semanage命令 是用来查询与修改SELinux默认目录的安全上下文。SELinux的策略与规则管理相关命令：seinfo命令、sesearch命令、getsebool命令、setsebool命令、semanage命令。

Centos7.7操作系统

Selinux已经开启 开启方式：

[root@localhost~]#sed-i'/^SELINUX/s/disabled/enforcing/g'/etc/selinux/config#然后重启一下操作系统[root@localhost~]#reboot#重启完成之后检查一下是否是enforcing模式[root@localhost~]#getenforceEnforcing常用参数

使用semanage port命令列出所有端口

[root@localhost~]#semanageport-lSELinuxPortTypeProtoPortNumberafs3_callback_port_ttcp7001afs3_callback_port_tudp7001afs_bos_port_tudp7007afs_fs_port_ttcp2040afs_fs_port_tudp7000,7005afs_ka_port_tudp7004afs_pt_port_ttcp7002afs_pt_port_tudp7002afs_vl_port_tudp7003agentx_port_ttcp705agentx_port_tudp705amanda_port_ttcp10080-10083amanda_port_tudp10080-10082……

列出指定的端口类型的端口

[root@localhost~]#semanageport-l|grep-whttp_port_thttp_port_ttcp80,81,443,488,8008,8009,8443,9000

通过查询端口号来列出端口类型

[root@localhost~]#semanageport-l|grep-w53dns_port_ttcp53dns_port_tudp53[root@localhost~]#semanageport-l|grep-w20ftp_data_port_ttcp20[root@localhost~]#semanageport-l|grep-w21ftp_port_ttcp21,989,990

通过下面的命令为http添加新端口

[root@localhost~]#[root@localhost~]#semanageport-a-thttp_port_t-ptcp8888[root@localhost~]##查看新添加的端口[root@localhost~]#semanageport-l|grep-w8888http_port_ttcp8888,80,81,443,488,8008,8009,8443,9000#也可以使用-C参数查看自定义的端口号[root@localhost~]#semanageport-lCSELinuxPortTypeProtoPortNumberhttp_port_ttcp8888

添加一个范围的端口

[root@localhost~]#semanageport-a-thttp_port_t-ptcp11180-11188[root@localhost~]#[root@localhost~]#semanageport-lCSELinuxPortTypeProtoPortNumberhttp_port_ttcp8888,11180-11188

[root@localhost~]#semanageport-d-thttp_port_t-ptcp8888[root@localhost~]#[root@localhost~]#semanageport-d-thttp_port_t-ptcp11180-11188[root@localhost~]##查看一下，已经没有自定义的端口了[root@localhost~]#semanageport-lC

为samba共享目录添加安全上下文

#没添加安全上下文之前是default_t[root@localhost~]#ll-dZ/share/drwxr-xr-x.rootrootunconfined_u:object_r:default_t:s0/share/[root@localhost~]#semanagefcontext-a-tsamba_share_t'/share(/.*)?'#恢复文件默认的安全上下文[root@localhost~]#restorecon-Rv/sharerestoreconreset/sharecontextunconfined_u:object_r:default_t:s0->unconfined_u:object_r:samba_share_t:s0#查看一下文件夹已经变成samba_share_t了[root@localhost~]#ll-dZ/sharedrwxr-xr-x.rootrootunconfined_u:object_r:samba_share_t:s0/share

为nfs共享目录添加读写

[root@localhost~]#ll-dZ/nfsshare/drwxr-xr-x.rootrootunconfined_u:object_r:default_t:s0/nfsshare/[root@localhost~]#[root@localhost~]#semanagefcontext-a-tpublic_content_rw_t'/nfsshare(/.*)?'[root@localhost~]#restorecon-Rv/nfsshare[root@localhost~]#ll-dZ/nfsshare/drwxr-xr-x.rootrootunconfined_u:object_r:public_content_rw_t:s0/nfsshare/

本文讲述了添加、修改和删除端口，修改安全上下文。如果你的系统有安装桌面，可以安装图形化管理软件 policycoreutils-gui来进行管理。

[root@localhost~]#yum-yinstallpolicycoreutils-gui#system-config-selinux执行该命令打开图形化管理界面[root@localhost~]#system-config-selinux