我需要知道运行系统当前规则中与se
linux类型相关的所有内容：
>允许,allowaudit,dontaudit规则.
>使用类型标记上下文的文件.
>过渡.
……以及任何其他信息.
是否有任何可用于查询该信息的命令,或者我是否应该下载所有与selinux相关的“src”软件包,过滤掉未使用的模块并为该信息grep每个文件？必须有一种更简单的方法来做到这一点.
解决方法
获取此信息的一些命令是(示例使用httpd_log_t)：
> seinfo
# seinfo -x --type=httpd_log_t /etc/selinux/default/policy/policy.26
httpd_log_t
file_type
non_security_file_type
logfile
>搜索
# sesearch --dontaudit -t httpd_log_t /etc/selinux/default/policy/policy.26 | head
Found 35 semantic av rules:
dontaudit run_init_t file_type : dir { getattr search open } ;
dontaudit staff_t non_security_file_type : file getattr ;
dontaudit staff_t non_security_file_type : dir { ioctl read getattr lock search open } ;
dontaudit staff_t non_security_file_type : lnk_file getattr ;
dontaudit staff_t non_security_file_type : sock_file getattr ;
dontaudit staff_t non_security_file_type : fifo_file getattr ;
dontaudit unconfined_t non_security_file_type : file getattr ;
dontaudit unconfined_t non_security_file_type : dir { ioctl read getattr lock search open } ;
dontaudit unconfined_t non_security_file_type : lnk_file getattr ;
> semanage
# semanage fcontext -l | grep httpd_log_t /etc/httpd/logs all files system_u:object_r:httpd_log_t:s0 /var/log/apache(2)?(/.*)? all files system_u:object_r:httpd_log_t:s0 /var/log/apache-ssl(2)?(/.*)? all files system_u:object_r:httpd_log_t:s0 /var/log/cacti(/.*)? all files system_u:object_r:httpd_log_t:s0 /var/log/cgiwrap\.log.* regular file system_u:object_r:httpd_log_t:s0 /var/log/horde2(/.*)? all files system_u:object_r:httpd_log_t:s0 /var/log/httpd(/.*)? all files system_u:object_r:httpd_log_t:s0 /var/log/lighttpd(/.*)? all files system_u:object_r:httpd_log_t:s0 /var/log/piranha(/.*)? all files system_u:object_r:httpd_log_t:s0 /var/www(/.*)?/logs(/.*)? all files system_u:object_r:httpd_log_t:s0
参考文献：RHEL6 SELinux manual
