ã¯ãå®å šã§ãªãã¡ã¢ãªãŒæäœã wine ãè¡ãã®ãé»æ¢ããŸããã SELinux ã«ããã$SOURCE ã¯ããã¡ã€ã«ã·ã¹ãã ã«ã$SOURCE_TYPE ã®ã³ã³ããã¹ããæã€ãã¡ã€ã«ãäœæã§ããŸããã éåžžãããã¯ãããšãã° "cp -a" ã®ããã«ããã¡ã€ã«ã·ã¹ãã éã§ã®ã³ããŒã®å®è¡æã«ã cp ã³ãã³ãã«ãã¡ã€ã«ã®ã³ã³ããã¹ããç¶æããããã«äŸé Œããéã«çããŸãããã¹ãŠã®ãã¡ã€ã«ã³ã³ããã¹ãããã¡ã€ã«ã·ã¹ãã éã§ç¶æãããã¹ãã§ã¯ãããŸããã ããšãã°ãiso9660_t ã®ãããªèªã¿èŸŒã¿å°çšã®ãã¡ã€ã«ã¿ã€ãã¯ã r/w ã·ã¹ãã ã«çœ®ãã¹ãã§ã¯ãããŸããã "cp -p" ã¯ãã³ããŒå ã®ããã©ã«ããã¡ã€ã«ã³ã³ããã¹ããæ¡çšããããã"cp -a" ããé©åãªå¯èœæ§ããããŸãã SELinux ã¯ã $TARGET_PATH ãžã® $SOURCE_PATH ã«ãã "$ACCESS" ã¢ã¯ã»ã¹ãé»æ¢ããŠããŸãã SELinux ã«ããã$SOURCE_PATH ãã $TARGET_PATH ãžã® "$ACCESS" ã¢ã¯ã»ã¹ãã§ããŸããã SELinux 㯠ãããã€ã¹ $TARGET_PATH ãžã® $SOURCE_PATH ã«ãã "$ACCESS" ã¢ã¯ã»ã¹ãé»æ¢ããŠããŸãã SELinux 㯠$TARGET_PATH ãžã® $SOURCE_PATH ã«ãã "$ACCESS" ãé»æ¢ããŠããŸãã SELinux ã¯ãæŒæŽ©ãã $TARGET_PATH ã®ãã¡ã€ã«ãã£ã¹ã¯ãªãã¿ãŒã« $SOURCE_PATH ãã¢ã¯ã»ã¹ããããšãé»æ¢ããŠããŸãã SELinux ã¯ã$SOURCE_PATH ã«ããããŒã $PORT_NUMBER ãžã®ãã€ã³ããé»æ¢ããŠããŸãã SELinux ã¯ã$SOURCE_PATH ããããŒãã®ã¡ã¢ãªãŒãžã®ã¢ã¯ã»ã¹ä¿è·ã å€æŽããããšãé»æ¢ããŠããŸãã SELinux ã¯ã$SOURCE_PATH ã«ããããŒã $PORT_NUMBER ãžã®æ¥ç¶ãæåŠããŠããŸãã SELinux ã«ããã$SOURCE_PATH ãããã¡ã€ã«ã·ã¹ãã ã« $SOURCE_TYPE ã®ã³ã³ããã¹ãã§ãã¡ã€ã«ãäœæã§ããŸããã SELinux ããããã¹ãã®åé 眮ãèŠæ±ãã $TARGET_PATH ãã$SOURCE_PATH ãããŒãããããšãæåŠããŠããŸãã SELinux ã«ããã$SOURCE_PATH ãããã°ã©ã ã¹ã¿ãã¯ãå®è¡å¯èœã«ããããšãã§ããŸããã SELinux 㯠$SOURCE_PATH ã® "$ACCESS" æ©èœãé»æ¢ããŠããŸãã SELinux 㯠$SOURCE_PATH ã® "sys_resource" æ©èœãé»æ¢ããŠããŸãã SELinux ã¯ã$TARGET_PATH ãžã® Samba ($SOURCE_PATH) ã«ãã "$ACCESS" ã¢ã¯ã»ã¹ãé»æ¢ããŠããŸãã SELinux ã¯ãunlabeled_t ãšã©ãã«ä»ãããããã¡ã€ã«ãžã®ã¢ã¯ã»ã¹ãé»æ¢ããŠããŸãã SELinux ã¯ãcvs ($SOURCE_PATH) ã«ãã $TARGET_PATH ãžã® "$ACCESS" ã¢ã¯ã»ã¹ãé»æ¢ããŠããŸã SELinux ã¯ã$SOURCE_PATH ã«ããã誀ã£ãã©ãã«ä»ãã®å¯èœæ§ã®ãããã¡ã€ã« $TARGET_PATH ã®äœ¿çšãé»æ¢ããŠããŸãã SELinux ã«ãããhttp ããŒã¢ã³ã«ããã¡ãŒã«éä¿¡ãã§ããŸããã SELinux ã¯ã$TARGET_PATH ãžã® xen ($SOURCE_PATH) ã«ãã "$ACCESS" ã¢ã¯ã»ã¹ãé»æ¢ããŠããŸãã unlabeled_t ãšã©ãã«ä»ãããããã¡ã€ã«ã® SELinux ããŒããã·ã§ã³ãã§ã㯠ã¯æåŠãããŠããŸããunlabeled_t ã¯ãSELinux ã«ãŒãã«ãã©ãã«ãæããªã ãã¡ã€ã«ã«äžããã³ã³ããã¹ãã§ããããã¯ãæ·±å»ãªã©ãã«ä»ãã®åé¡ã 瀺ããŠããŸããSELinux ããã¯ã¹äžã®ãã¡ã€ã«ã«ã¯ãunlabeled_t ãšããã©ãã« ã絶察ã«ä»ããªãã§ãã ãããã·ã¹ãã ã«ãã£ã¹ã¯ãã©ã€ããè¿œå ããã°ãã ã®å Žåã¯ãrestorecon ã³ãã³ãã䜿çšããŠã©ãã«ãä»ãçŽãããšãã§ããŸãã ããšãã°ãSELinux ã䜿çšããŠããªã以åã®ã€ã³ã¹ããŒã«ããããŒã ãã£ã¬ã¯ããªãŒãä¿åããå Žåã'restorecon -R -v /home' ãã©ãã«ãä¿®æ£ããŸãã ãã以å€ã®å Žåã¯ããã¡ã€ã«ã·ã¹ãã å šäœã®ã©ãã«ãå€æŽããå¿ èŠããããŸãã SELinux ããªã·ãŒã«ãããhttpd ã¹ã¯ãªããã®ãããªãã¯ãã£ã¬ã¯ããªãŒãžã®æžã蟌ã¿ã æåŠãããŸãã SELinux ããªã·ãŒã«ãããhttpd ã¹ã¯ãªããã®ãããªãã¯ãã£ã¬ã¯ããªãŒãžã®æžã蟌ã¿ã æåŠãããŸãã httpd ã«ããããªãã¯ãã£ã¬ã¯ããªãŒãžã®æžã蟌ã¿ãèšå®ãããŠããªã å Žåã¯ã ã»ãã¥ãªãã£äŸµå®³ã®è©Šã¿ããªãããå¯èœæ§ããããŸãã SELinux ã¯ã$SOURCE ããã¿ã€ã "$TARGET_TYPE" ã® "$TARGET_PATH" ã®ãã¡ã€ã«ãŸã㯠ãã£ã¬ã¯ããªãŒã«ãã¡ã€ã«ã·ã¹ãã ãããŠã³ãããããšãé»æ¢ããŸãããããã©ã«ãã§ã¯ã SELinux ã¯ããã¡ã€ã«ã·ã¹ãã ã®ããŠã³ãããäžéšã®ãã¡ã€ã«ããã£ã¬ã¯ããªãŒ (ããŠã³ããã€ã³ãå±æ§ãããã¿ã€ããå«ãŸãããã®ã®ã¿) ã«å¶éããŸããã¿ã€ã "$TARGET_TYPE" ã«ã¯ãã®å±æ§ããããŸããããã¡ã€ã«ãŸãã¯ãã£ã¬ã¯ããªãŒã®ã©ãã«ã¯å€æŽããããšãã§ããŸãã SELinux ã«ããã"$TARGET_PATH" ãšããååã®ãã¡ã€ã«ãŸãã¯ãã£ã¬ã¯ããªãŒ (ã¿ã€ã "$TARGET_TYPE") ã«ãããã$SOURCE ã«ããããŠã³ããé»æ¢ãããŸããã SELinux 㯠httpd ã® $TARGET_PATH ãžã® $ACCESS ã¢ã¯ã»ã¹ãé»æ¢ããŸããã httpd ã¹ã¯ãªããã¯ããã¹ãŠã®ãã¡ã€ã«ã«æ瀺çãªã©ãã«ããªããã°ãã³ã³ãã³ãã« æžã蟌ãããèš±å¯ãããŸããã$TARGET_PATH ãæžã蟌ã¿å¯èœãªã³ã³ãã³ãã§ãã å Žåãhttpd_sys_rw_content_t ã®ã©ãã«ãå¿ èŠãšãªããè¿œèšãå¿ èŠãªã ãã®å Žåã¯ã httpd_sys_ra_content_t ã®ã©ãã«ãä»ããŸããhttpd ãš selinux ã®èšå®ã«é¢ãã詳现ã¯ã'man httpd_selinux' ãåç §ããŠäžããã SELinux ã«ãããhttp ãã¡ã€ã«ãžã® httpd $ACCESS ã¢ã¯ã»ã¹ãé»æ¢ãããŸããã éåžžã® httpd ã®å Žåã http ãã¡ã€ã«ã³ã³ããã¹ãã®ã©ãã«ãä»ãããããã¡ã€ã«ã«ã¯å®å šã¢ã¯ã»ã¹ã èš±å¯ãããŸãã ãã®ãã·ã³ã§ã¯ã $BOOLEAN ããªãã«èšå®ããã ã»ãã¥ãªãã£ãŒããªã·ãŒã 匷åãããŠããŸãããã®ããã ãã¹ãŠã®ãã¡ã€ã«ã«æ瀺çãªã©ãã«ä»ããè¡ãå¿ èŠããããŸãã ãã¡ã€ã«ã cgi ã¹ã¯ãªããã®å Žåã¯ã ã¹ã¯ãªãããå®è¡ããããã« httpd_TYPE_script_exec_t ã®ã©ãã« ãä»ããå¿ èŠããããŸããèªã¿åãå°çšã®ã³ã³ãã³ãã®å Žåã¯ã httpd_TYPE_content_t ã®ã©ãã«ã ä»ããŸãã æžèŸŒã¿å¯èœãªã³ã³ãã³ããªãã httpd_TYPE_script_rw_t ãŸã㯠httpd_TYPE_script_ra_t ã® ã©ãã«ãä»ããå¿ èŠããããŸãã ã³ã³ããã¹ãã¯ãchcon ã³ãã³ãã䜿çšããŠå€æŽã§ããŸãã man ããŒãžã® "man httpd_selinux" ãåç §ãããã <a href="http://fedora.redhat.com/docs/selinux-apache-fc3">FAQ</a> ãã芧ãã ããã "TYPE" 㯠"sys"ã "user"ã "staff" ãåç §ããŠããããä»ã®ã¹ã¯ãªããã¿ã€ãã®ãããããåç §ããŠããå ŽåããããŸãã SELinux ã«ãããhttpd ã¯ã http ãã¡ã€ã«ãžã® $ACCESS ã¢ã¯ã»ã¹ãé»æ¢ããŸããã SELinux ã¯ã$ACCESS ãããCIFS ãã¡ã€ã«ã·ã¹ãã äžã«ä¿åãããŠãããã¡ã€ã«ãžãftp ããŒã¢ã³ãã¢ã¯ã»ã¹ããã®ãé»æ¢ããŸããã SELinux ã¯ãCIFS ãã¡ã€ã«ã·ã¹ãã ã«æ ŒçŽãããŠãããã¡ã€ã«ãžãftp ããŒã¢ã³ã $ACCESS ããã®ãé»æ¢ããŸããã CIFS (Comment Internet File System) ã¯ãSMB ãšåæ§ã®ãããã¯ãŒã¯ãã¡ã€ã«ã·ã¹ãã ã§ãã (<a href="http://www.microsoft.com/mind/1196/cifs.asp">http://www.microsoft.com/mind/1196/cifs.asp</a>)ã ftp ããŒã¢ã³ã¯ãããŠã³ããããŠãããã®ã¿ã€ãã®ãã¡ã€ã«ã·ã¹ãã ããã1 ã€ãŸãã¯è€æ°ã® ãã¡ã€ã«ãŸãã¯ãã£ã¬ã¯ããªãŒãèªã¿èŸŒãããšããŸããã CIFS ãã¡ã€ã«ã·ã¹ãã 㯠SELinux 㮠詳现ãªã©ãã«æ©èœããµããŒãããŠããªãããããã¡ã€ã«ã·ã¹ãã å ã®ãã¡ã€ã«ããã³ãã£ã¬ã¯ããªãŒã¯ãã¹ãŠã åãã»ãã¥ãªãã£ãŒã³ã³ããã¹ããæããããšã«ãªããŸãã ftp ããŒã¢ã³ã CIFS ãã¡ã€ã«ã·ã¹ãã ãããã¡ã€ã«ãèªã¿èŸŒãããã«èšå®ããŠããªãå Žåã ãã®ã¢ã¯ã»ã¹ã¯ãäžæ£äŸµå ¥ãè¡ãããããšã瀺ããŠããå¯èœæ§ããããŸãã SELinux ã¯ãftp ããŒã¢ã³ã $ACCESS ãã NFS ãã¡ã€ã«ã·ã¹ãã äžã«ä¿åãããŠãããã¡ã€ã«ãžã®ã¢ã¯ã»ã¹ãé»æ¢ããŸããã SELinux ã¯ãNFS ãã¡ã€ã«ã·ã¹ãã ã«æ ŒçŽãããŠãããã¡ã€ã«ãžãftp ããŒã¢ã³ã $ACCESS ããã®ãé»æ¢ããŸããã NFS (Network Filesystem) ã¯ãUnix ã·ã¹ãã / Linux ã·ã¹ãã ã§äžè¬çã«äœ¿çšããããããã¯ãŒã¯ ãã¡ã€ã«ã·ã¹ãã ã§ãã ftp ããŒã¢ã³ã¯ãããŠã³ããããŠãããã®ã¿ã€ãã®ãã¡ã€ã«ã·ã¹ãã ããã1 ã€ãŸãã¯è€æ°ã® ãã¡ã€ã«ãŸãã¯ãã£ã¬ã¯ããªãŒãèªã¿èŸŒãããšããŸããã NFS ãã¡ã€ã«ã·ã¹ãã ã¯ãSELinux ã®è©³çŽ°ãª ã©ãã«æ©èœã¯ãµããŒãããŠããªãããã ãã¡ã€ã«ã·ã¹ãã å ã®ãã¹ãŠã®ãã¡ã€ã«ããã³ãã£ã¬ã¯ããªãŒã¯ã åãã»ãã¥ãªãã£ãŒã³ã³ããã¹ããæããããšã«ãªããŸãã NFS ãã¡ã€ã«ã·ã¹ãã ãããã¡ã€ã«ãèªã¿èŸŒãããã« ftp ããŒã¢ã³ãèšå®ããŠããªãå Žåã ãã®ã¢ã¯ã»ã¹ã®è©Šè¡ãäžæ£äŸµå ¥ã®è©Šè¡ã瀺åããå¯èœæ§ããããŸãã ã©ã€ãã©ãªãŒã«ãééã£ãŠ execstack ãã©ã°ãä»ããããŠããããšããããŸãã ãã®ãã©ã°ã®ä»ããã©ã€ãã©ãªãŒãèŠã€ããå Žåã¯ãexecstack -c LIBRARY_PATH 㧠ãããæ¶å»ã§ããŸãããã®åŸã«ã¢ããªã±ãŒã·ã§ã³ãåè©Šè¡ããŠäžããã ã¢ããªã±ãŒã·ã§ã³ãæ©èœããªãç¶æ ãç¶ç¶ããå Žåã¯ã execstack -s LIBRARY_PATH ã§ãã©ã°ãæ»ãããšãã§ããŸãã $SOURCE ã¢ããªã±ãŒã·ã§ã³ãããŒãã¡ã¢ãªãŒ (äŸãã° malloc ã䜿ã£ãå²åœãŠ) ã®ã¢ã¯ã»ã¹ä¿è·ãå€æŽããããšè©Šã¿ãŸããããããã¯ã»ãã¥ãªãã£ãŒã®åé¡ãšãªãå¯èœæ§ã ãããŸããã¢ããªã±ãŒã·ã§ã³ã¯ãã®ãããªåäœãè¡ãã¹ãã§ã¯ãããŸããã ã¢ããªã±ãŒã·ã§ã³ã¯èª€ã£ãŠèšè¿°ãããããšãããã ãã®ããŒããã·ã§ã³ãèŠæ± ããããšããããŸãã <a href="http://people.redhat.com/drepper/selinux-mem.html">SELinux Memory Protection Tests</a> ã®ãŠã§ãããŒãžã«ããã®èŠæ±ã®åé€æ¹æ³ãèšèŒãããŠããŸãã $SOURCE ãåäœããã åäœãããå¿ èŠãããå Žåã¯ã ã¢ããªã±ãŒã·ã§ã³ãä¿®æ£ããããŸã§ã®éã SELinux ã§äžæçã«ãã®ã¢ã¯ã»ã¹ãèš±å¯ããããšãã§ããŸãã ãã®ããã±ãŒãž ã«é¢ãããã°ã¬ããŒããæåºããŠãã ããã $SOURCE ã¢ããªã±ãŒã·ã§ã³ã¯ãããã¹ã移åãèŠæ±ãã $TARGET_PATH ã®ããŒããè©Šè¡ããŸããã ã»ãã¥ãªãã£ãŒã®åé¡ãšãªãå¯èœæ§ããããŸãã ã»ãšãã©ã®ã©ã€ãã©ãªãŒã¯ãã®èš±å¯ãå¿ èŠãšããŸããã ã©ã€ãã©ãªãŒã¯ 誀ã£ãŠèšè¿°ãããããšãããã ãã®èš±å¯ãèŠæ±ããããšããããŸãã <a href="http://people.redhat.com/drepper/selinux-mem.html">SELinux Memory Protection Tests</a> ã® Web ããŒãžã§ããã®èŠæ±ã®åé€æ¹æ³ã«ã€ããŠèª¬æããŠããŸãã ã©ã€ãã©ãªãŒã ä¿®æ£ããããŸã§ã®éã®åé¿çãšããŠãSELinux ã§ãäžæçã« $TARGET_PATH ã 移åã䜿çšã§ããããã«ããããšãã§ããŸãã ãã®ããã±ãŒãžã«é¢ãããã°ã¬ããŒã ãæåºããŠãã ããã $SOURCE ã¢ããªã±ãŒã·ã§ã³ã¯ãããã¹ã移åãèŠæ±ãã $TARGET_PATH ã®ããŒããè©Šè¡ããŸããã ã»ãã¥ãªãã£ãŒã®åé¡ãšãªãå¯èœæ§ããããŸãã ã»ãšãã©ã®ã©ã€ãã©ãªãŒã¯ãã®èš±å¯ãå¿ èŠãšããŸããã <a href="http://people.redhat.com/drepper/selinux-mem.html"> SELinux Memory Protection Tests</a> ã®ãŠã§ãããŒãžã§ããã®ãã§ãã¯ã«ã€ããŠèª¬æããŠããŸãã ãã®ããŒã«ã¯ã©ã€ãã©ãªãŒãæ£ãã æ§ç¯ããããã©ããã調ã¹ãŸãããã®ãããsetroubleshoot ã¯ããã®ã¢ããªã±ãŒã·ã§ã³ãã»ãã¥ãªãã£ãŒã®ãªã¹ã¯ã«ãããããŠãããã©ãããå€å¥ã§ããŸãããããã¯é倧ãªåé¡ãšãªãå¯èœæ§ããããã䜿ãã®ã·ã¹ãã ãã»ãã¥ãªãã£ãŒã®ãªã¹ã¯ã«ãããããŠããå¯èœæ§ããããŸãã ã»ãã¥ãªãã£ãŒç®¡çè ã«é£çµ¡ãããã®åé¡ãã¬ããŒãããŠãã ããã $SOURCE ã¢ããªã±ãŒã·ã§ã³ãç¬èªã®ã¹ã¿ãã¯ãå®è¡å¯èœã«ããããšè©Šã¿ãŸããã ã»ãã¥ãªãã£ãŒã®åé¡ãšãªãå¯èœæ§ããããŸããããã¯å®å šã«äžèŠãªåäœã§ãã æè¿ã® OS ã§ã¯ãã»ãšãã©ã®å Žåã¹ã¿ãã¯ã¡ã¢ãªãŒã¯å®è¡å¯èœã«ãªã£ãŠããŸããããŸãã ãããå€æŽãããããšããããŸãããå®è¡å¯èœãªã¹ã¿ãã¯ã¡ã¢ãªãŒã¯ã»ãã¥ãªãã£ãŒã«é¢ãã é倧ãªåé¡ã®1 ã€ã§ããexecstack ãšã©ãŒã¯æªæã®ããã³ãŒãã« ãã£ãŠçºçããå¯èœæ§ãæãé«ããªãããã§ããã¢ããªã±ãŒã·ã§ã³ã¯èª€ã£ãŠèšè¿° ãããããšãããããã®èš±å¯ãèŠæ±ããããšããããŸãã <a href="http://people.redhat.com/drepper/selinux-mem.html">SELinux Memory Protection Tests</a> ã®ãŠã§ãããŒãžã«ããã®èŠæ±ã®åé€æ¹æ³ãèšèŒãããŠããŸãã$SOURCE ãåäœãããããã åäœãããå¿ èŠãããå Žåã«ãã¢ããªã±ãŒã·ã§ã³ãä¿®æ£ããããŸã§ã®éã SELinux ã§ãäžæçã«ãã®ã¢ã¯ã»ã¹ãèš±å¯ããããšãã§ããŸãã ãã°ã¬ããŒããæåºããŠãã ããã "cp -p" ãªã©ã®ã³ãã³ãã䜿çšããŠãSELinux ã³ã³ããã¹ã以å€ã®å šãŠã®æš©éãä¿æããŸãã chcon -R -t cvs_data_t '$TARGET_PATH' ãå®è¡ãããšããã¡ã€ã«ã³ã³ããã¹ããå€æŽããããšãã§ããŸãã ãŸããå®å šãªåã©ãã«ã®åŸã§ãããããç¶æã§ããããã«ããã«ã¯ãã·ã¹ãã äžã®ããã©ã«ãã®ãã¡ã€ã«ã³ã³ããã¹ããã¡ã€ã«ã®å€æŽãããªããã°ãªããŸããã "semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH'" chcon -R -t rsync_data_t '$TARGET_PATH' ãå®è¡ãããšããã¡ã€ã«ã³ã³ããã¹ããå€æŽããããšãã§ããŸãã ãŸãããã®ã³ã³ããã¹ããå®å šãªåã©ãã«ã®åŸã§ãä¿æã§ããããã«ãã·ã¹ãã ã§ããã©ã«ãã®ãã¡ã€ã«ã³ã³ããã¹ããå€æŽããå¿ èŠããããŸãã"semanage fcontext -a -t rsync_data_t '$FIX_TARGET_PATH'" chcon -R -t samba_share_t '$TARGET_PATH' ãå®è¡ãããšããã¡ã€ã«ã³ã³ããã¹ããå€æŽããããšãã§ããŸãã ãŸããå®å šãªåã©ãã«ã®åŸããã®ã³ã³ããã¹ããä¿æããããã«ãã·ã¹ãã ã§ããã©ã«ããšãªããã¡ã€ã«ã³ã³ããã¹ããã¡ã€ã«ãå€æŽããå¿ èŠããããŸãã"semanage fcontext -a -t samba_share_t '$FIX_TARGET_PATH'" chcon -t public_content_t '$TARGET_PATH' ãå®è¡ãããšã ãã¡ã€ã«ã®ã³ã³ããã¹ãã å€æŽããããšãã§ããŸãã ãŸãã å®å šãªåã©ãã«ä»ããè¡ãªãããåŸãå€æŽãã ãã¡ã€ã«ã³ã³ããã¹ããç¶æããããå Žåã«ã¯ã ã·ã¹ãã äžã§ããã©ã«ãã®ãã¡ã€ã« ã³ã³ããã¹ãã®ãã¡ã€ã«ãå€æŽããå¿ èŠããããŸãã "semanage fcontext -a -t public_content_t '$FIX_TARGET_PATH'" chcon -t swapfile_t '$TARGET_PATH' ãå®è¡ãããšããã¡ã€ã«ã³ã³ããã¹ããå€æŽããããšãã§ããŸãã ãŸããå®å šãªåã©ãã«ã®åŸã§ããã®ã³ã³ããã¹ããä¿æããããã«ãã·ã¹ãã ã§ããã©ã«ããšãªããã¡ã€ã«ã³ã³ããã¹ããã¡ã€ã«ãå€æŽããå¿ èŠããããŸãã"semanage fcontext -a -t swapfile_t '$FIX_TARGET_PATH'" chcon -t virt_image_t '$TARGET_PATH' ãå®è¡ãããšããã¡ã€ã«ã³ã³ããã¹ããå€æŽã§ããŸãã ãŸããå®å šãªåã©ãã«ã®åŸã§ããã®ãã¡ã€ã«ã³ã³ããã¹ããä¿æã§ããããã«ãã·ã¹ãã ã«ãããããã©ã«ãã®ãã¡ã€ã«ã³ã³ããã¹ããã¡ã€ã«ãå€æŽããå¿ èŠããããŸãã"semanage fcontext -a -t virt_image_t '$FIX_TARGET_PATH'" chcon -t xen_image_t '$TARGET_PATH' ãå®è¡ãããšããã¡ã€ã«ã³ã³ããã¹ãã® å€æŽãã§ããŸãã ãŸããå®å šãªåã©ãã«ã®åŸã§ããã®ã³ã³ããã¹ããä¿æãããããã«ãã·ã¹ãã ã§ããã©ã«ããšãªããã¡ã€ã«ã³ã³ããã¹ããã¡ã€ã«ãå€æŽããå¿ èŠããããŸãã"semanage fcontext -a -t xen_image_t '$FIX_TARGET_PATH'" root ãšããŠæ¬¡ã®ã³ãã³ããå®è¡ãããšãã䜿çšã®ã³ã³ãã¥ãŒã¿ãŒãåã©ãã«ãã ããšãã§ããŸã: "touch /.autorelabel; reboot" ããŒã«ã«ããªã·ãŒã¢ãžã¥ãŒã«ãçæããŠããã®ã¢ã¯ã»ã¹ãèš±å¯ããããã« ã§ããŸãã<a href="http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385">FAQ</a> ãã芧äžããã ãã°ã¬ããŒããæåºããŠãã ããã ããŒã«ã«ããªã·ãŒã¢ãžã¥ãŒã«ãçæããŠããã®ã¢ã¯ã»ã¹ãèš±å¯ã§ããŸãã <a href="http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385">FAQ</a> ãã芧ãã ããã restorecon ã³ãã³ããå®è¡ããããšã«ããããã®ãã¡ã€ã«ãžã®ããã©ã«ãã®ã·ã¹ãã ã³ã³ããã¹ãã 埩å ã§ããŸãã # restorecon -R /root/.ssh restorecon ã³ãã³ããå®è¡ããããšã«ããããã®ãã¡ã€ã«ãžããã©ã«ãã®ã·ã¹ãã ã³ã³ããã¹ãã 埩å ã§ããŸãã # restorecon -R /root/.ssh restorecon ã³ãã³ããå®è¡ããããšã«ããããã®ãã¡ã€ã«ã®ã³ã³ããã¹ãã ã·ã¹ãã ã®åæå€ã«åŸ©å ã§ããŸãã restorecon '$SOURCE_PATH' ã restorecon ã³ãã³ããå®è¡ããããšã«ããã ãã®ãã¡ã€ã«ã«ããã©ã«ãã® ã·ã¹ãã ã³ã³ããã¹ãã埩å ããããšãã§ããŸã (restorecon '$TARGET_PATH')ã ãã®ãã¡ã€ã«ããã£ã¬ã¯ããªãŒã®å Žåã«ã¯ã restorecon -R '$TARGET_PATH' ã 䜿çšããŠååž°çã«åŸ©å ããããšãã§ããŸãã ã䜿çšã®ã·ã¹ãã ã«ã¯æ·±å»ãªäŸµå®³ã®å¯èœæ§ããããŸã! ã䜿çšã®ã·ã¹ãã ã¯ãæ·±å»ãªã»ãã¥ãªãã£ãŒäŸµå®³ã®å¯èœæ§ããããŸã! $SOURCE_PATH ãäœäœçœ®ã«ãŒãã«ã¡ã¢ãªãŒãžã® mmap ãè©Šè¡ããŸããã ã䜿çšã®ã·ã¹ãã ã«ã¯æ·±å»ãªäŸµå®³ã®å¯èœæ§ããããŸã! $SOURCE_PATH ãã«ãŒãã«ã¢ãžã¥ãŒã«ãããŒãããããšããŸããã ã䜿çšã®ã·ã¹ãã ã«ã¯æ·±å»ãªäŸµå®³ã®å¯èœæ§ããããŸã! $SOURCE_PATH ã SELinux 匷å¶ãä¿®æ£ããããšããŸããã ã䜿çšã®ã·ã¹ãã ã«ã¯æ·±å»ãªäŸµå®³ã®å¯èœæ§ããããŸã! $SOURCE_PATH ãã«ãŒãã«èšå®ãå€æŽããããšããŸããã IPv6 ãæ£ããç¡å¹åããŸããã 'yum remove mozplugger' ãå®è¡ã㊠mozplluger ããã±ãŒãžãåé€ãããã Firefox ãã©ã°ã€ã³äžã® SELinux ã®åŒ·å¶ããªãã«ããŸãã setsebool -P unconfined_mozilla_plugin_transition 0 'yum remove mozplugger spice-xpi' ãå®è¡ã㊠mozplluger ãŸã㯠spice-xpi ã®ããã±ãŒãžãåé€ããããFirefox ãã©ã°ã€ã³ã§ SELinux ã®åŒ·å¶ããªãã«ããŸããsetsebool -P unconfined_mozilla_plugin_transition 0 'yum remove mozplugger spice-xpi' ãå®è¡ã㊠mozplluger ãŸã㯠spice-xpi ã®ããã±ãŒãžãåé€ããããChrome ãã©ã°ã€ã³ã§ SELinux ã®åŒ·å¶ããªãã«ããŸããsetsebool -P unconfined_chrome_sandbox_transition 0 åé¡ã«ãªã£ãŠããããã°ã©ã ãç¶ç¶ããŠå®è¡ãã決å®ãããå Žåã¯ããã® æäœãèš±å¯ããå¿ èŠããããŸããããã¯ä»¥äžã®ããã«ã³ãã³ãã©ã€ã³ã§ å®è¡ã§ããŸã: # setsebool -P mmap_low_allowed 1 SELinux ã¯ããããªããŒããŠã§ã¢ã®ç¶æ ãå€æŽããããã®ããã°ã©ã $SOURCE ã èŠæ±ããæäœãæåŠããŸãããvbetool ãšããŠãªãããŸãããã®ä»ã®å€ãã® ãã«ãŠã§ã¢/ã»ãã¥ãªãã£ãŒã®åŒ±ç¹ãçªãããã°ã©ã ãšåæ§ããã®ããã°ã©ã ã¯ã·ã¹ãã ã¡ã¢ãªãŒäžã§ å®å šã§ãªãæäœãããããšã§ç¥ãããŠããŸãããã®ããŒã«ã¯ããã·ã³ããµã¹ãã³ããã 埩垰ããéã« ãããªã®ç¶æ ããªã»ããããããã«äœ¿çšãããŸãã䜿çšäžã®ãã·ã³ãæ£åžžã«åŸ©åž°ããªãå Žåã¯ã ãã®æäœãèš±å¯ããã®ãå¯äžã®éžæè¢ãšãªããæªæã®ããã°ã©ã ã«å¯Ÿããã·ã¹ãã ã®ã»ãã¥ãªãã£ãŒã¯äœäžããŸãã SELinux ã¯ãLinux äžã§ Windows ã¢ããªã±ãŒã·ã§ã³ãå®è¡ããã®ã«äœ¿çšãããããã°ã©ã wine-preloader ãèŠæ±ããæäœãæåŠããŸããããã®ããã°ã©ã ã¯ãwine ãšããŠãªãããŸãã å€ãã®ãã«ãŠã§ã¢/ã»ãã¥ãªãã£ãŒã®åŒ±ç¹ãçªãããã°ã©ã ãšåæ§ãã·ã¹ãã ã¡ã¢ãªãŒäžã§å®å šã§ãªãæäœã䜿çšããããšã§ ç¥ãããŠããŸããWindows ããã°ã©ã ãå®è¡ããããšããŠããå Žåã¯ããã®æäœãèš±å¯ãããã®ãããªæªæã®ããããã°ã©ã ã«å¯Ÿããã·ã¹ãã ã»ãã¥ãªãã£ãŒã¬ãã«ãäžããããLinux äžã§ Windows ã¢ããªã±ãŒã·ã§ã³ã®å®è¡ãé¿ããããšãã§ããŸããWindows ã¢ããªã±ãŒã·ã§ã³ã® å®è¡ãè©Šè¡ããŠããªãå Žåãããã¯ãäžæ£ç®çã§ã·ã¹ãã ãæªçšããããšããŠããããã°ã©ã ã®æ»æãåããŠããããšã瀺ããŸãã 以äžã®ãµã€ããåç §ããŠäžããïŒ http://wiki.winehq.org/PreloaderPageZeroProblem ãã®ãµã€ãã«ã¯ãã¡ã¢ãªãŒã®äœ¿çšãå®å šã§ã¯ãªãããã«ãwine ãééãããã®ä»ã®åé¡ãšããã®ãœãªã¥ãŒã·ã§ã³ã®æŠèŠãèšèŒãããŠããŸãã å šé¢çãªç£æ»ãéå§ããŸã # auditctl -w /etc/shadow -p w AVC ã®åäœæãè©Šã¿ãŸãããã®åŸã«ä»¥äžãå®è¡ããŸãã # ausearch -m avc -ts recent PATH èšé²ã確èªã§ããå Žåã¯ããã¡ã€ã«ã®æææš©/èš±å¯ããã§ãã¯ããŠä¿®æ£ãã 確èªã§ããªãå Žåã¯ãã°ãšããŠå ±åããŸãã %s ã«ããã¡ã€ã«ã¿ã€ãã§ã¯ãªãã¿ã€ãã®é 眮ãè©Šã¿ãŸããããã®ã¿ã€ãã¯äœ¿çšã§ããªãããããã¡ã€ã«ã¿ã€ããæå®ããå¿ èŠããããŸãã次㮠seinfo ã³ãã³ãã䜿çšãããšããã¡ã€ã«ã¿ã€ããäžèŠ§è¡šç€ºããããšãåºæ¥ãŸãã seinfo -afile_type -x "$BOOLEAN" ããã³ "$WRITE_BOOLEAN" ã® boolean ã true ã«å€æŽãããšã ãã®ã¢ã¯ã»ã¹ãèš±å¯ãããŸã: "setsebool -P $BOOLEAN=1 $WRITE_BOOLEAN=1" èŠå: "$WRITE_BOOLEAN" ã® boolean ã true ã«èšå®ãããšã CIFS ãã¡ã€ã«ã·ã¹ãã äžã®ãã¡ã€ã«ããã£ã¬ã¯ããªãŒãžã®æžã蟌ã¿ã«å ããŠã ãã¹ãŠã®å ¬éã³ã³ãã³ã (ã¿ã€ãã public_content_t ã®ãã¡ã€ã«ãš ãã£ã¬ã¯ããªãŒ) ãžã®æžã蟌ã¿ããftp ããŒã¢ã³ã«èš±å¯ããããšã«ãªããŸãã "allow_ftpd_use_nfs" ãš "ftpd_anon_write" ã®ããŒã«å€ã true ã«å€æŽãããšã ãã®ã¢ã¯ã»ã¹ãèš±å¯ãããŸã: "setsebool -P allow_ftpd_use_nfs=1 ftpd_anon_write=1" èŠå: "ftpd_anon_write" ã®ããŒã«å€ã true ã«èšå®ãããšã NFS ãã¡ã€ã«ã·ã¹ãã äžã®ãã¡ã€ã«ããã£ã¬ã¯ããªãŒãžã® æžã蟌ã¿ã®ã»ãã«ã ãã¹ãŠã®å ¬éã³ã³ãã³ã (ã¿ã€ãã public_content_t ã®ãã¡ã€ã«ãšãã£ã¬ã¯ããªãŒ) ãžã®æžã蟌ã¿ã ftp ããŒã¢ã³ã«èš±å¯ããããšã«ãªããŸãã # ausearch -x $SOURCE_PATH --raw | audit2allow -D -M my-$SOURCE # semodule -X 300 -i my-$SOURCE.pp # semanage fcontext -a -t FILE_TYPE '$FIX_TARGET_PATH' ãã® FILE_TYPE ã¯ä»¥äžã®ããããã«ãªããŸã: %s. 次ã«ã以äžãå®è¡ããŠãã ãã: restorecon -v '$FIX_TARGET_PATH' # semanage fcontext -a -t SIMILAR_TYPE '$FIX_TARGET_PATH' # restorecon -v '$FIX_TARGET_PATH' # semanage fcontext -a -t samba_share_t '$FIX_TARGET_PATH%s' # restorecon %s -v '$FIX_TARGET_PATH' # semanage fcontext -a -t virt_image_t '$FIX_TARGET_PATH' # restorecon -v '$FIX_TARGET_PATH' # semanage port -a -t %s -p %s $PORT_NUMBER # semanage port -a -t PORT_TYPE -p %s $PORT_NUMBER ããããã§ãPORT_TYPE 㯠以äžã®ãããããšãªããŸã: %sã ããããã»ã¹ãã·ã¹ãã ãžã®ãããã³ã°ãè©Šã¿ãŠããå¯èœæ§ããããŸãã net.ipv6.conf.all.disable_ipv6 = 1 ã /etc/sysctl.conf ã«è¿œå ããŸã 以äžãå®è¡ããŠããã®ã¢ã¯ã»ã¹ãèš±å¯ããŸã: # ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME # semodule -X 300 -i my-$MODULE_NAME.pp ãã¡ã€ã«ã³ã³ããã¹ããå€æŽããŸãã ã©ãã«ã®å€æŽ ã©ã€ãã©ãªãŒã®ã©ãã«ãå€æŽããŸãã ãã¡ã€ã«ã©ãã«ã xen_image_t ã«å€æŽããŸãã ã»ãã¥ãªãã£ãŒç®¡çè ã«ããã®åé¡ãå ±åããŠãã ããã Chrome ãã©ã°ã€ã³ã«ãã㊠SELinux å¶åŸ¡ãç¡å¹å ããŒã«å€ãæå¹ã«ããŸã ããŒã«å€ãæå¹ã«ããŸãã $TARGET_BASE_PATH ãä»®æ³çãªã¿ãŒã²ããã§ããå Žå $TARGET_BASE_PATH 㯠RSYNC ããŒã¢ã³ã«ãã£ãŠå ±æãããã¹ãã§ã $TARGET_BASE_PATH ã¯ãcvs ããŒã¢ã³ãçµç±ããŠå ±æãããŠããå¿ èŠãããå Žå $SOURCE_BASE_PATH ã¯ã $TARGET_BASE_PATH ãã¡ã€ã«ãäœæããããã«èš±å¯ãããŠããã¹ããšèããå Žå $SOURCE_PATH ã SELinux ãç¡å¹ã«ããããšãããšèããå Žåã %s 㯠execstack ã å¿ èŠãšããªããšæãããå Žå $SOURCE_BASE_PATH ã«ã$TARGET_TYPE ãšã©ãã«ãããŠãã $TARGET_CLASS ãžã® $ACCESS ã¢ã¯ã»ã¹ããããã©ã«ãã§èš±å¯ãããã¹ãã ãšèããå Žåã $SOURCE_BASE_PATH ã«ã $TARGET_TYPE ã«ã©ãã«ãããŠããããã»ã¹ã§ã® $ACCESS ã¢ã¯ã»ã¹ãããã©ã«ãã§èš±å¯ãããã¹ããšèããå Žåã $SOURCE_BASE_PATH ã«ã $TARGET_BASE_PATH $TARGET_CLASS ã® $ACCESS ã¢ã¯ã»ã¹ãããã©ã«ãã§èš±å¯ãããã¹ããšèããå Žåã $SOURCE_BASE_PATH ã«ã¯ã$ACCESS æ©èœãããã©ã«ãã§æãããã¹ããšèããå Žåã ãã® AVC ã¯ããã®ãã¹ãã«ãã£ãŠçŽæ¥èµ·ãã£ããã®ã§ã¯ãªãå Žåã $SOURCE_PATH 㯠kernel ã¢ãžã¥ãŒã«ãããŒãããkernel ãç·šéããããšãã¹ãã§ã¯ãªããšèããå Žåã $SOURCE_PATH 㯠kernel ã¢ãžã¥ãŒã«ãããŒãããkernel ãç·šéãã¹ãã§ã¯ãªããšèããå Žå $SOURCE_BASE_PATH ã $TARGET_BASE_PATH ã® $ACCESS ã¢ã¯ã»ã¹ãè©Šã¿ãã¹ãã§ã¯ãªããšèããå Žåã $SOURCE_PATH ã«ãæžã蟌ã¿ãšå®è¡ã®äž¡æ¹ãå¯èœã«ãªããããŒãã¡ã¢ãªãŒã®ãããã³ã°ãè¡ãå¿ èŠããªããšèããå Žåã $SOURCE_PATH ã«ãæžã蟌ã¿ãšå®è¡ã®äž¡æ¹ãå¯èœãšãªããã¹ã¿ãã¯ã¡ã¢ãªãŒã®ãããã³ã°ãè¡ãªãå¿ èŠãããå Žåã $SOURCE_PATH ã«ã«ãŒãã«å ã§äœãã¡ã¢ãªãŒã® mmap ãè¡ãªãå¿ èŠããããšã¯æããªãå Žåã ããã»ã¹ã«ãã·ã¹ãã äžã®å šã·ã¹ãã ãªãœãŒã¹ãæ¶è²»ã§ããæ©èœãèŠæ±ãããããªãå Žå; ããããééã£ãã©ãã«ãä»ãããããã·ã³ã«ãã£ãŠèµ·ãããããšèããå Žåã %s ãããå Žå $SOURCE_BASE_PATH ãã $TARGET_BASE_PATH ã«ããŠã³ãããããšãèš±å¯ãããå Žåã $SOURCE_PATH ã«ãããå ±æã®å ¬éã³ã³ãã³ããžã®æžã蟌ã¿ãèš±å¯ããå Žå $SOURCE_PATH ãããããã¯ãŒã¯ããŒã $PORT_NUMBER ã«æ¥ç¶ãããå Žå $SOURCE_PATH ãããããã¯ãŒã¯ããŒã $PORT_NUMBER ã«æ¥ç¶ãããå Žå ftpd ããcifs ãã¡ã€ã«ã·ã¹ãã ã«æžã蟌ãããšãèš±å¯ãããå Žå ftpd ããnfs ãã¡ã€ã«ã·ã¹ãã ã«æžèŸŒãããšãèš±å¯ãããå Žå httpd ã«ãã cgi ã¹ã¯ãªããã®å®è¡ã ããã³å šã³ã³ãã³ããã¡ã€ã«ã® HTTPD åŠçã®çµ±äžãèš±å¯ãããå Žåã httpd ããã¡ãŒã«éä¿¡ããããšãèš±å¯ããå Žå $TARGET_PATH ã®ã©ãã«ã %s ã«å€æŽã«ããããšã¯ããããæå¹ãªãã¡ã€ã«ã¿ã€ãã§ã¯ãªããããèš±å¯ãããŸããã ãã®ãã·ã³ã«ãã㊠IPV6 ãç¡å¹åãããå Žå ã©ãã«ãä¿®æ£ããå Žåã $SOURCE_PATH ã®ããã©ã«ãã©ã³ã¬ãã«ã¯ %s ã®ã¯ãã§ãã ã©ãã«ãä¿®æ£ããå Žåã $TARGET_PATH ã®ããã©ã«ãã©ãã«ã¯ %s ã®ã¯ãã§ãã ãã¡ã€ã³ããã®ã¢ã¯ã»ã¹ãå¿ èŠãšãããããŸãã¯äœ¿çšããŠããã·ã¹ãã ã«ãããããŒããã·ã§ã³ã«èª€ãããããã¡ã€ã«ãææããŠãããã確èªãããå Žå ãã®ã¢ã¯ã»ã¹ã¯å¿ èŠã§ã¯ãªãããã$SOURCE_BASE_PATH ãã $TARGET_BASE_PATH $TARGET_CLASS ãž $ACCESS ã¢ã¯ã»ã¹ãè©Šã¿ãããšããæåŠãããå Žåã ãã® AVC ãç¡å¹ã«ãããå Žåããã® AVC ã¯å±éºã§ããããã·ã³ã¯æ£åžžã«åäœããŠããããã ãã® AVC ãç¡å¹ã«ãããå Žåããã® AVC ã¯å®å šã§ã¯ãããŸããããwine ã¢ããªã±ãŒã·ã§ã³ã¯æ£åžžã«åäœããŠããããã $SOURCE_BASE_PATH ã $ACCESS ãžã¢ã¯ã»ã¹ã§ããããã $TARGET_BASE_PATH ã®ã©ãã«ãç·šéãããå Žå $SOURCE_BASE_PATH ã $ACCESS ãžã¢ã¯ã»ã¹ã§ããããã $TARGET_BASE_PATH ãæšæºã®å Žæã«ç§»åãããå Žå mozplugger ããã±ãŒãžã§ã¯ãªããSELinux Firefox ãã©ã°ã€ã³ã®å 容ãç¶ããŠäœ¿çšãããå Žå $TARGET_BASE_PATH ãå ¬éã³ã³ãã³ããšããŠåŠçããå Žå %s ããã±ãŒãžã䜿çšãããå Žå ãã¡ã€ã«ã·ã¹ãã å šäœã®ã©ãã«ãå€æŽããŸããåèµ·åãå«ãŸããŸãã ã³ã³ããã¹ã㮠埩å ã³ã³ããã¹ãã®åŸ©å SELinux ã¯ã$SOURCE_PATH ã«ãã "$ACCESS" ã¢ã¯ã»ã¹ãé»æ¢ããŠããŸãã ã€ã¡ãŒãžã©ãã«ã virt_image_t ã«èšå®ããŸãã ããã¯ãæ°èŠäœæããããã¡ã€ã«ã·ã¹ãã ã«ãã£ãŠåŒãèµ·ãããããã®ã§ãã ã©ãã«ã®ä¿®æ£ãè©Šã¿ãŸãã ã¡ã¢ãªãŒã®ä¿è·ããªãã«ããŸã 詳现æ å ±ã«ã€ããŠã¯ã'%s' man ããŒãžãã芧äžããã ãããã³ã°ãããŠããå¯èœæ§ããããŸãã '%s' boolean ãæå¹ã«ããŠã ããã SELinux ã§æå¹ã«ããŸãã $FIX_TARGET_PATH ã®ã©ãã«ãå€æŽããå¿ èŠããããŸã $TARGET_BASE_PATH ã®ã©ãã«ãå€æŽããå¿ èŠããããŸã $TARGET_BASE_PATH ã®ã©ãã«ã public_content_t ãŸã㯠public_content_rw_t ã«å€æŽããå¿ èŠããããŸãã $TARGET_BASE_PATH' ã®ã©ãã«ãå€æŽããå¿ èŠããããŸã $TARGET_PATH ã®ã©ãã«ããåçš®ã®ããã€ã¹ã®ã¿ã€ãã«å€æŽããå¿ èŠããããŸãã '$FIX_TARGET_PATH' ã®ã©ãã«ãå€æŽããå¿ èŠããããŸã ãã°ãšããŠå ±åããŠãã ããã ããŒã«ã«ã®ããªã·ãŒã¢ãžã¥ãŒã«ãçæãããšã ãã®ã¢ã¯ã»ã¹ãèš±å¯ããããšãã§ããŸãã ãã°ãšããŠå ±åããŠãã ããã ããŒã«ã«ã®ããªã·ãŒã¢ãžã¥ãŒã«ãçæãããšããã®ã¢ã¯ã»ã¹ãç£æ»ããªãããã«ã§ããŸãã execstack -c %s ããããããã³ã°ãããŠãããšèããå Žå setsebool -P %s %s å šé¢çãªç£æ»ãéå§ããéåããŠãããã¡ã€ã«ã«é¢ãããã¹æ å ±ãååŸãã å床ãšã©ãŒãçæããŸãã "cp -p" ãªã©ã®ã³ãã³ãã䜿çšããŠãSELinux ã³ã³ããã¹ã以å€ã®å šãŠã®æš©éãä¿æããŸãã restorecon ãå®è¡ããããšãã§ããŸãã restorecon ãå®è¡ããããšãã§ããŸãã芪ãã£ã¬ã¯ããªãŒã«ã¢ã¯ã»ã¹ããã®ã«å¿ èŠãªæš©éããªããããèŠæ±ãããã¢ã¯ã»ã¹ãåæ¢ããå¯èœæ§ããããŸãããã®å Žåã¯ã以äžã®ã³ãã³ããç¶æ³ã«å¿ããŠé©åã«å€æŽããŸãã ãã®ã¢ã¯ã»ã¹ãå¶éããã¢ããªã±ãŒã·ã§ã³ã§å¿ èŠãšãããããšã¯çµ¶å¯Ÿã«ãªãããã ããã«ãŒããã®æ»æãåããŠããå¯èœæ§ããããŸãã å¶éããã¢ããªã±ãŒã·ã§ã³ã§ã¯ãã®ã¢ã¯ã»ã¹ã¯å¿ èŠãšãããªãããã ããã«ãŒããæ»æãåããŠããå¯èœæ§ããããŸãã ããã«ãŒããæ»æãããŠããå¯èœæ§ããããŸããããã¯éåžžã«å±éºãªã¢ã¯ã»ã¹ã§ãã $TARGET_PATH ã®ã©ãã«ãå€æŽããªããã°ãããŸããã ã©ãã«ãä¿®æ£ããªããã°ãããŸããã cert ãã¡ã€ã«ã ~/.cert directory ã«ç§»åããªããã°ãããŸãã æå¹ãªãã¡ã€ã«ã©ãã«ãéžæããå¿ èŠããããŸãã mozplugger ããã±ãŒãžãåé€ããå¿ èŠããããŸãã ãããèš±å¯ããã«ã¯ãSELinux ãèšå®ããªããã°ãããŸãã ããã«ã€ããŠã¯ãSELinux ã«èšå®ãããªããã°ãããŸãã ããã«ã€ããŠã¯ãSELinux 㧠'httpd_unified' ãš 'http_enable_cgi' booleans ãæå¹ã«ããªããã°ãããŸãã ããã«ã€ããŠã¯ãSELinux ã«ãvbetool_mmap_zero_ignore boolean ãæå¹ã«ããèšå®ãå¿ èŠã§ãã ããã«ã€ããŠã¯ãSELinux ã« wine_mmap_zero_ignore ãæå¹ã«ããèšå®ãå¿ èŠã§ãã Chrome ãã©ã°ã€ã³ã«ãã㊠SELinux å¶åŸ¡ãç¡å¹åããå¿ èŠããããŸãã Firefox ãã©ã°ã€ã³ã§ SELinux ã®å¶åŸ¡ããã¹ãŠãªãã«ããå¿ èŠããããŸãã ããã«ã©ãã«ãè¿œå ããå¿ èŠããããŸãã $TARGET_PATH ã®ã©ãã«ã public_content_rw_t ã«å€æŽããå¿ èŠããããŸãã ãŸãã allow_httpd_sys_script_anon_write boolean ã§æå¹ã«ããããšãå¿ èŠã«ãªãå ŽåããããŸãã ã·ã¹ãã ãªãœãŒã¹ãäžè¶³ããŠããåå ãçªãæ¢ããåé¡ã解決ããå¿ èŠããããŸãã /usr/include/linux/capability.h ã«ãããšãsys_resource ã¯æ¬¡ã®ãããªå Žåã«å¿ èŠãšãªããŸãã /* ãªãœãŒã¹ã®äžéãç¡å¹ã«ããŠããèšå®ãã */ /* ã¯ãªãŒã¿ã®äžéãç¡å¹ã«ãã */ /* ext2 ãã¡ã€ã«ã·ã¹ãã ã®äºçŽé åãç¡å¹ã«ãã */ /* ext3 ãã¡ã€ã«ã·ã¹ãã ã®ããŒã¿ãžã£ãŒããªã³ã°ã¢ãŒããå€æŽãã (ãžã£ãŒããªã³ã°ã®ãªãœãŒã¹ã䜿çš) */ /* 泚æ: ext2 ã¯ããªãœãŒã¹ã®ç¡å¹åãã§ãã¯ã®éã« fsuid ãåãåããããfsuid ã§ç¡å¹åãè¡ãããšãã§ããŸã */ /* IPC ã¡ãã»ãŒãžãã¥ãŒã§ãµã€ãºå¶éãç¡å¹ã«ãã */ /* ãªã¢ã«ã¿ã€ã ã¯ããã¯ããã®ã64hz ãè¶ ããå²ã蟌ã¿ãèš±å¯ãã */ /* ã³ã³ãœãŒã«ã®å²ãåœãŠã§ã³ã³ãœãŒã«ã®æ倧æ°ãç¡å¹ã«ãã */ /* ããŒãããã®æ倧æ°ãç¡å¹ã«ãã */ ãã¹ãŠã«ã©ãã«ãä»ãçŽãå¿ èŠããããŸãã ãµã³ãããã¯ã¹ã¿ã€ããå€æŽããå¿ èŠããããŸããsandbox_web_t ãŸã㯠sandbox_net_t ã§ãã äŸ: sandbox -X -t sandbox_net_t $SOURCE_PATH 詳现㯠'sandbox' ã® man ããŒãžãåç §ããŠãã ããã ãã°ãã¬ããŒãããå¿ èŠããããŸãã ããã¯å±éºãªã¢ã¯ã»ã¹ã§ãã ãã°ãã¬ããŒãããå¿ èŠããããŸããããã¯å±éºãªã¢ã¯ã»ã¹ã§ãã /proc/sys/net/ipv6/conf/all/disable_ipv6 ã 1 ã«èšå®ããå¿ èŠããããã¢ãžã¥ãŒã«ããã©ãã¯ãªã¹ãã«ããŸãã å¥ã®ã³ãã³ãã䜿çšããå¿ èŠããããŸããã¿ãŒã²ããã®ãã¡ã€ã«ã·ã¹ãã ã§ãSELinux ã³ã³ãã³ããä¿æããããšã¯ã§ããŸããã execstack ãã©ã°ãåé€ããŠã$SOURCE_PATH ãæ£åžžã«æ©èœããŠããããšã確èªããå¿ èŠããããŸãã ãã㯠%s ã®ãã°ãšããŠå ±åããŸãã 以äžãå®è¡ããã°ãexecstack ãã©ã°ãåé€ã§ããŸãã
ðŸ Save Changes
â Cancel