云主机云服务器

美国VPSlinux-chcon命令详解使用方法

chcon命令：修改对象（文件）的安全上下文。比如：用户：角色：类型：安全级别。
命令格式：
Chcon [OPTIONS…] CONTEXT FILES…..
Chcon [OPTIONS…] –reference=PEF_FILES FILES…
说明：
CONTEXT 为要设置的安全上下文
FILES 对象（文件）
--reference 参照的对象
PEF_FILES 参照文件上下文
FILES 应用参照文件上下文为我的上下文。
OPTIONS 如下：
-f 强迫执行
-R 递归地修改对象的安全上下文
-r ROLE 修改安全上下文角色的配置
-t TYPE 修改安全上下文类型的配置
-u USER 修改安全上下文用户的配置
-v 显示冗长的信息
-l, --range=RANGE 修改安全上下文中的安全级别
范例：
1、ftp
//If you want to share files anonymously
chcon -R -t public_content_t /var/ftp

//If you want to setup a directory where you can upload files
＜如果你想让你设置的FTP目录可以上传文件的话，SELINUX需要设置＞
chcon -t public_content_rw_t /var/ftp/incoming

//You must also turn on the boolean allow_ftpd_anon_write setsebool -P allow_ftpd_anon_write=1

//If you are setting up this machine as a ftpd server and wish to allow users to access their home directorories
setsebool -P ftp_home_dir 1

//If you want to run ftpd as a daemon
setsebool -P ftpd_is_daemon 1

//You can disable SELinux protection for the ftpd daemon
setsebool -P ftpd_disable_trans 1
2、httpd
//If you want a particular domain to write to the public_content_rw_t domain

setsebool -P allow_httpd_anon_write=1
or
setsebool -P allow_httpd_sys__anon_write=1

//httpd can be setup to allow cgi s to be executed
setsebool -P httpd_enable_cgi 1

//If you want to allow access to users home directories
setsebool -P httpd_enable_homedirs 1
chcon -R -t httpd_sys_content_t ~user/public_html

//httpd is allowed access to the controling terminalsetsebool -P httpd_tty_comm 1

//such that one httpd service can not interfere with another
setsebool -P httpd_unified 0

//loadable modules run under the same context as httpd
setsebool -P httpd_builtin_ing 0

//httpd s are allowed to connect out to the network
setsebool -P httpd_can_network_connect 1

// You can disable suexec transition
setsebool -P httpd_suexec_disable_trans 1

//You can disable SELinux protection for the httpd daemon by executing
setsebool -P httpd_disable_trans 1
service httpd restart
3、named
//If you want to have named update the master zone files
setsebool -P named_write_master_zones 1

//You can disable SELinux protection for the named daemon by executing

setsebool -P named_disable_trans 1
service named restart
4、nfs
//If you want to setup this machine to share nfs partitions read only

setsebool -P nfs_export_all_ro 1

//If you want to share files read/write
setsebool -P nfs_export_all_rw 1

//If you want to use a remote NFS server for the home directories on this machine
＜如果你想要将远程NFS的家目录共享到本机，需要开启>
setsebool -P use_nfs_home_dirs 1
5、samba
//If you want to share files other than home directorie

chcon -t samba_share_t /directory

//If you want to share files with multiple domains
如果samba服务器共享目录给多个域，则需要：
setsebool -P allow_smbd_anon_write=1

//If you are setting up this machine as a Samba server and wish to share the home directories
samba服务器要共享家目录时：
setsebool -P samba_enable_home_dirs 1

//If you want to use a remote Samba server for the home directories on this machine
如果你需在本机上使用远程samba服务器的家目录
setsebool -P use_samba_home_dirs 1

//You can disable SELinux protection for the samba daemon by executing
关闭selinux关于samba的进程守护的保护
setsebool -P smbd_disable_trans 1
service smb restart
6、rsync
//If you want to share files using the rsync daemon
共享rsync目录时：
chcon -t public_content_t /directories

//If you want to share files with multiple domains
允许其他用户写入时
setsebool -P allow_rsync_anon_write=1

//You can disable SELinux protection for the rsync daemon by executing
停止rsync的进程保护
setsebool -P rsync_disable_trans 1
7、kerberos
//allow your system to work properly in a Kerberos environment
允许系统使用kerberos
setsebool -P allow_kerberos 1
//If you are running Kerberos daemons kadmind or krb5kdc
setsebool -P krb5kdc_disable_trans 1
service krb5kdc restart
setsebool -P kadmind_disable_trans 1
service kadmind restart
8、nis
Allow your system to work properly in a NIS environment
系统工作在nis环境时
setsebool -P allow_ypbind 1

购买使用一诺网络美国服务器，可以极大降低初创企业、中小企业以及个人开发者等用户群体的整体IT使用成本，无需亲自搭建基础设施、简化了运维和管理的日常工作量，使用户能够更专注于自身的业务发展和创新。美国服务器低至49元/月，购买链接：https://www.enuoidc.com/vpszq.html?typeid=3