Linux 系统安全加固：深入 SELinux 与 AppArmor

#!/bin/bash
 
# 安装 SELinux 和 AppArmor
sudo apt-get install -y selinux apparmor apparmor-utils
 
# 启用并配置 SELinux
sudo sed -i 's/^SELINUX=permissive/SELINUX=enforcing/' /etc/selinux/config
sudo setenforce 1
 
# 启用 AppArmor 并设置为启动时启用
sudo ln -s /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
sudo systemctl enable apparmor
sudo systemctl restart apparmor
 
# 配置 AppArmor 规则，允许 MySQL 读取其配置文件
sudo bash -c "echo '
{
  "parser": "apparmor",
  "policy_groups": ["mysqld"],
  "policy_version": "v2.0",
  "rules": [
    {
      "access": "r",
      "comments": [
        "MySQL can read its config files"
      ],
      "criteria": [
        [
          {
            "op": "dir",
            "value": "/etc/"
          }
        ]
      ],
      "level": "mysqld",
      "log": false,
      "owner": "root",
      "parent": "mysqld",
      "permissions": [
        {
          "access": "r",
          "type": "file",
          "flags": [],
          "mask": "r"
        }
      ],
      "priority": "MID",
      "reads": [
        [
          {
            "op": "dir",
            "value": "/etc/"
          }
        ]
      ]
    }
  ]
}
' > /etc/apparmor.d/local/usr.sbin.mysqld"
 
# 重新加载 AppArmor 配置
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld
sudo systemctl restart apparmor

这个示例脚本展示了如何在Linux系统中安装并配置SELinux和AppArmor，以及如何为MySQL服务添加AppArmor规则，允许其读取/etc/下的配置文件。脚本中的注释解释了每一步的作用和原理。