{"id":31389,"date":"2025-10-09T10:42:14","date_gmt":"2025-10-09T07:42:14","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=31389"},"modified":"2025-10-09T10:42:14","modified_gmt":"2025-10-09T07:42:14","slug":"selinux-nedir-kapsamli-bir-teknik-rehber","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/","title":{"rendered":"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber"},"content":{"rendered":"

<\/p>\n

SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber<\/h2>\n

Linux tabanl\u0131 sistemlerde g\u00fcvenlik, her zaman \u00f6ncelikli konulardan biri olmu\u015ftur. Geleneksel olarak, Linux sistemleri kullan\u0131c\u0131 ve grup tabanl\u0131 eri\u015fim kontrol\u00fc (Discretionary Access Control – DAC) ile \u00e7al\u0131\u015f\u0131r. Ancak bu model, baz\u0131 geli\u015fmi\u015f sald\u0131r\u0131 vekt\u00f6rlerine kar\u015f\u0131 yeterli koruma sa\u011flayamayabilir. \u0130\u015fte tam bu noktada, g\u00fcvenlik mimarisini k\u00f6kten de\u011fi\u015ftiren ve Mandatory Access Control (MAC) ad\u0131 verilen zorunlu eri\u015fim kontrol\u00fcn\u00fc getiren bir teknoloji devreye girer: SELinux (Security-Enhanced Linux)<\/strong>.<\/p>\n

SELinux, Amerika Birle\u015fik Devletleri Ulusal G\u00fcvenlik Ajans\u0131 (NSA) taraf\u0131ndan geli\u015ftirilmi\u015f ve Linux \u00e7ekirde\u011fine entegre edilmi\u015f bir g\u00fcvenlik mekanizmas\u0131d\u0131r. Amac\u0131, sistemdeki her bir s\u00fcrecin ve dosyan\u0131n, belirli bir g\u00fcvenlik politikas\u0131 \u00e7er\u00e7evesinde ne yapabilece\u011fini veya neye eri\u015febilece\u011fini kesin olarak tan\u0131mlamakt\u0131r. Bu, potansiyel bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131n veya k\u00f6t\u00fc niyetli bir s\u00fcrecin sistemin tamam\u0131na zarar vermesini engellemek i\u00e7in \u00f6nemli bir katman sa\u011flar. DAC’den farkl\u0131 olarak, SELinux’ta bir s\u00fcre\u00e7, DAC izinlerine sahip olsa bile, SELinux politikas\u0131 buna izin vermedi\u011fi s\u00fcrece belirli bir kayna\u011fa eri\u015femez. Bu rehberde, SELinux’un temellerini, \u00e7al\u0131\u015fma prensiplerini, y\u00f6netimini ve pratik kullan\u0131m senaryolar\u0131n\u0131 detayl\u0131 bir \u015fekilde inceleyece\u011fiz.<\/p>\n

SELinux’un Temel \u00c7al\u0131\u015fma Prensibi ve Mimarisi<\/h3>\n

SELinux’un g\u00fcc\u00fc, sistemdeki t\u00fcm kaynaklara (dosyalar, dizinler, a\u011f portlar\u0131, s\u00fcre\u00e7ler vb.) g\u00fcvenlik ba\u011flamlar\u0131 (security contexts) atamas\u0131 ve bu ba\u011flamlar aras\u0131ndaki etkile\u015fimleri bir politika (policy) arac\u0131l\u0131\u011f\u0131yla zorunlu k\u0131lmas\u0131yla ortaya \u00e7\u0131kar.<\/p>\n

DAC vs. MAC: G\u00fcvenli\u011fe Farkl\u0131 Yakla\u015f\u0131mlar<\/h4>\n

* Discretionary Access Control (DAC):<\/strong> Geleneksel Linux izin sistemi (rwx). Bir dosyan\u0131n sahibi, o dosya \u00fczerindeki izinleri ba\u015fkalar\u0131na verme veya kald\u0131rma yetkisine sahiptir. Bu, kullan\u0131c\u0131lar\u0131n kendi dosyalar\u0131 \u00fczerinde tam kontrole sahip olmalar\u0131n\u0131 sa\u011flar ancak bir uygulaman\u0131n veya kullan\u0131c\u0131n\u0131n ele ge\u00e7irilmesi durumunda, sahip oldu\u011fu t\u00fcm izinlerle sistemde serbest\u00e7e hareket edebilir.
\n* Mandatory Access Control (MAC):<\/strong> SELinux’un kulland\u0131\u011f\u0131 modeldir. Sistem y\u00f6neticisi taraf\u0131ndan merkezi olarak tan\u0131mlanan ve zorunlu k\u0131l\u0131nan kurallar b\u00fct\u00fcn\u00fcd\u00fcr. Bir kullan\u0131c\u0131n\u0131n veya s\u00fcrecin, DAC izinleri olsa bile, SELinux politikas\u0131 buna izin vermedi\u011fi s\u00fcrece bir kayna\u011fa eri\u015femez. Bu, en az ayr\u0131cal\u0131k (least privilege) prensibini uygulayarak, sistemin sald\u0131r\u0131 y\u00fczeyini \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r.<\/p>\n

G\u00fcvenlik Ba\u011flamlar\u0131 (Security Contexts)<\/h4>\n

SELinux’un temel yap\u0131 ta\u015f\u0131d\u0131r. Her dosya, dizin, s\u00fcre\u00e7, a\u011f portu gibi sistem kayna\u011f\u0131n\u0131n bir g\u00fcvenlik ba\u011flam\u0131 vard\u0131r. Bir ba\u011flam genellikle d\u00f6rt ana bile\u015fenden olu\u015fur: user:role:type:level<\/code>.
\n* User (Kullan\u0131c\u0131):<\/strong> SELinux kullan\u0131c\u0131s\u0131. Genellikle Linux kullan\u0131c\u0131lar\u0131yla e\u015fle\u015fmezler. \u00d6rnek: unconfined_u<\/code>, system_u<\/code>.
\n* Role (Rol):<\/strong> SELinux rol\u00fc. Kullan\u0131c\u0131lar\u0131n hangi t\u00fcr s\u00fcre\u00e7leri \u00e7al\u0131\u015ft\u0131rabilece\u011fini veya hangi kaynaklara eri\u015febilece\u011fini tan\u0131mlar. \u00d6rnek: system_r<\/code>, object_r<\/code>.
\n* Type (Tip):<\/strong> En \u00f6nemli bile\u015fendir. Bir dosyan\u0131n veya s\u00fcrecin i\u015flevini tan\u0131mlar. SELinux politikas\u0131, tipler aras\u0131ndaki etkile\u015fimleri kurallarla belirler. \u00d6rnek: httpd_t<\/code> (Apache s\u00fcreci), httpd_sys_content_t<\/code> (Apache’nin sunabilece\u011fi dosyalar).
\n* Level (Seviye):<\/strong> \u00c7o\u011funlukla \u00c7ok Seviyeli G\u00fcvenlik (Multi-Level Security – MLS) veya \u00c7ok Kategorili G\u00fcvenlik (Multi-Category Security – MCS) sistemlerinde kullan\u0131l\u0131r. \u00d6rnek: s0:c0.c1023<\/code>. Genel kullan\u0131mda genellikle s0<\/code> olarak kal\u0131r ve nadiren de\u011fi\u015ftirilir.<\/p>\n

\u00d6rnek Ba\u011flam:<\/strong> \/var\/www\/html\/index.html<\/code> dosyas\u0131n\u0131n ba\u011flam\u0131 system_u:object_r:httpd_sys_content_t:s0<\/code> olabilir. Bu, dosyan\u0131n system_u<\/code> SELinux kullan\u0131c\u0131s\u0131na, object_r<\/code> rol\u00fcne ve httpd_sys_content_t<\/code> tipine ait oldu\u011funu g\u00f6sterir. Apache s\u00fcreci (httpd_t<\/code> tipinde), bu httpd_sys_content_t<\/code> tipindeki dosyalara eri\u015fim iznine sahip olacak \u015fekilde politika taraf\u0131ndan tan\u0131mlanm\u0131\u015ft\u0131r.<\/p>\n

SELinux Modlar\u0131<\/h4>\n

SELinux \u00fc\u00e7 ana modda \u00e7al\u0131\u015fabilir:
\n* Enforcing (Zorunlu):<\/strong> Varsay\u0131lan ve en g\u00fcvenli moddur. SELinux politikas\u0131na uymayan t\u00fcm eylemleri engeller ve bu olaylar\u0131 loglar.
\n* Permissive (\u0130zin Verici):<\/strong> SELinux politikas\u0131na uymayan eylemleri engellemez, ancak bu olaylar\u0131 loglar. Hata ay\u0131klama ve politika geli\u015ftirme a\u015famalar\u0131nda \u00e7ok kullan\u0131\u015fl\u0131d\u0131r.
\n* Disabled (Devre D\u0131\u015f\u0131):<\/strong> SELinux tamamen kapal\u0131d\u0131r ve hi\u00e7bir g\u00fcvenlik kontrol\u00fc sa\u011flamaz. G\u00fcvenlik a\u00e7\u0131s\u0131ndan tavsiye edilmez.<\/p>\n

Politika (Policy)<\/h4>\n

SELinux’un kalbidir. Sistemdeki t\u00fcm g\u00fcvenlik ba\u011flamlar\u0131 aras\u0131ndaki izin verilen ve verilmeyen etkile\u015fimleri tan\u0131mlayan kurallar b\u00fct\u00fcn\u00fcd\u00fcr. Politika, \u00e7ekirdek taraf\u0131ndan y\u00fcklenen ikili dosyalard\u0131r ve genellikle da\u011f\u0131t\u0131ma \u00f6zel olarak optimize edilmi\u015ftir (\u00f6rne\u011fin, targeted<\/code> veya mls<\/code> politikalar\u0131). \u00c7o\u011fu kullan\u0131c\u0131 i\u00e7in targeted<\/code> politikas\u0131 yeterlidir; bu politika, kritik sistem servislerini korur ve kullan\u0131c\u0131lar\u0131n kendi dosyalar\u0131 \u00fczerinde daha fazla esneklik sa\u011flar.<\/p>\n

SELinux Y\u00f6netimi ve Temel Komutlar<\/h3>\n

SELinux’u etkin bir \u015fekilde y\u00f6netmek i\u00e7in \u00e7e\u015fitli komutlara ve ara\u00e7lara ihtiya\u00e7 duyar\u0131z.<\/p>\n

SELinux Durumunu Kontrol Etme ve De\u011fi\u015ftirme<\/h4>\n

* Mevcut SELinux modunu \u00f6\u011frenme:<\/strong><\/p>\n

getenforce\n    # \u00c7\u0131kt\u0131: Enforcing, Permissive veya Disabled<\/code><\/pre>\n
*   Daha detayl\u0131 SELinux durumu bilgisi:<\/strong><\/p>\n
sestatus<\/code><\/pre>\n
    Bu komut, SELinux’un durumunu, politika ad\u0131n\u0131, politika tipini ve di\u011fer detaylar\u0131 g\u00f6sterir.
\n*   Ge\u00e7ici olarak modu de\u011fi\u015ftirme:<\/strong><\/p>\n
# Enforcing moda ge\u00e7mek i\u00e7in:\n    sudo setenforce 1\n    # Permissive moda ge\u00e7mek i\u00e7in:\n    sudo setenforce 0<\/code><\/pre>\n
    Bu de\u011fi\u015fiklikler yeniden ba\u015flatmaya kadar ge\u00e7erlidir.
\n*   Kal\u0131c\u0131 olarak modu de\u011fi\u015ftirme:<\/strong>
\n    \/etc\/selinux\/config<\/code> dosyas\u0131n\u0131 d\u00fczenleyin.<\/p>\n
sudo nano \/etc\/selinux\/config<\/code><\/pre>\n
    Dosya i\u00e7eri\u011fi a\u015fa\u011f\u0131daki gibi olabilir:<\/p>\n
# This file controls the state of SELinux on the system.\n    # SELINUX= can take one of these three values:\n    #     enforcing - SELinux security policy is enforced.\n    #     permissive - SELinux prints warnings instead of enforcing.\n    #     disabled - No SELinux policy is loaded.\n    SELINUX=enforcing\n    # SELINUXTYPE= can take one of these two values:\n    #     targeted - Targeted processes are protected,\n    #                others are not.\n    #     mls      - Multi Level Security protection.\n    SELINUXTYPE=targeted<\/code><\/pre>\n
    SELINUX=<\/code> sat\u0131r\u0131n\u0131 enforcing<\/code>, permissive<\/code> veya disabled<\/code> olarak de\u011fi\u015ftirin ve sistemi yeniden ba\u015flat\u0131n.<\/p>\n
Dosya Ba\u011flamlar\u0131n\u0131 G\u00f6r\u00fcnt\u00fcleme ve De\u011fi\u015ftirme<\/h4>\n
*   Dosya ve dizinlerin g\u00fcvenlik ba\u011flamlar\u0131n\u0131 g\u00f6r\u00fcnt\u00fcleme:<\/strong>
\n    ls<\/code> komutuna -Z<\/code> parametresi eklenir.<\/p>\n
ls -Z \/var\/www\/html\/index.html\n    # \u00c7\u0131kt\u0131: -rw-r--r--. root root system_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/index.html<\/code><\/pre>\n
ls -Zd \/var\/www\/html\/\n    # \u00c7\u0131kt\u0131: drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 \/var\/www\/html\/<\/code><\/pre>\n
*   Ge\u00e7ici olarak dosya ba\u011flam\u0131n\u0131 de\u011fi\u015ftirme:<\/strong>
\n    chcon<\/code> komutu kullan\u0131l\u0131r. Bu de\u011fi\u015fiklikler kal\u0131c\u0131 de\u011fildir, dosya sistemi yeniden etiketlendi\u011finde veya restorecon<\/code> \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131nda kaybolur.<\/p>\n
# \/opt\/myweb\/ dizinindeki bir dosyay\u0131 Apache'nin okuyabilece\u011fi bir tipe d\u00f6n\u00fc\u015ft\u00fcrme:\n    sudo chcon -t httpd_sys_content_t \/opt\/myweb\/index.html\n    # Rek\u00fcrsif olarak bir dizinin i\u00e7eri\u011fini de\u011fi\u015ftirme:\n    sudo chcon -R -t httpd_sys_content_t \/opt\/myweb\/<\/code><\/pre>\n
*   Kal\u0131c\u0131 olarak dosya ba\u011flamlar\u0131n\u0131 tan\u0131mlama ve uygulama:<\/strong>
\n    Yeni bir dizin olu\u015fturdu\u011funuzda veya bir uygulaman\u0131n verilerini standart olmayan bir yere ta\u015f\u0131d\u0131\u011f\u0131n\u0131zda bu gereklidir.
\n    semanage fcontext<\/code> ile ba\u011flam kural\u0131 tan\u0131mlan\u0131r, restorecon<\/code> ile bu kural uygulan\u0131r.<\/p>\n
# \/srv\/myweb dizini ve i\u00e7eri\u011fi i\u00e7in httpd_sys_content_t tipini tan\u0131mlama:\n    sudo semanage fcontext -a -t httpd_sys_content_t \"\/srv\/myweb(\/.*)?\"\n    # Tan\u0131mlanan kural\u0131 dosya sistemine uygulama:\n    sudo restorecon -Rv \/srv\/myweb\/<\/code><\/pre>\n
    semanage fcontext -l<\/code> ile mevcut fcontext kurallar\u0131n\u0131 listeleyebilirsiniz.
\n    semanage fcontext -d \"\/srv\/myweb(\/.*)?\"<\/code> ile bir kural\u0131 silebilirsiniz.<\/p>\n
Boolean De\u011ferleri Y\u00f6netme<\/h4>\n
SELinux politikas\u0131, belirli davran\u0131\u015flar\u0131 a\u00e7\u0131p kapatman\u0131za olanak tan\u0131yan boolean de\u011ferlere sahiptir.
\n*   T\u00fcm boolean de\u011ferlerini listeleme:<\/strong><\/p>\n
getsebool -a<\/code><\/pre>\n
*   Belirli bir boolean de\u011ferini kontrol etme:<\/strong><\/p>\n
getsebool httpd_can_network_connect\n    # \u00c7\u0131kt\u0131: httpd_can_network_connect --> off<\/code><\/pre>\n
*   Boolean de\u011ferini de\u011fi\u015ftirme:<\/strong>
\n    setsebool<\/code> komutu kullan\u0131l\u0131r. -P<\/code> parametresi kal\u0131c\u0131 de\u011fi\u015fiklik sa\u011flar.<\/p>\n
# Apache'nin a\u011f ba\u011flant\u0131s\u0131 kurmas\u0131na izin verme (ge\u00e7ici):\n    sudo setsebool httpd_can_network_connect on\n    # Apache'nin a\u011f ba\u011flant\u0131s\u0131 kurmas\u0131na izin verme (kal\u0131c\u0131):\n    sudo setsebool -P httpd_can_network_connect on<\/code><\/pre>\n
SELinux \u0130hlallerini Giderme (Troubleshooting)<\/h4>\n
SELinux ile ilgili sorunlar\u0131n \u00e7o\u011fu, bir s\u00fcrecin eri\u015fiminin politika taraf\u0131ndan reddedilmesinden kaynaklan\u0131r. Bu reddetmeler audit.log<\/code> dosyas\u0131nda kaydedilir.
\n*   Audit loglar\u0131n\u0131 kontrol etme:<\/strong><\/p>\n
sudo tail -f \/var\/log\/audit\/audit.log<\/code><\/pre>\n
    “AVC denied” mesajlar\u0131n\u0131 aray\u0131n. Bu mesajlar, hangi s\u00fcrecin hangi kayna\u011fa hangi eri\u015fimi denedi\u011fini ve SELinux’un bunu neden engelledi\u011fini g\u00f6sterir.
\n*   sealert<\/code> ile sorunlar\u0131 analiz etme:<\/strong>
\n    setroubleshoot-server<\/code> paketi y\u00fckl\u00fc ise sealert<\/code> arac\u0131, audit.log<\/code> dosyas\u0131ndaki SELinux ihlallerini insan taraf\u0131ndan okunabilir bir formata \u00e7evirir ve genellikle \u00e7\u00f6z\u00fcm \u00f6nerileri sunar.<\/p>\n
sudo sealert -a \/var\/log\/audit\/audit.log<\/code><\/pre>\n
    Bu komut, ihlallerin ayr\u0131nt\u0131lar\u0131n\u0131, olas\u0131 nedenlerini ve nas\u0131l \u00e7\u00f6z\u00fclece\u011fine dair komut \u00f6rneklerini g\u00f6sterir (\u00f6rne\u011fin, bir boolean’\u0131 a\u00e7ma veya bir dosya ba\u011flam\u0131n\u0131 de\u011fi\u015ftirme).
\n*   audit2allow<\/code> ile \u00f6zel politika olu\u015fturma (dikkatli kullan\u0131lmal\u0131):<\/strong>
\n    E\u011fer sealert<\/code> bir \u00e7\u00f6z\u00fcm bulamazsa veya uygulaman\u0131z\u0131n \u00f6zel bir davran\u0131\u015f\u0131 varsa, audit2allow<\/code> arac\u0131 audit.log<\/code>‘daki reddetmeleri analiz ederek bir \u00f6zel SELinux politika mod\u00fcl\u00fc olu\u015fturman\u0131za yard\u0131mc\u0131 olabilir.<\/p>\n
# Audit log'daki reddetmeleri analiz et ve \u00f6nerilen kurallar\u0131 g\u00f6ster:\n    sudo ausearch -c AVC -m avc -ts today | audit2allow -w -a\n    # Yeni bir politika mod\u00fcl\u00fc (.te) ve paket (.pp) olu\u015ftur:\n    sudo ausearch -c AVC -m avc -ts today | audit2allow -M myapp_custom\n    # Olu\u015fturulan politikay\u0131 y\u00fckle:\n    sudo semodule -i myapp_custom.pp<\/code><\/pre>\n
    audit2allow<\/code> kullan\u0131rken \u00e7ok dikkatli olunmal\u0131d\u0131r, \u00e7\u00fcnk\u00fc yanl\u0131\u015f veya a\u015f\u0131r\u0131 geni\u015f kurallar g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. Genellikle, mevcut boolean’lar\u0131 kullanmak veya dosya ba\u011flamlar\u0131n\u0131 do\u011fru \u015fekilde ayarlamak tercih edilir.<\/p>\n
Pratik Senaryolar ve SELinux \u0130pu\u00e7lar\u0131<\/h3>\n
SELinux, \u00f6zellikle sunucu ortamlar\u0131nda \u00e7e\u015fitli servislerin g\u00fcvenli\u011fini sa\u011flamak i\u00e7in hayati \u00f6neme sahiptir. \u0130\u015fte birka\u00e7 yayg\u0131n senaryo:<\/p>\n
Web Sunucusu (Apache\/Nginx) \u0130\u00e7in SELinux Ayarlar\u0131<\/h4>\n
Varsay\u0131lan olarak, Apache (httpd_t<\/code>) veya Nginx (nginx_t<\/code>) s\u00fcre\u00e7leri sadece belirli SELinux tiplerine sahip dosyalara (httpd_sys_content_t<\/code>, httpd_user_content_t<\/code> vb.) eri\u015febilir.
\n*   Web i\u00e7eri\u011fini standart olmayan bir dizinden sunma:<\/strong>
\n    Diyelim ki web sitenizin dosyalar\u0131n\u0131 \/srv\/www\/html<\/code> dizininde tutmak istiyorsunuz.<\/p>\n
# Dizini olu\u015fturun ve \u00f6rnek bir dosya ekleyin\n    sudo mkdir -p \/srv\/www\/html\n    echo \"Merhaba SELinux!\" | sudo tee \/srv\/www\/html\/index.html\n\n    # Dizine ve i\u00e7eri\u011fine do\u011fru SELinux ba\u011flam\u0131n\u0131 atay\u0131n\n    sudo semanage fcontext -a -t httpd_sys_content_t \"\/srv\/www\/html(\/.*)?\"\n    sudo restorecon -Rv \/srv\/www\/html\/\n\n    # Apache\/Nginx yap\u0131land\u0131rman\u0131z\u0131 bu dizini kullanacak \u015fekilde g\u00fcncelleyin.<\/code><\/pre>\n
*   Web sunucusunun a\u011f \u00fczerinden ba\u015fka bir servise ba\u011flanmas\u0131 (\u00f6rne\u011fin veritaban\u0131):<\/strong>
\n    Varsay\u0131lan olarak, web sunucusu s\u00fcre\u00e7lerinin d\u0131\u015far\u0131ya a\u011f ba\u011flant\u0131s\u0131 kurmas\u0131 k\u0131s\u0131tl\u0131d\u0131r. E\u011fer web uygulaman\u0131z bir veritaban\u0131na veya API’ye ba\u011flanacaksa, httpd_can_network_connect<\/code> boolean’\u0131n\u0131 a\u00e7man\u0131z gerekebilir.<\/p>\n
sudo setsebool -P httpd_can_network_connect on<\/code><\/pre>\n
    Benzer \u015fekilde, e\u011fer web sunucusu bir proxy olarak \u00e7al\u0131\u015facaksa, httpd_can_network_connect_http<\/code> veya httpd_can_network_connect_ftp<\/code> gibi daha spesifik boolean’lar kullan\u0131labilir.<\/p>\n
Dosya Payla\u015f\u0131m\u0131 (NFS\/Samba) ve SELinux<\/h4>\n
*   NFS\/Samba payla\u015f\u0131mlar\u0131 i\u00e7in do\u011fru ba\u011flamlar\u0131 ayarlama:<\/strong>
\n    E\u011fer \/export\/data<\/code> dizinini NFS veya Samba \u00fczerinden payla\u015facaksan\u0131z, bu dizine public_content_t<\/code> veya samba_share_t<\/code> gibi uygun bir tip ataman\u0131z gerekebilir.<\/p>\n
# \/export\/data dizini i\u00e7in public_content_t tipini tan\u0131mlama:\n    sudo semanage fcontext -a -t public_content_t \"\/export\/data(\/.*)?\"\n    sudo restorecon -Rv \/export\/data\/\n\n    # Samba i\u00e7in: Samba'n\u0131n ev dizinlerini payla\u015fmas\u0131na izin ver\n    sudo setsebool -P samba_enable_home_dirs on\n    # Samba'n\u0131n genel payla\u015f\u0131mlara yazmas\u0131na izin ver\n    sudo setsebool -P samba_export_all_rw on<\/code><\/pre>\n
Kullan\u0131c\u0131 Home Dizini G\u00fcvenli\u011fi<\/h4>\n
Kullan\u0131c\u0131lar\u0131n home dizinleri (\/home\/kullanici<\/code>) genellikle user_home_dir_t<\/code> tipine sahiptir. Bu, di\u011fer kullan\u0131c\u0131lar\u0131n veya yetkisiz s\u00fcre\u00e7lerin bu dizinlere eri\u015fimini k\u0131s\u0131tlar.<\/p>\n
Yeni Servis Kurulumu<\/h4>\n
Yeni bir uygulama veya servis kurdu\u011funuzda ve \u00e7al\u0131\u015fmad\u0131\u011f\u0131nda, ilk kontrol etmeniz gereken yerlerden biri SELinux’tur.
\n1.  Modu Permissive’e al\u0131n:<\/strong> sudo setenforce 0<\/code>. Servis \u015fimdi \u00e7al\u0131\u015f\u0131yorsa, sorun SELinux’tad\u0131r.
\n2.  Audit loglar\u0131n\u0131 kontrol edin:<\/strong> sudo tail -f \/var\/log\/audit\/audit.log<\/code> veya sudo sealert -a \/var\/log\/audit\/audit.log<\/code> ile reddetmeleri inceleyin.
\n3.  \u00d6nerilen \u00e7\u00f6z\u00fcmleri uygulay\u0131n:<\/strong> sealert<\/code>‘\u0131n \u00f6nerdi\u011fi boolean de\u011fi\u015fikliklerini veya dosya ba\u011flam g\u00fcncellemelerini yap\u0131n.
\n4.  Modu tekrar Enforcing’e al\u0131n:<\/strong> sudo setenforce 1<\/code>. Servisin hala \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 kontrol edin.<\/p>\n
Sonu\u00e7 ve S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h3>\n
SELinux, Linux sistemlerinin g\u00fcvenli\u011fini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131ran g\u00fc\u00e7l\u00fc ve esnek bir zorunlu eri\u015fim kontrol mekanizmas\u0131d\u0131r. \u0130lk ba\u015fta karma\u015f\u0131k g\u00f6r\u00fcnse de, temel prensiplerini ve y\u00f6netim komutlar\u0131n\u0131 anlamak, sistemlerinizi daha g\u00fcvenli hale getirmenize yard\u0131mc\u0131 olacakt\u0131r. SELinux’u devre d\u0131\u015f\u0131 b\u0131rakmak yerine, kar\u015f\u0131la\u015f\u0131lan sorunlar\u0131 gidermeyi \u00f6\u011frenmek, uzun vadede sistem g\u00fcvenli\u011finiz i\u00e7in \u00e7ok daha faydal\u0131d\u0131r. Do\u011fru yap\u0131land\u0131r\u0131lm\u0131\u015f bir SELinux politikas\u0131, bir sald\u0131rgan\u0131n sisteme s\u0131zmas\u0131 durumunda bile, hasar\u0131 s\u0131n\u0131rlamada kritik bir rol oynar.<\/p>\n
S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h4>\n
*   SELinux’u tamamen kapatmal\u0131 m\u0131y\u0131m?<\/strong>
\n    Hay\u0131r, genellikle tavsiye edilmez. SELinux, sistemin g\u00fcvenli\u011fini art\u0131ran \u00f6nemli bir katmand\u0131r. Sorun ya\u015fad\u0131\u011f\u0131n\u0131zda, ge\u00e7ici olarak permissive<\/code> moda al\u0131p audit.log<\/code>‘lar\u0131 inceleyerek sorunu \u00e7\u00f6zmeye \u00e7al\u0131\u015f\u0131n.
\n*   SELinux performans d\u00fc\u015f\u00fcr\u00fcr m\u00fc?<\/strong>
\n    \u00c7ok k\u00fc\u00e7\u00fck bir performans d\u00fc\u015f\u00fc\u015f\u00fc olabilir, ancak modern donan\u0131mlarda bu genellikle ihmal edilebilir d\u00fczeydedir ve sa\u011flad\u0131\u011f\u0131 g\u00fcvenlik faydalar\u0131na k\u0131yasla kabul edilebilir.
\n*   Hangi da\u011f\u0131t\u0131mlar SELinux kullan\u0131r?<\/strong>
\n    Red Hat Enterprise Linux (RHEL), CentOS, Fedora gibi Red Hat tabanl\u0131 da\u011f\u0131t\u0131mlarda varsay\u0131lan olarak etkin ve s\u0131k\u0131 bir \u015fekilde entegre edilmi\u015ftir. Debian ve Ubuntu gibi di\u011fer da\u011f\u0131t\u0131mlar da SELinux’u destekler, ancak genellikle varsay\u0131lan olarak AppArmor gibi ba\u015fka bir MAC sistemi veya hi\u00e7biri etkin de\u011fildir.
\n*   SELinux problemleri nas\u0131l \u00e7\u00f6zerim?<\/strong>
\n    audit.log<\/code> dosyas\u0131n\u0131 kontrol edin, sealert -a \/var\/log\/audit\/audit.log<\/code> komutunu kullanarak sorunlar\u0131 analiz edin ve \u00f6nerilen \u00e7\u00f6z\u00fcmleri uygulay\u0131n (boolean’lar\u0131 de\u011fi\u015ftirme, dosya ba\u011flamlar\u0131n\u0131 ayarlama). Gerekirse, ge\u00e7ici olarak permissive<\/code> moda ge\u00e7erek hata ay\u0131klama yapabilirsiniz.
\n*   SELinux ile AppArmor aras\u0131ndaki fark nedir?<\/strong>
\n    Her ikisi de birer MAC sistemidir.
\n    *   SELinux:<\/strong> Tip tabanl\u0131d\u0131r. Her dosya, s\u00fcre\u00e7 ve port bir “tip” ile etiketlenir ve politika bu tipler aras\u0131ndaki etkile\u015fimleri kontrol eder. Daha karma\u015f\u0131k ve g\u00fc\u00e7l\u00fcd\u00fcr, ancak \u00f6\u011frenme e\u011frisi daha diktir.
\n    *   AppArmor:<\/strong> Yol tabanl\u0131d\u0131r. Uygulamalar\u0131n dosya sistemi \u00fczerindeki belirli yollara eri\u015fimini kontrol eder. Genellikle daha basit ve y\u00f6netimi kolayd\u0131r, ancak SELinux kadar kapsaml\u0131 olmayabilir.<\/p>\n
<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber\nLinux tabanl\u0131 sistemlerde g\u00fcvenlik, her zaman \u00f6ncelikli konulardan biri olmu\u015ftur. Geleneksel olarak,","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-31389","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nSELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber\" \/>\n<meta property=\"og:description\" content=\"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber Linux tabanl\u0131 sistemlerde g\u00fcvenlik, her zaman \u00f6ncelikli konulardan biri olmu\u015ftur. Geleneksel olarak,\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-09T07:42:14+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber\",\"datePublished\":\"2025-10-09T07:42:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/\"},\"wordCount\":1906,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Linux\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/\",\"name\":\"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-10-09T07:42:14+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/","og_locale":"tr_TR","og_type":"article","og_title":"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber","og_description":"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber Linux tabanl\u0131 sistemlerde g\u00fcvenlik, her zaman \u00f6ncelikli konulardan biri olmu\u015ftur. Geleneksel olarak,","og_url":"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-10-09T07:42:14+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"13 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber","datePublished":"2025-10-09T07:42:14+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/"},"wordCount":1906,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Linux"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/","url":"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/","name":"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-10-09T07:42:14+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/selinux-nedir-kapsamli-bir-teknik-rehber\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"SELinux Nedir? Kapsaml\u0131 Bir Teknik Rehber"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/31389","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=31389"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/31389\/revisions"}],"predecessor-version":[{"id":31390,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/31389\/revisions\/31390"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=31389"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=31389"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=31389"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}