Linux 防火墙与 SELinux 配置：生产环境安全合规指南

- name: 配置 nftables 基础规则
  hosts: k8s_nodes
  become: true
  tasks:
    - name: 确保 nftables 服务启动并开机自启
      service:
        name: nftables
        state: started
        enabled: true

    - name: 部署 nftables 主配置文件
      copy:
        content: |
          # 清空现有规则
          flush ruleset

          # 定义表与链（ipv4）
          table inet filter {
              chain input {
                  type filter hook input priority 0; policy drop;

                  # 允许回环接口流量
                  iif lo accept comment "Allow loopback traffic"

                  # 允许已建立的连接
                  ct state established,related accept comment "Allow established connections"

                  # 允许 SSH（22 端口）
                  tcp dport 22 accept comment "Allow SSH access"

                  # 允许 HTTP（80）、HTTPS（443）
                  tcp dport {80, 443} accept comment "Allow web traffic"

                  # 允许容器网桥（docker0）流量
                  iifname docker0 accept comment "Allow docker bridge traffic"

                  # 拒绝其他所有入站流量
                  reject with icmpx type port-unreachable
              }

              chain forward {
                  type filter hook forward priority 0; policy drop;

                  # 允许容器间转发流量
                  ct state established,related accept
                  iifname docker0 oifname docker0 accept comment "Allow container-to-container traffic"
              }

              chain output {
                  type filter hook output priority 0; policy accept;
              }
          }
        dest: /etc/nftables.conf
        mode: '0644'
      notify:
        - 重启 nftables 服务

  handlers:
    - name: 重启 nftables 服务
      service:
        name: nftables
        state: restarted

resource "aws_security_group" "k8s_node_sg" {
  name        = "k8s-node-security-group"
  description = "Security group for Kubernetes nodes"

  # 允许 SSH 入站
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["你的办公网络 CIDR/32"] # 限制来源，避免全网开放
  }

  # 允许 HTTP/HTTPS 入站
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # 允许已建立的连接出站
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "k8s-node-sg"
  }
}

# 为 EC2 实例配置 nftables 规则
resource "aws_instance" "k8s_node" {
  ami           = "ami-xxxxxxxxxxxxxxxxx" # RHEL/CentOS Stream 8+ AMI
  instance_type = "t3.large"
  vpc_security_group_ids = [aws_security_group.k8s_node_sg.id]

  # 远程执行 nftables 配置脚本
  provisioner "remote-exec" {
    inline = [
      "yum install -y nftables",
      "echo 'flush ruleset' > /etc/nftables.conf",
      "echo 'table inet filter { chain input { type filter hook input priority 0; policy drop; iif lo accept; ct state established,related accept; tcp dport 22 accept; tcp dport {80,443} accept; reject; } }' >> /etc/nftables.conf",
      "systemctl enable --now nftables"
    ]
  }
}

# 启动容器时指定 SELinux 标签（默认即为 container_t，可显式指定）
docker run -d --security-opt label=type:container_t nginx

# 禁止容器访问主机的 /home 目录（通过 SELinux 策略限制，即使挂载也无法访问）
docker run -d --security-opt label=type:container_t -v /home:/home nginx

# 将主机 /data 目录的 SELinux 标签改为 container_file_t（容器可访问）
chcon -Rt container_file_t /data

# 启动容器并挂载 /data
docker run -d -v /data:/data nginx

apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
  annotations:
    # 指定 SELinux 类型为 container_t
    seccomp.security.alpha.kubernetes.io/pod: runtime/default
    selinux.security.alpha.kubernetes.io/container: 'type:container_t'
spec:
  containers:
  - name: nginx
    image: nginx:alpine
    securityContext:
      # 配合 PSS 限制，禁止特权用户
      runAsNonRoot: true
      runAsUser: 101

# 安装 udica 与依赖工具（RHEL/CentOS Stream）
yum install -y udica setools-console policycoreutils-python-utils

# Ubuntu 需安装 AppArmor 相关工具（替代 SELinux）
apt install -y apparmor-utils apparmor-profiles

# 启动自定义 Nginx 容器（假设需要访问 /dev/urandom 设备）
docker run -d --name custom-nginx custom-nginx:v1

# 查看 SELinux 拒绝日志（若没有日志，先将 SELinux 设为 permissive 模式）
ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent

# 导出容器的运行时信息到 JSON 文件
docker inspect custom-nginx > custom-nginx.json

# 生成 SELinux 策略模块（custom_nginx_t 为自定义策略类型）
udica -j custom-nginx.json custom_nginx

# 生成的策略文件包括：custom_nginx.cil、custom_nginx.te 等
ls -l custom_nginx.*

# 加载策略模块
semodule -i custom_nginx.cil

# 验证策略是否加载成功
semodule -l | grep custom_nginx

# 启动容器时指定自定义策略
docker run -d --name custom-nginx --security-opt label=type:custom_nginx_t custom-nginx:v1

# /etc/nftables.conf（CIS 合规版）
flush ruleset

# 定义表与链
table inet filter {
    # 入站规则：默认拒绝，仅开放必要端口
    chain input {
        type filter hook input priority 0; policy drop;

        # 允许回环接口
        iif lo accept comment "CIS 4.4.1.1: Allow loopback"
        # 拒绝回环接口的反向流量
        iif != lo ip saddr 127.0.0.0/8 reject comment "CIS 4.4.1.2: Deny loopback reverse traffic"
        iif != lo ip6 saddr ::1 reject comment "CIS 4.4.1.2: Deny loopback reverse traffic"

        # 允许已建立的连接
        ct state established,related accept comment "CIS 4.4.1.3: Allow established connections"

        # 允许 ICMP 回声请求（ping）
        ip protocol icmp icmp type echo-request accept comment "CIS 4.4.1.4: Allow ICMP echo request"
        ip6 protocol icmpv6 icmpv6 type echo-request accept comment "CIS 4.4.1.4: Allow ICMPv6 echo request"

        # 开放必要服务端口（根据业务调整）
        tcp dport 22 ip saddr 192.168.1.0/24 accept comment "CIS 4.4.1.5: Allow SSH from internal network"
        tcp dport 443 accept comment "CIS 4.4.1.5: Allow HTTPS"

        # 拒绝所有其他入站流量
        reject with icmpx type port-unreachable comment "CIS 4.4.1.6: Reject all other inbound traffic"
    }

    # 转发规则：默认拒绝（容器环境需调整）
    chain forward {
        type filter hook forward priority 0; policy drop;

        # 允许容器间转发（CIS 4.4.2.1: Allow container-to-container traffic if needed）
        ct state established,related accept
        iifname docker0 oifname docker0 accept

        # 拒绝其他转发流量
        reject comment "CIS 4.4.2.2: Reject other forward traffic"
    }

    # 出站规则：默认允许，限制危险流量
    chain output {
        type filter hook output priority 0; policy accept;

        # 禁止出站 SSH（防止数据泄露）
        tcp dport 22 reject comment "CIS 4.4.3.1: Deny outbound SSH"
    }
}

# 1. 确保 SELinux 处于 enforcing 模式（CIS 1.6.1.1）
setenforce 1
sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config

# 2. 确保 SELinux 政策已更新（CIS 1.6.1.2）
yum update -y selinux-policy-targeted

# 3. 禁止 SELinux 允许核心转储（CIS 1.6.1.3）
setsebool -P allow_core_dump off

# 4. 限制容器进程的 SELinux 权限（CIS 5.7.1）
setsebool -P container_use_网络 on
setsebool -P container_connect_all off

# 5. 确保 SSH 登录使用 SELinux 标签（CIS 5.2.17）
semanage login -a -s staff_u root # 为 root 登录分配 staff_u 标签（限制权限）

- name: 灰度切换 SELinux 模式为 permissive
  hosts: k8s_nodes[0:1] # 仅选择前 2 个节点
  become: true
  tasks:
    - name: 检查当前 SELinux 模式
      command: getenforce
      register: selinux_mode
      changed_when: false

    - name: 切换为 permissive 模式
      command: setenforce 0
      when: selinux_mode.stdout == "Enforcing"

    - name: 验证切换结果
      command: getenforce
      register: result
      changed_when: false

    - name: 输出切换结果
      debug:
        msg: "SELinux 模式已切换为: {{ result.stdout }}"

    - name: 记录变更日志
      copy:
        content: |
          变更时间: {{ ansible_date_time.iso8601 }}
          操作人员: {{ ansible_user }}
          变更内容: 切换 SELinux 模式为 permissive
          节点 IP: {{ ansible_default_ipv4.address }}
          切换结果: {{ result.stdout }}
        dest: /var/log/selinux_mode_change.log
        mode: '0644'

firewall-gitops/
├── ansible/
│   ├── playbooks/
│   │   └── configure-nftables.yml # 防火墙配置 Playbook
│   └── roles/
│       └── nftables/
│           ├── tasks/
│           └── templates/
│               └── nftables.conf.j2 # nftables 配置模板
└── argocd/
    └── application.yaml # ArgoCD 应用配置

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: firewall-config
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/your-org/firewall-gitops.git
    targetRevision: HEAD
    path: ansible/playbooks
  destination:
    server: https://kubernetes.default.svc
    namespace: default
  syncPolicy:
    automated:
      prune: true # 自动删除未在 Git 中定义的资源
      selfHeal: true # 出现配置漂移时自动回滚
    syncOptions:
      - CreateNamespace=true
    retry:
      limit: 5
      backoff:
        duration: "30s"
        factor: 2
        maxDuration: "5m"

name: Validate Firewall Config
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Validate nftables config
        run: |
          docker run -v $PWD/ansible/roles/nftables/templates:/templates rhel:9 bash -c "yum install -y nftables; nft -c -f /templates/nftables.conf.j2"

# /etc/logstash/conf.d/selinux.conf
input {
  file {
    path => "/var/log/audit/audit.log"
    start_position => "beginning"
    sincedb_path => "/dev/null" # 每次重启都重新读取日志（适合测试，生产环境需调整）
  }
}

filter {
  # 解析 SELinux AVC 日志
  grok {
    match => { "message" => "type=AVC msg=audit\(%{NUMBER:audit_time:float}:%{NUMBER:audit_id:int}\): avc:  %{WORD:action}  { %{DATA:permissions} } for  pid=%{NUMBER:pid:int} comm=\"%{DATA:comm}\" name=\"%{DATA:file_name}\" dev=\"%{DATA:device}\" ino=%{NUMBER:inode:int} scontext=%{DATA:source_context} tcontext=%{DATA:target_context} tclass=%{DATA:target_class} permissive=%{NUMBER:permissive:int}" }
    add_tag => [ "selinux_avc" ]
  }

  # 转换时间格式
  date {
    match => [ "audit_time", "UNIX" ]
    target => "@timestamp"
  }
}

output {
  elasticsearch {
    hosts => [ "http://elasticsearch:9200" ]
    index => "selinux-avc-%{+YYYY.MM.dd}"
  }
  stdout { codec => rubydebug } # 调试用，生产环境可注释
}

{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": [ "selinux-avc-*" ],
        "query": {
          "bool": {
            "must": [
              { "match": { "action": "denied" } },
              { "range": { "@timestamp": { "gte": "now-5m" } } }
            ]
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total.value": {
        "gt": 10
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "to": "ops@your-org.com",
        "subject": "SELinux AVC 拒绝日志异常增多",
        "body": "最近 5 分钟内出现 {{ctx.payload.hits.total.value}} 条 SELinux AVC 拒绝日志，请及时排查。"
      }
    }
  }
}

# 安装 OpenSCAP
yum install -y openscap-scanner scap-security-guide

# 执行 CIS Benchmark 扫描（针对 RHEL 9）
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results cis-scan-results.xml \
  --report cis-scan-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

# 查看扫描报告（重点关注防火墙与 SELinux 相关的失败项）
firefox cis-scan-report.html