简介

SELinux是一种有力制访问控制机制，用于搞优良Linux系统的平安性。它通过管束进程能访问的材料来干活，从而少许些平安漏洞的凶险。本篇文章将详细介绍怎么在不同的Linux发行版中开启SELinux功能。

安装SELinux包

在巨大许多数Linux发行版中，先说说需要安装SELinux包。

• 在Red Hat、 CentOS、Fedora和Oracle Linux上：

sudo yum install selinux-policy selinux-policy-targeted

• 在Debian和Ubuntu上：

sudo apt-get install selinux-policy selinux-policy-targeted

启用SELinux

安装SELinux包后需要启用SELinux。

Red Hat、 CentOS、Fedora和Oracle Linux

sudo setenforce 1

这会将SELinux设置为有力制模式。要检查SELinux状态， 能用以下命令：

getenforce

Debian和Ubuntu

sudo sysctl enforcing=1

同样，要检查SELinux状态，能用以下命令：

getenforce

编辑配置文件

要永久更改SELinux的配置，需要编辑配置文件。

sudo nano /etc/selinux/config

将以下行更改为：

SELINUX=enforcing

sudo nano /etc/sysctl.conf

在文件中添加以下行：

kernel.security.insecurens=0
net.ipv4.iplocalportrange=1024 65535
net.ipv4.ipforward=1
net.ipv4.conf.default.rpfilter=1
net.ipv4.conf.default.acceptsourceroute=0
net.ipv4.icmpignoreboguserrormessages=1
net.ipv4.conf.all.logmartians=1
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default.basereachabletimems=2000
net.ipv4.neigh.default.reachtimems=25
net.ipv4.neigh.default.staletime=40000
net.ipv4.neigh.default.gcstaletime=40000
net.ipv4.neigh.default.retranstime=3
net.ipv4.neigh.default

---