Author: rlandmann Date: 2010-11-21 23:12:12 +0000 (Sun, 21 Nov 2010) New Revision: 492

Modified: community/branches/f13/de-DE/Appendix.po community/branches/f13/de-DE/Author_Group.po community/branches/f13/de-DE/Book_Info.po community/branches/f13/de-DE/Contexts_and_Attributes.po community/branches/f13/de-DE/Further_Information.po community/branches/f13/de-DE/Introduction.po community/branches/f13/de-DE/Managing_Users.po community/branches/f13/de-DE/Preface.po community/branches/f13/de-DE/Revision_History.po community/branches/f13/de-DE/SELinux_User_Guide.po community/branches/f13/de-DE/Security-Enhanced_Linux.po community/branches/f13/de-DE/Targeted_Policy.po community/branches/f13/de-DE/Trademarks.po community/branches/f13/de-DE/Troubleshooting.po community/branches/f13/de-DE/Working_With_SELinux.po community/branches/f13/fr-FR/Appendix.po community/branches/f13/fr-FR/Author_Group.po community/branches/f13/fr-FR/Book_Info.po community/branches/f13/fr-FR/Contexts_and_Attributes.po community/branches/f13/fr-FR/Further_Information.po community/branches/f13/fr-FR/Introduction.po community/branches/f13/fr-FR/Managing_Users.po community/branches/f13/fr-FR/Preface.po community/branches/f13/fr-FR/Revision_History.po community/branches/f13/fr-FR/SELinux_User_Guide.po community/branches/f13/fr-FR/Security-Enhanced_Linux.po community/branches/f13/fr-FR/Targeted_Policy.po community/branches/f13/fr-FR/Trademarks.po community/branches/f13/fr-FR/Troubleshooting.po community/branches/f13/fr-FR/Working_With_SELinux.po community/branches/f13/ru-RU/Appendix.po community/branches/f13/ru-RU/Author_Group.po community/branches/f13/ru-RU/Book_Info.po community/branches/f13/ru-RU/Contexts_and_Attributes.po community/branches/f13/ru-RU/Further_Information.po community/branches/f13/ru-RU/Introduction.po community/branches/f13/ru-RU/Managing_Users.po community/branches/f13/ru-RU/Preface.po community/branches/f13/ru-RU/Revision_History.po community/branches/f13/ru-RU/SELinux_User_Guide.po community/branches/f13/ru-RU/Security-Enhanced_Linux.po community/branches/f13/ru-RU/Targeted_Policy.po community/branches/f13/ru-RU/Trademarks.po community/branches/f13/ru-RU/Troubleshooting.po community/branches/f13/ru-RU/Working_With_SELinux.po Log: update translations from trunk

Modified: community/branches/f13/de-DE/Appendix.po =================================================================== --- community/branches/f13/de-DE/Appendix.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Appendix.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n"

Modified: community/branches/f13/de-DE/Author_Group.po =================================================================== --- community/branches/f13/de-DE/Author_Group.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Author_Group.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -75,15 +76,8 @@

#. Tag: contrib #, fuzzy, no-c-format -msgid "" -"Technical editor for the Introduction, SELinux Contexts, Targeted Policy, " -"Working with SELinux, Confining Users, and Troubleshooting chapters." -msgstr "" -"<firstname>Dominick</firstname> <surname>Grift</surname> <contrib>Technical " -"editor for the Introduction, SELinux Contexts, Targeted Policy, Working with " -"SELinux, Confining Users, and Troubleshooting chapters.</contrib> " -"<affiliation> <orgname></orgname> <orgdiv></orgdiv> </affiliation> " -"<email>domg472@gmail.com</email>" +msgid "Technical editor for the Introduction, SELinux Contexts, Targeted Policy, Working with SELinux, Confining Users, and Troubleshooting chapters." +msgstr "<firstname>Dominick</firstname> <surname>Grift</surname> <contrib>Technical editor for the Introduction, SELinux Contexts, Targeted Policy, Working with SELinux, Confining Users, and Troubleshooting chapters.</contrib> <affiliation> <orgname></orgname> <orgdiv></orgdiv> </affiliation> <email>domg472@gmail.com</email>"

#. Tag: firstname #, no-c-format @@ -97,9 +91,7 @@

#. Tag: contrib #, no-c-format -msgid "" -"Technical editor for the Mounting File Systems and Raw Audit Messages " -"sections." +msgid "Technical editor for the Mounting File Systems and Raw Audit Messages sections." msgstr ""

#. Tag: firstname @@ -117,53 +109,17 @@ msgid "Technical editor for the Introduction and Targeted Policy chapters." msgstr ""

-#~ msgid "" -#~ "<firstname>Murray</firstname> <surname>McAllister</surname> <affiliation> " -#~ "<orgname>Red Hat</orgname> <orgdiv>Engineering Content Services</orgdiv> " -#~ "</affiliation> <email>mmcallis@redhat.com</email>" -#~ msgstr "" -#~ "<firstname>Murray</firstname> <surname>McAllister</surname> <affiliation> " -#~ "<orgname>Red Hat</orgname> <orgdiv>Engineering Content Services</orgdiv> " -#~ "</affiliation> <email>mmcallis@redhat.com</email>" +#~ msgid "<firstname>Murray</firstname> <surname>McAllister</surname> <affiliation> <orgname>Red Hat</orgname> <orgdiv>Engineering Content Services</orgdiv> </affiliation> <email>mmcallis@redhat.com</email>" +#~ msgstr "<firstname>Murray</firstname> <surname>McAllister</surname> <affiliation> <orgname>Red Hat</orgname> <orgdiv>Engineering Content Services</orgdiv> </affiliation> <email>mmcallis@redhat.com</email>"

-#~ msgid "" -#~ "<firstname>Daniel</firstname> <surname>Walsh</surname> <affiliation> " -#~ "<orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </" -#~ "affiliation> <email>dwalsh@redhat.com</email>" -#~ msgstr "" -#~ "<firstname>Daniel</firstname> <surname>Walsh</surname> <affiliation> " -#~ "<orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </" -#~ "affiliation> <email>dwalsh@redhat.com</email>" +#~ msgid "<firstname>Daniel</firstname> <surname>Walsh</surname> <affiliation> <orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </affiliation> <email>dwalsh@redhat.com</email>" +#~ msgstr "<firstname>Daniel</firstname> <surname>Walsh</surname> <affiliation> <orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </affiliation> <email>dwalsh@redhat.com</email>"

-#~ msgid "" -#~ "<firstname>Eric</firstname> <surname>Paris</surname> <affiliation> " -#~ "<orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </" -#~ "affiliation> <contrib>Technical editor for the Mounting File Systems and " -#~ "Raw Audit Messages sections.</contrib> <email>eparis@parisplace.org</" -#~ "email>" -#~ msgstr "" -#~ "<firstname>Eric</firstname> <surname>Paris</surname> <affiliation> " -#~ "<orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </" -#~ "affiliation> <contrib>Technical editor for the Mounting File Systems and " -#~ "Raw Audit Messages sections.</contrib> <email>eparis@parisplace.org</" -#~ "email>" +#~ msgid "<firstname>Eric</firstname> <surname>Paris</surname> <affiliation> <orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </affiliation> <contrib>Technical editor for the Mounting File Systems and Raw Audit Messages sections.</contrib> <email>eparis@parisplace.org</email>" +#~ msgstr "<firstname>Eric</firstname> <surname>Paris</surname> <affiliation> <orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </affiliation> <contrib>Technical editor for the Mounting File Systems and Raw Audit Messages sections.</contrib> <email>eparis@parisplace.org</email>"

-#~ msgid "" -#~ "<firstname>James</firstname> <surname>Morris</surname> <affiliation> " -#~ "<orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </" -#~ "affiliation> <contrib>Technical editor for the Introduction and Targeted " -#~ "Policy chapters.</contrib> <email>jmorris@redhat.com</email>" -#~ msgstr "" -#~ "<firstname>James</firstname> <surname>Morris</surname> <affiliation> " -#~ "<orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </" -#~ "affiliation> <contrib>Technical editor for the Introduction and Targeted " -#~ "Policy chapters.</contrib> <email>jmorris@redhat.com</email>" +#~ msgid "<firstname>James</firstname> <surname>Morris</surname> <affiliation> <orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </affiliation> <contrib>Technical editor for the Introduction and Targeted Policy chapters.</contrib> <email>jmorris@redhat.com</email>" +#~ msgstr "<firstname>James</firstname> <surname>Morris</surname> <affiliation> <orgname>Red Hat</orgname> <orgdiv>Security Engineering</orgdiv> </affiliation> <contrib>Technical editor for the Introduction and Targeted Policy chapters.</contrib> <email>jmorris@redhat.com</email>"

-#~ msgid "" -#~ "<firstname>Scott</firstname> <surname>Radvan</surname> <affiliation> " -#~ "<orgname>Red Hat</orgname> <orgdiv>Engineering Content Services</orgdiv> " -#~ "</affiliation> <email>sradvan@redhat.com</email>" -#~ msgstr "" -#~ "<firstname>Scott</firstname> <surname>Radvan</surname> <affiliation> " -#~ "<orgname>Red Hat</orgname> <orgdiv>Engineering Content Services</orgdiv> " -#~ "</affiliation> <email>sradvan@redhat.com</email>" +#~ msgid "<firstname>Scott</firstname> <surname>Radvan</surname> <affiliation> <orgname>Red Hat</orgname> <orgdiv>Engineering Content Services</orgdiv> </affiliation> <email>sradvan@redhat.com</email>" +#~ msgstr "<firstname>Scott</firstname> <surname>Radvan</surname> <affiliation> <orgname>Red Hat</orgname> <orgdiv>Engineering Content Services</orgdiv> </affiliation> <email>sradvan@redhat.com</email>"

Modified: community/branches/f13/de-DE/Book_Info.po =================================================================== --- community/branches/f13/de-DE/Book_Info.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Book_Info.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -30,12 +31,8 @@

#. Tag: para #, fuzzy, no-c-format -msgid "" -"The SELinux User Guide assists users and administrators in managing and " -"using Security-Enhanced <trademark class="registered">Linux</trademark>." -msgstr "" -"Dieses Buch befasst sich mit der Verwaltung und Benutzung von Security-" -"Enhanced <trademark class="registered">Linux</trademark>." +msgid "The SELinux User Guide assists users and administrators in managing and using Security-Enhanced <trademark class="registered">Linux</trademark>." +msgstr "Dieses Buch befasst sich mit der Verwaltung und Benutzung von Security-Enhanced <trademark class="registered">Linux</trademark>."

#~ msgid "Logo" #~ msgstr "Logo"

Modified: community/branches/f13/de-DE/Contexts_and_Attributes.po =================================================================== --- community/branches/f13/de-DE/Contexts_and_Attributes.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Contexts_and_Attributes.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -25,43 +26,18 @@

#. Tag: para #, fuzzy, no-c-format -msgid "" -"Processes and files are labeled with an SELinux context that contains " -"additional information, such as an SELinux user, role, type, and, " -"optionally, a level. When running SELinux, all of this information is used " -"to make access control decisions. In Fedora, SELinux provides a combination " -"of Role-Based Access Control (RBAC), <trademark class="registered">Type " -"Enforcement</trademark> (TE), and, optionally, Multi-Level Security (MLS)." -msgstr "" -"Prozesse und Dateien sind mit einem SELinux Kontext markiert, welcher " -"zusätzliche Information beinhaltet, wie zum Beispiel einem SELinux Benutzer, " -"einer Rolle, einem Typen, und wahlweise einem Level. Bei aktiviertem SELinux " -"werden all diese Informationen zur Bestimmung der Zugriffsberechtigung " -"herangezogen. In Fedora 11 bietet SELinux eine Kombination von Rollen-" -"basierter Zugriffskontrolle (RBAC), <trademark class="registered">Type " -"Enforcement</trademark> (TE), und wahlweise Multi-Level Sicherheit (MLS)." +msgid "Processes and files are labeled with an SELinux context that contains additional information, such as an SELinux user, role, type, and, optionally, a level. When running SELinux, all of this information is used to make access control decisions. In Fedora, SELinux provides a combination of Role-Based Access Control (RBAC), <trademark class="registered">Type Enforcement</trademark> (TE), and, optionally, Multi-Level Security (MLS)." +msgstr "Prozesse und Dateien sind mit einem SELinux Kontext markiert, welcher zusätzliche Information beinhaltet, wie zum Beispiel einem SELinux Benutzer, einer Rolle, einem Typen, und wahlweise einem Level. Bei aktiviertem SELinux werden all diese Informationen zur Bestimmung der Zugriffsberechtigung herangezogen. In Fedora 11 bietet SELinux eine Kombination von Rollen-basierter Zugriffskontrolle (RBAC), <trademark class="registered">Type Enforcement</trademark> (TE), und wahlweise Multi-Level Sicherheit (MLS)."

#. Tag: para #, fuzzy, no-c-format -msgid "" -"The following is an example showing SELinux context. SELinux contexts are " -"used on processes, Linux users, and files, on Linux operating systems that " -"run SELinux. Use the <command>ls -Z</command> command to view the SELinux " -"context of files and directories:" -msgstr "" -"Nachfolgend finden Sie einen Beispiel SELinux Kontext. SELinux Kontexte " -"werden auf Prozesse, Linux Benutzer und Dateien angewendet, welche auf einem " -"SELinux fähigen Linux Betriebssystem laufen. Über den Befehl <command>ls -Z</" -"command> sehen Sie den SELinux Kontext von Dateien und Verzeichnissen." +msgid "The following is an example showing SELinux context. SELinux contexts are used on processes, Linux users, and files, on Linux operating systems that run SELinux. Use the <command>ls -Z</command> command to view the SELinux context of files and directories:" +msgstr "Nachfolgend finden Sie einen Beispiel SELinux Kontext. SELinux Kontexte werden auf Prozesse, Linux Benutzer und Dateien angewendet, welche auf einem SELinux fähigen Linux Betriebssystem laufen. Über den Befehl <command>ls -Z</command> sehen Sie den SELinux Kontext von Dateien und Verzeichnissen."

#. Tag: para #, fuzzy, no-c-format -msgid "" -"SELinux contexts follow the <emphasis>SELinux user:role:type:level</" -"emphasis> syntax:" -msgstr "" -"SELinux Kontexte besitzen folgende Syntax <emphasis>SELinux user:role:type:" -"level</emphasis> " +msgid "SELinux contexts follow the <emphasis>SELinux user:role:type:level</emphasis> syntax:" +msgstr "SELinux Kontexte besitzen folgende Syntax <emphasis>SELinux user:role:type:level</emphasis> "

#. Tag: term #, no-c-format @@ -70,27 +46,12 @@

#. Tag: para #, no-c-format -msgid "" -"The SELinux user identity is an identity known to the policy that is " -"authorized for a specific set of roles, and for a specific MLS range. Each " -"Linux user is mapped to an SELinux user via SELinux policy. This allows " -"Linux users to inherit the restrictions placed on SELinux users. The mapped " -"SELinux user identity is used in the SELinux context for processes in that " -"session, in order to define what roles and levels they can enter. Run the " -"<command>semanage login -l</command> command as the Linux root user to view " -"a list of mappings between SELinux and Linux user accounts:" +msgid "The SELinux user identity is an identity known to the policy that is authorized for a specific set of roles, and for a specific MLS range. Each Linux user is mapped to an SELinux user via SELinux policy. This allows Linux users to inherit the restrictions placed on SELinux users. The mapped SELinux user identity is used in the SELinux context for processes in that session, in order to define what roles and levels they can enter. Run the <command>semanage login -l</command> command as the Linux root user to view a list of mappings between SELinux and Linux user accounts:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Output may differ slightly from system to system. The <computeroutput>Login " -"Name</computeroutput> column lists Linux users, and the " -"<computeroutput>SELinux User</computeroutput> column lists which SELinux " -"user the Linux user is mapped to. For processes, the SELinux user limits " -"which roles and levels are accessible. The last column, <computeroutput>MLS/" -"MCS Range</computeroutput>, is the level used by Multi-Level Security (MLS) " -"and Multi-Category Security (MCS). Levels are briefly discussed later." +msgid "Output may differ slightly from system to system. The <computeroutput>Login Name</computeroutput> column lists Linux users, and the <computeroutput>SELinux User</computeroutput> column lists which SELinux user the Linux user is mapped to. For processes, the SELinux user limits which roles and levels are accessible. The last column, <computeroutput>MLS/MCS Range</computeroutput>, is the level used by Multi-Level Security (MLS) and Multi-Category Security (MCS). Levels are briefly discussed later." msgstr ""

#. Tag: term @@ -100,13 +61,7 @@

#. Tag: para #, no-c-format -msgid "" -"Part of SELinux is the Role-Based Access Control (RBAC) security model. The " -"role is an attribute of RBAC. SELinux users are authorized for roles, and " -"roles are authorized for domains. The role serves as an intermediary between " -"domains and SELinux users. The roles that can be entered determine which " -"domains can be entered - ultimately, this controls which object types can be " -"accessed. This helps reduce vulnerability to privilege escalation attacks." +msgid "Part of SELinux is the Role-Based Access Control (RBAC) security model. The role is an attribute of RBAC. SELinux users are authorized for roles, and roles are authorized for domains. The role serves as an intermediary between domains and SELinux users. The roles that can be entered determine which domains can be entered - ultimately, this controls which object types can be accessed. This helps reduce vulnerability to privilege escalation attacks." msgstr ""

#. Tag: term @@ -116,12 +71,7 @@

#. Tag: para #, no-c-format -msgid "" -"The type is an attribute of Type Enforcement. The type defines a domain for " -"processes, and a type for files. SELinux policy rules define how types can " -"access each other, whether it be a domain accessing a type, or a domain " -"accessing another domain. Access is only allowed if a specific SELinux " -"policy rule exists that allows it." +msgid "The type is an attribute of Type Enforcement. The type defines a domain for processes, and a type for files. SELinux policy rules define how types can access each other, whether it be a domain accessing a type, or a domain accessing another domain. Access is only allowed if a specific SELinux policy rule exists that allows it." msgstr ""

#. Tag: term @@ -131,28 +81,12 @@

#. Tag: para #, no-c-format -msgid "" -"The level is an attribute of MLS and Multi-Category Security (MCS). An MLS " -"range is a pair of levels, written as <emphasis>lowlevel-highlevel</" -"emphasis> if the levels differ, or <emphasis>lowlevel</emphasis> if the " -"levels are identical (<computeroutput>s0-s0</computeroutput> is the same as " -"<computeroutput>s0</computeroutput>). Each level is a sensitivity-category " -"pair, with categories being optional. If there are categories, the level is " -"written as <emphasis>sensitivity:category-set</emphasis>. If there are no " -"categories, it is written as <emphasis>sensitivity</emphasis>." +msgid "The level is an attribute of MLS and Multi-Category Security (MCS). An MLS range is a pair of levels, written as <emphasis>lowlevel-highlevel</emphasis> if the levels differ, or <emphasis>lowlevel</emphasis> if the levels are identical (<computeroutput>s0-s0</computeroutput> is the same as <computeroutput>s0</computeroutput>). Each level is a sensitivity-category pair, with categories being optional. If there are categories, the level is written as <emphasis>sensitivity:category-set</emphasis>. If there are no categories, it is written as <emphasis>sensitivity</emphasis>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If the category set is a contiguous series, it can be abbreviated. For " -"example, <computeroutput>c0.c3</computeroutput> is the same as " -"<computeroutput>c0,c1,c2,c3</computeroutput>. The <filename>/etc/selinux/" -"targeted/setrans.conf</filename> file maps levels (<computeroutput>s0:c0</" -"computeroutput>) to human-readable form (ie. " -"<computeroutput>CompanyConfidential</computeroutput>). Do not edit " -"<filename>setrans.conf</filename> with a text editor: use <command>semanage</" -"command> to make changes. Refer to the" +msgid "If the category set is a contiguous series, it can be abbreviated. For example, <computeroutput>c0.c3</computeroutput> is the same as <computeroutput>c0,c1,c2,c3</computeroutput>. The <filename>/etc/selinux/targeted/setrans.conf</filename> file maps levels (<computeroutput>s0:c0</computeroutput>) to human-readable form (ie. <computeroutput>CompanyConfidential</computeroutput>). Do not edit <filename>setrans.conf</filename> with a text editor: use <command>semanage</command> to make changes. Refer to the" msgstr ""

#. Tag: refentrytitle @@ -162,29 +96,12 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page for further information. In Fedora, targeted policy enforces " -"MCS, and in MCS, there is just one sensitivity, <computeroutput>s0</" -"computeroutput>. MCS in Fedora supports 1024 different categories: " -"<computeroutput>c0</computeroutput> through to <computeroutput>c1023</" -"computeroutput>. <computeroutput>s0-s0:c0.c1023</computeroutput> is " -"sensitivity <computeroutput>s0</computeroutput> and authorized for all " -"categories." +msgid "manual page for further information. In Fedora, targeted policy enforces MCS, and in MCS, there is just one sensitivity, <computeroutput>s0</computeroutput>. MCS in Fedora supports 1024 different categories: <computeroutput>c0</computeroutput> through to <computeroutput>c1023</computeroutput>. <computeroutput>s0-s0:c0.c1023</computeroutput> is sensitivity <computeroutput>s0</computeroutput> and authorized for all categories." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"MLS enforces the <ulink url="http://en.wikipedia.org/wiki/Bell-" -"LaPadula_model">Bell-La Padula Mandatory Access Model</ulink>, and is used " -"in Labeled Security Protection Profile (LSPP) environments. To use MLS " -"restrictions, install the <package>selinux-policy-mls</package> package, and " -"configure MLS to be the default SELinux policy. The MLS policy shipped with " -"Fedora omits many program domains that were not part of the evaluated " -"configuration, and therefore, MLS on a desktop workstation is unusable (no " -"support for the X Window System); however, an MLS policy from the <ulink url=" -""http://oss.tresys.com/projects/refpolicy%5C%22%3Eupstream SELinux Reference " -"Policy</ulink> can be built that includes all program domains." +msgid "MLS enforces the <ulink url="http://en.wikipedia.org/wiki/Bell-LaPadula_model%5C%22%3EBell-La Padula Mandatory Access Model</ulink>, and is used in Labeled Security Protection Profile (LSPP) environments. To use MLS restrictions, install the <package>selinux-policy-mls</package> package, and configure MLS to be the default SELinux policy. The MLS policy shipped with Fedora omits many program domains that were not part of the evaluated configuration, and therefore, MLS on a desktop workstation is unusable (no support for the X Window System); however, an MLS policy from the <ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3Eupstream SELinux Reference Policy</ulink> can be built that includes all program domains." msgstr ""

#. Tag: title @@ -194,127 +111,57 @@

#. Tag: para #, no-c-format -msgid "" -"A process in one domain transitions to another domain by executing an " -"application that has the <computeroutput>entrypoint</computeroutput> type " -"for the new domain. The <computeroutput>entrypoint</computeroutput> " -"permission is used in SELinux policy, and controls which applications can be " -"used to enter a domain. The following example demonstrates a domain " -"transition:" +msgid "A process in one domain transitions to another domain by executing an application that has the <computeroutput>entrypoint</computeroutput> type for the new domain. The <computeroutput>entrypoint</computeroutput> permission is used in SELinux policy, and controls which applications can be used to enter a domain. The following example demonstrates a domain transition:" msgstr ""

#. Tag: para #, fuzzy, no-c-format -msgid "" -"A user wants to change their password. To do this, they run the " -"<command>passwd</command> application. The <filename>/usr/bin/passwd</" -"filename> executable is labeled with the <computeroutput>passwd_exec_t</" -"computeroutput> type:" -msgstr "" -"Die <application>passwd</application> Anwendung greift auf die Datei " -"<filename>/etc/shadow</filename> zu, welche mit dem Typ " -"<computeroutput>shadow_t</computeroutput> bezeichnet ist:" +msgid "A user wants to change their password. To do this, they run the <command>passwd</command> application. The <filename>/usr/bin/passwd</filename> executable is labeled with the <computeroutput>passwd_exec_t</computeroutput> type:" +msgstr "Die <application>passwd</application> Anwendung greift auf die Datei <filename>/etc/shadow</filename> zu, welche mit dem Typ <computeroutput>shadow_t</computeroutput> bezeichnet ist:"

#. Tag: para #, fuzzy, no-c-format -msgid "" -"The <application>passwd</application> application accesses <filename>/etc/" -"shadow</filename>, which is labeled with the <computeroutput>shadow_t</" -"computeroutput> type:" -msgstr "" -"Die <application>passwd</application> Anwendung greift auf die Datei " -"<filename>/etc/shadow</filename> zu, welche mit dem Typ " -"<computeroutput>shadow_t</computeroutput> bezeichnet ist:" +msgid "The <application>passwd</application> application accesses <filename>/etc/shadow</filename>, which is labeled with the <computeroutput>shadow_t</computeroutput> type:" +msgstr "Die <application>passwd</application> Anwendung greift auf die Datei <filename>/etc/shadow</filename> zu, welche mit dem Typ <computeroutput>shadow_t</computeroutput> bezeichnet ist:"

#. Tag: para #, no-c-format -msgid "" -"An SELinux policy rule states that processes running in the " -"<computeroutput>passwd_t</computeroutput> domain are allowed to read and " -"write to files labeled with the <computeroutput>shadow_t</computeroutput> " -"type. The <computeroutput>shadow_t</computeroutput> type is only applied to " -"files that are required for a password change. This includes <filename>/etc/" -"gshadow</filename>, <filename>/etc/shadow</filename>, and their backup files." +msgid "An SELinux policy rule states that processes running in the <computeroutput>passwd_t</computeroutput> domain are allowed to read and write to files labeled with the <computeroutput>shadow_t</computeroutput> type. The <computeroutput>shadow_t</computeroutput> type is only applied to files that are required for a password change. This includes <filename>/etc/gshadow</filename>, <filename>/etc/shadow</filename>, and their backup files." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"An SELinux policy rule states that the <computeroutput>passwd_t</" -"computeroutput> domain has <computeroutput>entrypoint</computeroutput> " -"permission to the <computeroutput>passwd_exec_t</computeroutput> type." +msgid "An SELinux policy rule states that the <computeroutput>passwd_t</computeroutput> domain has <computeroutput>entrypoint</computeroutput> permission to the <computeroutput>passwd_exec_t</computeroutput> type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When a user runs the <command>/usr/bin/passwd</command> application, the " -"user's shell process transitions to the <computeroutput>passwd_t</" -"computeroutput> domain. With SELinux, since the default action is to deny, " -"and a rule exists that allows (among other things) applications running in " -"the <computeroutput>passwd_t</computeroutput> domain to access files labeled " -"with the <computeroutput>shadow_t</computeroutput> type, the " -"<application>passwd</application> application is allowed to access " -"<filename>/etc/shadow</filename>, and update the user's password." +msgid "When a user runs the <command>/usr/bin/passwd</command> application, the user's shell process transitions to the <computeroutput>passwd_t</computeroutput> domain. With SELinux, since the default action is to deny, and a rule exists that allows (among other things) applications running in the <computeroutput>passwd_t</computeroutput> domain to access files labeled with the <computeroutput>shadow_t</computeroutput> type, the <application>passwd</application> application is allowed to access <filename>/etc/shadow</filename>, and update the user's password." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This example is not exhaustive, and is used as a basic example to explain " -"domain transition. Although there is an actual rule that allows subjects " -"running in the <computeroutput>passwd_t</computeroutput> domain to access " -"objects labeled with the <computeroutput>shadow_t</computeroutput> file " -"type, other SELinux policy rules must be met before the subject can " -"transition to a new domain. In this example, Type Enforcement ensures:" +msgid "This example is not exhaustive, and is used as a basic example to explain domain transition. Although there is an actual rule that allows subjects running in the <computeroutput>passwd_t</computeroutput> domain to access objects labeled with the <computeroutput>shadow_t</computeroutput> file type, other SELinux policy rules must be met before the subject can transition to a new domain. In this example, Type Enforcement ensures:" msgstr ""

#. Tag: para #, fuzzy, no-c-format -msgid "" -"the <computeroutput>passwd_t</computeroutput> domain can only be entered by " -"executing an application labeled with the <computeroutput>passwd_exec_t</" -"computeroutput> type; can only execute from authorized shared libraries, " -"such as the <computeroutput>lib_t</computeroutput> type; and can not execute " -"any other applications." -msgstr "" -"die <computeroutput>passwd_t</computeroutput> Domäne ist nur zugänglich, " -"wenn Sie von einem Programm ausgeführt wird, welches mit dem Typen " -"<computeroutput>passwd_exec_t</computeroutput> gekennzeichnet ist; kann nur " -"von authorisierten Bibliotheken ausgeführt werden, wie zum Beispiel dem " -"Typen <computeroutput>lib_t</computeroutput>, und kann keine anderen " -"Anwendung ausführen." +msgid "the <computeroutput>passwd_t</computeroutput> domain can only be entered by executing an application labeled with the <computeroutput>passwd_exec_t</computeroutput> type; can only execute from authorized shared libraries, such as the <computeroutput>lib_t</computeroutput> type; and can not execute any other applications." +msgstr "die <computeroutput>passwd_t</computeroutput> Domäne ist nur zugänglich, wenn Sie von einem Programm ausgeführt wird, welches mit dem Typen <computeroutput>passwd_exec_t</computeroutput> gekennzeichnet ist; kann nur von authorisierten Bibliotheken ausgeführt werden, wie zum Beispiel dem Typen <computeroutput>lib_t</computeroutput>, und kann keine anderen Anwendung ausführen."

#. Tag: para #, no-c-format -msgid "" -"only authorized domains, such as <computeroutput>passwd_t</computeroutput>, " -"can write to files labeled with the <computeroutput>shadow_t</" -"computeroutput> type. Even if other processes are running with superuser " -"privileges, those processes can not write to files labeled with the " -"<computeroutput>shadow_t</computeroutput> type, as they are not running in " -"the <computeroutput>passwd_t</computeroutput> domain." +msgid "only authorized domains, such as <computeroutput>passwd_t</computeroutput>, can write to files labeled with the <computeroutput>shadow_t</computeroutput> type. Even if other processes are running with superuser privileges, those processes can not write to files labeled with the <computeroutput>shadow_t</computeroutput> type, as they are not running in the <computeroutput>passwd_t</computeroutput> domain." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"only authorized domains can transition to the <computeroutput>passwd_t</" -"computeroutput> domain. For example, the <systemitem class="daemon" -"">sendmail</systemitem> process running in the <computeroutput>sendmail_t</" -"computeroutput> domain does not have a legitimate reason to execute " -"<command>passwd</command>; therefore, it can never transition to the " -"<computeroutput>passwd_t</computeroutput> domain." +msgid "only authorized domains can transition to the <computeroutput>passwd_t</computeroutput> domain. For example, the <systemitem class="daemon">sendmail</systemitem> process running in the <computeroutput>sendmail_t</computeroutput> domain does not have a legitimate reason to execute <command>passwd</command>; therefore, it can never transition to the <computeroutput>passwd_t</computeroutput> domain." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"processes running in the <computeroutput>passwd_t</computeroutput> domain " -"can only read and write to authorized types, such as files labeled with the " -"<computeroutput>etc_t</computeroutput> or <computeroutput>shadow_t</" -"computeroutput> types. This prevents the <application>passwd</application> " -"application from being tricked into reading or writing arbitrary files." +msgid "processes running in the <computeroutput>passwd_t</computeroutput> domain can only read and write to authorized types, such as files labeled with the <computeroutput>etc_t</computeroutput> or <computeroutput>shadow_t</computeroutput> types. This prevents the <application>passwd</application> application from being tricked into reading or writing arbitrary files." msgstr ""

#. Tag: title @@ -324,73 +171,42 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>ps -eZ</command> command to view the SELinux context for " -"processes. For example:" -msgstr "" -"Benutzen Sie den Befehl <command>ps -eZ</command> um den SELinux Kontekt für " -"Prozesse zu sehen. Zum Beispiel:" +msgid "Use the <command>ps -eZ</command> command to view the SELinux context for processes. For example:" +msgstr "Benutzen Sie den Befehl <command>ps -eZ</command> um den SELinux Kontekt für Prozesse zu sehen. Zum Beispiel:"

#. Tag: para #, fuzzy, no-c-format -msgid "" -"Open a terminal, such as <menuchoice><guimenu>Applications</" -"guimenu><guisubmenu>System Tools</guisubmenu><guimenuitem>Terminal</" -"guimenuitem></menuchoice>." -msgstr "" -"Öffnen Sie eine Kommandozeile, wie zum Beispiel " -"<menuchoice><guimenu>Programme</guimenu><guisubmenu>System Tools</" -"guisubmenu><guimenuitem>Terminal</guimenuitem></menuchoice>." +msgid "Open a terminal, such as <menuchoice><guimenu>Applications</guimenu><guisubmenu>System Tools</guisubmenu><guimenuitem>Terminal</guimenuitem></menuchoice>." +msgstr "Öffnen Sie eine Kommandozeile, wie zum Beispiel <menuchoice><guimenu>Programme</guimenu><guisubmenu>System Tools</guisubmenu><guimenuitem>Terminal</guimenuitem></menuchoice>."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>/usr/bin/passwd</command> command. Do not enter a new " -"password." -msgstr "" -"Führen Sie den Befehl <command>/usr/bin/passwd</command> aus. Geben Sie kein " -"neues Passwort ein." +msgid "Run the <command>/usr/bin/passwd</command> command. Do not enter a new password." +msgstr "Führen Sie den Befehl <command>/usr/bin/passwd</command> aus. Geben Sie kein neues Passwort ein."

#. Tag: para #, no-c-format -msgid "" -"Open a new tab, or another terminal, and run the <command>ps -eZ | grep " -"passwd</command> command. The output is similar to the following:" +msgid "Open a new tab, or another terminal, and run the <command>ps -eZ | grep passwd</command> command. The output is similar to the following:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In the first tab/terminal, press <userinput>Ctrl+C</userinput> to cancel the " -"<application>passwd</application> application." +msgid "In the first tab/terminal, press <userinput>Ctrl+C</userinput> to cancel the <application>passwd</application> application." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, when the <filename>/usr/bin/passwd</filename> application " -"(labeled with the <computeroutput>passwd_exec_t</computeroutput> type) is " -"executed, the user's shell process transitions to the " -"<computeroutput>passwd_t</computeroutput> domain. Remember: the type defines " -"a domain for processes, and a type for files." +msgid "In this example, when the <filename>/usr/bin/passwd</filename> application (labeled with the <computeroutput>passwd_exec_t</computeroutput> type) is executed, the user's shell process transitions to the <computeroutput>passwd_t</computeroutput> domain. Remember: the type defines a domain for processes, and a type for files." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Use the <command>ps -eZ</command> command to view the SELinux contexts for " -"running processes. The following is a limited example of the output, and may " -"differ on your system:" -msgstr "" -"Führen Sie den Befehl <command>ps -eZ</command> aus um die SELinux Kontexte " -"für laufende Prozesse zu sehen. Nachfolgend sehen Sie ein eingeschränktes " -"Beispiel für die Ausgabe, dies kann auf Ihrem System etwas anders aussehen:" +msgid "Use the <command>ps -eZ</command> command to view the SELinux contexts for running processes. The following is a limited example of the output, and may differ on your system:" +msgstr "Führen Sie den Befehl <command>ps -eZ</command> aus um die SELinux Kontexte für laufende Prozesse zu sehen. Nachfolgend sehen Sie ein eingeschränktes Beispiel für die Ausgabe, dies kann auf Ihrem System etwas anders aussehen:"

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>system_r</computeroutput> role is used for system " -"processes, such as daemons. Type Enforcement then separates each domain." +msgid "The <computeroutput>system_r</computeroutput> role is used for system processes, such as daemons. Type Enforcement then separates each domain." msgstr ""

#. Tag: title @@ -400,26 +216,12 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>id -Z</command> command to view the SELinux context " -"associated with your Linux user:" -msgstr "" -"Führen Sie den Befehl <command>id -Z</command> aus um den SELinux Kontext zu " -"sehen, welcher Ihrem Linux Benutzer zugehörig ist." +msgid "Use the <command>id -Z</command> command to view the SELinux context associated with your Linux user:" +msgstr "Führen Sie den Befehl <command>id -Z</command> aus um den SELinux Kontext zu sehen, welcher Ihrem Linux Benutzer zugehörig ist."

#. Tag: para #, no-c-format -msgid "" -"In Fedora, Linux users run unconfined by default. This SELinux context shows " -"that the Linux user is mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user, running as the <computeroutput>unconfined_r</" -"computeroutput> role, and is running in the <computeroutput>unconfined_t</" -"computeroutput> domain. <computeroutput>s0-s0</computeroutput> is an MLS " -"range, which in this case, is the same as just <computeroutput>s0</" -"computeroutput>. The categories the user has access to is defined by " -"<computeroutput>c0.c1023</computeroutput>, which is all categories " -"(<computeroutput>c0</computeroutput> through to <computeroutput>c1023</" -"computeroutput>)." +msgid "In Fedora, Linux users run unconfined by default. This SELinux context shows that the Linux user is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user, running as the <computeroutput>unconfined_r</computeroutput> role, and is running in the <computeroutput>unconfined_t</computeroutput> domain. <computeroutput>s0-s0</computeroutput> is an MLS range, which in this case, is the same as just <computeroutput>s0</computeroutput>. The categories the user has access to is defined by <computeroutput>c0.c1023</computeroutput>, which is all categories (<computeroutput>c0</computeroutput> through to <computeroutput>c1023</computeroutput>)." msgstr ""

#, fuzzy

Modified: community/branches/f13/de-DE/Further_Information.po =================================================================== --- community/branches/f13/de-DE/Further_Information.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Further_Information.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -30,23 +31,17 @@

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://fedoraproject.org/wiki/GeertWarrink%5C%22%3EGeert Warrink</" -"ulink> (translation - Dutch)" +msgid "<ulink url="http://fedoraproject.org/wiki/GeertWarrink%5C%22%3EGeert Warrink</ulink> (translation - Dutch)" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://fedoraproject.org/wiki/User:Beckerde%5C%22%3EDomingo Becker</" -"ulink> (translation - Spanish)" +msgid "<ulink url="http://fedoraproject.org/wiki/User:Beckerde%5C%22%3EDomingo Becker</ulink> (translation - Spanish)" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://fedoraproject.org/wiki/User:Logan%5C%22%3EDaniel Cabrera</" -"ulink> (translation - Spanish)" +msgid "<ulink url="http://fedoraproject.org/wiki/User:Logan%5C%22%3EDaniel Cabrera</ulink> (translation - Spanish)" msgstr ""

#. Tag: title @@ -61,43 +56,27 @@

#. Tag: para #, no-c-format -msgid "" -"From the NSA <ulink url="http://www.nsa.gov/research/selinux/contrib.shtml" -"">Contributors to SELinux</ulink> page:" +msgid "From the NSA <ulink url="http://www.nsa.gov/research/selinux/contrib.shtml%5C%22%3EContributors to SELinux</ulink> page:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<emphasis>Researchers in NSA's National Information Assurance Research " -"Laboratory (NIARL) designed and implemented flexible mandatory access " -"controls in the major subsystems of the Linux kernel and implemented the new " -"operating system components provided by the Flask architecture, namely the " -"security server and the access vector cache. The NSA researchers reworked " -"the LSM-based SELinux for inclusion in Linux 2.6. NSA has also led the " -"development of similar controls for the X Window System (XACE/XSELinux) and " -"for Xen (XSM/Flask).</emphasis>" +msgid "<emphasis>Researchers in NSA's National Information Assurance Research Laboratory (NIARL) designed and implemented flexible mandatory access controls in the major subsystems of the Linux kernel and implemented the new operating system components provided by the Flask architecture, namely the security server and the access vector cache. The NSA researchers reworked the LSM-based SELinux for inclusion in Linux 2.6. NSA has also led the development of similar controls for the X Window System (XACE/XSELinux) and for Xen (XSM/Flask).</emphasis>" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Main SELinux website: <ulink url="http://www.nsa.gov/research/selinux/index." -"shtml" />." +msgid "Main SELinux website: <ulink url="http://www.nsa.gov/research/selinux/index.shtml%5C" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux documentation: <ulink url="http://www.nsa.gov/research/selinux/docs." -"shtml" />." +msgid "SELinux documentation: <ulink url="http://www.nsa.gov/research/selinux/docs.shtml%5C" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux background: <ulink url="http://www.nsa.gov/research/selinux/" -"background.shtml" />." +msgid "SELinux background: <ulink url="http://www.nsa.gov/research/selinux/background.shtml%5C" />." msgstr ""

#. Tag: title @@ -107,23 +86,17 @@

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> are the " -"upstream for:" +msgid "<ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> are the upstream for:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://userspace.selinuxproject.org/trac/%5C%22%3ESELinux userland " -"libraries and tools</ulink>." +msgid "<ulink url="http://userspace.selinuxproject.org/trac/%5C%22%3ESELinux userland libraries and tools</ulink>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference " -"Policy</ulink>." +msgid "<ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference Policy</ulink>." msgstr ""

#. Tag: title @@ -138,8 +111,7 @@

#. Tag: para #, no-c-format -msgid "" -"Planet SELinux (blogs): <ulink url="http://selinuxnews.org/planet/%5C" />." +msgid "Planet SELinux (blogs): <ulink url="http://selinuxnews.org/planet/%5C" />." msgstr ""

#. Tag: title @@ -154,9 +126,7 @@

#. Tag: para #, no-c-format -msgid "" -"User resources, including links to documentation, mailing lists, websites, " -"and tools: <ulink url="http://selinuxproject.org/page/User_Resources%5C" />." +msgid "User resources, including links to documentation, mailing lists, websites, and tools: <ulink url="http://selinuxproject.org/page/User_Resources%5C" />." msgstr ""

#. Tag: title @@ -166,21 +136,12 @@

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://www.redhat.com/docs/en-US/" -"Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/index.html">Red Hat " -"Enterprise Linux Deployment Guide</ulink> contains an SELinux <ulink url=" -""http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/" -"Deployment_Guide/selg-chapter-0054.html">References</ulink> section, that " -"has links to SELinux tutorials, general information, and the technology " -"behind SELinux." +msgid "The <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux Deployment Guide</ulink> contains an SELinux <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen...</ulink> section, that has links to SELinux tutorials, general information, and the technology behind SELinux." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/" -"selinux-guide/index.html">Red Hat Enterprise Linux 4 SELinux Guide</ulink>." +msgid "The <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/in... Hat Enterprise Linux 4 SELinux Guide</ulink>." msgstr ""

#. Tag: title @@ -191,36 +152,22 @@ #. Tag: para #, fuzzy, no-c-format msgid "Main page: <ulink url="http://fedoraproject.org/wiki/SELinux%5C" />." -msgstr "" -"Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/" -"selinux-faq-fc5/"></ulink>." +msgstr "Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3E</ulink>."

#. Tag: para #, fuzzy, no-c-format -msgid "" -"Troubleshooting: <ulink url="http://fedoraproject.org/wiki/SELinux/" -"Troubleshooting" />." -msgstr "" -"Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/" -"selinux-faq-fc5/"></ulink>." +msgid "Troubleshooting: <ulink url="http://fedoraproject.org/wiki/SELinux/Troubleshooting%5C" />." +msgstr "Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3E</ulink>."

#. Tag: para #, fuzzy, no-c-format -msgid "" -"Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/" -"selinux-faq-fc5/" />." -msgstr "" -"Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/" -"selinux-faq-fc5/"></ulink>." +msgid "Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C" />." +msgstr "Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3E</ulink>."

#. Tag: para #, fuzzy, no-c-format -msgid "" -"SELinux Managing Confined Services Guide: <ulink url="http://docs." -"fedoraproject.org/selinux-managing-confined-services-guide/" />" -msgstr "" -"Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/" -"selinux-faq-fc5/"></ulink>." +msgid "SELinux Managing Confined Services Guide: <ulink url="http://docs.fedoraproject.org/selinux-managing-confined-services-guide/%5C" />" +msgstr "Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3E</ulink>."

#. Tag: title #, no-c-format

Modified: community/branches/f13/de-DE/Introduction.po =================================================================== --- community/branches/f13/de-DE/Introduction.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Introduction.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -25,125 +26,42 @@

#. Tag: para #, no-c-format -msgid "" -"Security-Enhanced Linux (SELinux) is an implementation of a " -"<firstterm>mandatory access control</firstterm> mechanism in the Linux " -"kernel, checking for allowed operations after standard " -"<firstterm>discretionary access controls</firstterm> are checked. It was " -"created by the National Security Agency and can enforce rules on files and " -"processes in a Linux system, and on their actions, based on defined policy." +msgid "Security-Enhanced Linux (SELinux) is an implementation of a <firstterm>mandatory access control</firstterm> mechanism in the Linux kernel, checking for allowed operations after standard <firstterm>discretionary access controls</firstterm> are checked. It was created by the National Security Agency and can enforce rules on files and processes in a Linux system, and on their actions, based on defined policy." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When using SELinux, files, including directories and devices, are referred " -"to as objects. Processes, such as a user running a command or the <trademark " -"class="registered">Mozilla</trademark><trademark class="registered"> " -"Firefox</trademark> application, are referred to as subjects. Most operating " -"systems use a Discretionary Access Control (DAC) system that controls how " -"subjects interact with objects, and how subjects interact with each other. " -"On operating systems using DAC, users control the permissions of files " -"(objects) that they own. For example, on <trademark class="registered" -"">Linux</trademark> operating systems, users could make their home " -"directories world-readable, giving users and processes (subjects) access to " -"potentially sensitive information, with no further protection over this " -"unwanted action." +msgid "When using SELinux, files, including directories and devices, are referred to as objects. Processes, such as a user running a command or the <trademark class="registered">Mozilla</trademark><trademark class="registered"> Firefox</trademark> application, are referred to as subjects. Most operating systems use a Discretionary Access Control (DAC) system that controls how subjects interact with objects, and how subjects interact with each other. On operating systems using DAC, users control the permissions of files (objects) that they own. For example, on <trademark class="registered">Linux</trademark> operating systems, users could make their home directories world-readable, giving users and processes (subjects) access to potentially sensitive information, with no further protection over this unwanted action." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Relying on DAC mechanisms alone is fundamentally inadequate for strong " -"system security. DAC access decisions are only based on user identity and " -"ownership, ignoring other security-relevant information such as the role of " -"the user, the function and trustworthiness of the program, and the " -"sensitivity and integrity of the data. Each user has complete discretion " -"over their files, making it impossible to enforce a system-wide security " -"policy. Furthermore, every program run by a user inherits all of the " -"permissions granted to the user and is free to change access to the user's " -"files, so no protection is provided against malicious software. Many system " -"services and privileged programs must run with coarse-grained privileges " -"that far exceed their requirements, so that a flaw in any one of these " -"programs could be exploited to obtain further system access.<footnote> " -"<para> "Integrating Flexible Support for Security Policies into the Linux " -"Operating System", by Peter Loscocco and Stephen Smalley. This paper was " -"originally prepared for the National Security Agency and is, consequently, " -"in the public domain. Refer to the <ulink url="http://www.nsa.gov/research/" -"_files/selinux/papers/freenix01/index.shtml">original paper</ulink> for " -"details and the document as it was first released. Any edits and changes " -"were done by Murray McAllister. </para> </footnote>" +msgid "Relying on DAC mechanisms alone is fundamentally inadequate for strong system security. DAC access decisions are only based on user identity and ownership, ignoring other security-relevant information such as the role of the user, the function and trustworthiness of the program, and the sensitivity and integrity of the data. Each user has complete discretion over their files, making it impossible to enforce a system-wide security policy. Furthermore, every program run by a user inherits all of the permissions granted to the user and is free to change access to the user's files, so no protection is provided against malicious software. Many system services and privileged programs must run with coarse-grained privileges that far exceed their requirements, so that a flaw in any one of these programs could be exploited to obtain further system access.<footnote> <para> "Integrating Flexible Support for Security Policies into the Linux Operating System", by Peter Loscocco and Stephen Smalley. This paper was originally prepared for the National Security Agency and is, consequently, in the public domain. Refer to the <ulink url="http://www.nsa.gov/research/_files/selinux/papers/freenix01/index.shtml%5C%2... paper</ulink> for details and the document as it was first released. Any edits and changes were done by Murray McAllister. </para> </footnote>" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following is an example of permissions used on Linux operating systems " -"that do not run Security-Enhanced Linux (SELinux). The permissions and " -"output in these examples may differ from your system. Use the <command>ls -" -"l</command> command to view file permissions:" +msgid "The following is an example of permissions used on Linux operating systems that do not run Security-Enhanced Linux (SELinux). The permissions and output in these examples may differ from your system. Use the <command>ls -l</command> command to view file permissions:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The first three permission bits, <computeroutput>rwx</computeroutput>, " -"control the access the Linux <computeroutput>user1</computeroutput> user (in " -"this case, the owner) has to <filename>file1</filename>. The next three " -"permission bits, <computeroutput>rw-</computeroutput>, control the access " -"the Linux <computeroutput>group1</computeroutput> group has to " -"<filename>file1</filename>. The last three permission bits, " -"<computeroutput>r--</computeroutput>, control the access everyone else has " -"to <filename>file1</filename>, which includes all users and processes." +msgid "The first three permission bits, <computeroutput>rwx</computeroutput>, control the access the Linux <computeroutput>user1</computeroutput> user (in this case, the owner) has to <filename>file1</filename>. The next three permission bits, <computeroutput>rw-</computeroutput>, control the access the Linux <computeroutput>group1</computeroutput> group has to <filename>file1</filename>. The last three permission bits, <computeroutput>r--</computeroutput>, control the access everyone else has to <filename>file1</filename>, which includes all users and processes." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Security-Enhanced Linux (SELinux) adds Mandatory Access Control (MAC) to the " -"Linux kernel, and is enabled by default in Fedora. A general purpose MAC " -"architecture needs the ability to enforce an administratively-set security " -"policy over all processes and files in the system, basing decisions on " -"labels containing a variety of security-relevant information. When properly " -"implemented, it enables a system to adequately defend itself and offers " -"critical support for application security by protecting against the " -"tampering with, and bypassing of, secured applications. MAC provides strong " -"separation of applications that permits the safe execution of untrustworthy " -"applications. Its ability to limit the privileges associated with executing " -"processes limits the scope of potential damage that can result from the " -"exploitation of vulnerabilities in applications and system services. MAC " -"enables information to be protected from legitimate users with limited " -"authorization as well as from authorized users who have unwittingly executed " -"malicious applications.<footnote> <para> "Meeting Critical Security " -"Objectives with Security-Enhanced Linux", by Peter Loscocco and Stephen " -"Smalley. This paper was originally prepared for the National Security Agency " -"and is, consequently, in the public domain. Refer to the <ulink url="http://" -"www.nsa.gov/research/_files/selinux/papers/ottawa01/index.shtml">original " -"paper</ulink> for details and the document as it was first released. Any " -"edits and changes were done by Murray McAllister. </para> </footnote>" +msgid "Security-Enhanced Linux (SELinux) adds Mandatory Access Control (MAC) to the Linux kernel, and is enabled by default in Fedora. A general purpose MAC architecture needs the ability to enforce an administratively-set security policy over all processes and files in the system, basing decisions on labels containing a variety of security-relevant information. When properly implemented, it enables a system to adequately defend itself and offers critical support for application security by protecting against the tampering with, and bypassing of, secured applications. MAC provides strong separation of applications that permits the safe execution of untrustworthy applications. Its ability to limit the privileges associated with executing processes limits the scope of potential damage that can result from the exploitation of vulnerabilities in applications and system services. MAC enables information to be protected from legitimate users with limited authorization as well as f rom authorized users who have unwittingly executed malicious applications.<footnote> <para> "Meeting Critical Security Objectives with Security-Enhanced Linux", by Peter Loscocco and Stephen Smalley. This paper was originally prepared for the National Security Agency and is, consequently, in the public domain. Refer to the <ulink url="http://www.nsa.gov/research/_files/selinux/papers/ottawa01/index.shtml%5C%22... paper</ulink> for details and the document as it was first released. Any edits and changes were done by Murray McAllister. </para> </footnote>" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following is an example of the labels containing security-relevant " -"information that are used on processes, Linux users, and files, on Linux " -"operating systems that run SELinux. This information is called the SELinux " -"<emphasis>context</emphasis>, and is viewed using the <command>ls -Z</" -"command> command:" +msgid "The following is an example of the labels containing security-relevant information that are used on processes, Linux users, and files, on Linux operating systems that run SELinux. This information is called the SELinux <emphasis>context</emphasis>, and is viewed using the <command>ls -Z</command> command:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, SELinux provides a user (<computeroutput>unconfined_u</" -"computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type " -"(<computeroutput>user_home_t</computeroutput>), and a level " -"(<computeroutput>s0</computeroutput>). This information is used to make " -"access control decisions. With DAC, access is controlled based only on Linux " -"user and group IDs. It is important to remember that SELinux policy rules " -"are checked <emphasis>after</emphasis> DAC rules. SELinux policy rules are " -"not used if DAC rules deny access first." +msgid "In this example, SELinux provides a user (<computeroutput>unconfined_u</computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type (<computeroutput>user_home_t</computeroutput>), and a level (<computeroutput>s0</computeroutput>). This information is used to make access control decisions. With DAC, access is controlled based only on Linux user and group IDs. It is important to remember that SELinux policy rules are checked <emphasis>after</emphasis> DAC rules. SELinux policy rules are not used if DAC rules deny access first." msgstr ""

#. Tag: title @@ -153,11 +71,7 @@

#. Tag: para #, no-c-format -msgid "" -"On Linux operating systems that run SELinux, there are Linux users as well " -"as SELinux users. SELinux users are part of SELinux policy. Linux users are " -"mapped to SELinux users. To avoid confusion, this guide uses "Linux user" " -"and "SELinux user" to differentiate between the two." +msgid "On Linux operating systems that run SELinux, there are Linux users as well as SELinux users. SELinux users are part of SELinux policy. Linux users are mapped to SELinux users. To avoid confusion, this guide uses "Linux user" and "SELinux user" to differentiate between the two." msgstr ""

#. Tag: title @@ -167,51 +81,27 @@

#. Tag: para #, no-c-format -msgid "" -"All processes and files are labeled with a type. A type defines a domain for " -"processes, and a type for files. Processes are separated from each other by " -"running in their own domains, and SELinux policy rules define how processes " -"interact with files, as well as how processes interact with each other. " -"Access is only allowed if an SELinux policy rule exists that specifically " -"allows it." +msgid "All processes and files are labeled with a type. A type defines a domain for processes, and a type for files. Processes are separated from each other by running in their own domains, and SELinux policy rules define how processes interact with files, as well as how processes interact with each other. Access is only allowed if an SELinux policy rule exists that specifically allows it." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Fine-grained access control. Stepping beyond traditional <trademark class=" -""registered">UNIX</trademark> permissions that are controlled at user " -"discretion and based on Linux user and group IDs, SELinux access decisions " -"are based on all available information, such as an SELinux user, role, type, " -"and, optionally, a level." +msgid "Fine-grained access control. Stepping beyond traditional <trademark class="registered">UNIX</trademark> permissions that are controlled at user discretion and based on Linux user and group IDs, SELinux access decisions are based on all available information, such as an SELinux user, role, type, and, optionally, a level." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux policy is administratively-defined, enforced system-wide, and is not " -"set at user discretion." +msgid "SELinux policy is administratively-defined, enforced system-wide, and is not set at user discretion." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Reduced vulnerability to privilege escalation attacks. One example: since " -"processes run in domains, and are therefore separated from each other, and " -"because SELinux policy rules define how processes access files and other " -"processes, if a process is compromised, the attacker only has access to the " -"normal functions of that process, and to files the process has been " -"configured to have access to. For example, if the Apache HTTP Server is " -"compromised, an attacker can not use that process to read files in user home " -"directories, unless a specific SELinux policy rule was added or configured " -"to allow such access." +msgid "Reduced vulnerability to privilege escalation attacks. One example: since processes run in domains, and are therefore separated from each other, and because SELinux policy rules define how processes access files and other processes, if a process is compromised, the attacker only has access to the normal functions of that process, and to files the process has been configured to have access to. For example, if the Apache HTTP Server is compromised, an attacker can not use that process to read files in user home directories, unless a specific SELinux policy rule was added or configured to allow such access." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux can be used to enforce data confidentiality and integrity, as well " -"as protecting processes from untrusted inputs." +msgid "SELinux can be used to enforce data confidentiality and integrity, as well as protecting processes from untrusted inputs." msgstr ""

#. Tag: para @@ -236,11 +126,7 @@

#. Tag: para #, no-c-format -msgid "" -"SELinux is designed to enhance existing security solutions, not replace " -"them. Even when running SELinux, continue to follow good security practices, " -"such as keeping software up-to-date, using hard-to-guess passwords, " -"firewalls, and so on." +msgid "SELinux is designed to enhance existing security solutions, not replace them. Even when running SELinux, continue to follow good security practices, such as keeping software up-to-date, using hard-to-guess passwords, firewalls, and so on." msgstr ""

#. Tag: title @@ -255,101 +141,42 @@

#. Tag: para #, no-c-format -msgid "" -"The default action is deny. If an SELinux policy rule does not exist to " -"allow access, such as for a process opening a file, access is denied." +msgid "The default action is deny. If an SELinux policy rule does not exist to allow access, such as for a process opening a file, access is denied." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux can confine Linux users. A number of confined SELinux users exist in " -"SELinux policy. Linux users can be mapped to confined SELinux users to take " -"advantage of the security rules and mechanisms applied to them. For example, " -"mapping a Linux user to the SELinux user_u user, results in a Linux user " -"that is not able to run (unless configured otherwise) set user ID (setuid) " -"applications, such as <command>sudo</command> and <command>su</command>, as " -"well as preventing them from executing files and applications in their home " -"directory - if configured, this prevents users from executing malicious " -"files from their home directories." +msgid "SELinux can confine Linux users. A number of confined SELinux users exist in SELinux policy. Linux users can be mapped to confined SELinux users to take advantage of the security rules and mechanisms applied to them. For example, mapping a Linux user to the SELinux user_u user, results in a Linux user that is not able to run (unless configured otherwise) set user ID (setuid) applications, such as <command>sudo</command> and <command>su</command>, as well as preventing them from executing files and applications in their home directory - if configured, this prevents users from executing malicious files from their home directories." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Process separation is used. Processes run in their own domains, preventing " -"processes from accessing files used by other processes, as well as " -"preventing processes from accessing other processes. For example, when " -"running SELinux, unless otherwise configured, an attacker can not compromise " -"a Samba server, and then use that Samba server as an attack vector to read " -"and write to files used by other processes, such as databases used by " -"<trademark class="registered">MySQL</trademark>." +msgid "Process separation is used. Processes run in their own domains, preventing processes from accessing files used by other processes, as well as preventing processes from accessing other processes. For example, when running SELinux, unless otherwise configured, an attacker can not compromise a Samba server, and then use that Samba server as an attack vector to read and write to files used by other processes, such as databases used by <trademark class="registered">MySQL</trademark>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux helps limit the damage made by configuration mistakes. <ulink url=" -""http://en.wikipedia.org/wiki/Domain_Name_System%5C%22%3EDomain Name System (DNS)" -"</ulink> servers often replicate information between each other in what is " -"known as a zone transfer. Attackers can use zone transfers to update DNS " -"servers with false information. When running the <ulink url="https://www." -"isc.org/software/bind">Berkeley Internet Name Domain (BIND)</ulink> as a " -"DNS server in Fedora, even if an administrator forgets to limit which " -"servers can perform a zone transfer, the default SELinux policy prevents " -"zone files <footnote> <para> Text files that include information, such as " -"hostname to IP address mappings, that are used by DNS servers. </para> </" -"footnote> from being updated via zone transfers, by the BIND <systemitem " -"class="daemon">named</systemitem> daemon itself, and by other processes." +msgid "SELinux helps limit the damage made by configuration mistakes. <ulink url="http://en.wikipedia.org/wiki/Domain_Name_System%5C%22%3EDomain Name System (DNS)</ulink> servers often replicate information between each other in what is known as a zone transfer. Attackers can use zone transfers to update DNS servers with false information. When running the <ulink url="https://www.isc.org/software/bind%5C%22%3EBerkeley Internet Name Domain (BIND)</ulink> as a DNS server in Fedora, even if an administrator forgets to limit which servers can perform a zone transfer, the default SELinux policy prevents zone files <footnote> <para> Text files that include information, such as hostname to IP address mappings, that are used by DNS servers. </para> </footnote> from being updated via zone transfers, by the BIND <systemitem class="daemon">named</systemitem> daemon itself, and by other processes." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://www.redhatmagazine.com/%5C%22%3E<trademark class=" -""registered">Red Hat</trademark> Magazine</ulink> article, <ulink url=" -""http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-" -"hat-enterprise-linux-4/">Risk report: Three years of Red Hat Enterprise " -"Linux 4</ulink><footnote> <para> Cox, Mark. "Risk report: Three years of " -"Red Hat Enterprise Linux 4". Published 26 February 2008. Accessed 27 August " -"2009: <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-" -"three-years-of-red-hat-enterprise-linux-4/" />. </para> </footnote>, for " -"exploits that were restricted due to the default SELinux targeted policy in " -"<trademark class="registered">Red Hat</trademark> Enterprise <trademark " -"class="registered">Linux</trademark> 4." +msgid "Refer to the <ulink url="http://www.redhatmagazine.com/%5C%22%3E<trademark class="registered">Red Hat</trademark> Magazine</ulink> article, <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-hat-... report: Three years of Red Hat Enterprise Linux 4</ulink><footnote> <para> Cox, Mark. "Risk report: Three years of Red Hat Enterprise Linux 4". Published 26 February 2008. Accessed 27 August 2009: <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-hat-..." />. </para> </footnote>, for exploits that were restricted due to the default SELinux targeted policy in <trademark class="registered">Red Hat</trademark> Enterprise <trademark class="registered">Linux</trademark> 4." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://www.linuxworld.com%5C%22%3ELinuxWorld.com</ulink> " -"article, <ulink url="http://www.linuxworld.com/news/2008/022408-selinux." -"html?page=1">A seatbelt for server software: SELinux blocks real-world " -"exploits</ulink><footnote> <para> Marti, Don. "A seatbelt for server " -"software: SELinux blocks real-world exploits". Published 24 February 2008. " -"Accessed 27 August 2009: <ulink url="http://www.linuxworld.com/" -"news/2008/022408-selinux.html?page=1" />. </para> </footnote>, for " -"background information about SELinux, and information about various exploits " -"that SELinux has prevented." +msgid "Refer to the <ulink url="http://www.linuxworld.com%5C%22%3ELinuxWorld.com</ulink> article, <ulink url="http://www.linuxworld.com/news/2008/022408-selinux.html?page=1%5C%22%3EA seatbelt for server software: SELinux blocks real-world exploits</ulink><footnote> <para> Marti, Don. "A seatbelt for server software: SELinux blocks real-world exploits". Published 24 February 2008. Accessed 27 August 2009: <ulink url="http://www.linuxworld.com/news/2008/022408-selinux.html?page=1%5C" />. </para> </footnote>, for background information about SELinux, and information about various exploits that SELinux has prevented." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to James Morris's <ulink url="http://james-morris.livejournal." -"com/25421.html">SELinux mitigates remote root vulnerability in OpenPegasus</" -"ulink> blog post for information about an exploit in <ulink url="http://www." -"openpegasus.org/">OpenPegasus</ulink> that was mitigated by SELinux as " -"shipped with Red Hat Enterprise Linux 4 and 5." +msgid "Refer to James Morris's <ulink url="http://james-morris.livejournal.com/25421.html%5C%22%3ESELinux mitigates remote root vulnerability in OpenPegasus</ulink> blog post for information about an exploit in <ulink url="http://www.openpegasus.org/%5C%22%3EOpenPegasus</ulink> that was mitigated by SELinux as shipped with Red Hat Enterprise Linux 4 and 5." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> website " -"has an <ulink url="http://www.tresys.com/innovation.php%5C%22%3ESELinux " -"Mitigation News</ulink> section (on the right-hand side), that lists recent " -"exploits that have been mitigated or prevented by SELinux." +msgid "The <ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> website has an <ulink url="http://www.tresys.com/innovation.php%5C%22%3ESELinux Mitigation News</ulink> section (on the right-hand side), that lists recent exploits that have been mitigated or prevented by SELinux." msgstr ""

#. Tag: title @@ -359,23 +186,12 @@

#. Tag: para #, no-c-format -msgid "" -"SELinux is a Linux security module that is built into the Linux kernel. " -"SELinux is driven by loadable policy rules. When security-relevant access is " -"taking place, such as when a process attempts to open a file, the operation " -"is intercepted in the kernel by SELinux. If an SELinux policy rule allows " -"the operation, it continues, otherwise, the operation is blocked and the " -"process receives an error." +msgid "SELinux is a Linux security module that is built into the Linux kernel. SELinux is driven by loadable policy rules. When security-relevant access is taking place, such as when a process attempts to open a file, the operation is intercepted in the kernel by SELinux. If an SELinux policy rule allows the operation, it continues, otherwise, the operation is blocked and the process receives an error." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux decisions, such as allowing or disallowing access, are cached. This " -"cache is known as the Access Vector Cache (AVC). Caching decisions decreases " -"how often SELinux policy rules need to be checked, which increases " -"performance. Remember that SELinux policy rules have no effect if DAC rules " -"deny access first." +msgid "SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). Caching decisions decreases how often SELinux policy rules need to be checked, which increases performance. Remember that SELinux policy rules have no effect if DAC rules deny access first." msgstr ""

#. Tag: title @@ -385,16 +201,12 @@

#. Tag: para #, no-c-format -msgid "" -"Refer to the following for information about running SELinux on operating " -"systems:" +msgid "Refer to the following for information about running SELinux on operating systems:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Hardened Gentoo: <ulink url="http://www.gentoo.org/proj/en/hardened/selinux/" -"selinux-handbook.xml" />." +msgid "Hardened Gentoo: <ulink url="http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml%5C" />." msgstr ""

#. Tag: para @@ -404,27 +216,17 @@

#. Tag: para #, no-c-format -msgid "" -"Ubuntu: <ulink url="https://wiki.ubuntu.com/SELinux%5C" /> and <ulink url=" -""https://help.ubuntu.com/community/SELinux%5C" />." +msgid "Ubuntu: <ulink url="https://wiki.ubuntu.com/SELinux%5C" /> and <ulink url="https://help.ubuntu.com/community/SELinux%5C" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Red Hat Enterprise Linux: <ulink url="http://www.redhat.com/docs/en-US/" -"Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/selg-overview.html">Red " -"Hat Enterprise Linux Deployment Guide</ulink> and <ulink url="http://www." -"redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/">Red Hat " -"Enterprise Linux 4 SELinux Guide</ulink>." +msgid "Red Hat Enterprise Linux: <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux Deployment Guide</ulink> and <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/%5... Hat Enterprise Linux 4 SELinux Guide</ulink>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Fedora: <ulink url="http://fedoraproject.org/wiki/SELinux%5C" /> and the " -"<ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3EFedora Core 5 " -"SELinux FAQ</ulink>." +msgid "Fedora: <ulink url="http://fedoraproject.org/wiki/SELinux%5C" /> and the <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3EFedora Core 5 SELinux FAQ</ulink>." msgstr ""

#, fuzzy

Modified: community/branches/f13/de-DE/Managing_Users.po =================================================================== --- community/branches/f13/de-DE/Managing_Users.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Managing_Users.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -25,16 +26,7 @@

#. Tag: para #, no-c-format -msgid "" -"A number of confined SELinux users are available in Fedora&nbsp;&PRODVER;. " -"Each Linux user is mapped to an SELinux user via SELinux policy, allowing " -"Linux users to inherit the restrictions placed on SELinux users, for example " -"(depending on the user), not being able to: run the X Window System; use " -"networking; run setuid applications (unless SELinux policy permits it); or " -"run the <command>su</command> and <command>sudo</command> commands. This " -"helps protect the system from the user. Refer to <xref linkend="sect-" -"Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users" /> " -"for further information about confined users." +msgid "A number of confined SELinux users are available in Fedora&nbsp;&PRODVER;. Each Linux user is mapped to an SELinux user via SELinux policy, allowing Linux users to inherit the restrictions placed on SELinux users, for example (depending on the user), not being able to: run the X Window System; use networking; run setuid applications (unless SELinux policy permits it); or run the <command>su</command> and <command>sudo</command> commands. This helps protect the system from the user. Refer to <xref linkend="sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users" /> for further information about confined users." msgstr ""

#. Tag: title @@ -44,21 +36,12 @@

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>semanage login -l</command> command " -"to view the mapping between Linux users and SELinux users:" +msgid "As the Linux root user, run the <command>semanage login -l</command> command to view the mapping between Linux users and SELinux users:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux " -"<computeroutput>__default__</computeroutput> login by default (which is in " -"turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> " -"user). When a Linux user is created with the <command>useradd</command> " -"command, if no options are specified, they are mapped to the SELinux " -"<computeroutput>unconfined_u</computeroutput> user. The following defines " -"the default-mapping:" +msgid "In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is in turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). When a Linux user is created with the <command>useradd</command> command, if no options are specified, they are mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user. The following defines the default-mapping:" msgstr ""

#. Tag: title @@ -68,87 +51,42 @@

#. Tag: para #, no-c-format -msgid "" -"Linux users mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user run in the <computeroutput>unconfined_t</" -"computeroutput> domain. This is seen by running the <command>id -Z</command> " -"command while logged-in as a Linux user mapped to " -"<computeroutput>unconfined_u</computeroutput>:" +msgid "Linux users mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user run in the <computeroutput>unconfined_t</computeroutput> domain. This is seen by running the <command>id -Z</command> command while logged-in as a Linux user mapped to <computeroutput>unconfined_u</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When Linux users run in the <computeroutput>unconfined_t</computeroutput> " -"domain, SELinux policy rules are applied, but policy rules exist that allow " -"Linux users running in the <computeroutput>unconfined_t</computeroutput> " -"domain almost all access. If unconfined Linux users execute an application " -"that SELinux policy defines can transition from the " -"<computeroutput>unconfined_t</computeroutput> domain to its own confined " -"domain, unconfined Linux users are still subject to the restrictions of that " -"confined domain. The security benefit of this is that, even though a Linux " -"user is running unconfined, the application remains confined, and therefore, " -"the exploitation of a flaw in the application can be limited by policy. " -"Note: this does not protect the system from the user. Instead, the user and " -"the system are being protected from possible damage caused by a flaw in the " -"application." +msgid "When Linux users run in the <computeroutput>unconfined_t</computeroutput> domain, SELinux policy rules are applied, but policy rules exist that allow Linux users running in the <computeroutput>unconfined_t</computeroutput> domain almost all access. If unconfined Linux users execute an application that SELinux policy defines can transition from the <computeroutput>unconfined_t</computeroutput> domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy. Note: this does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When creating Linux users with <command>useradd</command>, use the <option>-" -"Z</option> option to specify which SELinux user they are mapped to. The " -"following example creates a new Linux user, useruuser, and maps that user to " -"the SELinux <computeroutput>user_u</computeroutput> user. Linux users mapped " -"to the SELinux <computeroutput>user_u</computeroutput> user run in the " -"<computeroutput>user_t</computeroutput> domain. In this domain, Linux users " -"are unable to run setuid applications unless SELinux policy permits it (such " -"as <command>passwd</command>), and can not run <command>su</command> or " -"<command>sudo</command>, preventing them from becoming the Linux root user " -"with these commands." +msgid "When creating Linux users with <command>useradd</command>, use the <option>-Z</option> option to specify which SELinux user they are mapped to. The following example creates a new Linux user, useruuser, and maps that user to the SELinux <computeroutput>user_u</computeroutput> user. Linux users mapped to the SELinux <computeroutput>user_u</computeroutput> user run in the <computeroutput>user_t</computeroutput> domain. In this domain, Linux users are unable to run setuid applications unless SELinux policy permits it (such as <command>passwd</command>), and can not run <command>su</command> or <command>sudo</command>, preventing them from becoming the Linux root user with these commands." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/useradd -Z user_u " -"useruuser</command> command to create a new Linux user (useruuser) that is " -"mapped to the SELinux <computeroutput>user_u</computeroutput> user." +msgid "As the Linux root user, run the <command>/usr/sbin/useradd -Z user_u useruuser</command> command to create a new Linux user (useruuser) that is mapped to the SELinux <computeroutput>user_u</computeroutput> user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>semanage login -l</command> command " -"to view the mapping between the Linux <computeroutput>useruuser</" -"computeroutput> user and <computeroutput>user_u</computeroutput>:" +msgid "As the Linux root user, run the <command>semanage login -l</command> command to view the mapping between the Linux <computeroutput>useruuser</computeroutput> user and <computeroutput>user_u</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>passwd useruuser</command> command " -"to assign a password to the Linux useruuser user:" +msgid "As the Linux root user, run the <command>passwd useruuser</command> command to assign a password to the Linux useruuser user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Log out of your current session, and log in as the Linux useruuser user. " -"When you log in, pam_selinux maps the Linux user to an SELinux user (in this " -"case, <computeroutput>user_u</computeroutput>), and sets up the resulting " -"SELinux context. The Linux user's shell is then launched with this context. " -"Run the <command>id -Z</command> command to view the context of a Linux user:" +msgid "Log out of your current session, and log in as the Linux useruuser user. When you log in, pam_selinux maps the Linux user to an SELinux user (in this case, <computeroutput>user_u</computeroutput>), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run the <command>id -Z</command> command to view the context of a Linux user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Log out of the Linux useruuser's session, and log back in with your account. " -"If you do not want the Linux useruuser user, run the <command>/usr/sbin/" -"userdel -r useruuser</command> command as the Linux root user to remove it, " -"along with its home directory." +msgid "Log out of the Linux useruuser's session, and log back in with your account. If you do not want the Linux useruuser user, run the <command>/usr/sbin/userdel -r useruuser</command> command as the Linux root user to remove it, along with its home directory." msgstr ""

#. Tag: title @@ -158,29 +96,17 @@

#. Tag: para #, no-c-format -msgid "" -"If a Linux user is mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user (the default behavior), and you would like to change " -"which SELinux user they are mapped to, use the <command>semanage login</" -"command> command. The following example creates a new Linux user named " -"newuser, then maps that Linux user to the SELinux <computeroutput>user_u</" -"computeroutput> user:" +msgid "If a Linux user is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user (the default behavior), and you would like to change which SELinux user they are mapped to, use the <command>semanage login</command> command. The following example creates a new Linux user named newuser, then maps that Linux user to the SELinux <computeroutput>user_u</computeroutput> user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> " -"command to create a new Linux user (newuser). Since this user uses the " -"default mapping, it does not appear in the <command>/usr/sbin/semanage login " -"-l</command> output:" +msgid "As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> command to create a new Linux user (newuser). Since this user uses the default mapping, it does not appear in the <command>/usr/sbin/semanage login -l</command> output:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To map the Linux newuser user to the SELinux <computeroutput>user_u</" -"computeroutput> user, run the following command as the Linux root user:" +msgid "To map the Linux newuser user to the SELinux <computeroutput>user_u</computeroutput> user, run the following command as the Linux root user:" msgstr ""

#. Tag: para @@ -190,45 +116,27 @@

#. Tag: para #, no-c-format -msgid "" -"The <option>-a</option> option adds a new record, and the <option>-s</" -"option> option specifies the SELinux user to map a Linux user to. The last " -"argument, <computeroutput>newuser</computeroutput>, is the Linux user you " -"want mapped to the specified SELinux user." +msgid "The <option>-a</option> option adds a new record, and the <option>-s</option> option specifies the SELinux user to map a Linux user to. The last argument, <computeroutput>newuser</computeroutput>, is the Linux user you want mapped to the specified SELinux user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To view the mapping between the Linux newuser user and " -"<computeroutput>user_u</computeroutput>, run the <command>semanage login -l</" -"command> command as the Linux root user:" +msgid "To view the mapping between the Linux newuser user and <computeroutput>user_u</computeroutput>, run the <command>semanage login -l</command> command as the Linux root user:" msgstr ""

#. Tag: para #, fuzzy, no-c-format -msgid "" -"As the Linux root user, run the <command>passwd newuser</command> command to " -"assign a password to the Linux newuser user:" -msgstr "" -"Führen Sie als Linux Benutzer root den Befehl <command>rm -i /var/www/html/" -"testfile</command> aus, um <filename>testfile</filename> zu löschen." +msgid "As the Linux root user, run the <command>passwd newuser</command> command to assign a password to the Linux newuser user:" +msgstr "Führen Sie als Linux Benutzer root den Befehl <command>rm -i /var/www/html/testfile</command> aus, um <filename>testfile</filename> zu löschen."

#. Tag: para #, no-c-format -msgid "" -"Log out of your current session, and log in as the Linux newuser user. Run " -"the <command>id -Z</command> command to view the newuser's SELinux context:" +msgid "Log out of your current session, and log in as the Linux newuser user. Run the <command>id -Z</command> command to view the newuser's SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Log out of the Linux newuser's session, and log back in with your account. " -"If you do not want the Linux newuser user, run the <command>userdel -r " -"newuser</command> command as the Linux root user to remove it, along with " -"its home directory. Also, the mapping between the Linux newuser user and " -"<computeroutput>user_u</computeroutput> is removed:" +msgid "Log out of the Linux newuser's session, and log back in with your account. If you do not want the Linux newuser user, run the <command>userdel -r newuser</command> command as the Linux root user to remove it, along with its home directory. Also, the mapping between the Linux newuser user and <computeroutput>user_u</computeroutput> is removed:" msgstr ""

#. Tag: title @@ -238,55 +146,32 @@

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux " -"<computeroutput>__default__</computeroutput> login by default (which is in " -"turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> " -"user). If you would like new Linux users, and Linux users not specifically " -"mapped to an SELinux user to be confined by default, change the default " -"mapping with the <command>semanage login</command> command." +msgid "In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is in turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). If you would like new Linux users, and Linux users not specifically mapped to an SELinux user to be confined by default, change the default mapping with the <command>semanage login</command> command." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For example, run the following command as the Linux root user to change the " -"default mapping from <computeroutput>unconfined_u</computeroutput> to " -"<computeroutput>user_u</computeroutput>:" +msgid "For example, run the following command as the Linux root user to change the default mapping from <computeroutput>unconfined_u</computeroutput> to <computeroutput>user_u</computeroutput>:" msgstr ""

#. Tag: para #, fuzzy, no-c-format -msgid "" -"<command>/usr/sbin/semanage login -m -S targeted -s "user_u" -r s0 " -"__default__</command>" -msgstr "" -"/usr/sbin/semanage login -m -S targeted -s "user_u" -r s0 __default__" +msgid "<command>/usr/sbin/semanage login -m -S targeted -s "user_u" -r s0 __default__</command>" +msgstr "/usr/sbin/semanage login -m -S targeted -s "user_u" -r s0 __default__"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>semanage login -l</command> command as the Linux root user " -"to verify the <computeroutput>__default__</computeroutput> login is mapped " -"to <computeroutput>user_u</computeroutput>:" +msgid "Run the <command>semanage login -l</command> command as the Linux root user to verify the <computeroutput>__default__</computeroutput> login is mapped to <computeroutput>user_u</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If a new Linux user is created and an SELinux user is not specified, or if " -"an existing Linux user logs in and does not match a specific entry from the " -"<command>semanage login -l</command> output, they are mapped to " -"<computeroutput>user_u</computeroutput>, as per the " -"<computeroutput>__default__</computeroutput> login." +msgid "If a new Linux user is created and an SELinux user is not specified, or if an existing Linux user logs in and does not match a specific entry from the <command>semanage login -l</command> output, they are mapped to <computeroutput>user_u</computeroutput>, as per the <computeroutput>__default__</computeroutput> login." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To change back to the default behavior, run the following command as the " -"Linux root user to map the <computeroutput>__default__</computeroutput> " -"login to the SELinux <computeroutput>unconfined_u</computeroutput> user:" +msgid "To change back to the default behavior, run the following command as the Linux root user to map the <computeroutput>__default__</computeroutput> login to the SELinux <computeroutput>unconfined_u</computeroutput> user:" msgstr ""

#. Tag: title @@ -296,14 +181,7 @@

#. Tag: para #, no-c-format -msgid "" -"The <package>xguest</package> package provides a kiosk user account. This " -"account is used to secure machines that people walk up to and use, such as " -"those at libraries, banks, airports, information kiosks, and coffee shops. " -"The kiosk user account is very limited: essentially, it only allows users to " -"log in and use <application>Firefox</application> to browse Internet " -"websites. Any changes made while logged in with his account, such as " -"creating files or changing settings, are lost when you log out." +msgid "The <package>xguest</package> package provides a kiosk user account. This account is used to secure machines that people walk up to and use, such as those at libraries, banks, airports, information kiosks, and coffee shops. The kiosk user account is very limited: essentially, it only allows users to log in and use <application>Firefox</application> to browse Internet websites. Any changes made while logged in with his account, such as creating files or changing settings, are lost when you log out." msgstr ""

#. Tag: para @@ -313,38 +191,22 @@

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run <command>yum install xguest</command> command to " -"install the <package>xguest</package> package. Install dependencies as " -"required." +msgid "As the Linux root user, run <command>yum install xguest</command> command to install the <package>xguest</package> package. Install dependencies as required." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In order to allow the kiosk account to be used by a variety of people, the " -"account is not password-protected, and as such, the account can only be " -"protected if SELinux is running in enforcing mode. Before logging in with " -"this account, use the <command>getenforce</command> command to confirm that " -"SELinux is running in enforcing mode:" +msgid "In order to allow the kiosk account to be used by a variety of people, the account is not password-protected, and as such, the account can only be protected if SELinux is running in enforcing mode. Before logging in with this account, use the <command>getenforce</command> command to confirm that SELinux is running in enforcing mode:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If this is not the case, refer to <xref linkend="sect-Security-" -"Enhanced_Linux-Working_with_SELinux-SELinux_Modes" /> for information about " -"changing to enforcing mode. It is not possible to log in with this account " -"if SELinux is in permissive mode or disabled." +msgid "If this is not the case, refer to <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Modes" /> for information about changing to enforcing mode. It is not possible to log in with this account if SELinux is in permissive mode or disabled." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"You can only log in to this account via the GNOME Display Manager (GDM). " -"Once the <package>xguest</package> package is installed, a " -"<computeroutput>Guest</computeroutput> account is added to GDM. To log in, " -"click on the <computeroutput>Guest</computeroutput> account:" +msgid "You can only log in to this account via the GNOME Display Manager (GDM). Once the <package>xguest</package> package is installed, a <computeroutput>Guest</computeroutput> account is added to GDM. To log in, click on the <computeroutput>Guest</computeroutput> account:" msgstr ""

#. Tag: title @@ -354,26 +216,12 @@

#. Tag: para #, no-c-format -msgid "" -"Not allowing Linux users to execute applications (which inherit users' " -"permissions) in their home directories and <filename>/tmp/</filename>, which " -"they have write access to, helps prevent flawed or malicious applications " -"from modifying files that users own. In Fedora&nbsp;&PRODVER;, by default, " -"Linux users in the <computeroutput>guest_t</computeroutput> and " -"<computeroutput>xguest_t</computeroutput> domains can not execute " -"applications in their home directories or <filename>/tmp/</filename>; " -"however, by default, Linux users in the <computeroutput>user_t</" -"computeroutput> and <computeroutput>staff_t</computeroutput> domains can." +msgid "Not allowing Linux users to execute applications (which inherit users' permissions) in their home directories and <filename>/tmp/</filename>, which they have write access to, helps prevent flawed or malicious applications from modifying files that users own. In Fedora&nbsp;&PRODVER;, by default, Linux users in the <computeroutput>guest_t</computeroutput> and <computeroutput>xguest_t</computeroutput> domains can not execute applications in their home directories or <filename>/tmp/</filename>; however, by default, Linux users in the <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Booleans are available to change this behavior, and are configured with the " -"<command>setsebool</command> command. The <command>setsebool</command> " -"command must be run as the Linux root user. The <command>setsebool -P</" -"command> command makes persistent changes. Do not use the <option>-P</" -"option> option if you do not want changes to persist across reboots:" +msgid "Booleans are available to change this behavior, and are configured with the <command>setsebool</command> command. The <command>setsebool</command> command must be run as the Linux root user. The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots:" msgstr ""

#. Tag: title @@ -383,10 +231,7 @@

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>allow</emphasis> Linux users in the <computeroutput>guest_t</" -"computeroutput> domain to execute applications in their home directories and " -"<filename>/tmp/</filename>:" +msgid "To <emphasis>allow</emphasis> Linux users in the <computeroutput>guest_t</computeroutput> domain to execute applications in their home directories and <filename>/tmp/</filename>:" msgstr ""

#. Tag: para @@ -401,10 +246,7 @@

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>allow</emphasis> Linux users in the <computeroutput>xguest_t</" -"computeroutput> domain to execute applications in their home directories and " -"<filename>/tmp/</filename>:" +msgid "To <emphasis>allow</emphasis> Linux users in the <computeroutput>xguest_t</computeroutput> domain to execute applications in their home directories and <filename>/tmp/</filename>:" msgstr ""

#. Tag: para @@ -419,10 +261,7 @@

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>prevent</emphasis> Linux users in the <computeroutput>user_t</" -"computeroutput> domain from executing applications in their home directories " -"and <filename>/tmp/</filename>:" +msgid "To <emphasis>prevent</emphasis> Linux users in the <computeroutput>user_t</computeroutput> domain from executing applications in their home directories and <filename>/tmp/</filename>:" msgstr ""

#. Tag: para @@ -437,10 +276,7 @@

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>prevent</emphasis> Linux users in the <computeroutput>staff_t</" -"computeroutput> domain from executing applications in their home directories " -"and <filename>/tmp/</filename>:" +msgid "To <emphasis>prevent</emphasis> Linux users in the <computeroutput>staff_t</computeroutput> domain from executing applications in their home directories and <filename>/tmp/</filename>:" msgstr ""

#. Tag: para

Modified: community/branches/f13/de-DE/Preface.po =================================================================== --- community/branches/f13/de-DE/Preface.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Preface.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -25,47 +26,30 @@

#. Tag: para #, no-c-format -msgid "" -"The Fedora&nbsp;&PRODVER; SELinux User Guide is for people with minimal or " -"no experience with SELinux. Although system administration experience is not " -"necessary, content in this guide is written for system administration tasks. " -"This guide provides an introduction to fundamental concepts and practical " -"applications of SELinux. After reading this guide you should have an " -"intermediate understanding of SELinux." +msgid "The Fedora&nbsp;&PRODVER; SELinux User Guide is for people with minimal or no experience with SELinux. Although system administration experience is not necessary, content in this guide is written for system administration tasks. This guide provides an introduction to fundamental concepts and practical applications of SELinux. After reading this guide you should have an intermediate understanding of SELinux." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Thank you to everyone who offered encouragement, help, and testing - it is " -"most appreciated. Very special thanks to:" +msgid "Thank you to everyone who offered encouragement, help, and testing - it is most appreciated. Very special thanks to:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Dominick Grift, Stephen Smalley, and Russell Coker for their contributions, " -"help, and patience." +msgid "Dominick Grift, Stephen Smalley, and Russell Coker for their contributions, help, and patience." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Karsten Wade for his help, adding a component for this guide to <ulink url=" -""https://bugzilla.redhat.com/%5C%22%3E Red Hat Bugzilla</ulink>, and sorting out " -"web hosting on <ulink url="http://docs.fedoraproject.org/%5C" />." +msgid "Karsten Wade for his help, adding a component for this guide to <ulink url="https://bugzilla.redhat.com/%5C%22%3E Red Hat Bugzilla</ulink>, and sorting out web hosting on <ulink url="http://docs.fedoraproject.org/%5C" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://fedoraproject.org/wiki/Infrastructure%5C%22%3EFedora " -"Infrastructure Team</ulink> for providing hosting." +msgid "The <ulink url="http://fedoraproject.org/wiki/Infrastructure%5C%22%3EFedora Infrastructure Team</ulink> for providing hosting." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Jens-Ulrik Petersen for making sure the Red Hat Brisbane office has up-to-" -"date Fedora mirrors." +msgid "Jens-Ulrik Petersen for making sure the Red Hat Brisbane office has up-to-date Fedora mirrors." msgstr ""

Modified: community/branches/f13/de-DE/Revision_History.po =================================================================== --- community/branches/f13/de-DE/Revision_History.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Revision_History.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -60,10 +61,7 @@

#. Tag: member #, no-c-format -msgid "" -"Resolving <ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=472986" -"">Red Hat Bugzilla #472986, "httpd does not write to /etc/httpd/logs/"</" -"ulink>" +msgid "Resolving <ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=472986%5C%22%3ERed Hat Bugzilla #472986, "httpd does not write to /etc/httpd/logs/"</ulink>" msgstr ""

#. Tag: member @@ -78,8 +76,5 @@

#. Tag: member #, fuzzy, no-c-format -msgid "" -"Initial content release on <ulink url="http://docs.fedoraproject.org/%5C" />" -msgstr "" -"Die erste Freigabe des Inhalts unter <ulink url="http://docs.fedoraproject." -"org/"></ulink>" +msgid "Initial content release on <ulink url="http://docs.fedoraproject.org/%5C" />" +msgstr "Die erste Freigabe des Inhalts unter <ulink url="http://docs.fedoraproject.org/%5C%22%3E</ulink>"

Modified: community/branches/f13/de-DE/SELinux_User_Guide.po =================================================================== --- community/branches/f13/de-DE/SELinux_User_Guide.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/SELinux_User_Guide.po 2010-11-21 23:12:12 UTC (rev 492) @@ -0,0 +1,14 @@ +# +# AUTHOR EMAIL@ADDRESS, YEAR. +# +msgid "" +msgstr "" +"Project-Id-Version: 0\n" +"POT-Creation-Date: 2010-04-15T00:19:31\n" +"PO-Revision-Date: 2010-04-15T00:19:31\n" +"Last-Translator: Automatically generated\n" +"Language-Team: None\n" +"MIME-Version: 1.0\n" +"Content-Type: application/x-publican; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +

Modified: community/branches/f13/de-DE/Security-Enhanced_Linux.po =================================================================== --- community/branches/f13/de-DE/Security-Enhanced_Linux.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Security-Enhanced_Linux.po 2010-11-21 23:12:12 UTC (rev 492) @@ -0,0 +1,14 @@ +# +# AUTHOR EMAIL@ADDRESS, YEAR. +# +msgid "" +msgstr "" +"Project-Id-Version: 0\n" +"POT-Creation-Date: 2010-04-15T00:19:31\n" +"PO-Revision-Date: 2010-04-15T00:19:31\n" +"Last-Translator: Automatically generated\n" +"Language-Team: None\n" +"MIME-Version: 1.0\n" +"Content-Type: application/x-publican; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +

Modified: community/branches/f13/de-DE/Targeted_Policy.po =================================================================== --- community/branches/f13/de-DE/Targeted_Policy.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Targeted_Policy.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -25,26 +26,12 @@

#. Tag: para #, no-c-format -msgid "" -"Targeted policy is the default SELinux policy used in Fedora. When using " -"targeted policy, processes that are targeted run in a confined domain, and " -"processes that are not targeted run in an unconfined domain. For example, by " -"default, logged in users run in the <computeroutput>unconfined_t</" -"computeroutput> domain, and system processes started by init run in the " -"<computeroutput>initrc_t</computeroutput> domain - both of these domains are " -"unconfined." +msgid "Targeted policy is the default SELinux policy used in Fedora. When using targeted policy, processes that are targeted run in a confined domain, and processes that are not targeted run in an unconfined domain. For example, by default, logged in users run in the <computeroutput>unconfined_t</computeroutput> domain, and system processes started by init run in the <computeroutput>initrc_t</computeroutput> domain - both of these domains are unconfined." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Unconfined domains (as well as confined domains) are subject to executable " -"and writeable memory checks. By default, subjects running in an unconfined " -"domain can not allocate writeable memory and execute it. This reduces " -"vulnerability to <ulink url="http://en.wikipedia.org/wiki/Buffer_overflow" -"">buffer overflow attacks</ulink>. These memory checks are disabled by " -"setting Booleans, which allow the SELinux policy to be modified at runtime. " -"Boolean configuration is discussed later." +msgid "Unconfined domains (as well as confined domains) are subject to executable and writeable memory checks. By default, subjects running in an unconfined domain can not allocate writeable memory and execute it. This reduces vulnerability to <ulink url="http://en.wikipedia.org/wiki/Buffer_overflow%5C%22%3Ebuffer overflow attacks</ulink>. These memory checks are disabled by setting Booleans, which allow the SELinux policy to be modified at runtime. Boolean configuration is discussed later." msgstr ""

#. Tag: title @@ -54,105 +41,52 @@

#. Tag: para #, no-c-format -msgid "" -"Almost every service that listens on a network is confined in Fedora. Also, " -"most processes that run as the Linux root user and perform tasks for users, " -"such as the <application>passwd</application> application, are confined. " -"When a process is confined, it runs in its own domain, such as the " -"<systemitem class="daemon">httpd</systemitem> process running in the " -"<computeroutput>httpd_t</computeroutput> domain. If a confined process is " -"compromised by an attacker, depending on SELinux policy configuration, an " -"attacker's access to resources and the possible damage they can do is " -"limited." +msgid "Almost every service that listens on a network is confined in Fedora. Also, most processes that run as the Linux root user and perform tasks for users, such as the <application>passwd</application> application, are confined. When a process is confined, it runs in its own domain, such as the <systemitem class="daemon">httpd</systemitem> process running in the <computeroutput>httpd_t</computeroutput> domain. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates how SELinux prevents the Apache HTTP " -"Server (<systemitem class="daemon">httpd</systemitem>) from reading files " -"that are not correctly labeled, such as files intended for use by Samba. " -"This is an example, and should not be used in production. It assumes that " -"the <package>httpd</package>, <package>wget</package>, " -"<package>setroubleshoot-server</package>, <package>dbus</package> and " -"<package>audit</package> packages are installed, that the SELinux targeted " -"policy is used, and that SELinux is running in enforcing mode:" +msgid "The following example demonstrates how SELinux prevents the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) from reading files that are not correctly labeled, such as files intended for use by Samba. This is an example, and should not be used in production. It assumes that the <package>httpd</package>, <package>wget</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>sestatus</command> command to confirm that SELinux is " -"enabled, is running in enforcing mode, and that targeted policy is being " -"used:" +msgid "Run the <command>sestatus</command> command to confirm that SELinux is enabled, is running in enforcing mode, and that targeted policy is being used:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>SELinux status: enabled</computeroutput> is returned when " -"SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> " -"is returned when SELinux is running in enforcing mode. " -"<computeroutput>Policy from config file: targeted</computeroutput> is " -"returned when the SELinux targeted policy is used." +msgid "<computeroutput>SELinux status: enabled</computeroutput> is returned when SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> is returned when SELinux is running in enforcing mode. <computeroutput>Policy from config file: targeted</computeroutput> is returned when the SELinux targeted policy is used." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /var/www/html/testfile</" -"command> command to create a file." +msgid "As the Linux root user, run the <command>touch /var/www/html/testfile</command> command to create a file." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/testfile</command> command to view the " -"SELinux context:" +msgid "Run the <command>ls -Z /var/www/html/testfile</command> command to view the SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users run unconfined in Fedora, which is why the " -"<filename>testfile</filename> file is labeled with the SELinux " -"<computeroutput>unconfined_u</computeroutput> user. RBAC is used for " -"processes, not files. Roles do not have a meaning for files - the " -"<computeroutput>object_r</computeroutput> role is a generic role used for " -"files (on persistent storage and network file systems). Under the <filename>/" -"proc/</filename> directory, files related to processes may use the " -"<computeroutput>system_r</computeroutput> role.<footnote> <para> When using " -"other policies, such as MLS, other roles may be used, for example, " -"<computeroutput>secadm_r</computeroutput>. </para> </footnote> The " -"<computeroutput>httpd_sys_content_t</computeroutput> type allows the " -"<systemitem class="daemon">httpd</systemitem> process to access this file." +msgid "By default, Linux users run unconfined in Fedora, which is why the <filename>testfile</filename> file is labeled with the SELinux <computeroutput>unconfined_u</computeroutput> user. RBAC is used for processes, not files. Roles do not have a meaning for files - the <computeroutput>object_r</computeroutput> role is a generic role used for files (on persistent storage and network file systems). Under the <filename>/proc/</filename> directory, files related to processes may use the <computeroutput>system_r</computeroutput> role.<footnote> <para> When using other policies, such as MLS, other roles may be used, for example, <computeroutput>secadm_r</computeroutput>. </para> </footnote> The <computeroutput>httpd_sys_content_t</computeroutput> type allows the <systemitem class="daemon">httpd</systemitem> process to access this file." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>service httpd start</command> " -"command to start the <systemitem class="daemon">httpd</systemitem> " -"process. The output is as follows if <systemitem class="daemon">httpd</" -"systemitem> starts successfully:" +msgid "As the Linux root user, run the <command>service httpd start</command> command to start the <systemitem class="daemon">httpd</systemitem> process. The output is as follows if <systemitem class="daemon">httpd</systemitem> starts successfully:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Change into a directory where your Linux user has write access to, and run " -"the <command>wget http://localhost/testfile</command> command. Unless there " -"are changes to the default configuration, this command succeeds:" +msgid "Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/testfile</command> command. Unless there are changes to the default configuration, this command succeeds:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>chcon</command> command relabels files; however, such label " -"changes do not survive when the file system is relabeled. For permanent " -"changes that survive a file system relabel, use the <command>semanage</" -"command> command, which is discussed later. As the Linux root user, run the " -"following command to change the type to a type used by Samba:" +msgid "The <command>chcon</command> command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the <command>semanage</command> command, which is discussed later. As the Linux root user, run the following command to change the type to a type used by Samba:" msgstr ""

#. Tag: para @@ -162,70 +96,37 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/testfile</command> command to view the " -"changes:" -msgstr "" -"Führen Sie den Befehl <command>ls -Z /var/www/html/testfile</command> aus, " -"um die Änderungen sehen zu können:" +msgid "Run the <command>ls -Z /var/www/html/testfile</command> command to view the changes:" +msgstr "Führen Sie den Befehl <command>ls -Z /var/www/html/testfile</command> aus, um die Änderungen sehen zu können:"

#. Tag: para #, no-c-format -msgid "" -"Note: the current DAC permissions allow the <systemitem class="daemon" -"">httpd</systemitem> process access to <filename>testfile</filename>. " -"Change into a directory where your Linux user has write access to, and run " -"the <command>wget http://localhost/testfile</command> command. Unless there " -"are changes to the default configuration, this command fails:" +msgid "Note: the current DAC permissions allow the <systemitem class="daemon">httpd</systemitem> process access to <filename>testfile</filename>. Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/testfile</command> command. Unless there are changes to the default configuration, this command fails:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>rm -i /var/www/html/testfile</" -"command> command to remove <filename>testfile</filename>." -msgstr "" -"Führen Sie als Linux Benutzer root den Befehl <command>rm -i /var/www/html/" -"testfile</command> aus, um <filename>testfile</filename> zu löschen." +msgid "As the Linux root user, run the <command>rm -i /var/www/html/testfile</command> command to remove <filename>testfile</filename>." +msgstr "Führen Sie als Linux Benutzer root den Befehl <command>rm -i /var/www/html/testfile</command> aus, um <filename>testfile</filename> zu löschen."

#. Tag: para #, no-c-format -msgid "" -"If you do not require <systemitem class="daemon">httpd</systemitem> to be " -"running, as the Linux root user, run the <command>service httpd stop</" -"command> command to stop <systemitem class="daemon">httpd</systemitem>:" +msgid "If you do not require <systemitem class="daemon">httpd</systemitem> to be running, as the Linux root user, run the <command>service httpd stop</command> command to stop <systemitem class="daemon">httpd</systemitem>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This example demonstrates the additional security added by SELinux. Although " -"DAC rules allowed the <systemitem class="daemon">httpd</systemitem> " -"process access to <filename>testfile</filename> in step 7, because the file " -"was labeled with a type that the <systemitem class="daemon">httpd</" -"systemitem> process does not have access to, SELinux denied access. After " -"step 7, an error similar to the following is logged to <filename>/var/log/" -"messages</filename>:" +msgid "This example demonstrates the additional security added by SELinux. Although DAC rules allowed the <systemitem class="daemon">httpd</systemitem> process access to <filename>testfile</filename> in step 7, because the file was labeled with a type that the <systemitem class="daemon">httpd</systemitem> process does not have access to, SELinux denied access. After step 7, an error similar to the following is logged to <filename>/var/log/messages</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Previous log files may use a <filename>/var/log/messages." -"<replaceable>YYYYMMDD</replaceable></filename> format. When running " -"<application>syslog-ng</application>, previous log files may use a " -"<filename>/var/log/messages.<replaceable>X</replaceable></filename> format. " -"If the <systemitem class="daemon">setroubleshootd</systemitem> and " -"<systemitem class="daemon">auditd</systemitem> processes are running, " -"errors similar to the following are logged to <filename>/var/log/audit/audit." -"log</filename>:" +msgid "Previous log files may use a <filename>/var/log/messages.<replaceable>YYYYMMDD</replaceable></filename> format. When running <application>syslog-ng</application>, previous log files may use a <filename>/var/log/messages.<replaceable>X</replaceable></filename> format. If the <systemitem class="daemon">setroubleshootd</systemitem> and <systemitem class="daemon">auditd</systemitem> processes are running, errors similar to the following are logged to <filename>/var/log/audit/audit.log</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Also, an error similar to the following is logged to <filename>/var/log/" -"httpd/error_log</filename>:" +msgid "Also, an error similar to the following is logged to <filename>/var/log/httpd/error_log</filename>:" msgstr ""

#. Tag: title @@ -235,65 +136,27 @@

#. Tag: para #, no-c-format -msgid "" -"Unconfined processes run in unconfined domains, for example, init programs " -"run in the unconfined <computeroutput>initrc_t</computeroutput> domain, " -"unconfined kernel processes run in the <computeroutput>kernel_t</" -"computeroutput> domain, and unconfined Linux users run in the " -"<computeroutput>unconfined_t</computeroutput> domain. For unconfined " -"processes, SELinux policy rules are applied, but policy rules exist that " -"allow processes running in unconfined domains almost all access. Processes " -"running in unconfined domains fall back to using DAC rules exclusively. If " -"an unconfined process is compromised, SELinux does not prevent an attacker " -"from gaining access to system resources and data, but of course, DAC rules " -"are still used. SELinux is a security enhancement on top of DAC rules - it " -"does not replace them." +msgid "Unconfined processes run in unconfined domains, for example, init programs run in the unconfined <computeroutput>initrc_t</computeroutput> domain, unconfined kernel processes run in the <computeroutput>kernel_t</computeroutput> domain, and unconfined Linux users run in the <computeroutput>unconfined_t</computeroutput> domain. For unconfined processes, SELinux policy rules are applied, but policy rules exist that allow processes running in unconfined domains almost all access. Processes running in unconfined domains fall back to using DAC rules exclusively. If an unconfined process is compromised, SELinux does not prevent an attacker from gaining access to system resources and data, but of course, DAC rules are still used. SELinux is a security enhancement on top of DAC rules - it does not replace them." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates how the Apache HTTP Server (<systemitem " -"class="daemon">httpd</systemitem>) can access data intended for use by " -"Samba, when running unconfined. Note: in Fedora, the <systemitem class=" -""daemon">httpd</systemitem> process runs in the confined " -"<computeroutput>httpd_t</computeroutput> domain by default. This is an " -"example, and should not be used in production. It assumes that the " -"<package>httpd</package>, <package>wget</package>, <package>setroubleshoot-" -"server</package>, <package>dbus</package> and <package>audit</package> " -"packages are installed, that the SELinux targeted policy is used, and that " -"SELinux is running in enforcing mode:" +msgid "The following example demonstrates how the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) can access data intended for use by Samba, when running unconfined. Note: in Fedora, the <systemitem class="daemon">httpd</systemitem> process runs in the confined <computeroutput>httpd_t</computeroutput> domain by default. This is an example, and should not be used in production. It assumes that the <package>httpd</package>, <package>wget</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /var/www/html/test2file</" -"command> command to create a file." +msgid "As the Linux root user, run the <command>touch /var/www/html/test2file</command> command to create a file." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/test2file</command> command to view the " -"SELinux context:" +msgid "Run the <command>ls -Z /var/www/html/test2file</command> command to view the SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users run unconfined in Fedora, which is why the " -"<filename>test2file</filename> file is labeled with the SELinux " -"<computeroutput>unconfined_u</computeroutput> user. RBAC is used for " -"processes, not files. Roles do not have a meaning for files - the " -"<computeroutput>object_r</computeroutput> role is a generic role used for " -"files (on persistent storage and network file systems). Under the <filename>/" -"proc/</filename> directory, files related to processes may use the " -"<computeroutput>system_r</computeroutput> role.<footnote> <para> When using " -"other policies, such as MLS, other roles may also be used, for example, " -"<computeroutput>secadm_r</computeroutput>. </para> </footnote> The " -"<computeroutput>httpd_sys_content_t</computeroutput> type allows the " -"<systemitem class="daemon">httpd</systemitem> process to access this file." +msgid "By default, Linux users run unconfined in Fedora, which is why the <filename>test2file</filename> file is labeled with the SELinux <computeroutput>unconfined_u</computeroutput> user. RBAC is used for processes, not files. Roles do not have a meaning for files - the <computeroutput>object_r</computeroutput> role is a generic role used for files (on persistent storage and network file systems). Under the <filename>/proc/</filename> directory, files related to processes may use the <computeroutput>system_r</computeroutput> role.<footnote> <para> When using other policies, such as MLS, other roles may also be used, for example, <computeroutput>secadm_r</computeroutput>. </para> </footnote> The <computeroutput>httpd_sys_content_t</computeroutput> type allows the <systemitem class="daemon">httpd</systemitem> process to access this file." msgstr ""

#. Tag: para @@ -303,33 +166,22 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/test2file</command> command to view the " -"changes:" +msgid "Run the <command>ls -Z /var/www/html/test2file</command> command to view the changes:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>service httpd status</command> command to confirm that the " -"<systemitem class="daemon">httpd</systemitem> process is not running:" +msgid "Run the <command>service httpd status</command> command to confirm that the <systemitem class="daemon">httpd</systemitem> process is not running:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If the output differs, run the <command>service httpd stop</command> command " -"as the Linux root user to stop the <systemitem class="daemon">httpd</" -"systemitem> process:" +msgid "If the output differs, run the <command>service httpd stop</command> command as the Linux root user to stop the <systemitem class="daemon">httpd</systemitem> process:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To make the <systemitem class="daemon">httpd</systemitem> process run " -"unconfined, run the following command as the Linux root user to change the " -"type of <filename>/usr/sbin/httpd</filename>, to a type that does not " -"transition to a confined domain:" +msgid "To make the <systemitem class="daemon">httpd</systemitem> process run unconfined, run the following command as the Linux root user to change the type of <filename>/usr/sbin/httpd</filename>, to a type that does not transition to a confined domain:" msgstr ""

#. Tag: para @@ -339,92 +191,47 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that " -"<filename>/usr/sbin/httpd</filename> is labeled with the " -"<computeroutput>unconfined_exec_t</computeroutput> type:" -msgstr "" -"Führen Sie den Befehl <command>ls -Z /usr/sbin/httpd</command> aus um " -"sicherzugehen, dass <filename>/usr/sbin/httpd</filename> mit dem Typ " -"<computeroutput>unconfined_exec_t</computeroutput> gekennzeichnet ist." +msgid "Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that <filename>/usr/sbin/httpd</filename> is labeled with the <computeroutput>unconfined_exec_t</computeroutput> type:" +msgstr "Führen Sie den Befehl <command>ls -Z /usr/sbin/httpd</command> aus um sicherzugehen, dass <filename>/usr/sbin/httpd</filename> mit dem Typ <computeroutput>unconfined_exec_t</computeroutput> gekennzeichnet ist."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ps -eZ | grep httpd</command> command to view the " -"<systemitem class="daemon">httpd</systemitem> running in the " -"<computeroutput>unconfined_t</computeroutput> domain:" -msgstr "" -"Führen Sie den Befehl <command>ps -eZ | grep httpd</command> aus, um sehen " -"zu können, dass der Dienst <systemitem class="daemon">httpd</systemitem> " -"unter der Domäne <computeroutput>unconfined_t</computeroutput> läuft:" +msgid "Run the <command>ps -eZ | grep httpd</command> command to view the <systemitem class="daemon">httpd</systemitem> running in the <computeroutput>unconfined_t</computeroutput> domain:" +msgstr "Führen Sie den Befehl <command>ps -eZ | grep httpd</command> aus, um sehen zu können, dass der Dienst <systemitem class="daemon">httpd</systemitem> unter der Domäne <computeroutput>unconfined_t</computeroutput> läuft:"

#. Tag: para #, no-c-format -msgid "" -"Change into a directory where your Linux user has write access to, and run " -"the <command>wget http://localhost/test2file</command> command. Unless there " -"are changes to the default configuration, this command succeeds:" +msgid "Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/test2file</command> command. Unless there are changes to the default configuration, this command succeeds:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Although the <systemitem class="daemon">httpd</systemitem> process does " -"not have access to files labeled with the <computeroutput>samba_share_t</" -"computeroutput> type, <systemitem class="daemon">httpd</systemitem> is " -"running in the unconfined <computeroutput>unconfined_t</computeroutput> " -"domain, and falls back to using DAC rules, and as such, the <command>wget</" -"command> command succeeds. Had <systemitem class="daemon">httpd</" -"systemitem> been running in the confined <computeroutput>httpd_t</" -"computeroutput> domain, the <command>wget</command> command would have " -"failed." +msgid "Although the <systemitem class="daemon">httpd</systemitem> process does not have access to files labeled with the <computeroutput>samba_share_t</computeroutput> type, <systemitem class="daemon">httpd</systemitem> is running in the unconfined <computeroutput>unconfined_t</computeroutput> domain, and falls back to using DAC rules, and as such, the <command>wget</command> command succeeds. Had <systemitem class="daemon">httpd</systemitem> been running in the confined <computeroutput>httpd_t</computeroutput> domain, the <command>wget</command> command would have failed." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>restorecon</command> command restores the default SELinux " -"context for files. As the Linux root user, run the <command>restorecon -v /" -"usr/sbin/httpd</command> command to restore the default SELinux context for " -"<filename>/usr/sbin/httpd</filename>:" +msgid "The <command>restorecon</command> command restores the default SELinux context for files. As the Linux root user, run the <command>restorecon -v /usr/sbin/httpd</command> command to restore the default SELinux context for <filename>/usr/sbin/httpd</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that " -"<filename>/usr/sbin/httpd</filename> is labeled with the " -"<computeroutput>httpd_exec_t</computeroutput> type:" -msgstr "" -"Führen Sie den Befehl <command>ls -Z /usr/sbin/httpd</command> aus um " -"sicherzugehen dass <filename>/usr/sbin/httpd</filename> mit dem Typ " -"<computeroutput>httpd_exec_t</computeroutput> gekennzeichnet ist:" +msgid "Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that <filename>/usr/sbin/httpd</filename> is labeled with the <computeroutput>httpd_exec_t</computeroutput> type:" +msgstr "Führen Sie den Befehl <command>ls -Z /usr/sbin/httpd</command> aus um sicherzugehen dass <filename>/usr/sbin/httpd</filename> mit dem Typ <computeroutput>httpd_exec_t</computeroutput> gekennzeichnet ist:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/service httpd restart</" -"command> command to restart <systemitem class="daemon">httpd</systemitem>. " -"After restarting, run the <command>ps -eZ | grep httpd</command> to confirm " -"that <systemitem class="daemon">httpd</systemitem> is running in the " -"confined <computeroutput>httpd_t</computeroutput> domain:" +msgid "As the Linux root user, run the <command>/sbin/service httpd restart</command> command to restart <systemitem class="daemon">httpd</systemitem>. After restarting, run the <command>ps -eZ | grep httpd</command> to confirm that <systemitem class="daemon">httpd</systemitem> is running in the confined <computeroutput>httpd_t</computeroutput> domain:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>rm -i /var/www/html/test2file</" -"command> command to remove <filename>test2file</filename>." +msgid "As the Linux root user, run the <command>rm -i /var/www/html/test2file</command> command to remove <filename>test2file</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The examples in these sections demonstrate how data can be protected from a " -"compromised confined-process (protected by SELinux), as well as how data is " -"more accessible to an attacker from a compromised unconfined-process (not " -"protected by SELinux)." +msgid "The examples in these sections demonstrate how data can be protected from a compromised confined-process (protected by SELinux), as well as how data is more accessible to an attacker from a compromised unconfined-process (not protected by SELinux)." msgstr ""

#. Tag: title @@ -434,86 +241,47 @@

#. Tag: para #, no-c-format -msgid "" -"Each Linux user is mapped to an SELinux user via SELinux policy. This allows " -"Linux users to inherit the restrictions on SELinux users. This Linux user " -"mapping is seen by running the <command>semanage login -l</command> command " -"as the Linux root user:" +msgid "Each Linux user is mapped to an SELinux user via SELinux policy. This allows Linux users to inherit the restrictions on SELinux users. This Linux user mapping is seen by running the <command>semanage login -l</command> command as the Linux root user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux " -"<computeroutput>__default__</computeroutput> login by default (which is " -"mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). " -"The following defines the default-mapping:" +msgid "In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). The following defines the default-mapping:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates adding a new Linux user, and that Linux " -"user being mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user. It assumes that the Linux root user is running " -"unconfined, as it does by default in Fedora&nbsp;&PRODVER;:" +msgid "The following example demonstrates adding a new Linux user, and that Linux user being mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user. It assumes that the Linux root user is running unconfined, as it does by default in Fedora&nbsp;&PRODVER;:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> " -"command to create a new Linux user named newuser." +msgid "As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> command to create a new Linux user named newuser." msgstr ""

#. Tag: para #, fuzzy, no-c-format -msgid "" -"As the Linux root user, run the <command>passwd newuser</command> command to " -"assign a password to the Linux newuser user:" -msgstr "" -"Führen Sie als Linux Benutzer root den Befehl <command>rm -i /var/www/html/" -"testfile</command> aus, um <filename>testfile</filename> zu löschen." +msgid "As the Linux root user, run the <command>passwd newuser</command> command to assign a password to the Linux newuser user:" +msgstr "Führen Sie als Linux Benutzer root den Befehl <command>rm -i /var/www/html/testfile</command> aus, um <filename>testfile</filename> zu löschen."

#. Tag: para #, no-c-format -msgid "" -"Log out of your current session, and log in as the Linux newuser user. When " -"you log in, pam_selinux maps the Linux user to an SELinux user (in this " -"case, unconfined_u), and sets up the resulting SELinux context. The Linux " -"user's shell is then launched with this context. Run the <command>id -Z</" -"command> command to view the context of a Linux user:" +msgid "Log out of your current session, and log in as the Linux newuser user. When you log in, pam_selinux maps the Linux user to an SELinux user (in this case, unconfined_u), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run the <command>id -Z</command> command to view the context of a Linux user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Log out of the Linux newuser's session, and log in with your account. If you " -"do not want the Linux newuser user, run the <command>/usr/sbin/userdel -r " -"newuser</command> command as the Linux root user to remove it, along with " -"the Linux newuser's home directory." +msgid "Log out of the Linux newuser's session, and log in with your account. If you do not want the Linux newuser user, run the <command>/usr/sbin/userdel -r newuser</command> command as the Linux root user to remove it, along with the Linux newuser's home directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Confined and unconfined Linux users are subject to executable and writeable " -"memory checks, and are also restricted by MCS (and MLS, if the MLS policy is " -"used). If unconfined Linux users execute an application that SELinux policy " -"defines can transition from the <computeroutput>unconfined_t</" -"computeroutput> domain to its own confined domain, unconfined Linux users " -"are still subject to the restrictions of that confined domain. The security " -"benefit of this is that, even though a Linux user is running unconfined, the " -"application remains confined, and therefore, the exploitation of a flaw in " -"the application can be limited by policy. Note: this does not protect the " -"system from the user. Instead, the user and the system are being protected " -"from possible damage caused by a flaw in the application." +msgid "Confined and unconfined Linux users are subject to executable and writeable memory checks, and are also restricted by MCS (and MLS, if the MLS policy is used). If unconfined Linux users execute an application that SELinux policy defines can transition from the <computeroutput>unconfined_t</computeroutput> domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy. Note: this does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following confined SELinux users are available in Fedora&nbsp;&PRODVER;:" +msgid "The following confined SELinux users are available in Fedora&nbsp;&PRODVER;:" msgstr ""

#. Tag: title @@ -618,71 +386,37 @@

#. Tag: para #, no-c-format -msgid "" -"Linux users in the <computeroutput>guest_t</computeroutput>, " -"<computeroutput>xguest_t</computeroutput>, and <computeroutput>user_t</" -"computeroutput> domains can only run set user ID (setuid) applications if " -"SELinux policy permits it (such as <command>passwd</command>). They can not " -"run the <command>su</command> and <command>/usr/bin/sudo</command> setuid " -"applications, and therefore, can not use these applications to become the " -"Linux root user." +msgid "Linux users in the <computeroutput>guest_t</computeroutput>, <computeroutput>xguest_t</computeroutput>, and <computeroutput>user_t</computeroutput> domains can only run set user ID (setuid) applications if SELinux policy permits it (such as <command>passwd</command>). They can not run the <command>su</command> and <command>/usr/bin/sudo</command> setuid applications, and therefore, can not use these applications to become the Linux root user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Linux users in the <computeroutput>guest_t</computeroutput> domain have no " -"network access, and can only log in via a terminal (including <systemitem " -"class="daemon">ssh</systemitem>; they can log in via <systemitem class=" -""daemon">ssh</systemitem>, but can not use <systemitem class="daemon" -"">ssh</systemitem> to connect to another system)." +msgid "Linux users in the <computeroutput>guest_t</computeroutput> domain have no network access, and can only log in via a terminal (including <systemitem class="daemon">ssh</systemitem>; they can log in via <systemitem class="daemon">ssh</systemitem>, but can not use <systemitem class="daemon">ssh</systemitem> to connect to another system)." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The only network access Linux users in the <computeroutput>xguest_t</" -"computeroutput> domain have is <application>Firefox</application> connecting " -"to web pages." +msgid "The only network access Linux users in the <computeroutput>xguest_t</computeroutput> domain have is <application>Firefox</application> connecting to web pages." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Linux users in the <computeroutput>xguest_t</computeroutput>, " -"<computeroutput>user_t</computeroutput> and <computeroutput>staff_t</" -"computeroutput> domains can log in via the X Window System and a terminal." +msgid "Linux users in the <computeroutput>xguest_t</computeroutput>, <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can log in via the X Window System and a terminal." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users in the <computeroutput>staff_t</computeroutput> " -"domain do not have permissions to execute applications with <command>/usr/" -"bin/sudo</command>. These permissions must be configured by an administrator." +msgid "By default, Linux users in the <computeroutput>staff_t</computeroutput> domain do not have permissions to execute applications with <command>/usr/bin/sudo</command>. These permissions must be configured by an administrator." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users in the <computeroutput>guest_t</computeroutput> and " -"<computeroutput>xguest_t</computeroutput> domains can not execute " -"applications in their home directories or <filename>/tmp/</filename>, " -"preventing them from executing applications (which inherit users' " -"permissions) in directories they have write access to. This helps prevent " -"flawed or malicious applications from modifying files users' own." +msgid "By default, Linux users in the <computeroutput>guest_t</computeroutput> and <computeroutput>xguest_t</computeroutput> domains can not execute applications in their home directories or <filename>/tmp/</filename>, preventing them from executing applications (which inherit users' permissions) in directories they have write access to. This helps prevent flawed or malicious applications from modifying files users' own." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users in the <computeroutput>user_t</computeroutput> and " -"<computeroutput>staff_t</computeroutput> domains can execute applications in " -"their home directories and <filename>/tmp/</filename>. Refer to <xref " -"linkend="sect-Security-Enhanced_Linux-Confining_Users-" -"Booleans_for_Users_Executing_Applications" /> for information about " -"allowing and preventing users from executing applications in their home " -"directories and <filename>/tmp/</filename>." +msgid "By default, Linux users in the <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can execute applications in their home directories and <filename>/tmp/</filename>. Refer to <xref linkend="sect-Security-Enhanced_Linux-Confining_Users-Booleans_for_Users_Executing_Applications" /> for information about allowing and preventing users from executing applications in their home directories and <filename>/tmp/</filename>." msgstr ""

#~ msgid "" @@ -692,12 +426,8 @@ #~ "# /sbin/service httpd start\n" #~ "Starting httpd: [ OK ]"

-#~ msgid "" -#~ "-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/" -#~ "html/testfile" -#~ msgstr "" -#~ "-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/" -#~ "html/testfile" +#~ msgid "-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/testfile" +#~ msgstr "-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/testfile"

#~ msgid "" #~ "--2009-05-06 23:00:54-- http://localhost/testfile%5Cn" @@ -720,41 +450,19 @@ #~ "Stopping httpd: [ OK ]"

#~ msgid "" -#~ "type=AVC msg=audit(1220706212.937:70): avc: denied { getattr } for " -#~ "pid=1904 comm="httpd" path="/var/www/html/testfile" dev=sda5 " -#~ "ino=247576 scontext=unconfined_u:system_r:httpd_t:s0 " -#~ "tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file\n" +#~ "type=AVC msg=audit(1220706212.937:70): avc: denied { getattr } for pid=1904 comm="httpd" path="/var/www/html/testfile" dev=sda5 ino=247576 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file\n" #~ "\n" -#~ "type=SYSCALL msg=audit(1220706212.937:70): arch=40000003 syscall=196 " -#~ "success=no exit=-13 a0=b9e21da0 a1=bf9581dc a2=555ff4 a3=2008171 items=0 " -#~ "ppid=1902 pid=1904 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 " -#~ "egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm="httpd" exe="/usr/sbin/" -#~ "httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)" +#~ "type=SYSCALL msg=audit(1220706212.937:70): arch=40000003 syscall=196 success=no exit=-13 a0=b9e21da0 a1=bf9581dc a2=555ff4 a3=2008171 items=0 ppid=1902 pid=1904 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)" #~ msgstr "" -#~ "type=AVC msg=audit(1220706212.937:70): avc: denied { getattr } for " -#~ "pid=1904 comm="httpd" path="/var/www/html/testfile" dev=sda5 " -#~ "ino=247576 scontext=unconfined_u:system_r:httpd_t:s0 " -#~ "tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file\n" +#~ "type=AVC msg=audit(1220706212.937:70): avc: denied { getattr } for pid=1904 comm="httpd" path="/var/www/html/testfile" dev=sda5 ino=247576 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file\n" #~ "\n" -#~ "type=SYSCALL msg=audit(1220706212.937:70): arch=40000003 syscall=196 " -#~ "success=no exit=-13 a0=b9e21da0 a1=bf9581dc a2=555ff4 a3=2008171 items=0 " -#~ "ppid=1902 pid=1904 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 " -#~ "egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm="httpd" exe="/usr/sbin/" -#~ "httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)" +#~ "type=SYSCALL msg=audit(1220706212.937:70): arch=40000003 syscall=196 success=no exit=-13 a0=b9e21da0 a1=bf9581dc a2=555ff4 a3=2008171 items=0 ppid=1902 pid=1904 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)"

-#~ msgid "" -#~ "-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/" -#~ "www/html/test2file" -#~ msgstr "" -#~ "-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/" -#~ "www/html/test2file" +#~ msgid "-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/test2file" +#~ msgstr "-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/test2file"

-#~ msgid "" -#~ "-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/" -#~ "html/test2file" -#~ msgstr "" -#~ "-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/" -#~ "html/test2file" +#~ msgid "-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/test2file" +#~ msgstr "-rw-r--r-- root root unconfined_u:object_r:samba_share_t:s0 /var/www/html/test2file"

#~ msgid "" #~ "$ /sbin/service httpd status\n" @@ -763,19 +471,15 @@ #~ "$ /sbin/service httpd status\n" #~ "httpd is stopped"

-#~ msgid "" -#~ "-rwxr-xr-x root root system_u:object_r:unconfined_exec_t /usr/sbin/httpd" -#~ msgstr "" -#~ "-rwxr-xr-x root root system_u:object_r:unconfined_exec_t /usr/sbin/httpd" +#~ msgid "-rwxr-xr-x root root system_u:object_r:unconfined_exec_t /usr/sbin/httpd" +#~ msgstr "-rwxr-xr-x root root system_u:object_r:unconfined_exec_t /usr/sbin/httpd"

#~ msgid "" #~ "# /sbin/restorecon -v /usr/sbin/httpd\n" -#~ "restorecon reset /usr/sbin/httpd context system_u:object_r:" -#~ "unconfined_notrans_exec_t:s0-&gt;system_u:object_r:httpd_exec_t:s0" +#~ "restorecon reset /usr/sbin/httpd context system_u:object_r:unconfined_notrans_exec_t:s0-&gt;system_u:object_r:httpd_exec_t:s0" #~ msgstr "" #~ "# /sbin/restorecon -v /usr/sbin/httpd\n" -#~ "restorecon reset /usr/sbin/httpd context system_u:object_r:" -#~ "unconfined_notrans_exec_t:s0-&gt;system_u:object_r:httpd_exec_t:s0" +#~ "restorecon reset /usr/sbin/httpd context system_u:object_r:unconfined_notrans_exec_t:s0-&gt;system_u:object_r:httpd_exec_t:s0"

#~ msgid "" #~ "$ ls -Z /usr/sbin/httpd\n" @@ -835,16 +539,13 @@ #~ "# passwd newuser\n" #~ "Changing password for user newuser.\n" #~ "New UNIX password: <replaceable>Enter a password</replaceable> \n" -#~ "Retype new UNIX password: <replaceable>Enter the same password again</" -#~ "replaceable> \n" +#~ "Retype new UNIX password: <replaceable>Enter the same password again</replaceable> \n" #~ "passwd: all authentication tokens updated successfully." #~ msgstr "" #~ "# passwd neueruser\n" #~ "Ändert das Passwort für den Benutzer neueruser.\n" -#~ "Neues UNIX Passwort: <replaceable>Geben Sie ein Passwort ein </" -#~ "replaceable>\n" -#~ "Passwort nochmals eingeben:<replaceable> Geben Sie das gleiche Passwort " -#~ "nochmals ein</replaceable>\n" +#~ "Neues UNIX Passwort: <replaceable>Geben Sie ein Passwort ein </replaceable>\n" +#~ "Passwort nochmals eingeben:<replaceable> Geben Sie das gleiche Passwort nochmals ein</replaceable>\n" #~ "passwd: alle Authentifizierungsmerkmale wurden erfolgreich aktualisiert."

#~ msgid "<entry>no</entry>"

Modified: community/branches/f13/de-DE/Trademarks.po =================================================================== --- community/branches/f13/de-DE/Trademarks.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Trademarks.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -25,9 +26,7 @@

#. Tag: para #, no-c-format -msgid "" -"<trademark class="registered">Linux</trademark> is the registered " -"trademark of Linus Torvalds in the U.S. and other countries." +msgid "<trademark class="registered">Linux</trademark> is the registered trademark of Linus Torvalds in the U.S. and other countries." msgstr ""

#. Tag: para @@ -37,11 +36,7 @@

#. Tag: para #, no-c-format -msgid "" -"Type Enforcement is a trademark of Secure Computing, LLC, a wholly owned " -"subsidiary of McAfee, Inc., registered in the U.S. and in other countries. " -"Neither McAfee nor Secure Computing, LLC, has consented to the use or " -"reference to this trademark by the author outside of this guide." +msgid "Type Enforcement is a trademark of Secure Computing, LLC, a wholly owned subsidiary of McAfee, Inc., registered in the U.S. and in other countries. Neither McAfee nor Secure Computing, LLC, has consented to the use or reference to this trademark by the author outside of this guide." msgstr ""

#. Tag: para @@ -51,15 +46,12 @@

#. Tag: para #, no-c-format -msgid "" -"MySQL is a trademark or registered trademark of MySQL AB in the U.S. and " -"other countries." +msgid "MySQL is a trademark or registered trademark of MySQL AB in the U.S. and other countries." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Other products mentioned may be trademarks of their respective corporations." +msgid "Other products mentioned may be trademarks of their respective corporations." msgstr ""

#. Tag: title @@ -69,8 +61,5 @@

#. Tag: para #, no-c-format -msgid "" -"The XML source for this guide is available at <ulink url="http://svn." -"fedorahosted.org/svn/selinuxguide/">http://svn.fedorahosted.org/svn/" -"selinuxguide/</ulink>" +msgid "The XML source for this guide is available at <ulink url="http://svn.fedorahosted.org/svn/selinuxguide/%5C%22%3Ehttp://svn.fedorahoste...</ulink>" msgstr ""

Modified: community/branches/f13/de-DE/Troubleshooting.po =================================================================== --- community/branches/f13/de-DE/Troubleshooting.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Troubleshooting.po 2010-11-21 23:12:12 UTC (rev 492) @@ -11,6 +11,7 @@ "PO-Revision-Date: 2010-02-19 09:48+0100\n" "Last-Translator: gerd\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -25,11 +26,7 @@

#. Tag: para #, no-c-format -msgid "" -"The following chapter describes what happens when SELinux denies access; the " -"top three causes of problems; where to find information about correct " -"labeling; analyzing SELinux denials; and creating custom policy modules with " -"<command>audit2allow</command>." +msgid "The following chapter describes what happens when SELinux denies access; the top three causes of problems; where to find information about correct labeling; analyzing SELinux denials; and creating custom policy modules with <command>audit2allow</command>." msgstr ""

#. Tag: title @@ -39,12 +36,7 @@

#. Tag: para #, no-c-format -msgid "" -"SELinux decisions, such as allowing or disallowing access, are cached. This " -"cache is known as the Access Vector Cache (AVC). Denial messages are logged " -"when SELinux denies access. These denials are also known as "AVC denials", " -"and are logged to a different location, depending on which daemons are " -"running:" +msgid "SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). Denial messages are logged when SELinux denies access. These denials are also known as "AVC denials", and are logged to a different location, depending on which daemons are running:" msgstr ""

#. Tag: segtitle @@ -84,40 +76,22 @@

#. Tag: seg #, no-c-format -msgid "" -"<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial " -"messages also sent to <filename>/var/log/messages</filename>" +msgid "<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial messages also sent to <filename>/var/log/messages</filename>" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you are running the X Window System, have the <package>setroubleshoot</" -"package> and <package>setroubleshoot-server</package> packages installed, " -"and the <systemitem class="daemon">setroubleshootd</systemitem> and " -"<systemitem class="daemon">auditd</systemitem> daemons are running, a " -"warning is displayed when access is denied by SELinux:" +msgid "If you are running the X Window System, have the <package>setroubleshoot</package> and <package>setroubleshoot-server</package> packages installed, and the <systemitem class="daemon">setroubleshootd</systemitem> and <systemitem class="daemon">auditd</systemitem> daemons are running, a warning is displayed when access is denied by SELinux:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Clicking on 'Show' presents a detailed analysis of why SELinux denied " -"access, and a possible solution for allowing access. If you are not running " -"the X Window System, it is less obvious when access is denied by SELinux. " -"For example, users browsing your website may receive an error similar to the " -"following:" +msgid "Clicking on 'Show' presents a detailed analysis of why SELinux denied access, and a possible solution for allowing access. If you are not running the X Window System, it is less obvious when access is denied by SELinux. For example, users browsing your website may receive an error similar to the following:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For these situations, if DAC rules (standard Linux permissions) allow " -"access, check <filename>/var/log/messages</filename> and <filename>/var/log/" -"audit/audit.log</filename> for <computeroutput>"SELinux is preventing"</" -"computeroutput> and <computeroutput>"denied"</computeroutput> errors " -"respectively. This can be done by running the following commands as the " -"Linux root user:" +msgid "For these situations, if DAC rules (standard Linux permissions) allow access, check <filename>/var/log/messages</filename> and <filename>/var/log/audit/audit.log</filename> for <computeroutput>"SELinux is preventing"</computeroutput> and <computeroutput>"denied"</computeroutput> errors respectively. This can be done by running the following commands as the Linux root user:" msgstr ""

#. Tag: para @@ -137,10 +111,7 @@

#. Tag: para #, no-c-format -msgid "" -"The following sections describe the top three causes of problems: labeling " -"problems, configuring Booleans and ports for services, and evolving SELinux " -"rules." +msgid "The following sections describe the top three causes of problems: labeling problems, configuring Booleans and ports for services, and evolving SELinux rules." msgstr ""

#. Tag: title @@ -150,54 +121,22 @@

#. Tag: para #, no-c-format -msgid "" -"On systems running SELinux, all processes and files are labeled with a label " -"that contains security-relevant information. This information is called the " -"SELinux context. If these labels are wrong, access may be denied. If an " -"application is labeled incorrectly, the process it transitions to may not " -"have the correct label, possibly causing SELinux to deny access, and the " -"process being able to create mislabeled files." +msgid "On systems running SELinux, all processes and files are labeled with a label that contains security-relevant information. This information is called the SELinux context. If these labels are wrong, access may be denied. If an application is labeled incorrectly, the process it transitions to may not have the correct label, possibly causing SELinux to deny access, and the process being able to create mislabeled files." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"A common cause of labeling problems is when a non-standard directory is used " -"for a service. For example, instead of using <filename>/var/www/html/</" -"filename> for a website, an administrator wants to use <filename>/srv/myweb/" -"</filename>. On Fedora&nbsp;&PRODVER;, the <filename>/srv/</filename> " -"directory is labeled with the <computeroutput>var_t</computeroutput> type. " -"Files and directories created and <filename>/srv/</filename> inherit this " -"type. Also, newly-created top-level directories (such as <filename>/myserver/" -"</filename>) may be labeled with the <computeroutput>default_t</" -"computeroutput> type. SELinux prevents the Apache HTTP Server (<systemitem " -"class="daemon">httpd</systemitem>) from accessing both of these types. To " -"allow access, SELinux must know that the files in <filename>/srv/myweb/</" -"filename> are to be accessible to <systemitem class="daemon">httpd</" -"systemitem>:" +msgid "A common cause of labeling problems is when a non-standard directory is used for a service. For example, instead of using <filename>/var/www/html/</filename> for a website, an administrator wants to use <filename>/srv/myweb/</filename>. On Fedora&nbsp;&PRODVER;, the <filename>/srv/</filename> directory is labeled with the <computeroutput>var_t</computeroutput> type. Files and directories created and <filename>/srv/</filename> inherit this type. Also, newly-created top-level directories (such as <filename>/myserver/</filename>) may be labeled with the <computeroutput>default_t</computeroutput> type. SELinux prevents the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) from accessing both of these types. To allow access, SELinux must know that the files in <filename>/srv/myweb/</filename> are to be accessible to <systemitem class="daemon">httpd</systemitem>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This <command>semanage</command> command adds the context for the <filename>/" -"srv/myweb/</filename> directory (and all files and directories under it) to " -"the SELinux file-context configuration<footnote> <para> Files in <filename>/" -"etc/selinux/targeted/contexts/files/</filename> define contexts for files " -"and directories. Files in this directory are read by <command>restorecon</" -"command> and <command>setfiles</command> to restore files and directories to " -"their default contexts. </para> </footnote>. The <command>semanage</command> " -"command does not change the context. As the Linux root user, run the " -"<command>restorecon</command> command to apply the changes:" +msgid "This <command>semanage</command> command adds the context for the <filename>/srv/myweb/</filename> directory (and all files and directories under it) to the SELinux file-context configuration<footnote> <para> Files in <filename>/etc/selinux/targeted/contexts/files/</filename> define contexts for files and directories. Files in this directory are read by <command>restorecon</command> and <command>setfiles</command> to restore files and directories to their default contexts. </para> </footnote>. The <command>semanage</command> command does not change the context. As the Linux root user, run the <command>restorecon</command> command to apply the changes:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to <xref linkend="sect-Security-Enhanced_Linux-" -"SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> " -"for further information about adding contexts to the file-context " -"configuration." +msgid "Refer to <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> for further information about adding contexts to the file-context configuration." msgstr ""

#. Tag: title @@ -207,39 +146,22 @@

#. Tag: para #, no-c-format -msgid "" -"The <command>matchpathcon</command> command checks the context of a file " -"path and compares it to the default label for that path. The following " -"example demonstrates using <command>matchpathcon</command> on a directory " -"that contains incorrectly labeled files:" +msgid "The <command>matchpathcon</command> command checks the context of a file path and compares it to the default label for that path. The following example demonstrates using <command>matchpathcon</command> on a directory that contains incorrectly labeled files:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, the <filename>index.html</filename> and <filename>page1." -"html</filename> files are labeled with the <computeroutput>user_home_t</" -"computeroutput> type. This type is used for files in user home directories. " -"Using the <command>mv</command> command to move files from your home " -"directory may result in files being labeled with the " -"<computeroutput>user_home_t</computeroutput> type. This type should not " -"exist outside of home directories. Use the <command>restorecon</command> " -"command to restore such files to their correct type:" +msgid "In this example, the <filename>index.html</filename> and <filename>page1.html</filename> files are labeled with the <computeroutput>user_home_t</computeroutput> type. This type is used for files in user home directories. Using the <command>mv</command> command to move files from your home directory may result in files being labeled with the <computeroutput>user_home_t</computeroutput> type. This type should not exist outside of home directories. Use the <command>restorecon</command> command to restore such files to their correct type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To restore the context for all files under a directory, use the <option>-R</" -"option> option:" +msgid "To restore the context for all files under a directory, use the <option>-R</option> option:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to <xref linkend="sect-Security-Enhanced_Linux-" -"Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context" /> for a " -"more detailed example of <command>matchpathcon</command>." +msgid "Refer to <xref linkend="sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context" /> for a more detailed example of <command>matchpathcon</command>." msgstr ""

#. Tag: title @@ -249,42 +171,22 @@

#. Tag: para #, no-c-format -msgid "" -"Services can be run in a variety of ways. To cater for this, you must tell " -"SELinux how you are running services. This can be achieved via Booleans that " -"allow parts of SELinux policy to be changed at runtime, without any " -"knowledge of SELinux policy writing. This allows changes, such as allowing " -"services access to NFS file systems, without reloading or recompiling " -"SELinux policy. Also, running services on non-default port numbers requires " -"policy configuration to be updated via the <command>semanage</command> " -"command." +msgid "Services can be run in a variety of ways. To cater for this, you must tell SELinux how you are running services. This can be achieved via Booleans that allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing. This allows changes, such as allowing services access to NFS file systems, without reloading or recompiling SELinux policy. Also, running services on non-default port numbers requires policy configuration to be updated via the <command>semanage</command> command." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For example, to allow the Apache HTTP Server to communicate with MySQL, turn " -"the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean on:" +msgid "For example, to allow the Apache HTTP Server to communicate with MySQL, turn the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean on:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If access is denied for a particular service, use the <command>getsebool</" -"command> and <command>grep</command> commands to see if any Booleans are " -"available to allow access. For example, use the <command>getsebool -a | grep " -"ftp</command> command to search for FTP related Booleans:" +msgid "If access is denied for a particular service, use the <command>getsebool</command> and <command>grep</command> commands to see if any Booleans are available to allow access. For example, use the <command>getsebool -a | grep ftp</command> command to search for FTP related Booleans:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For a list of Booleans and whether they are on or off, run the <command>/usr/" -"sbin/getsebool -a</command> command. For a list of Booleans, an explanation " -"of what each one is, and whether they are on or off, run the <command>/usr/" -"sbin/semanage boolean -l</command> command as the Linux root user. Refer to " -"<xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans" -"" /> for information about listing and configuring Booleans." +msgid "For a list of Booleans and whether they are on or off, run the <command>/usr/sbin/getsebool -a</command> command. For a list of Booleans, an explanation of what each one is, and whether they are on or off, run the <command>/usr/sbin/semanage boolean -l</command> command as the Linux root user. Refer to <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans" /> for information about listing and configuring Booleans." msgstr ""

#. Tag: title @@ -294,52 +196,27 @@

#. Tag: para #, no-c-format -msgid "" -"Depending on policy configuration, services may only be allowed to run on " -"certain port numbers. Attempting to change the port a service runs on " -"without changing policy may result in the service failing to start. For " -"example, run the <command>semanage port -l | grep http</command> command as " -"the Linux root user to list <systemitem class="daemon">http</systemitem> " -"related ports:" +msgid "Depending on policy configuration, services may only be allowed to run on certain port numbers. Attempting to change the port a service runs on without changing policy may result in the service failing to start. For example, run the <command>semanage port -l | grep http</command> command as the Linux root user to list <systemitem class="daemon">http</systemitem> related ports:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>http_port_t</computeroutput> port type defines the ports " -"Apache HTTP Server can listen on, which in this case, are TCP ports 80, 443, " -"488, 8008, 8009, and 8443. If an administrator configures <filename>httpd." -"conf</filename> so that <systemitem class="daemon">httpd</systemitem> " -"listens on port 9876 (<option>Listen 9876</option>), but policy is not " -"updated to reflect this, the <command>service httpd start</command> command " -"fails:" +msgid "The <computeroutput>http_port_t</computeroutput> port type defines the ports Apache HTTP Server can listen on, which in this case, are TCP ports 80, 443, 488, 8008, 8009, and 8443. If an administrator configures <filename>httpd.conf</filename> so that <systemitem class="daemon">httpd</systemitem> listens on port 9876 (<option>Listen 9876</option>), but policy is not updated to reflect this, the <command>service httpd start</command> command fails:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"An SELinux denial similar to the following is logged to <filename>/var/log/" -"audit/audit.log</filename>:" +msgid "An SELinux denial similar to the following is logged to <filename>/var/log/audit/audit.log</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To allow <systemitem class="daemon">httpd</systemitem> to listen on a port " -"that is not listed for the <computeroutput>http_port_t</computeroutput> port " -"type, run the <command>semanage port</command> command to add a port to " -"policy configuration<footnote> <para> The <command>semanage port -a</" -"command> command adds an entry to the <filename>/etc/selinux/targeted/" -"modules/active/ports.local</filename> file. Note: by default, this file can " -"only be viewed by the Linux root user. </para> </footnote>:" +msgid "To allow <systemitem class="daemon">httpd</systemitem> to listen on a port that is not listed for the <computeroutput>http_port_t</computeroutput> port type, run the <command>semanage port</command> command to add a port to policy configuration<footnote> <para> The <command>semanage port -a</command> command adds an entry to the <filename>/etc/selinux/targeted/modules/active/ports.local</filename> file. Note: by default, this file can only be viewed by the Linux root user. </para> </footnote>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <option>-a</option> option adds a new record; the <option>-t</option> " -"option defines a type; and the <option>-p</option> option defines a " -"protocol. The last argument is the port number to add." +msgid "The <option>-a</option> option adds a new record; the <option>-t</option> option defines a type; and the <option>-p</option> option defines a protocol. The last argument is the port number to add." msgstr ""

#. Tag: title @@ -349,23 +226,12 @@

#. Tag: para #, no-c-format -msgid "" -"Applications may be broken, causing SELinux to deny access. Also, SELinux " -"rules are evolving - SELinux may not have seen an application running in a " -"certain way, possibly causing it to deny access, even though the application " -"is working as expected. For example, if a new version of PostgreSQL is " -"released, it may perform actions the current policy has not seen before, " -"causing access to be denied, even though access should be allowed." +msgid "Applications may be broken, causing SELinux to deny access. Also, SELinux rules are evolving - SELinux may not have seen an application running in a certain way, possibly causing it to deny access, even though the application is working as expected. For example, if a new version of PostgreSQL is released, it may perform actions the current policy has not seen before, causing access to be denied, even though access should be allowed." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For these situations, after access is denied, use <command>audit2allow</" -"command> to create a custom policy module to allow access. Refer to <xref " -"linkend="sect-Security-Enhanced_Linux-Fixing_Problems-" -"Allowing_Access_audit2allow" /> for information about using " -"<command>audit2allow</command>." +msgid "For these situations, after access is denied, use <command>audit2allow</command> to create a custom policy module to allow access. Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow" /> for information about using <command>audit2allow</command>." msgstr ""

#. Tag: title @@ -375,14 +241,7 @@

#. Tag: para #, no-c-format -msgid "" -"The following sections help troubleshoot issues. They go over: checking " -"Linux permissions, which are checked before SELinux rules; possible causes " -"of SELinux denying access, but no denials being logged; manual pages for " -"services, which contain information about labeling and Booleans; permissive " -"domains, for allowing one process to run permissive, rather than the whole " -"system; how to search for and view denial messages; analyzing denials; and " -"creating custom policy modules with <command>audit2allow</command>." +msgid "The following sections help troubleshoot issues. They go over: checking Linux permissions, which are checked before SELinux rules; possible causes of SELinux denying access, but no denials being logged; manual pages for services, which contain information about labeling and Booleans; permissive domains, for allowing one process to run permissive, rather than the whole system; how to search for and view denial messages; analyzing denials; and creating custom policy modules with <command>audit2allow</command>." msgstr ""

#. Tag: title @@ -392,50 +251,27 @@

#. Tag: para #, no-c-format -msgid "" -"When access is denied, check standard Linux permissions. As mentioned in " -"<xref linkend="chap-Security-Enhanced_Linux-Introduction" />, most " -"operating systems use a Discretionary Access Control (DAC) system to control " -"access, allowing users to control the permissions of files that they own. " -"SELinux policy rules are checked after DAC rules. SELinux policy rules are " -"not used if DAC rules deny access first." +msgid "When access is denied, check standard Linux permissions. As mentioned in <xref linkend="chap-Security-Enhanced_Linux-Introduction" />, most operating systems use a Discretionary Access Control (DAC) system to control access, allowing users to control the permissions of files that they own. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If access is denied and no SELinux denials are logged, use the <command>ls -" -"l</command> command to view the standard Linux permissions:" +msgid "If access is denied and no SELinux denials are logged, use the <command>ls -l</command> command to view the standard Linux permissions:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, <filename>index.html</filename> is owned by the root user " -"and group. The root user has read and write permissions (<computeroutput>-" -"rw</computeroutput>), and members of the root group have read permissions " -"(<computeroutput>-r-</computeroutput>). Everyone else has no access " -"(<computeroutput>---</computeroutput>). By default, such permissions do not " -"allow <systemitem class="daemon">httpd</systemitem> to read this file. To " -"resolve this issue, use the <command>chown</command> command to change the " -"owner and group. This command must be run as the Linux root user:" +msgid "In this example, <filename>index.html</filename> is owned by the root user and group. The root user has read and write permissions (<computeroutput>-rw</computeroutput>), and members of the root group have read permissions (<computeroutput>-r-</computeroutput>). Everyone else has no access (<computeroutput>---</computeroutput>). By default, such permissions do not allow <systemitem class="daemon">httpd</systemitem> to read this file. To resolve this issue, use the <command>chown</command> command to change the owner and group. This command must be run as the Linux root user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This assumes the default configuration, in which <systemitem class="daemon" -"">httpd</systemitem> runs as the Linux apache user. If you run <systemitem " -"class="daemon">httpd</systemitem> with a different user, replace " -"<computeroutput>apache:apache</computeroutput> with that user." +msgid "This assumes the default configuration, in which <systemitem class="daemon">httpd</systemitem> runs as the Linux apache user. If you run <systemitem class="daemon">httpd</systemitem> with a different user, replace <computeroutput>apache:apache</computeroutput> with that user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://fedoraproject.org/wiki/Docs/Drafts/" -"AdministrationGuide/Permissions">Fedora Documentation Project "Permissions" -""</ulink> draft for information about managing Linux permissions." +msgid "Refer to the <ulink url="http://fedoraproject.org/wiki/Docs/Drafts/AdministrationGuide/Permissions%5C... Documentation Project "Permissions"</ulink> draft for information about managing Linux permissions." msgstr ""

#. Tag: title @@ -445,24 +281,12 @@

#. Tag: para #, no-c-format -msgid "" -"In certain situations, AVC denials may not be logged when SELinux denies " -"access. Applications and system library functions often probe for more " -"access than required to perform their tasks. To maintain least privilege " -"without filling audit logs with AVC denials for harmless application " -"probing, the policy can silence AVC denials without allowing a permission by " -"using <computeroutput>dontaudit</computeroutput> rules. These rules are " -"common in standard policy. The downside of <computeroutput>dontaudit</" -"computeroutput> is that, although SELinux denies access, denial messages are " -"not logged, making troubleshooting hard." +msgid "In certain situations, AVC denials may not be logged when SELinux denies access. Applications and system library functions often probe for more access than required to perform their tasks. To maintain least privilege without filling audit logs with AVC denials for harmless application probing, the policy can silence AVC denials without allowing a permission by using <computeroutput>dontaudit</computeroutput> rules. These rules are common in standard policy. The downside of <computeroutput>dontaudit</computeroutput> is that, although SELinux denies access, denial messages are not logged, making troubleshooting hard." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To temporarily disable <computeroutput>dontaudit</computeroutput> rules, " -"allowing all denials to be logged, run the following command as the Linux " -"root user:" +msgid "To temporarily disable <computeroutput>dontaudit</computeroutput> rules, allowing all denials to be logged, run the following command as the Linux root user:" msgstr ""

#. Tag: para @@ -472,24 +296,12 @@

#. Tag: para #, no-c-format -msgid "" -"The <option>-D</option> option disables <computeroutput>dontaudit</" -"computeroutput> rules; the <option>-B</option> option rebuilds policy. After " -"running <command>semodule -DB</command>, try exercising the application that " -"was encountering permission problems, and see if SELinux denials &mdash; " -"relevant to the application &mdash; are now being logged. Take care in " -"deciding which denials should be allowed, as some should be ignored and " -"handled via <computeroutput>dontaudit</computeroutput> rules. If in doubt, " -"or in search of guidance, contact other SELinux users and developers on an " -"SELinux list, such as <ulink url="http://www.redhat.com/mailman/listinfo/" -"fedora-selinux-list">fedora-selinux-list</ulink>." +msgid "The <option>-D</option> option disables <computeroutput>dontaudit</computeroutput> rules; the <option>-B</option> option rebuilds policy. After running <command>semodule -DB</command>, try exercising the application that was encountering permission problems, and see if SELinux denials &mdash; relevant to the application &mdash; are now being logged. Take care in deciding which denials should be allowed, as some should be ignored and handled via <computeroutput>dontaudit</computeroutput> rules. If in doubt, or in search of guidance, contact other SELinux users and developers on an SELinux list, such as <ulink url="http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-se...</ulink>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To rebuild policy and enable <computeroutput>dontaudit</computeroutput> " -"rules, run the following command as the Linux root user:" +msgid "To rebuild policy and enable <computeroutput>dontaudit</computeroutput> rules, run the following command as the Linux root user:" msgstr ""

#. Tag: para @@ -499,21 +311,12 @@

#. Tag: para #, no-c-format -msgid "" -"This restores the policy to its original state. For a full list of " -"<computeroutput>dontaudit</computeroutput> rules, run the <command>sesearch " -"--dontaudit</command> command. Narrow down searches using the <option>-s " -"<replaceable>domain</replaceable></option> option and the <command>grep</" -"command> command. For example:" +msgid "This restores the policy to its original state. For a full list of <computeroutput>dontaudit</computeroutput> rules, run the <command>sesearch --dontaudit</command> command. Narrow down searches using the <option>-s <replaceable>domain</replaceable></option> option and the <command>grep</command> command. For example:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-" -"Raw_Audit_Messages" /> and <xref linkend="sect-Security-Enhanced_Linux-" -"Fixing_Problems-sealert_Messages" /> for information about analyzing " -"denials." +msgid "Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> and <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" /> for information about analyzing denials." msgstr ""

#. Tag: title @@ -523,13 +326,7 @@

#. Tag: para #, no-c-format -msgid "" -"Manual pages for services contain valuable information, such as what file " -"type to use for a given situation, and Booleans to change the access a " -"service has (such as <systemitem class="daemon">httpd</systemitem> " -"accessing NFS file systems). This information may be in the standard manual " -"page, or a manual page with <computeroutput>selinux</computeroutput> " -"prepended or appended." +msgid "Manual pages for services contain valuable information, such as what file type to use for a given situation, and Booleans to change the access a service has (such as <systemitem class="daemon">httpd</systemitem> accessing NFS file systems). This information may be in the standard manual page, or a manual page with <computeroutput>selinux</computeroutput> prepended or appended." msgstr ""

#. Tag: para @@ -544,11 +341,7 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page has information about what file type to use for a given " -"situation, as well as Booleans to allow scripts, sharing files, accessing " -"directories inside user home directories, and so on. Other manual pages with " -"SELinux information for services include:" +msgid "manual page has information about what file type to use for a given situation, as well as Booleans to allow scripts, sharing files, accessing directories inside user home directories, and so on. Other manual pages with SELinux information for services include:" msgstr ""

#. Tag: para @@ -563,11 +356,7 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes that files and directories to be exported via Samba " -"must be labeled with the <computeroutput>samba_share_t</computeroutput> " -"type, as well as Booleans to allow files labeled with types other than " -"<computeroutput>samba_share_t</computeroutput> to be exported via Samba." +msgid "manual page describes that files and directories to be exported via Samba must be labeled with the <computeroutput>samba_share_t</computeroutput> type, as well as Booleans to allow files labeled with types other than <computeroutput>samba_share_t</computeroutput> to be exported via Samba." msgstr ""

#. Tag: para @@ -582,11 +371,7 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes that, by default, file systems can not be exported via " -"NFS, and that to allow file systems to be exported, Booleans such as " -"<computeroutput>nfs_export_all_ro</computeroutput> or " -"<computeroutput>nfs_export_all_rw</computeroutput> must be turned on." +msgid "manual page describes that, by default, file systems can not be exported via NFS, and that to allow file systems to be exported, Booleans such as <computeroutput>nfs_export_all_ro</computeroutput> or <computeroutput>nfs_export_all_rw</computeroutput> must be turned on." msgstr ""

#. Tag: para @@ -601,10 +386,7 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes what file type to use for a given situation (see the " -"<computeroutput>Red Hat SELinux BIND Security Profile</computeroutput> " -"section). The" +msgid "manual page describes what file type to use for a given situation (see the <computeroutput>Red Hat SELinux BIND Security Profile</computeroutput> section). The" msgstr ""

#. Tag: refentrytitle @@ -614,18 +396,12 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes that, by default, <systemitem class="daemon">named</" -"systemitem> can not write to master zone files, and to allow such access, " -"the <computeroutput>named_write_master_zones</computeroutput> Boolean must " -"be turned on." +msgid "manual page describes that, by default, <systemitem class="daemon">named</systemitem> can not write to master zone files, and to allow such access, the <computeroutput>named_write_master_zones</computeroutput> Boolean must be turned on." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The information in manual pages helps you configure the correct file types " -"and Booleans, helping to prevent SELinux from denying access." +msgid "The information in manual pages helps you configure the correct file types and Booleans, helping to prevent SELinux from denying access." msgstr ""

#. Tag: title @@ -635,64 +411,32 @@

#. Tag: para #, no-c-format -msgid "" -"When SELinux is running in permissive mode, SELinux does not deny access, " -"but denials are logged for actions that would have been denied if running in " -"enforcing mode. Previously, it was not possible to make a single domain " -"permissive (remember: processes run in domains). In certain situations, this " -"led to making the whole system permissive to troubleshoot issues." +msgid "When SELinux is running in permissive mode, SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode. Previously, it was not possible to make a single domain permissive (remember: processes run in domains). In certain situations, this led to making the whole system permissive to troubleshoot issues." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Fedora&nbsp;&PRODVER; includes permissive domains, where an administrator " -"can configure a single process (domain) to run permissive, rather than " -"making the whole system permissive. SELinux checks are still performed for " -"permissive domains; however, the kernel allows access and reports an AVC " -"denial for situations where SELinux would have denied access. Permissive " -"domains are also available in Fedora 9 (with the latest updates applied)." +msgid "Fedora&nbsp;&PRODVER; includes permissive domains, where an administrator can configure a single process (domain) to run permissive, rather than making the whole system permissive. SELinux checks are still performed for permissive domains; however, the kernel allows access and reports an AVC denial for situations where SELinux would have denied access. Permissive domains are also available in Fedora 9 (with the latest updates applied)." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In Red Hat Enterprise Linux 4 and 5, <computeroutput><replaceable>domain</" -"replaceable>_disable_trans</computeroutput> Booleans are available to " -"prevent an application from transitioning to a confined domain, and " -"therefore, the process runs in an unconfined domain, such as " -"<computeroutput>initrc_t</computeroutput>. Turning such Booleans on can " -"cause major problems. For example, if the " -"<computeroutput>httpd_disable_trans</computeroutput> Boolean is turned on:" +msgid "In Red Hat Enterprise Linux 4 and 5, <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> Booleans are available to prevent an application from transitioning to a confined domain, and therefore, the process runs in an unconfined domain, such as <computeroutput>initrc_t</computeroutput>. Turning such Booleans on can cause major problems. For example, if the <computeroutput>httpd_disable_trans</computeroutput> Boolean is turned on:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<systemitem class="daemon">httpd</systemitem> runs in the unconfined " -"<computeroutput>initrc_t</computeroutput> domain. Files created by processes " -"running in the <computeroutput>initrc_t</computeroutput> domain may not have " -"the same labeling rules applied as files created by a process running in the " -"<computeroutput>httpd_t</computeroutput> domain, potentially allowing " -"processes to create mislabeled files. This causes access problems later on." +msgid "<systemitem class="daemon">httpd</systemitem> runs in the unconfined <computeroutput>initrc_t</computeroutput> domain. Files created by processes running in the <computeroutput>initrc_t</computeroutput> domain may not have the same labeling rules applied as files created by a process running in the <computeroutput>httpd_t</computeroutput> domain, potentially allowing processes to create mislabeled files. This causes access problems later on." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"confined domains that are allowed to communicate with " -"<computeroutput>httpd_t</computeroutput> can not communicate with " -"<computeroutput>initrc_t</computeroutput>, possibly causing additional " -"failures." +msgid "confined domains that are allowed to communicate with <computeroutput>httpd_t</computeroutput> can not communicate with <computeroutput>initrc_t</computeroutput>, possibly causing additional failures." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput><replaceable>domain</replaceable>_disable_trans</" -"computeroutput> Booleans were removed from Fedora 7, even though there was " -"no replacement. Permissive domains solve the above issues: transition rules " -"apply, and files are created with the correct labels." +msgid "The <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> Booleans were removed from Fedora 7, even though there was no replacement. Permissive domains solve the above issues: transition rules apply, and files are created with the correct labels." msgstr ""

#. Tag: para @@ -702,22 +446,12 @@

#. Tag: para #, no-c-format -msgid "" -"making a single process (domain) run permissive to troubleshoot an issue, " -"rather than putting the entire system at risk by making the entire system " -"permissive." +msgid "making a single process (domain) run permissive to troubleshoot an issue, rather than putting the entire system at risk by making the entire system permissive." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"creating policies for new applications. Previously, it was recommended that " -"a minimal policy be created, and then the entire machine put into permissive " -"mode, so that the application could run, but SELinux denials still logged. " -"<command>audit2allow</command> could then be used to help write the policy. " -"This put the whole system at risk. With permissive domains, only the domain " -"in the new policy can be marked permissive, without putting the whole system " -"at risk." +msgid "creating policies for new applications. Previously, it was recommended that a minimal policy be created, and then the entire machine put into permissive mode, so that the application could run, but SELinux denials still logged. <command>audit2allow</command> could then be used to help write the policy. This put the whole system at risk. With permissive domains, only the domain in the new policy can be marked permissive, without putting the whole system at risk." msgstr ""

#. Tag: title @@ -727,13 +461,7 @@

#. Tag: para #, no-c-format -msgid "" -"To make a domain permissive, run the <command>semanage permissive -a " -"<replaceable>domain</replaceable></command> command, where " -"<replaceable>domain</replaceable> is the domain you want to make permissive. " -"For example, run the following command as the Linux root user to make the " -"<computeroutput>httpd_t</computeroutput> domain (the domain the Apache HTTP " -"Server runs in) permissive:" +msgid "To make a domain permissive, run the <command>semanage permissive -a <replaceable>domain</replaceable></command> command, where <replaceable>domain</replaceable> is the domain you want to make permissive. For example, run the following command as the Linux root user to make the <computeroutput>httpd_t</computeroutput> domain (the domain the Apache HTTP Server runs in) permissive:" msgstr ""

#. Tag: para @@ -743,18 +471,12 @@

#. Tag: para #, no-c-format -msgid "" -"To view a list of domains you have made permissive, run the " -"<command>semodule -l | grep permissive</command> command as the Linux root " -"user. For example:" +msgid "To view a list of domains you have made permissive, run the <command>semodule -l | grep permissive</command> command as the Linux root user. For example:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you no longer want a domain to be permissive, run the <command>semanage " -"permissive -d <replaceable>domain</replaceable></command> command as the " -"Linux root user. For example:" +msgid "If you no longer want a domain to be permissive, run the <command>semanage permissive -d <replaceable>domain</replaceable></command> command as the Linux root user. For example:" msgstr ""

#. Tag: para @@ -769,38 +491,22 @@

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>SYSCALL</computeroutput> message is different for " -"permissive domains. The following is an example AVC denial (and the " -"associated system call) from the Apache HTTP Server:" +msgid "The <computeroutput>SYSCALL</computeroutput> message is different for permissive domains. The following is an example AVC denial (and the associated system call) from the Apache HTTP Server:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, the <computeroutput>httpd_t</computeroutput> domain is not " -"permissive, and as such, the action is denied, and the " -"<computeroutput>SYSCALL</computeroutput> message contains " -"<computeroutput>success=no</computeroutput>. The following is an example AVC " -"denial for the same situation, except the <command>semanage permissive -a " -"httpd_t</command> command has been run to make the <computeroutput>httpd_t</" -"computeroutput> domain permissive:" +msgid "By default, the <computeroutput>httpd_t</computeroutput> domain is not permissive, and as such, the action is denied, and the <computeroutput>SYSCALL</computeroutput> message contains <computeroutput>success=no</computeroutput>. The following is an example AVC denial for the same situation, except the <command>semanage permissive -a httpd_t</command> command has been run to make the <computeroutput>httpd_t</computeroutput> domain permissive:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this case, although an AVC denial was logged, access was not denied, as " -"shown by <computeroutput>success=yes</computeroutput> in the " -"<computeroutput>SYSCALL</computeroutput> message." +msgid "In this case, although an AVC denial was logged, access was not denied, as shown by <computeroutput>success=yes</computeroutput> in the <computeroutput>SYSCALL</computeroutput> message." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24537.html" -"">"Permissive Domains"</ulink> blog entry for further information about " -"permissive domains." +msgid "Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24537.html%5C%22%3E%5C%22Permissive Domains"</ulink> blog entry for further information about permissive domains." msgstr ""

#. Tag: title @@ -810,17 +516,7 @@

#. Tag: para #, no-c-format -msgid "" -"This section assumes the <package>setroubleshoot</package>, " -"<package>setroubleshoot-server</package>, <package>dbus</package> and " -"<package>audit</package> packages are installed, and that the <systemitem " -"class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</" -"systemitem>, and <systemitem class="daemon">setroubleshootd</systemitem> " -"daemons are running. Refer to <xref linkend="sect-Security-Enhanced_Linux-" -"Working_with_SELinux-Which_Log_File_is_Used" /> for information about " -"starting these daemons. A number of tools are available for searching for " -"and viewing SELinux denials, such as <command>ausearch</command>, " -"<command>aureport</command>, and <command>sealert</command>." +msgid "This section assumes the <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, and that the <systemitem class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</systemitem>, and <systemitem class="daemon">setroubleshootd</systemitem> daemons are running. Refer to <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Which_Log_File_is_Used" /> for information about starting these daemons. A number of tools are available for searching for and viewing SELinux denials, such as <command>ausearch</command>, <command>aureport</command>, and <command>sealert</command>." msgstr ""

#. Tag: title @@ -830,22 +526,12 @@

#. Tag: para #, no-c-format -msgid "" -"The <package>audit</package> package provides <command>ausearch</command>. " -"From the" +msgid "The <package>audit</package> package provides <command>ausearch</command>. From the" msgstr ""

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>ausearch</command> is a tool that can query the " -"audit daemon logs based for events based on different search criteria" -""<footnote> <para> From the <citerefentry><refentrytitle>ausearch</" -"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as " -"shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. " -"</para> </footnote>. The <command>ausearch</command> tool accesses " -"<filename>/var/log/audit/audit.log</filename>, and as such, must be run as " -"the Linux root user:" +msgid "manual page: "<command>ausearch</command> is a tool that can query the audit daemon logs based for events based on different search criteria"<footnote> <para> From the <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. The <command>ausearch</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user:" msgstr ""

#. Tag: segtitle @@ -890,16 +576,7 @@

#. Tag: para #, no-c-format -msgid "" -"To search for SELinux denials for a particular service, use the <option>-c " -"<replaceable>comm-name</replaceable></option> option, where " -"<replaceable>comm-name</replaceable> "is the executable’s name"<footnote> " -"<para> From the <citerefentry><refentrytitle>ausearch</" -"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as " -"shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. " -"</para> </footnote>, for example, <systemitem class="daemon">httpd</" -"systemitem> for the Apache HTTP Server, and <systemitem class="daemon" -"">smbd</systemitem> for Samba:" +msgid "To search for SELinux denials for a particular service, use the <option>-c <replaceable>comm-name</replaceable></option> option, where <replaceable>comm-name</replaceable> "is the executable’s name"<footnote> <para> From the <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>, for example, <systemitem class="daemon">httpd</systemitem> for the Apache HTTP Server, and <systemitem class="daemon">smbd</systemitem> for Samba:" msgstr ""

#. Tag: para @@ -929,24 +606,12 @@

#. Tag: para #, no-c-format -msgid "" -"The <package>audit</package> package provides <command>aureport</command>. " -"From the" +msgid "The <package>audit</package> package provides <command>aureport</command>. From the" msgstr ""

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>aureport</command> is a tool that produces summary " -"reports of the audit system logs"<footnote> <para> From the " -"<citerefentry><refentrytitle>aureport</refentrytitle><manvolnum>8</" -"manvolnum></citerefentry> manual page, as shipped with the <package>audit</" -"package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. The " -"<command>aureport</command> tool accesses <filename>/var/log/audit/audit." -"log</filename>, and as such, must be run as the Linux root user. To view a " -"list of SELinux denials and how often each one occurred, run the " -"<command>aureport -a</command> command. The following is example output that " -"includes two denials:" +msgid "manual page: "<command>aureport</command> is a tool that produces summary reports of the audit system logs"<footnote> <para> From the <citerefentry><refentrytitle>aureport</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. The <command>aureport</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user. To view a list of SELinux denials and how often each one occurred, run the <command>aureport -a</command> command. The following is example output that includes two denials:" msgstr ""

#. Tag: citerefentry @@ -961,57 +626,32 @@

#. Tag: para #, no-c-format -msgid "" -"The <package>setroubleshoot-server</package> package provides " -"<command>sealert</command>, which reads denial messages translated by " -"<package>setroubleshoot-server</package>. Denials are assigned IDs, as seen " -"in <filename>/var/log/messages</filename>. The following is an example " -"denial from <filename>messages</filename>:" +msgid "The <package>setroubleshoot-server</package> package provides <command>sealert</command>, which reads denial messages translated by <package>setroubleshoot-server</package>. Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. The following is an example denial from <filename>messages</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, the denial ID is <computeroutput>84e0b04d-d0ad-4347-8317-" -"22e74f6cd020</computeroutput>. The <option>-l</option> option takes an ID as " -"an argument. Running the <command>sealert -l 84e0b04d-d0ad-4347-8317-" -"22e74f6cd020</command> command presents a detailed analysis of why SELinux " -"denied access, and a possible solution for allowing access." +msgid "In this example, the denial ID is <computeroutput>84e0b04d-d0ad-4347-8317-22e74f6cd020</computeroutput>. The <option>-l</option> option takes an ID as an argument. Running the <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> command presents a detailed analysis of why SELinux denied access, and a possible solution for allowing access." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you are running the X Window System, have the <package>setroubleshoot</" -"package> and <package>setroubleshoot-server</package> packages installed, " -"and the <systemitem class="daemon">setroubleshootd</systemitem>, " -"<systemitem class="daemon">dbus</systemitem> and <systemitem class="daemon" -"">auditd</systemitem> daemons are running, a warning is displayed when " -"access is denied by SELinux. Clicking on 'Show' launches the " -"<command>sealert</command> GUI, and displays denials in HTML output:" +msgid "If you are running the X Window System, have the <package>setroubleshoot</package> and <package>setroubleshoot-server</package> packages installed, and the <systemitem class="daemon">setroubleshootd</systemitem>, <systemitem class="daemon">dbus</systemitem> and <systemitem class="daemon">auditd</systemitem> daemons are running, a warning is displayed when access is denied by SELinux. Clicking on 'Show' launches the <command>sealert</command> GUI, and displays denials in HTML output:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>sealert -b</command> command to launch the " -"<command>sealert</command> GUI." +msgid "Run the <command>sealert -b</command> command to launch the <command>sealert</command> GUI." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>sealert -l \*</command> command to view a detailed " -"analysis of all denials." +msgid "Run the <command>sealert -l \*</command> command to view a detailed analysis of all denials." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>sealert -a /var/log/audit/audit.log " -"-H &gt; audit.html</command> command to create a HTML version of the " -"<command>sealert</command> analysis, as seen with the <command>sealert</" -"command> GUI." +msgid "As the Linux root user, run the <command>sealert -a /var/log/audit/audit.log -H &gt; audit.html</command> command to create a HTML version of the <command>sealert</command> analysis, as seen with the <command>sealert</command> GUI." msgstr ""

#. Tag: citerefentry @@ -1026,13 +666,7 @@

#. Tag: para #, no-c-format -msgid "" -"Raw audit messages are logged to <filename>/var/log/audit/audit.log</" -"filename>. The following is an example AVC denial (and the associated system " -"call) that occurred when the Apache HTTP Server (running in the " -"<computeroutput>httpd_t</computeroutput> domain) attempted to access the " -"<filename>/var/www/html/file1</filename> file (labeled with the " -"<computeroutput>samba_share_t</computeroutput> type):" +msgid "Raw audit messages are logged to <filename>/var/log/audit/audit.log</filename>. The following is an example AVC denial (and the associated system call) that occurred when the Apache HTTP Server (running in the <computeroutput>httpd_t</computeroutput> domain) attempted to access the <filename>/var/www/html/file1</filename> file (labeled with the <computeroutput>samba_share_t</computeroutput> type):" msgstr ""

#. Tag: term @@ -1042,14 +676,7 @@

#. Tag: para #, no-c-format -msgid "" -"The item in braces indicates the permission that was denied. " -"<computeroutput>getattr</computeroutput> indicates the source process was " -"trying to read the target file's status information. This occurs before " -"reading files. This action is denied due to the file being accessed having " -"the wrong label. Commonly seen permissions include <computeroutput>getattr</" -"computeroutput>, <computeroutput>read</computeroutput>, and " -"<computeroutput>write</computeroutput>." +msgid "The item in braces indicates the permission that was denied. <computeroutput>getattr</computeroutput> indicates the source process was trying to read the target file's status information. This occurs before reading files. This action is denied due to the file being accessed having the wrong label. Commonly seen permissions include <computeroutput>getattr</computeroutput>, <computeroutput>read</computeroutput>, and <computeroutput>write</computeroutput>." msgstr ""

#. Tag: term @@ -1059,11 +686,7 @@

#. Tag: para #, no-c-format -msgid "" -"The executable that launched the process. The full path of the executable is " -"found in the <computeroutput>exe=</computeroutput> section of the system " -"call (<computeroutput>SYSCALL</computeroutput>) message, which in this case, " -"is <computeroutput>exe="/usr/sbin/httpd"</computeroutput>." +msgid "The executable that launched the process. The full path of the executable is found in the <computeroutput>exe=</computeroutput> section of the system call (<computeroutput>SYSCALL</computeroutput>) message, which in this case, is <computeroutput>exe="/usr/sbin/httpd"</computeroutput>." msgstr ""

#. Tag: term @@ -1078,96 +701,52 @@

#. Tag: term #, no-c-format -msgid "" -"scontext="<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>"" -msgstr "" -"scontext="<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>"" +msgid "scontext="<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>"" +msgstr "scontext="<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>""

#. Tag: para #, no-c-format -msgid "" -"The SELinux context of the process that attempted the denied action. In this " -"case, it is the SELinux context of the Apache HTTP Server, which is running " -"in the <computeroutput>httpd_t</computeroutput> domain." +msgid "The SELinux context of the process that attempted the denied action. In this case, it is the SELinux context of the Apache HTTP Server, which is running in the <computeroutput>httpd_t</computeroutput> domain." msgstr ""

#. Tag: term #, no-c-format -msgid "" -"tcontext="<replaceable>unconfined_u:object_r:samba_share_t:s0</replaceable>" -""" +msgid "tcontext="<replaceable>unconfined_u:object_r:samba_share_t:s0</replaceable>"" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The SELinux context of the object (target) the process attempted to access. " -"In this case, it is the SELinux context of <filename>file1</filename>. Note: " -"the <computeroutput>samba_share_t</computeroutput> type is not accessible to " -"processes running in the <computeroutput>httpd_t</computeroutput> domain." +msgid "The SELinux context of the object (target) the process attempted to access. In this case, it is the SELinux context of <filename>file1</filename>. Note: the <computeroutput>samba_share_t</computeroutput> type is not accessible to processes running in the <computeroutput>httpd_t</computeroutput> domain." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In certain situations, the <computeroutput>tcontext</computeroutput> may " -"match the <computeroutput>scontext</computeroutput>, for example, when a " -"process attempts to execute a system service that will change " -"characteristics of that running process, such as the user ID. Also, the " -"<computeroutput>tcontext</computeroutput> may match the " -"<computeroutput>scontext</computeroutput> when a process tries to use more " -"resources (such as memory) than normal limits allow, resulting in a security " -"check to see if that process is allowed to break those limits." +msgid "In certain situations, the <computeroutput>tcontext</computeroutput> may match the <computeroutput>scontext</computeroutput>, for example, when a process attempts to execute a system service that will change characteristics of that running process, such as the user ID. Also, the <computeroutput>tcontext</computeroutput> may match the <computeroutput>scontext</computeroutput> when a process tries to use more resources (such as memory) than normal limits allow, resulting in a security check to see if that process is allowed to break those limits." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"From the system call (<computeroutput>SYSCALL</computeroutput>) message, two " -"items are of interest:" +msgid "From the system call (<computeroutput>SYSCALL</computeroutput>) message, two items are of interest:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>success=<replaceable>no</replaceable></computeroutput>: " -"indicates whether the denial (AVC) was enforced or not. " -"<computeroutput>success=no</computeroutput> indicates the system call was " -"not successful (SELinux denied access). <computeroutput>success=yes</" -"computeroutput> indicates the system call was successful - this can be seen " -"for permissive domains or unconfined domains, such as " -"<computeroutput>initrc_t</computeroutput> and <computeroutput>kernel_t</" -"computeroutput>." +msgid "<computeroutput>success=<replaceable>no</replaceable></computeroutput>: indicates whether the denial (AVC) was enforced or not. <computeroutput>success=no</computeroutput> indicates the system call was not successful (SELinux denied access). <computeroutput>success=yes</computeroutput> indicates the system call was successful - this can be seen for permissive domains or unconfined domains, such as <computeroutput>initrc_t</computeroutput> and <computeroutput>kernel_t</computeroutput>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>exe="<replaceable>/usr/sbin/httpd</replaceable>"</" -"computeroutput>: the full path to the executable that launched the process, " -"which in this case, is <computeroutput>exe="/usr/sbin/httpd"</" -"computeroutput>." +msgid "<computeroutput>exe="<replaceable>/usr/sbin/httpd</replaceable>"</computeroutput>: the full path to the executable that launched the process, which in this case, is <computeroutput>exe="/usr/sbin/httpd"</computeroutput>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"An incorrect file type is a common cause for SELinux denying access. To " -"start troubleshooting, compare the source context (<computeroutput>scontext</" -"computeroutput>) with the target context (<computeroutput>tcontext</" -"computeroutput>). Should the process (<computeroutput>scontext</" -"computeroutput>) be accessing such an object (<computeroutput>tcontext</" -"computeroutput>)? For example, the Apache HTTP Server " -"(<computeroutput>httpd_t</computeroutput>) should only be accessing types " -"specified in the" +msgid "An incorrect file type is a common cause for SELinux denying access. To start troubleshooting, compare the source context (<computeroutput>scontext</computeroutput>) with the target context (<computeroutput>tcontext</computeroutput>). Should the process (<computeroutput>scontext</computeroutput>) be accessing such an object (<computeroutput>tcontext</computeroutput>)? For example, the Apache HTTP Server (<computeroutput>httpd_t</computeroutput>) should only be accessing types specified in the" msgstr ""

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page, such as <computeroutput>httpd_sys_content_t</computeroutput>, " -"<computeroutput>public_content_t</computeroutput>, and so on, unless " -"configured otherwise." +msgid "manual page, such as <computeroutput>httpd_sys_content_t</computeroutput>, <computeroutput>public_content_t</computeroutput>, and so on, unless configured otherwise." msgstr ""

#. Tag: title @@ -1177,22 +756,12 @@

#. Tag: para #, no-c-format -msgid "" -"Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. " -"The following is an example AVC denial (logged to <filename>messages</" -"filename>) that occurred when the Apache HTTP Server (running in the " -"<computeroutput>httpd_t</computeroutput> domain) attempted to access the " -"<filename>/var/www/html/file1</filename> file (labeled with the " -"<computeroutput>samba_share_t</computeroutput> type):" +msgid "Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. The following is an example AVC denial (logged to <filename>messages</filename>) that occurred when the Apache HTTP Server (running in the <computeroutput>httpd_t</computeroutput> domain) attempted to access the <filename>/var/www/html/file1</filename> file (labeled with the <computeroutput>samba_share_t</computeroutput> type):" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As suggested, run the <command>sealert -l 84e0b04d-d0ad-4347-8317-" -"22e74f6cd020</command> command to view the complete message. This command " -"only works on the local machine, and presents the same information as the " -"<command>sealert</command> GUI:" +msgid "As suggested, run the <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> command to view the complete message. This command only works on the local machine, and presents the same information as the <command>sealert</command> GUI:" msgstr ""

#. Tag: term @@ -1202,12 +771,7 @@

#. Tag: para #, no-c-format -msgid "" -"A brief summary of the denied action. This is the same as the denial in " -"<filename>/var/log/messages</filename>. In this example, the <systemitem " -"class="daemon">httpd</systemitem> process was denied access to a file " -"(<filename>file1</filename>), which is labeled with the " -"<computeroutput>samba_share_t</computeroutput> type." +msgid "A brief summary of the denied action. This is the same as the denial in <filename>/var/log/messages</filename>. In this example, the <systemitem class="daemon">httpd</systemitem> process was denied access to a file (<filename>file1</filename>), which is labeled with the <computeroutput>samba_share_t</computeroutput> type." msgstr ""

#. Tag: term @@ -1217,12 +781,7 @@

#. Tag: para #, no-c-format -msgid "" -"A more verbose description. In this example, <filename>file1</filename> is " -"labeled with the <computeroutput>samba_share_t</computeroutput> type. This " -"type is used for files and directories that you want to export via Samba. " -"The description suggests changing the type to a type that can be accessed by " -"the Apache HTTP Server and Samba, if such access is desired." +msgid "A more verbose description. In this example, <filename>file1</filename> is labeled with the <computeroutput>samba_share_t</computeroutput> type. This type is used for files and directories that you want to export via Samba. The description suggests changing the type to a type that can be accessed by the Apache HTTP Server and Samba, if such access is desired." msgstr ""

#. Tag: term @@ -1232,11 +791,7 @@

#. Tag: para #, no-c-format -msgid "" -"A suggestion for how to allow access. This may be relabeling files, turning " -"a Boolean on, or making a local policy module. In this case, the suggestion " -"is to label the file with a type accessible to both the Apache HTTP Server " -"and Samba." +msgid "A suggestion for how to allow access. This may be relabeling files, turning a Boolean on, or making a local policy module. In this case, the suggestion is to label the file with a type accessible to both the Apache HTTP Server and Samba." msgstr ""

#. Tag: term @@ -1246,11 +801,7 @@

#. Tag: para #, no-c-format -msgid "" -"A suggested command to allow access and resolve the denial. In this example, " -"it gives the command to change the <filename>file1</filename> type to " -"<computeroutput>public_content_t</computeroutput>, which is accessible to " -"the Apache HTTP Server and Samba." +msgid "A suggested command to allow access and resolve the denial. In this example, it gives the command to change the <filename>file1</filename> type to <computeroutput>public_content_t</computeroutput>, which is accessible to the Apache HTTP Server and Samba." msgstr ""

#. Tag: term @@ -1260,19 +811,12 @@

#. Tag: para #, no-c-format -msgid "" -"Information that is useful in bug reports, such as the policy package name " -"and version (<computeroutput>selinux-policy-3.5.13-11.fc12</" -"computeroutput>), but may not help towards solving why the denial occurred." +msgid "Information that is useful in bug reports, such as the policy package name and version (<computeroutput>selinux-policy-3.5.13-11.fc12</computeroutput>), but may not help towards solving why the denial occurred." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The raw audit messages from <filename>/var/log/audit/audit.log</filename> " -"that are associated with the denial. Refer to <xref linkend="sect-Security-" -"Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> for information about " -"each item in the AVC denial." +msgid "The raw audit messages from <filename>/var/log/audit/audit.log</filename> that are associated with the denial. Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> for information about each item in the AVC denial." msgstr ""

#. Tag: title @@ -1282,9 +826,7 @@

#. Tag: para #, no-c-format -msgid "" -"Do not use the example in this section in production. It is used only to " -"demonstrate the use of <command>audit2allow</command>." +msgid "Do not use the example in this section in production. It is used only to demonstrate the use of <command>audit2allow</command>." msgstr ""

#. Tag: para @@ -1299,58 +841,27 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>audit2allow</command> - generate SELinux policy " -"allow rules from logs of denied operations"<footnote> <para> From the " -"<citerefentry><refentrytitle>audit2allow</refentrytitle><manvolnum>1</" -"manvolnum></citerefentry> manual page, as shipped with the " -"<package>policycoreutils</package> package in Fedora&nbsp;&PRODVER;. </para> " -"</footnote>. After analyzing denials as per <xref linkend="sect-Security-" -"Enhanced_Linux-Fixing_Problems-sealert_Messages" />, and if no label " -"changes or Booleans allowed access, use <command>audit2allow</command> to " -"create a local policy module. After access is denied by SELinux, running the " -"<command>audit2allow</command> command presents Type Enforcement rules that " -"allow the previously denied access." +msgid "manual page: "<command>audit2allow</command> - generate SELinux policy allow rules from logs of denied operations"<footnote> <para> From the <citerefentry><refentrytitle>audit2allow</refentrytitle><manvolnum>1</manvolnum></citerefentry> manual page, as shipped with the <package>policycoreutils</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. After analyzing denials as per <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" />, and if no label changes or Booleans allowed access, use <command>audit2allow</command> to create a local policy module. After access is denied by SELinux, running the <command>audit2allow</command> command presents Type Enforcement rules that allow the previously denied access." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates using <command>audit2allow</command> to " -"create a policy module:" +msgid "The following example demonstrates using <command>audit2allow</command> to create a policy module:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"A denial and the associated system call are logged to <filename>/var/log/" -"audit/audit.log</filename>:" +msgid "A denial and the associated system call are logged to <filename>/var/log/audit/audit.log</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, <application>certwatch</application> (<computeroutput>comm=" -""certwatch"</computeroutput>) was denied write access (<computeroutput>" -"{ write }</computeroutput>) to a directory labeled with the " -"<computeroutput>var_t</computeroutput> type " -"(<computeroutput>tcontext=system_u:object_r:var_t:s0</computeroutput>). " -"Analyze the denial as per <xref linkend="sect-Security-Enhanced_Linux-" -"Fixing_Problems-sealert_Messages" />. If no label changes or Booleans " -"allowed access, use <command>audit2allow</command> to create a local policy " -"module." +msgid "In this example, <application>certwatch</application> (<computeroutput>comm="certwatch"</computeroutput>) was denied write access (<computeroutput>{ write }</computeroutput>) to a directory labeled with the <computeroutput>var_t</computeroutput> type (<computeroutput>tcontext=system_u:object_r:var_t:s0</computeroutput>). Analyze the denial as per <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" />. If no label changes or Booleans allowed access, use <command>audit2allow</command> to create a local policy module." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"With a denial logged, such as the <computeroutput>certwatch</computeroutput> " -"denial in step 1, run the <command>audit2allow -w -a</command> command to " -"produce a human-readable description of why access was denied. The <option>-" -"a</option> option causes all audit logs to be read. The <option>-w</option> " -"option produces the human-readable description. The <command>audit2allow</" -"command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as " -"such, must be run as the Linux root user:" +msgid "With a denial logged, such as the <computeroutput>certwatch</computeroutput> denial in step 1, run the <command>audit2allow -w -a</command> command to produce a human-readable description of why access was denied. The <option>-a</option> option causes all audit logs to be read. The <option>-w</option> option produces the human-readable description. The <command>audit2allow</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user:" msgstr ""

#. Tag: para @@ -1360,73 +871,37 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>audit2allow -a</command> command to view the Type " -"Enforcement rule that allows the denied access:" +msgid "Run the <command>audit2allow -a</command> command to view the Type Enforcement rule that allows the denied access:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Missing Type Enforcement rules are usually caused by bugs in SELinux policy, " -"and should be reported in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed " -"Hat Bugzilla</ulink>. For Fedora, create bugs against the " -"<computeroutput>Fedora</computeroutput> product, and select the " -"<computeroutput>selinux-policy</computeroutput> component. Include the " -"output of the <command>audit2allow -w -a</command> and <command>audit2allow -" -"a</command> commands in such bug reports." +msgid "Missing Type Enforcement rules are usually caused by bugs in SELinux policy, and should be reported in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat Bugzilla</ulink>. For Fedora, create bugs against the <computeroutput>Fedora</computeroutput> product, and select the <computeroutput>selinux-policy</computeroutput> component. Include the output of the <command>audit2allow -w -a</command> and <command>audit2allow -a</command> commands in such bug reports." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To use the rule displayed by <command>audit2allow -a</command>, run the " -"<command>audit2allow -a -M <replaceable>mycertwatch</replaceable></command> " -"command as the Linux root user to create custom module. The <option>-M</" -"option> option creates a Type Enforcement file (<filename>.te</filename>) " -"with the name specified with <option>-M</option>, in your current working " -"directory:" +msgid "To use the rule displayed by <command>audit2allow -a</command>, run the <command>audit2allow -a -M <replaceable>mycertwatch</replaceable></command> command as the Linux root user to create custom module. The <option>-M</option> option creates a Type Enforcement file (<filename>.te</filename>) with the name specified with <option>-M</option>, in your current working directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Also, <command>audit2allow</command> compiles the Type Enforcement rule into " -"a policy package (<filename>.pp</filename>). To install the module, run the " -"<command>/usr/sbin/semodule -i <replaceable>mycertwatch.pp</replaceable></" -"command> command as the Linux root user." +msgid "Also, <command>audit2allow</command> compiles the Type Enforcement rule into a policy package (<filename>.pp</filename>). To install the module, run the <command>/usr/sbin/semodule -i <replaceable>mycertwatch.pp</replaceable></command> command as the Linux root user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Modules created with <command>audit2allow</command> may allow more access " -"than required. It is recommended that policy created with " -"<command>audit2allow</command> be posted to an SELinux list, such as <ulink " -"url="http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-" -"selinux-list</ulink>, for review. If you believe their is a bug in policy, " -"create a bug in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat " -"Bugzilla</ulink>." +msgid "Modules created with <command>audit2allow</command> may allow more access than required. It is recommended that policy created with <command>audit2allow</command> be posted to an SELinux list, such as <ulink url="http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-se...</ulink>, for review. If you believe their is a bug in policy, create a bug in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat Bugzilla</ulink>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you have multiple denials from multiple processes, but only want to " -"create a custom policy for a single process, use the <command>grep</command> " -"command to narrow down the input for <command>audit2allow</command>. The " -"following example demonstrates using <command>grep</command> to only send " -"denials related to <command>certwatch</command> through " -"<command>audit2allow</command>:" +msgid "If you have multiple denials from multiple processes, but only want to create a custom policy for a single process, use the <command>grep</command> command to narrow down the input for <command>audit2allow</command>. The following example demonstrates using <command>grep</command> to only send denials related to <command>certwatch</command> through <command>audit2allow</command>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24750.html" -"">"Using audit2allow to build policy modules. Revisited."</ulink> blog " -"entry for further information about using <command>audit2allow</command> to " -"build policy modules." +msgid "Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24750.html%5C%22%3E%5C%22Using audit2allow to build policy modules. Revisited."</ulink> blog entry for further information about using <command>audit2allow</command> to build policy modules." msgstr ""

#~ msgid "" @@ -1441,38 +916,28 @@

#~ msgid "" #~ "$ /usr/sbin/matchpathcon -V /var/www/html/*\n" -#~ "/var/www/html/index.html has context unconfined_u:object_r:user_home_t:" -#~ "s0, should be system_u:object_r:httpd_sys_content_t:s0\n" -#~ "/var/www/html/page1.html has context unconfined_u:object_r:user_home_t:" -#~ "s0, should be system_u:object_r:httpd_sys_content_t:s0" +#~ "/var/www/html/index.html has context unconfined_u:object_r:user_home_t:s0, should be system_u:object_r:httpd_sys_content_t:s0\n" +#~ "/var/www/html/page1.html has context unconfined_u:object_r:user_home_t:s0, should be system_u:object_r:httpd_sys_content_t:s0" #~ msgstr "" #~ "$ /usr/sbin/matchpathcon -V /var/www/html/*\n" -#~ "/var/www/html/index.html has context unconfined_u:object_r:user_home_t:" -#~ "s0, should be system_u:object_r:httpd_sys_content_t:s0\n" -#~ "/var/www/html/page1.html has context unconfined_u:object_r:user_home_t:" -#~ "s0, should be system_u:object_r:httpd_sys_content_t:s0" +#~ "/var/www/html/index.html has context unconfined_u:object_r:user_home_t:s0, should be system_u:object_r:httpd_sys_content_t:s0\n" +#~ "/var/www/html/page1.html has context unconfined_u:object_r:user_home_t:s0, should be system_u:object_r:httpd_sys_content_t:s0"

#~ msgid "" #~ "# /sbin/restorecon -v /var/www/html/index.html \n" -#~ "restorecon reset /var/www/html/index.html context unconfined_u:object_r:" -#~ "user_home_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" +#~ "restorecon reset /var/www/html/index.html context unconfined_u:object_r:user_home_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" #~ msgstr "" #~ "# /sbin/restorecon -v /var/www/html/index.html \n" -#~ "restorecon reset /var/www/html/index.html context unconfined_u:object_r:" -#~ "user_home_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" +#~ "restorecon reset /var/www/html/index.html context unconfined_u:object_r:user_home_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0"

#~ msgid "" #~ "# /sbin/restorecon -R -v /var/www/html/\n" -#~ "restorecon reset /var/www/html/page1.html context unconfined_u:object_r:" -#~ "samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0\n" -#~ "restorecon reset /var/www/html/index.html context unconfined_u:object_r:" -#~ "samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" +#~ "restorecon reset /var/www/html/page1.html context unconfined_u:object_r:samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0\n" +#~ "restorecon reset /var/www/html/index.html context unconfined_u:object_r:samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" #~ msgstr "" #~ "# /sbin/restorecon -R -v /var/www/html/\n" -#~ "restorecon reset /var/www/html/page1.html context unconfined_u:object_r:" -#~ "samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0\n" -#~ "restorecon reset /var/www/html/index.html context unconfined_u:object_r:" -#~ "samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" +#~ "restorecon reset /var/www/html/page1.html context unconfined_u:object_r:samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0\n" +#~ "restorecon reset /var/www/html/index.html context unconfined_u:object_r:samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0"

#, fuzzy #~ msgid "# /usr/sbin/setsebool -P httpd_can_network_connect_db on" @@ -1514,29 +979,21 @@

#~ msgid "" #~ "# /sbin/service httpd start\n" -#~ "Starting httpd: (13)Permission denied: make_sock: could not bind to " -#~ "address [::]:9876\n" +#~ "Starting httpd: (13)Permission denied: make_sock: could not bind to address [::]:9876\n" #~ "(13)Permission denied: make_sock: could not bind to address 0.0.0.0:9876\n" #~ "no listening sockets available, shutting down\n" #~ "Unable to open logs\n" #~ " [FAILED]" #~ msgstr "" #~ "# /sbin/service httpd start\n" -#~ "Starting httpd: (13)Permission denied: make_sock: could not bind to " -#~ "address [::]:9876\n" +#~ "Starting httpd: (13)Permission denied: make_sock: could not bind to address [::]:9876\n" #~ "(13)Permission denied: make_sock: could not bind to address 0.0.0.0:9876\n" #~ "no listening sockets available, shutting down\n" #~ "Unable to open logs\n" #~ " [FAILED]"

-#~ msgid "" -#~ "type=AVC msg=audit(1225948455.061:294): avc: denied { name_bind } for " -#~ "pid=4997 comm="httpd" src=9876 scontext=unconfined_u:system_r:httpd_t:" -#~ "s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket" -#~ msgstr "" -#~ "type=AVC msg=audit(1225948455.061:294): avc: denied { name_bind } for " -#~ "pid=4997 comm="httpd" src=9876 scontext=unconfined_u:system_r:httpd_t:" -#~ "s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket" +#~ msgid "type=AVC msg=audit(1225948455.061:294): avc: denied { name_bind } for pid=4997 comm="httpd" src=9876 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket" +#~ msgstr "type=AVC msg=audit(1225948455.061:294): avc: denied { name_bind } for pid=4997 comm="httpd" src=9876 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket"

#~ msgid "# /usr/sbin/semanage port -a -t http_port_t -p tcp 9876" #~ msgstr "# /usr/sbin/semanage port -a -t http_port_t -p tcp 9876" @@ -1570,50 +1027,22 @@ #~ "permissive_httpd_t 1.0"

#~ msgid "" -#~ "type=AVC msg=audit(1226882736.442:86): avc: denied { getattr } for " -#~ "pid=2427 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=284133 " -#~ "scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:" -#~ "samba_share_t:s0 tclass=file\n" +#~ "type=AVC msg=audit(1226882736.442:86): avc: denied { getattr } for pid=2427 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file\n" #~ " \n" -#~ "type=SYSCALL msg=audit(1226882736.442:86): arch=40000003 syscall=196 " -#~ "success=no exit=-13 a0=b9a1e198 a1=bfc2921c a2=54dff4 a3=2008171 items=0 " -#~ "ppid=2425 pid=2427 auid=502 uid=48 gid=48 euid=48 suid=48 fsuid=48 " -#~ "egid=48 sgid=48 fsgid=48 tty=(none) ses=4 comm="httpd" exe="/usr/sbin/" -#~ "httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)" +#~ "type=SYSCALL msg=audit(1226882736.442:86): arch=40000003 syscall=196 success=no exit=-13 a0=b9a1e198 a1=bfc2921c a2=54dff4 a3=2008171 items=0 ppid=2425 pid=2427 auid=502 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)" #~ msgstr "" -#~ "type=AVC msg=audit(1226882736.442:86): avc: denied { getattr } for " -#~ "pid=2427 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=284133 " -#~ "scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:" -#~ "samba_share_t:s0 tclass=file\n" +#~ "type=AVC msg=audit(1226882736.442:86): avc: denied { getattr } for pid=2427 comm="httpd" path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file\n" #~ " \n" -#~ "type=SYSCALL msg=audit(1226882736.442:86): arch=40000003 syscall=196 " -#~ "success=no exit=-13 a0=b9a1e198 a1=bfc2921c a2=54dff4 a3=2008171 items=0 " -#~ "ppid=2425 pid=2427 auid=502 uid=48 gid=48 euid=48 suid=48 fsuid=48 " -#~ "egid=48 sgid=48 fsgid=48 tty=(none) ses=4 comm="httpd" exe="/usr/sbin/" -#~ "httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)" +#~ "type=SYSCALL msg=audit(1226882736.442:86): arch=40000003 syscall=196 success=no exit=-13 a0=b9a1e198 a1=bfc2921c a2=54dff4 a3=2008171 items=0 ppid=2425 pid=2427 auid=502 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)"

#~ msgid "" -#~ "type=AVC msg=audit(1226882925.714:136): avc: denied { read } for " -#~ "pid=2512 comm="httpd" name="file1" dev=dm-0 ino=284133 " -#~ "scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:" -#~ "samba_share_t:s0 tclass=file\n" +#~ "type=AVC msg=audit(1226882925.714:136): avc: denied { read } for pid=2512 comm="httpd" name="file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file\n" #~ " \n" -#~ "type=SYSCALL msg=audit(1226882925.714:136): arch=40000003 syscall=5 " -#~ "success=yes exit=11 a0=b962a1e8 a1=8000 a2=0 a3=8000 items=0 ppid=2511 " -#~ "pid=2512 auid=502 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 " -#~ "fsgid=48 tty=(none) ses=4 comm="httpd" exe="/usr/sbin/httpd" " -#~ "subj=unconfined_u:system_r:httpd_t:s0 key=(null)" +#~ "type=SYSCALL msg=audit(1226882925.714:136): arch=40000003 syscall=5 success=yes exit=11 a0=b962a1e8 a1=8000 a2=0 a3=8000 items=0 ppid=2511 pid=2512 auid=502 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)" #~ msgstr "" -#~ "type=AVC msg=audit(1226882925.714:136): avc: denied { read } for " -#~ "pid=2512 comm="httpd" name="file1" dev=dm-0 ino=284133 " -#~ "scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:" -#~ "samba_share_t:s0 tclass=file\n" +#~ "type=AVC msg=audit(1226882925.714:136): avc: denied { read } for pid=2512 comm="httpd" name="file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file\n" #~ " \n" -#~ "type=SYSCALL msg=audit(1226882925.714:136): arch=40000003 syscall=5 " -#~ "success=yes exit=11 a0=b962a1e8 a1=8000 a2=0 a3=8000 items=0 ppid=2511 " -#~ "pid=2512 auid=502 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 " -#~ "fsgid=48 tty=(none) ses=4 comm="httpd" exe="/usr/sbin/httpd" " -#~ "subj=unconfined_u:system_r:httpd_t:s0 key=(null)" +#~ "type=SYSCALL msg=audit(1226882925.714:136): arch=40000003 syscall=5 success=yes exit=11 a0=b962a1e8 a1=8000 a2=0 a3=8000 items=0 ppid=2511 pid=2512 auid=502 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)"

#~ msgid "/sbin/ausearch -m avc" #~ msgstr "/sbin/ausearch -m avc" @@ -1625,10 +1054,8 @@ #~ "========================================================\n" #~ "# date time comm subj syscall class permission obj event\n" #~ "========================================================\n" -#~ "1. 05/01/2009 21:41:39 httpd unconfined_u:system_r:httpd_t:s0 195 file " -#~ "getattr system_u:object_r:samba_share_t:s0 denied 2\n" -#~ "2. 05/03/2009 22:00:25 vsftpd unconfined_u:system_r:ftpd_t:s0 5 file read " -#~ "unconfined_u:object_r:cifs_t:s0 denied 4" +#~ "1. 05/01/2009 21:41:39 httpd unconfined_u:system_r:httpd_t:s0 195 file getattr system_u:object_r:samba_share_t:s0 denied 2\n" +#~ "2. 05/03/2009 22:00:25 vsftpd unconfined_u:system_r:ftpd_t:s0 5 file read unconfined_u:object_r:cifs_t:s0 denied 4" #~ msgstr "" #~ "# /sbin/aureport -a\n" #~ "\n" @@ -1636,10 +1063,8 @@ #~ "========================================================\n" #~ "# date time comm subj syscall class permission obj event\n" #~ "========================================================\n" -#~ "1. 05/01/2009 21:41:39 httpd unconfined_u:system_r:httpd_t:s0 195 file " -#~ "getattr system_u:object_r:samba_share_t:s0 denied 2\n" -#~ "2. 05/03/2009 22:00:25 vsftpd unconfined_u:system_r:ftpd_t:s0 5 file read " -#~ "unconfined_u:object_r:cifs_t:s0 denied 4" +#~ "1. 05/01/2009 21:41:39 httpd unconfined_u:system_r:httpd_t:s0 195 file getattr system_u:object_r:samba_share_t:s0 denied 2\n" +#~ "2. 05/03/2009 22:00:25 vsftpd unconfined_u:system_r:ftpd_t:s0 5 file read unconfined_u:object_r:cifs_t:s0 denied 4"

#~ msgid "{ getattr }" #~ msgstr "{ getattr }"

Modified: community/branches/f13/de-DE/Working_With_SELinux.po =================================================================== --- community/branches/f13/de-DE/Working_With_SELinux.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/de-DE/Working_With_SELinux.po 2010-11-21 23:12:12 UTC (rev 492) @@ -2,15 +2,16 @@ # # # Fabian Affolter fab@fedoraproject.org, 2009. -# gerd, 2010. +# Gerd Koenig gkoenig@fedoraproject.org, 2010. msgid "" msgstr "" "Project-Id-Version: selinux-user-guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:32\n" -"PO-Revision-Date: 2010-02-19 09:48+0100\n" -"Last-Translator: gerd\n" +"PO-Revision-Date: 2010-08-12 13:30+0200\n" +"Last-Translator: Gerd Koenig gkoenig@fedoraproject.org\n" "Language-Team: American English kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -21,209 +22,106 @@ #. Tag: title #, no-c-format msgid "Working with SELinux" -msgstr "" +msgstr "Arbeiten mit SELinux"

#. Tag: para #, no-c-format -msgid "" -"The following sections give a brief overview of the main SELinux packages in " -"Fedora; installing and updating packages; which log files are used; the main " -"SELinux configuration file; enabling and disabling SELinux; SELinux modes; " -"configuring Booleans; temporarily and persistently changing file and " -"directory labels; overriding file system labels with the <command>mount</" -"command> command; mounting NFS file systems; and how to preserve SELinux " -"contexts when copying and archiving files and directories." +msgid "The following sections give a brief overview of the main SELinux packages in Fedora; installing and updating packages; which log files are used; the main SELinux configuration file; enabling and disabling SELinux; SELinux modes; configuring Booleans; temporarily and persistently changing file and directory labels; overriding file system labels with the <command>mount</command> command; mounting NFS file systems; and how to preserve SELinux contexts when copying and archiving files and directories." msgstr ""

#. Tag: title #, no-c-format msgid "SELinux Packages" -msgstr "" +msgstr "SELinux Pakete"

#. Tag: para -#, no-c-format -msgid "" -"In Fedora, the SELinux packages are installed by default, unless they are " -"manually excluded during installation. By default, SELinux targeted policy " -"is used, and SELinux runs in enforcing mode. The following is a brief " -"description of the main SELinux packages:" -msgstr "" +#, fuzzy, no-c-format +msgid "In Fedora, the SELinux packages are installed by default, unless they are manually excluded during installation. By default, SELinux targeted policy is used, and SELinux runs in enforcing mode. The following is a brief description of the main SELinux packages:" +msgstr "Fedora installiert standardmässig die SELinux Pakete, es sei denn sie wurden währen der Installation manuell ignoriert. SELinux verwendet standardmässig den targeted Regelsatz und läuft im enforcing Modus. Nachfolgend finden Sie eine kurze Beschreibung der wichtigsten SELinux Pakete:"

#. Tag: para #, no-c-format -msgid "" -"<package>policycoreutils</package>: provides utilities, such as " -"<command>semanage</command>, <command>restorecon</command>, " -"<command>audit2allow</command>, <command>semodule</command>, " -"<command>load_policy</command>, and <command>setsebool</command>, for " -"operating and managing SELinux." -msgstr "" +msgid "<package>policycoreutils</package>: provides utilities, such as <command>semanage</command>, <command>restorecon</command>, <command>audit2allow</command>, <command>semodule</command>, <command>load_policy</command>, and <command>setsebool</command>, for operating and managing SELinux." +msgstr "<package>policycoreutils</package>: enthält diverse Hilfsmittel, wie z.B.: <command>semanage</command>, <command>restorecon</command>, <command>audit2allow</command>, <command>semodule</command>, <command>load_policy</command>, und <command>setsebool</command>, um SELinux betreiben und verwalten zu können."

#. Tag: para #, no-c-format -msgid "" -"<package>policycoreutils-gui</package>: provides <command>system-config-" -"selinux</command>, a graphical tool for managing SELinux." +msgid "<package>policycoreutils-gui</package>: provides <command>system-config-selinux</command>, a graphical tool for managing SELinux." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>selinux-policy</package>: provides the SELinux Reference Policy. " -"The SELinux Reference Policy is a complete SELinux policy, and is used as a " -"basis for other policies, such as the SELinux targeted policy. Refer to the " -"Tresys Technology <ulink url="http://oss.tresys.com/projects/refpolicy" -"">SELinux Reference Policy</ulink> page for further information. The " -"<package>selinux-policy-devel</package> package provides development tools, " -"such as <command>/usr/share/selinux/devel/policygentool</command> and " -"<command>/usr/share/selinux/devel/policyhelp</command>, as well as example " -"policy files. This package was merged into the <package>selinux-policy</" -"package> package." +msgid "<package>selinux-policy</package>: provides the SELinux Reference Policy. The SELinux Reference Policy is a complete SELinux policy, and is used as a basis for other policies, such as the SELinux targeted policy. Refer to the Tresys Technology <ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference Policy</ulink> page for further information. The <package>selinux-policy-devel</package> package provides development tools, such as <command>/usr/share/selinux/devel/policygentool</command> and <command>/usr/share/selinux/devel/policyhelp</command>, as well as example policy files. This package was merged into the <package>selinux-policy</package> package." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>selinux-policy-<replaceable>policy</replaceable></package>: " -"provides SELinux policies. For targeted policy, install <package>selinux-" -"policy-targeted</package>. For MLS, install <package>selinux-policy-mls</" -"package>. In Fedora 8, the strict policy was merged into targeted policy, " -"allowing confined and unconfined users to co-exist on the same system." +msgid "<package>selinux-policy-<replaceable>policy</replaceable></package>: provides SELinux policies. For targeted policy, install <package>selinux-policy-targeted</package>. For MLS, install <package>selinux-policy-mls</package>. In Fedora 8, the strict policy was merged into targeted policy, allowing confined and unconfined users to co-exist on the same system." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>setroubleshoot-server</package>: translates denial messages, " -"produced when access is denied by SELinux, into detailed descriptions that " -"are viewed with <command>sealert</command> (which is provided by this " -"package)." +msgid "<package>setroubleshoot-server</package>: translates denial messages, produced when access is denied by SELinux, into detailed descriptions that are viewed with <command>sealert</command> (which is provided by this package)." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>setools</package>, <package>setools-gui</package>, and " -"<package>setools-console</package>: these packages provide the <ulink url=" -""http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools " -"distribution</ulink>, a number of tools and libraries for analyzing and " -"querying policy, audit log monitoring and reporting, and file context " -"management<footnote> <para> Brindle, Joshua. "Re: blurb for fedora setools " -"packages" Email to Murray McAllister. 1 November 2008. Any edits or changes " -"in this version were done by Murray McAllister. </para> </footnote>. The " -"<package>setools</package> package is a meta-package for SETools. The " -"<package>setools-gui</package> package provides the <command>apol</command>, " -"<command>seaudit</command>, and <command>sediffx</command> tools. The " -"<package>setools-console</package> package provides the <command>seaudit-" -"report</command>, <command>sechecker</command>, <command>sediff</command>, " -"<command>seinfo</command>, <command>sesearch</command>, <command>findcon</" -"command>, <command>replcon</command>, and <command>indexcon</command> " -"command line tools. Refer to the <ulink url="http://oss.tresys.com/projects/" -"setools">Tresys Technology SETools</ulink> page for information about these " -"tools." +msgid "<package>setools</package>, <package>setools-gui</package>, and <package>setools-console</package>: these packages provide the <ulink url="http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools distribution</ulink>, a number of tools and libraries for analyzing and querying policy, audit log monitoring and reporting, and file context management<footnote> <para> Brindle, Joshua. "Re: blurb for fedora setools packages" Email to Murray McAllister. 1 November 2008. Any edits or changes in this version were done by Murray McAllister. </para> </footnote>. The <package>setools</package> package is a meta-package for SETools. The <package>setools-gui</package> package provides the <command>apol</command>, <command>seaudit</command>, and <command>sediffx</command> tools. The <package>setools-console</package> package provides the <command>seaudit-report</command>, <command>sechecker</command>, <command>sediff</command>, <command>seinfo</command>, <command>sesear ch</command>, <command>findcon</command>, <command>replcon</command>, and <command>indexcon</command> command line tools. Refer to the <ulink url="http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools</ulink> page for information about these tools." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>libselinux-utils</package>: provides the <command>avcstat</" -"command>, <command>getenforce</command>, <command>getsebool</command>, " -"<command>matchpathcon</command>, <command>selinuxconlist</command>, " -"<command>selinuxdefcon</command>, <command>selinuxenabled</command>, " -"<command>setenforce</command>, <command>togglesebool</command> tools." +msgid "<package>libselinux-utils</package>: provides the <command>avcstat</command>, <command>getenforce</command>, <command>getsebool</command>, <command>matchpathcon</command>, <command>selinuxconlist</command>, <command>selinuxdefcon</command>, <command>selinuxenabled</command>, <command>setenforce</command>, <command>togglesebool</command> tools." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>mcstrans</package>: translates levels, such as <computeroutput>s0-" -"s0:c0.c1023</computeroutput>, to an easier to read form, such as " -"<computeroutput>SystemLow-SystemHigh</computeroutput>. This package is not " -"installed by default." +msgid "<package>mcstrans</package>: translates levels, such as <computeroutput>s0-s0:c0.c1023</computeroutput>, to an easier to read form, such as <computeroutput>SystemLow-SystemHigh</computeroutput>. This package is not installed by default." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To install packages in Fedora, as the Linux root user, run the <command>yum " -"install <replaceable>package-name</replaceable></command> command. For " -"example, to install the <package>mcstrans</package> package, run the " -"<command>yum install mcstrans</command> command. To upgrade all installed " -"packages in Fedora, run the <command>yum update</command> command." +msgid "To install packages in Fedora, as the Linux root user, run the <command>yum install <replaceable>package-name</replaceable></command> command. For example, to install the <package>mcstrans</package> package, run the <command>yum install mcstrans</command> command. To upgrade all installed packages in Fedora, run the <command>yum update</command> command." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to <ulink url="http://docs.fedoraproject.org/yum/en/%5C%22%3EManaging " -"Software with yum</ulink><footnote> <para> Managing Software with yum, " -"written by Stuart Ellis, edited by Paul W. Frields, Rodrigo Menezes, and " -"Hugo Cisneiros. </para> </footnote> for further information about using " -"<command>yum</command> to manage packages." +msgid "Refer to <ulink url="http://docs.fedoraproject.org/yum/en/%5C%22%3EManaging Software with yum</ulink><footnote> <para> Managing Software with yum, written by Stuart Ellis, edited by Paul W. Frields, Rodrigo Menezes, and Hugo Cisneiros. </para> </footnote> for further information about using <command>yum</command> to manage packages." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In previous versions of Fedora, the <package>selinux-policy-devel</package> " -"package is required when making a local policy module with " -"<command>audit2allow -M</command>." +msgid "In previous versions of Fedora, the <package>selinux-policy-devel</package> package is required when making a local policy module with <command>audit2allow -M</command>." msgstr ""

#. Tag: title #, no-c-format msgid "Which Log File is Used" -msgstr "" +msgstr "welche Logdatei benutzt wird"

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, the <package>dbus</package>, " -"<package>setroubleshoot-server</package> and <package>audit</package> " -"packages are installed if packages are not removed from the default package " -"selection." +msgid "In Fedora&nbsp;&PRODVER;, the <package>dbus</package>, <package>setroubleshoot-server</package> and <package>audit</package> packages are installed if packages are not removed from the default package selection." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux denial messages, such as the following, are written to <filename>/" -"var/log/audit/audit.log</filename> by default:" -msgstr "" +msgid "SELinux denial messages, such as the following, are written to <filename>/var/log/audit/audit.log</filename> by default:" +msgstr "SELinux Zugriffsfehlermeldungen, wie z.B. die nachfolgende, werden standardmässig in die Datei <filename>/var/log/audit/audit.log</filename> geschrieben:"

#. Tag: para #, no-c-format -msgid "" -"Also, if <systemitem class="daemon">setroubleshootd</systemitem> is " -"running, denial messages from <filename>/var/log/audit/audit.log</filename> " -"are translated to an easier-to-read form and sent to <filename>/var/log/" -"messages</filename>:" -msgstr "" +msgid "Also, if <systemitem class="daemon">setroubleshootd</systemitem> is running, denial messages from <filename>/var/log/audit/audit.log</filename> are translated to an easier-to-read form and sent to <filename>/var/log/messages</filename>:" +msgstr "Falls <systemitem class="daemon">setroubleshootd</systemitem> aktiv ist, werden Zugriffsfehlermeldungen aus <filename>/var/log/audit/audit.log</filename> in eine einfacher lesbare Form übersetzt und in die Datei <filename>/var/log/messages</filename> geschrieben:"

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, <systemitem class="daemon">setroubleshootd</" -"systemitem> no longer constantly runs as a service, however it is still used " -"to analyze the AVC messages. Two new programs act as a method to start " -"setroubleshoot when needed: <systemitem class="daemon">sedispatch</" -"systemitem> and <systemitem class="daemon">seapplet</systemitem>. " -"<systemitem class="daemon">sedispatch</systemitem> runs as part of the " -"audit subsystem, and via <systemitem class="daemon">dbus</systemitem>, " -"sends a message when an AVC denial occurs, which will go straight to " -"<systemitem class="daemon">setroubleshootd</systemitem> if it is already " -"running, or it will start <systemitem class="daemon">setroubleshootd</" -"systemitem> if it is not running. <systemitem class="daemon">seapplet</" -"systemitem> is a tool which runs in the system's toolbar, waiting for dbus " -"messages in <systemitem class="daemon">setroubleshootd</systemitem>, and " -"will launch the notification bubble, allowing the user to review the denial." +msgid "In Fedora&nbsp;&PRODVER;, <systemitem class="daemon">setroubleshootd</systemitem> no longer constantly runs as a service, however it is still used to analyze the AVC messages. Two new programs act as a method to start setroubleshoot when needed: <systemitem class="daemon">sedispatch</systemitem> and <systemitem class="daemon">seapplet</systemitem>. <systemitem class="daemon">sedispatch</systemitem> runs as part of the audit subsystem, and via <systemitem class="daemon">dbus</systemitem>, sends a message when an AVC denial occurs, which will go straight to <systemitem class="daemon">setroubleshootd</systemitem> if it is already running, or it will start <systemitem class="daemon">setroubleshootd</systemitem> if it is not running. <systemitem class="daemon">seapplet</systemitem> is a tool which runs in the system's toolbar, waiting for dbus messages in <systemitem class="daemon">setroubleshootd</systemitem>, and will launch the notification bubble, all owing the user to review the denial." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Denial messages are sent to a different location, depending on which daemons " -"are running:" +msgid "Denial messages are sent to a different location, depending on which daemons are running:" msgstr ""

#. Tag: segtitle @@ -239,33 +137,31 @@ #. Tag: seg #, no-c-format msgid "auditd on" -msgstr "" +msgstr "auditd Ein"

#. Tag: seg -#, fuzzy, no-c-format +#, no-c-format msgid "<filename>/var/log/audit/audit.log</filename>" -msgstr "grep "denied" /var/log/audit/audit.log" +msgstr "<filename>/var/log/audit/audit.log</filename>"

#. Tag: seg #, no-c-format msgid "auditd off; rsyslogd on" -msgstr "" +msgstr "auditd Aus; rsyslogd Ein"

#. Tag: seg #, no-c-format msgid "<filename>/var/log/messages</filename>" -msgstr "" +msgstr "<filename>/var/log/messages</filename>"

#. Tag: seg #, no-c-format msgid "rsyslogd and auditd on" -msgstr "" +msgstr "rsyslogd und auditd Ein"

#. Tag: seg #, no-c-format -msgid "" -"<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial " -"messages also sent to <filename>/var/log/messages</filename>" +msgid "<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial messages also sent to <filename>/var/log/messages</filename>" msgstr ""

#. Tag: title @@ -275,27 +171,17 @@

#. Tag: para #, no-c-format -msgid "" -"To configure the <systemitem class="daemon">auditd</systemitem>, " -"<systemitem class="daemon">rsyslogd</systemitem>, and <systemitem class=" -""daemon">setroubleshootd</systemitem> daemons to automatically start at " -"boot, run the following commands as the Linux root user:" +msgid "To configure the <systemitem class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</systemitem>, and <systemitem class="daemon">setroubleshootd</systemitem> daemons to automatically start at boot, run the following commands as the Linux root user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Use the <command>service <replaceable>service-name</replaceable> status</" -"command> command to check if these services are running, for example:" -msgstr "" +msgid "Use the <command>service <replaceable>service-name</replaceable> status</command> command to check if these services are running, for example:" +msgstr "Benutzen Sie den Befehl <command>service <replaceable>service-name</replaceable> status</command> um zu überprüfen ob die Dienste aktiv sind, wie z.B.:"

#. Tag: para #, no-c-format -msgid "" -"If the above services are not running (<computeroutput><replaceable>service-" -"name</replaceable> is stopped</computeroutput>), use the <command>service " -"<replaceable>service-name</replaceable> start</command> command as the Linux " -"root user to start them. For example:" +msgid "If the above services are not running (<computeroutput><replaceable>service-name</replaceable> is stopped</computeroutput>), use the <command>service <replaceable>service-name</replaceable> start</command> command as the Linux root user to start them. For example:" msgstr ""

#. Tag: title @@ -305,218 +191,122 @@

#. Tag: para #, no-c-format -msgid "" -"The <filename>/etc/selinux/config</filename> file is the main SELinux " -"configuration file. It controls the SELinux mode and the SELinux policy to " -"use:" -msgstr "" +msgid "The <filename>/etc/selinux/config</filename> file is the main SELinux configuration file. It controls the SELinux mode and the SELinux policy to use:" +msgstr "Die Datei <filename>/etc/selinux/config</filename> ist die Hauptkonfigurationsdatei von SELinux. Diese steuert den SELinux Modus und den benutzten SELinux Regelsatz:"

#. Tag: term #, no-c-format msgid "<computeroutput>SELINUX=enforcing</computeroutput>" -msgstr "" +msgstr "<computeroutput>SELINUX=enforcing</computeroutput>"

#. Tag: para #, no-c-format -msgid "" -"The <option>SELINUX</option> option sets the mode SELinux runs in. SELinux " -"has three modes: enforcing, permissive, and disabled. When using enforcing " -"mode, SELinux policy is enforced, and SELinux denies access based on SELinux " -"policy rules. Denial messages are logged. When using permissive mode, " -"SELinux policy is not enforced. SELinux does not deny access, but denials " -"are logged for actions that would have been denied if running SELinux in " -"enforcing mode. When using disabled mode, SELinux is disabled (the SELinux " -"module is not registered with the Linux kernel), and only DAC rules are used." +msgid "The <option>SELINUX</option> option sets the mode SELinux runs in. SELinux has three modes: enforcing, permissive, and disabled. When using enforcing mode, SELinux policy is enforced, and SELinux denies access based on SELinux policy rules. Denial messages are logged. When using permissive mode, SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running SELinux in enforcing mode. When using disabled mode, SELinux is disabled (the SELinux module is not registered with the Linux kernel), and only DAC rules are used." msgstr ""

#. Tag: term #, no-c-format msgid "<computeroutput>SELINUXTYPE=targeted</computeroutput>" -msgstr "" +msgstr "<computeroutput>SELINUXTYPE=targeted</computeroutput>"

#. Tag: para #, no-c-format -msgid "" -"The <option>SELINUXTYPE</option> option sets the SELinux policy to use. " -"Targeted policy is the default policy. Only change this option if you want " -"to use the MLS policy. To use the MLS policy, install the <package>selinux-" -"policy-mls</package> package; configure <option>SELINUXTYPE=mls</option> in " -"<filename>/etc/selinux/config</filename>; and reboot your system." +msgid "The <option>SELINUXTYPE</option> option sets the SELinux policy to use. Targeted policy is the default policy. Only change this option if you want to use the MLS policy. To use the MLS policy, install the <package>selinux-policy-mls</package> package; configure <option>SELINUXTYPE=mls</option> in <filename>/etc/selinux/config</filename>; and reboot your system." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When systems run with SELinux in permissive or disabled mode, users have " -"permission to label files incorrectly. Also, files created while SELinux is " -"disabled are not labeled. This causes problems when changing to enforcing " -"mode. To prevent incorrectly labeled and unlabeled files from causing " -"problems, file systems are automatically relabeled when changing from " -"disabled mode to permissive or enforcing mode." +msgid "When systems run with SELinux in permissive or disabled mode, users have permission to label files incorrectly. Also, files created while SELinux is disabled are not labeled. This causes problems when changing to enforcing mode. To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from disabled mode to permissive or enforcing mode." msgstr ""

#. Tag: title #, no-c-format msgid "Enabling and Disabling SELinux" -msgstr "" +msgstr "Einschalten und Abschalten von SELinux"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/usr/sbin/getenforce</command> or <command>/usr/sbin/" -"sestatus</command> commands to check the status of SELinux. The " -"<command>getenforce</command> command returns <computeroutput>Enforcing</" -"computeroutput>, <computeroutput>Permissive</computeroutput>, or " -"<computeroutput>Disabled</computeroutput>. The <command>getenforce</command> " -"command returns <computeroutput>Enforcing</computeroutput> when SELinux is " -"enabled (SELinux policy rules are enforced):" +msgid "Use the <command>/usr/sbin/getenforce</command> or <command>/usr/sbin/sestatus</command> commands to check the status of SELinux. The <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput>, <computeroutput>Permissive</computeroutput>, or <computeroutput>Disabled</computeroutput>. The <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput> when SELinux is enabled (SELinux policy rules are enforced):" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>getenforce</command> command returns " -"<computeroutput>Permissive</computeroutput> when SELinux is enabled, but " -"SELinux policy rules are not enforced, and only DAC rules are used. The " -"<command>getenforce</command> command returns <computeroutput>Disabled</" -"computeroutput> if SELinux is disabled." +msgid "The <command>getenforce</command> command returns <computeroutput>Permissive</computeroutput> when SELinux is enabled, but SELinux policy rules are not enforced, and only DAC rules are used. The <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput> if SELinux is disabled." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>sestatus</command> command returns the SELinux status and the " -"SELinux policy being used:" +msgid "The <command>sestatus</command> command returns the SELinux status and the SELinux policy being used:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>SELinux status: enabled</computeroutput> is returned when " -"SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> " -"is returned when SELinux is running in enforcing mode. " -"<computeroutput>Policy from config file: targeted</computeroutput> is " -"returned when the SELinux targeted policy is used." +msgid "<computeroutput>SELinux status: enabled</computeroutput> is returned when SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> is returned when SELinux is running in enforcing mode. <computeroutput>Policy from config file: targeted</computeroutput> is returned when the SELinux targeted policy is used." msgstr ""

#. Tag: title #, no-c-format msgid "Enabling SELinux" -msgstr "" +msgstr "Anschalten von SELinux"

#. Tag: para #, no-c-format -msgid "" -"On systems with SELinux disabled, the <computeroutput>SELINUX=disabled</" -"computeroutput> option is configured in <filename>/etc/selinux/config</" -"filename>:" +msgid "On systems with SELinux disabled, the <computeroutput>SELINUX=disabled</computeroutput> option is configured in <filename>/etc/selinux/config</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Also, the <command>getenforce</command> command returns " -"<computeroutput>Disabled</computeroutput>:" +msgid "Also, the <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format msgid "To enable SELinux:" -msgstr "" +msgstr "um SELinux anzuschalten:"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>rpm -qa | grep selinux</command>, <command>rpm -q " -"policycoreutils</command>, and <command>rpm -qa | grep setroubleshoot</" -"command> commands to confirm that the SELinux packages are installed. This " -"guide assumes the following packages are installed: <package>selinux-policy-" -"targeted</package>, <package>selinux-policy</package>, <package>libselinux</" -"package>, <package>libselinux-python</package>, <package>libselinux-utils</" -"package>, <package>policycoreutils</package>, <package>setroubleshoot</" -"package>, <package>setroubleshoot-server</package>, <package>setroubleshoot-" -"plugins</package>. If these packages are not installed, as the Linux root " -"user, install them via the <command>yum install <replaceable>package-name</" -"replaceable></command> command. The following packages are optional: " -"<package>policycoreutils-gui</package>, <package>setroubleshoot</package>, " -"<package>selinux-policy-devel</package>, and <package>mcstrans</package>." +msgid "Use the <command>rpm -qa | grep selinux</command>, <command>rpm -q policycoreutils</command>, and <command>rpm -qa | grep setroubleshoot</command> commands to confirm that the SELinux packages are installed. This guide assumes the following packages are installed: <package>selinux-policy-targeted</package>, <package>selinux-policy</package>, <package>libselinux</package>, <package>libselinux-python</package>, <package>libselinux-utils</package>, <package>policycoreutils</package>, <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>setroubleshoot-plugins</package>. If these packages are not installed, as the Linux root user, install them via the <command>yum install <replaceable>package-name</replaceable></command> command. The following packages are optional: <package>policycoreutils-gui</package>, <package>setroubleshoot</package>, <package>selinux-policy-devel</package>, and <package>mcstrans</package>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Before SELinux is enabled, each file on the file system must be labeled with " -"an SELinux context. Before this happens, confined domains may be denied " -"access, preventing your system from booting correctly. To prevent this, " -"configure <computeroutput>SELINUX=permissive</computeroutput> in <filename>/" -"etc/selinux/config</filename>:" +msgid "Before SELinux is enabled, each file on the file system must be labeled with an SELinux context. Before this happens, confined domains may be denied access, preventing your system from booting correctly. To prevent this, configure <computeroutput>SELINUX=permissive</computeroutput> in <filename>/etc/selinux/config</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>reboot</command> command to restart " -"the system. During the next boot, file systems are labeled. The label " -"process labels all files with an SELinux context:" +msgid "As the Linux root user, run the <command>reboot</command> command to restart the system. During the next boot, file systems are labeled. The label process labels all files with an SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Each <computeroutput>*</computeroutput> character on the bottom line " -"represents 1000 files that have been labeled. In the above example, four " -"<computeroutput>*</computeroutput> characters represent 4000 files have been " -"labeled. The time it takes to label all files depends upon the number of " -"files on the system, and the speed of the hard disk drives. On modern " -"systems, this process can take as little as 10 minutes." +msgid "Each <computeroutput>*</computeroutput> character on the bottom line represents 1000 files that have been labeled. In the above example, four <computeroutput>*</computeroutput> characters represent 4000 files have been labeled. The time it takes to label all files depends upon the number of files on the system, and the speed of the hard disk drives. On modern systems, this process can take as little as 10 minutes." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In permissive mode, SELinux policy is not enforced, but denials are still " -"logged for actions that would have been denied if running in enforcing mode. " -"Before changing to enforcing mode, as the Linux root user, run the " -"<command>grep "SELinux is preventing" /var/log/messages</command> command " -"as the Linux root user to confirm that SELinux did not deny actions during " -"the last boot. If SELinux did not deny actions during the last boot, this " -"command does not return any output. Refer to <xref linkend="chap-Security-" -"Enhanced_Linux-Troubleshooting" /> for troubleshooting information if " -"SELinux denied access during boot." +msgid "In permissive mode, SELinux policy is not enforced, but denials are still logged for actions that would have been denied if running in enforcing mode. Before changing to enforcing mode, as the Linux root user, run the <command>grep "SELinux is preventing" /var/log/messages</command> command as the Linux root user to confirm that SELinux did not deny actions during the last boot. If SELinux did not deny actions during the last boot, this command does not return any output. Refer to <xref linkend="chap-Security-Enhanced_Linux-Troubleshooting" /> for troubleshooting information if SELinux denied access during boot." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If there were no denial messages in <filename>/var/log/messages</filename>, " -"configure <computeroutput>SELINUX=enforcing</computeroutput> in <filename>/" -"etc/selinux/config</filename>:" +msgid "If there were no denial messages in <filename>/var/log/messages</filename>, configure <computeroutput>SELINUX=enforcing</computeroutput> in <filename>/etc/selinux/config</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Reboot your system. After reboot, confirm that the <command>getenforce</" -"command> command returns <computeroutput>Enforcing</computeroutput>:" -msgstr "" +msgid "Reboot your system. After reboot, confirm that the <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput>:" +msgstr "Starten Sie Ihr System neu. Vergewissern Sie sich nach den Neustart, dass der Befehl <command>getenforce</command> den folgenden Wert zurückliefert <computeroutput>Enforcing</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage login -l</" -"command> command to view the mapping between SELinux and Linux users. The " -"output should be as follows:" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage login -l</command> command to view the mapping between SELinux and Linux users. The output should be as follows:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If this is not the case, run the following commands as the Linux root user " -"to fix the user mappings. It is safe to ignore the <computeroutput>SELinux-" -"user<replaceable> username</replaceable> is already defined</computeroutput> " -"warnings if they occur, where <replaceable>username</replaceable> can be " -"<computeroutput>unconfined_u</computeroutput>, <computeroutput>guest_u</" -"computeroutput>, or <computeroutput>xguest_u</computeroutput>:" +msgid "If this is not the case, run the following commands as the Linux root user to fix the user mappings. It is safe to ignore the <computeroutput>SELinux-user<replaceable> username</replaceable> is already defined</computeroutput> warnings if they occur, where <replaceable>username</replaceable> can be <computeroutput>unconfined_u</computeroutput>, <computeroutput>guest_u</computeroutput>, or <computeroutput>xguest_u</computeroutput>:" msgstr ""

#. Tag: title @@ -526,16 +316,12 @@

#. Tag: para #, no-c-format -msgid "" -"To disable SELinux, configure <option>SELINUX=disabled</option> in " -"<filename>/etc/selinux/config</filename>:" +msgid "To disable SELinux, configure <option>SELINUX=disabled</option> in <filename>/etc/selinux/config</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Reboot your system. After reboot, confirm that the <command>getenforce</" -"command> command returns <computeroutput>Disabled</computeroutput>:" +msgid "Reboot your system. After reboot, confirm that the <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput>:" msgstr ""

#. Tag: title @@ -550,17 +336,12 @@

#. Tag: para #, no-c-format -msgid "" -"Enforcing: SELinux policy is enforced. SELinux denies access based on " -"SELinux policy rules." +msgid "Enforcing: SELinux policy is enforced. SELinux denies access based on SELinux policy rules." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Permissive: SELinux policy is not enforced. SELinux does not deny access, " -"but denials are logged for actions that would have been denied if running in " -"enforcing mode." +msgid "Permissive: SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode." msgstr ""

#. Tag: para @@ -570,21 +351,12 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/usr/sbin/setenforce</command> command to change between " -"enforcing and permissive mode. Changes made with <command>/usr/sbin/" -"setenforce</command> do not persist across reboots. To change to enforcing " -"mode, as the Linux root user, run the <command>/usr/sbin/setenforce 1</" -"command> command. To change to permissive mode, run the <command>/usr/sbin/" -"setenforce 0</command> command. Use the <command>/usr/sbin/getenforce</" -"command> command to view the current SELinux mode." +msgid "Use the <command>/usr/sbin/setenforce</command> command to change between enforcing and permissive mode. Changes made with <command>/usr/sbin/setenforce</command> do not persist across reboots. To change to enforcing mode, as the Linux root user, run the <command>/usr/sbin/setenforce 1</command> command. To change to permissive mode, run the <command>/usr/sbin/setenforce 0</command> command. Use the <command>/usr/sbin/getenforce</command> command to view the current SELinux mode." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Persistent mode changes are covered in <xref linkend="sect-Security-" -"Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux" />." +msgid "Persistent mode changes are covered in <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux" />." msgstr ""

#. Tag: title @@ -594,11 +366,7 @@

#. Tag: para #, no-c-format -msgid "" -"Booleans allow parts of SELinux policy to be changed at runtime, without any " -"knowledge of SELinux policy writing. This allows changes, such as allowing " -"services access to NFS file systems, without reloading or recompiling " -"SELinux policy." +msgid "Booleans allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing. This allows changes, such as allowing services access to NFS file systems, without reloading or recompiling SELinux policy." msgstr ""

#. Tag: title @@ -608,43 +376,27 @@

#. Tag: para #, no-c-format -msgid "" -"For a list of Booleans, an explanation of what each one is, and whether they " -"are on or off, run the <command>semanage boolean -l</command> command as the " -"Linux root user. The following example does not list all Booleans:" +msgid "For a list of Booleans, an explanation of what each one is, and whether they are on or off, run the <command>semanage boolean -l</command> command as the Linux root user. The following example does not list all Booleans:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>SELinux boolean</computeroutput> column lists Boolean " -"names. The <computeroutput>Description</computeroutput> column lists whether " -"the Booleans are on or off, and what they do." +msgid "The <computeroutput>SELinux boolean</computeroutput> column lists Boolean names. The <computeroutput>Description</computeroutput> column lists whether the Booleans are on or off, and what they do." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In the following example, the <computeroutput>ftp_home_dir</computeroutput> " -"Boolean is off, preventing the FTP daemon (<systemitem class="daemon" -"">vsftpd</systemitem>) from reading and writing to files in user home " -"directories:" +msgid "In the following example, the <computeroutput>ftp_home_dir</computeroutput> Boolean is off, preventing the FTP daemon (<systemitem class="daemon">vsftpd</systemitem>) from reading and writing to files in user home directories:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>getsebool -a</command> command lists Booleans, whether they are " -"on or off, but does not give a description of each one. The following " -"example does not list all Booleans:" +msgid "The <command>getsebool -a</command> command lists Booleans, whether they are on or off, but does not give a description of each one. The following example does not list all Booleans:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>getsebool <replaceable>boolean-name</replaceable></command> " -"command to only list the status of the <replaceable>boolean-name</" -"replaceable> Boolean:" +msgid "Run the <command>getsebool <replaceable>boolean-name</replaceable></command> command to only list the status of the <replaceable>boolean-name</replaceable> Boolean:" msgstr ""

#. Tag: para @@ -659,66 +411,42 @@

#. Tag: para #, no-c-format -msgid "" -"The <command>setsebool <replaceable>boolean-name</replaceable> " -"<replaceable>x</replaceable></command> command turns Booleans on or off, " -"where <replaceable>boolean-name</replaceable> is a Boolean name, and " -"<replaceable>x</replaceable> is either <option>on</option> to turn the " -"Boolean on, or <option>off</option> to turn it off." +msgid "The <command>setsebool <replaceable>boolean-name</replaceable> <replaceable>x</replaceable></command> command turns Booleans on or off, where <replaceable>boolean-name</replaceable> is a Boolean name, and <replaceable>x</replaceable> is either <option>on</option> to turn the Boolean on, or <option>off</option> to turn it off." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates configuring the " -"<computeroutput>httpd_can_network_connect_db</computeroutput> Boolean:" +msgid "The following example demonstrates configuring the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, the <computeroutput>httpd_can_network_connect_db</" -"computeroutput> Boolean is off, preventing Apache HTTP Server scripts and " -"modules from connecting to database servers:" +msgid "By default, the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean is off, preventing Apache HTTP Server scripts and modules from connecting to database servers:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To temporarily enable Apache HTTP Server scripts and modules to connect to " -"database servers, run the <command>setsebool httpd_can_network_connect_db " -"on</command> command as the Linux root user." +msgid "To temporarily enable Apache HTTP Server scripts and modules to connect to database servers, run the <command>setsebool httpd_can_network_connect_db on</command> command as the Linux root user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Use the <command>getsebool httpd_can_network_connect_db</command> command to " -"verify the Boolean is turned on:" +msgid "Use the <command>getsebool httpd_can_network_connect_db</command> command to verify the Boolean is turned on:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This allows Apache HTTP Server scripts and modules to connect to database " -"servers." +msgid "This allows Apache HTTP Server scripts and modules to connect to database servers." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This change is not persistent across reboots. To make changes persistent " -"across reboots, run the <command>setsebool -P <replaceable>boolean-name</" -"replaceable> on</command> command as the Linux root user:" +msgid "This change is not persistent across reboots. To make changes persistent across reboots, run the <command>setsebool -P <replaceable>boolean-name</replaceable> on</command> command as the Linux root user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To temporarily revert to the default behavior, as the Linux root user, run " -"the <command>setsebool httpd_can_network_connect_db off</command> command. " -"For changes that persist across reboots, run the <command>setsebool -P " -"httpd_can_network_connect_db off</command> command." +msgid "To temporarily revert to the default behavior, as the Linux root user, run the <command>setsebool httpd_can_network_connect_db off</command> command. For changes that persist across reboots, run the <command>setsebool -P httpd_can_network_connect_db off</command> command." msgstr ""

#. Tag: title @@ -728,34 +456,17 @@

#. Tag: para #, no-c-format -msgid "" -"By default, NFS mounts on the client side are labeled with a default context " -"defined by policy for NFS file systems. In common policies, this default " -"context uses the <computeroutput>nfs_t</computeroutput> type. Also, by " -"default, Samba shares mounted on the client side are labeled with a default " -"context defined by policy. In common policies, this default context uses the " -"<computeroutput>cifs_t</computeroutput> type." +msgid "By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Also, by default, Samba shares mounted on the client side are labeled with a default context defined by policy. In common policies, this default context uses the <computeroutput>cifs_t</computeroutput> type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Depending on policy configuration, services may not be able to read files " -"labeled with the <computeroutput>nfs_t</computeroutput> or " -"<computeroutput>cifs_t</computeroutput> types. This may prevent file systems " -"labeled with these types from being mounted and then read or exported by " -"other services. Booleans can be turned on or off to control which services " -"are allowed to access the <computeroutput>nfs_t</computeroutput> and " -"<computeroutput>cifs_t</computeroutput> types." +msgid "Depending on policy configuration, services may not be able to read files labeled with the <computeroutput>nfs_t</computeroutput> or <computeroutput>cifs_t</computeroutput> types. This may prevent file systems labeled with these types from being mounted and then read or exported by other services. Booleans can be turned on or off to control which services are allowed to access the <computeroutput>nfs_t</computeroutput> and <computeroutput>cifs_t</computeroutput> types." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>setsebool</command> and <command>semanage</command> commands " -"must be run as the Linux root user. The <command>setsebool -P</command> " -"command makes persistent changes. Do not use the <option>-P</option> option " -"if you do not want changes to persist across reboots:" +msgid "The <command>setsebool</command> and <command>semanage</command> commands must be run as the Linux root user. The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots:" msgstr ""

#. Tag: title @@ -765,21 +476,17 @@

#. Tag: para #, no-c-format -msgid "" -"To allow access to NFS file systems (files labeled with the " -"<computeroutput>nfs_t</computeroutput> type):" +msgid "To allow access to NFS file systems (files labeled with the <computeroutput>nfs_t</computeroutput> type):" msgstr ""

#. Tag: para -#, fuzzy, no-c-format +#, no-c-format msgid "<command>/usr/sbin/setsebool -P httpd_use_nfs on</command>" -msgstr "/usr/sbin/setsebool -P httpd_use_nfs on" +msgstr "<command>/usr/sbin/setsebool -P httpd_use_nfs on</command>"

#. Tag: para #, no-c-format -msgid "" -"To allow access to Samba file systems (files labeled with the " -"<computeroutput>cifs_t</computeroutput> type):" +msgid "To allow access to Samba file systems (files labeled with the <computeroutput>cifs_t</computeroutput> type):" msgstr ""

#. Tag: para @@ -854,18 +561,12 @@

#. Tag: para #, no-c-format -msgid "" -"These Booleans exist in SELinux policy as shipped with Fedora&nbsp;" -"&PRODVER;. They may not exist in policy shipped with other versions of " -"Fedora or other operating systems." +msgid "These Booleans exist in SELinux policy as shipped with Fedora&nbsp;&PRODVER;. They may not exist in policy shipped with other versions of Fedora or other operating systems." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to the SELinux Managing Confined Services Guide:<ulink url="http://" -"docs.fedoraproject.org/selinux-managing-confined-services-guide" /> for " -"more information relating to SELinux Booleans." +msgid "Refer to the SELinux Managing Confined Services Guide:<ulink url="http://docs.fedoraproject.org/selinux-managing-confined-services-guide%5C" /> for more information relating to SELinux Booleans." msgstr ""

#. Tag: title @@ -875,31 +576,17 @@

#. Tag: para #, no-c-format -msgid "" -"On systems running SELinux, all processes and files are labeled in a way " -"that represents security-relevant information. This information is called " -"the SELinux context. For files, this is viewed using the <command>ls -Z</" -"command> command:" +msgid "On systems running SELinux, all processes and files are labeled in a way that represents security-relevant information. This information is called the SELinux context. For files, this is viewed using the <command>ls -Z</command> command:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, SELinux provides a user (<computeroutput>unconfined_u</" -"computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type " -"(<computeroutput>user_home_t</computeroutput>), and a level " -"(<computeroutput>s0</computeroutput>). This information is used to make " -"access control decisions. On DAC systems, access is controlled based on " -"Linux user and group IDs. SELinux policy rules are checked after DAC rules. " -"SELinux policy rules are not used if DAC rules deny access first." +msgid "In this example, SELinux provides a user (<computeroutput>unconfined_u</computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type (<computeroutput>user_home_t</computeroutput>), and a level (<computeroutput>s0</computeroutput>). This information is used to make access control decisions. On DAC systems, access is controlled based on Linux user and group IDs. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"There are multiple commands for managing the SELinux context for files, such " -"as <command>chcon</command>, <command>semanage fcontext</command>, and " -"<command>restorecon</command>." +msgid "There are multiple commands for managing the SELinux context for files, such as <command>chcon</command>, <command>semanage fcontext</command>, and <command>restorecon</command>." msgstr ""

#. Tag: title @@ -909,14 +596,7 @@

#. Tag: para #, no-c-format -msgid "" -"The <command>chcon</command> command changes the SELinux context for files. " -"However, changes made with the <command>chcon</command> command do not " -"survive a file system relabel, or the execution of the <command>/sbin/" -"restorecon</command> command. SELinux policy controls whether users are able " -"to modify the SELinux context for any given file. When using <command>chcon</" -"command>, users provide all or part of the SELinux context to change. An " -"incorrect file type is a common cause of SELinux denying access." +msgid "The <command>chcon</command> command changes the SELinux context for files. However, changes made with the <command>chcon</command> command do not survive a file system relabel, or the execution of the <command>/sbin/restorecon</command> command. SELinux policy controls whether users are able to modify the SELinux context for any given file. When using <command>chcon</command>, users provide all or part of the SELinux context to change. An incorrect file type is a common cause of SELinux denying access." msgstr ""

#. Tag: title @@ -926,23 +606,12 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>chcon -t <replaceable>type</replaceable> <replaceable>file-" -"name</replaceable></command> command to change the file type, where " -"<replaceable>type</replaceable> is a type, such as " -"<computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>file-" -"name</replaceable> is a file or directory name." +msgid "Run the <command>chcon -t <replaceable>type</replaceable> <replaceable>file-name</replaceable></command> command to change the file type, where <replaceable>type</replaceable> is a type, such as <computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>file-name</replaceable> is a file or directory name." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>chcon -R -t <replaceable>type</replaceable> " -"<replaceable>directory-name</replaceable></command> command to change the " -"type of the directory and its contents, where <replaceable>type</" -"replaceable> is a type, such as <computeroutput>httpd_sys_content_t</" -"computeroutput>, and <replaceable>directory-name</replaceable> is a " -"directory name." +msgid "Run the <command>chcon -R -t <replaceable>type</replaceable> <replaceable>directory-name</replaceable></command> command to change the type of the directory and its contents, where <replaceable>type</replaceable> is a type, such as <computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>directory-name</replaceable> is a directory name." msgstr ""

#. Tag: title @@ -952,70 +621,42 @@

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates changing the type, and no other " -"attributes of the SELinux context:" +msgid "The following example demonstrates changing the type, and no other attributes of the SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd</command> command without arguments to change into your " -"home directory." +msgid "Run the <command>cd</command> command without arguments to change into your home directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>touch file1</command> command to create a new file. Use the " -"<command>ls -Z file1</command> command to view the SELinux context for " -"<filename>file1</filename>:" +msgid "Run the <command>touch file1</command> command to create a new file. Use the <command>ls -Z file1</command> command to view the SELinux context for <filename>file1</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, the SELinux context for <filename>file1</filename> includes " -"the SELinux <computeroutput>unconfined_u</computeroutput> user, " -"<computeroutput>object_r</computeroutput> role, <computeroutput>user_home_t</" -"computeroutput> type, and the <computeroutput>s0</computeroutput> level. For " -"a description of each part of the SELinux context, refer to <xref linkend=" -""chap-Security-Enhanced_Linux-SELinux_Contexts" />." +msgid "In this example, the SELinux context for <filename>file1</filename> includes the SELinux <computeroutput>unconfined_u</computeroutput> user, <computeroutput>object_r</computeroutput> role, <computeroutput>user_home_t</computeroutput> type, and the <computeroutput>s0</computeroutput> level. For a description of each part of the SELinux context, refer to <xref linkend="chap-Security-Enhanced_Linux-SELinux_Contexts" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>chcon -t samba_share_t file1</command> command to change " -"the type to <computeroutput>samba_share_t</computeroutput>. The <option>-t</" -"option> option only changes the type. View the change with <command>ls -Z " -"file1</command>:" +msgid "Run the <command>chcon -t samba_share_t file1</command> command to change the type to <computeroutput>samba_share_t</computeroutput>. The <option>-t</option> option only changes the type. View the change with <command>ls -Z file1</command>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/sbin/restorecon -v file1</command> command to restore the " -"SELinux context for the <filename>file1</filename> file. Use the <option>-v</" -"option> option to view what changes:" +msgid "Use the <command>/sbin/restorecon -v file1</command> command to restore the SELinux context for the <filename>file1</filename> file. Use the <option>-v</option> option to view what changes:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, the previous type, <computeroutput>samba_share_t</" -"computeroutput>, is restored to the correct, <computeroutput>user_home_t</" -"computeroutput> type. When using targeted policy (the default SELinux policy " -"in Fedora 11), the <command>/sbin/restorecon</command> command reads the " -"files in the <filename>/etc/selinux/targeted/contexts/files/</filename> " -"directory, to see which SELinux context files should have." +msgid "In this example, the previous type, <computeroutput>samba_share_t</computeroutput>, is restored to the correct, <computeroutput>user_home_t</computeroutput> type. When using targeted policy (the default SELinux policy in Fedora 11), the <command>/sbin/restorecon</command> command reads the files in the <filename>/etc/selinux/targeted/contexts/files/</filename> directory, to see which SELinux context files should have." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The example in this section works the same for directories, for example, if " -"<filename>file1</filename> was a directory." +msgid "The example in this section works the same for directories, for example, if <filename>file1</filename> was a directory." msgstr ""

#. Tag: title @@ -1025,39 +666,22 @@

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a new directory, and changing " -"the directory's file type (along with its contents) to a type used by the " -"Apache HTTP Server. The configuration in this example is used if you want " -"Apache HTTP Server to use a different document root (instead of <filename>/" -"var/www/html/</filename>):" +msgid "The following example demonstrates creating a new directory, and changing the directory's file type (along with its contents) to a type used by the Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of <filename>/var/www/html/</filename>):" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mkdir /web</command> command to " -"create a new directory, and then the <command>touch /web/file{1,2,3}</" -"command> command to create 3 empty files (<filename>file1</filename>, " -"<filename>file2</filename>, and <filename>file3</filename>). The <filename>/" -"web/</filename> directory and files in it are labeled with the " -"<computeroutput>default_t</computeroutput> type:" +msgid "As the Linux root user, run the <command>mkdir /web</command> command to create a new directory, and then the <command>touch /web/file{1,2,3}</command> command to create 3 empty files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). The <filename>/web/</filename> directory and files in it are labeled with the <computeroutput>default_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>chcon -R -t httpd_sys_content_t /" -"web/</command> command to change the type of the <filename>/web/</filename> " -"directory (and its contents) to <computeroutput>httpd_sys_content_t</" -"computeroutput>:" +msgid "As the Linux root user, run the <command>chcon -R -t httpd_sys_content_t /web/</command> command to change the type of the <filename>/web/</filename> directory (and its contents) to <computeroutput>httpd_sys_content_t</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -R -v /web/</" -"command> command to restore the default SELinux contexts:" +msgid "As the Linux root user, run the <command>/sbin/restorecon -R -v /web/</command> command to restore the default SELinux contexts:" msgstr ""

#. Tag: para @@ -1077,9 +701,7 @@

#. Tag: para #, no-c-format -msgid "" -"Type Enforcement is the main permission control used in SELinux targeted " -"policy. For the most part, SELinux users and roles can be ignored." +msgid "Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored." msgstr ""

#. Tag: title @@ -1089,20 +711,7 @@

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext</command> command changes the " -"SELinux context for files. When using targeted policy, changes made with " -"this command are added to the <filename>/etc/selinux/targeted/contexts/files/" -"file_contexts</filename> file if the changes are to files that exists in " -"<filename>file_contexts</filename>, or are added to <filename>file_contexts." -"local</filename> for new files and directories, such as creating a " -"<filename>/web/</filename> directory. <command>setfiles</command>, which is " -"used when a file system is relabeled, and <command>/sbin/restorecon</" -"command>, which restores the default SELinux contexts, read these files. " -"This means that changes made by <command>/usr/sbin/semanage fcontext</" -"command> are persistent, even if the file system is relabeled. SELinux " -"policy controls whether users are able to modify the SELinux context for any " -"given file." +msgid "The <command>/usr/sbin/semanage fcontext</command> command changes the SELinux context for files. When using targeted policy, changes made with this command are added to the <filename>/etc/selinux/targeted/contexts/files/file_contexts</filename> file if the changes are to files that exists in <filename>file_contexts</filename>, or are added to <filename>file_contexts.local</filename> for new files and directories, such as creating a <filename>/web/</filename> directory. <command>setfiles</command>, which is used when a file system is relabeled, and <command>/sbin/restorecon</command>, which restores the default SELinux contexts, read these files. This means that changes made by <command>/usr/sbin/semanage fcontext</command> are persistent, even if the file system is relabeled. SELinux policy controls whether users are able to modify the SELinux context for any given file." msgstr ""

#. Tag: para @@ -1112,19 +721,12 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>/usr/sbin/semanage fcontext -a <replaceable>options</" -"replaceable> <replaceable>file-name</replaceable>|<replaceable>directory-" -"name</replaceable></command> command, remembering to use the full path to " -"the file or directory." +msgid "Run the <command>/usr/sbin/semanage fcontext -a <replaceable>options</replaceable> <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command, remembering to use the full path to the file or directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>/sbin/restorecon -v <replaceable>file-name</replaceable>|" -"<replaceable>directory-name</replaceable></command> command to apply the " -"context changes." +msgid "Run the <command>/sbin/restorecon -v <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command to apply the context changes." msgstr ""

#. Tag: title @@ -1134,66 +736,37 @@

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates changing a file's type, and no other " -"attributes of the SELinux context:" +msgid "The following example demonstrates changing a file's type, and no other attributes of the SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /etc/file1</command> command " -"to create a new file. By default, newly-created files in the <filename>/etc/" -"</filename> directory are labeled with the <computeroutput>etc_t</" -"computeroutput> type:" +msgid "As the Linux root user, run the <command>touch /etc/file1</command> command to create a new file. By default, newly-created files in the <filename>/etc/</filename> directory are labeled with the <computeroutput>etc_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"samba_share_t /etc/file1</command> command to change the <filename>file1</" -"filename> type to <computeroutput>samba_share_t</computeroutput>. The " -"<option>-a</option> option adds a new record, and the <option>-t</option> " -"option defines a type (<computeroutput>samba_share_t</computeroutput>). " -"Note: running this command does not directly change the type - " -"<filename>file1</filename> is still labeled with the <computeroutput>etc_t</" -"computeroutput> type:" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</command> command to change the <filename>file1</filename> type to <computeroutput>samba_share_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (<computeroutput>samba_share_t</computeroutput>). Note: running this command does not directly change the type - <filename>file1</filename> is still labeled with the <computeroutput>etc_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</" -"command> command adds the following entry to <filename>/etc/selinux/targeted/" -"contexts/files/file_contexts.local</filename>:" +msgid "The <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</command> command adds the following entry to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -v /etc/file1</" -"command> command to change the type. Since the <command>semanage</command> " -"command added an entry to <filename>file.contexts.local</filename> for " -"<filename>/etc/file1</filename>, the <command>/sbin/restorecon</command> " -"command changes the type to <computeroutput>samba_share_t</computeroutput>:" +msgid "As the Linux root user, run the <command>/sbin/restorecon -v /etc/file1</command> command to change the type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <filename>/etc/file1</filename>, the <command>/sbin/restorecon</command> command changes the type to <computeroutput>samba_share_t</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>rm -i /etc/file1</command> command " -"to remove <filename>file1</filename>." +msgid "As the Linux root user, run the <command>rm -i /etc/file1</command> command to remove <filename>file1</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /etc/" -"file1</command> command to remove the context added for <filename>/etc/" -"file1</filename>. When the context is removed, running <command>restorecon</" -"command> changes the type to <computeroutput>etc_t</computeroutput>, rather " -"than <computeroutput>samba_share_t</computeroutput>." +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /etc/file1</command> command to remove the context added for <filename>/etc/file1</filename>. When the context is removed, running <command>restorecon</command> changes the type to <computeroutput>etc_t</computeroutput>, rather than <computeroutput>samba_share_t</computeroutput>." msgstr ""

#. Tag: title @@ -1203,156 +776,82 @@

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a new directory and changing " -"that directory's file type, to a type used by Apache HTTP Server:" +msgid "The following example demonstrates creating a new directory and changing that directory's file type, to a type used by Apache HTTP Server:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mkdir /web</command> command to " -"create a new directory. This directory is labeled with the " -"<computeroutput>default_t</computeroutput> type:" +msgid "As the Linux root user, run the <command>mkdir /web</command> command to create a new directory. This directory is labeled with the <computeroutput>default_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>ls</command> <option>-d</option> option makes <command>ls</" -"command> list information about a directory, rather than its contents, and " -"the <option>-Z</option> option makes <command>ls</command> display the " -"SELinux context (in this example, <computeroutput>unconfined_u:object_r:" -"default_t:s0</computeroutput>)." +msgid "The <command>ls</command> <option>-d</option> option makes <command>ls</command> list information about a directory, rather than its contents, and the <option>-Z</option> option makes <command>ls</command> display the SELinux context (in this example, <computeroutput>unconfined_u:object_r:default_t:s0</computeroutput>)." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"httpd_sys_content_t /web</command> command to change the <filename>/web/</" -"filename> type to <computeroutput>httpd_sys_content_t</computeroutput>. The " -"<option>-a</option> option adds a new record, and the <option>-t</option> " -"option defines a type (<computeroutput>httpd_sys_content_t</" -"computeroutput>). Note: running this command does not directly change the " -"type - <filename>/web/</filename> is still labeled with the " -"<computeroutput>default_t</computeroutput> type:" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</command> command to change the <filename>/web/</filename> type to <computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (<computeroutput>httpd_sys_content_t</computeroutput>). Note: running this command does not directly change the type - <filename>/web/</filename> is still labeled with the <computeroutput>default_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</" -"command> command adds the following entry to <command>/etc/selinux/targeted/" -"contexts/files/file_contexts.local</command>:" +msgid "The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</command> command adds the following entry to <command>/etc/selinux/targeted/contexts/files/file_contexts.local</command>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -v /web</command> " -"command to change the type. Since the <command>semanage</command> command " -"added an entry to <filename>file.contexts.local</filename> for <filename>/" -"web</filename>, the <command>/sbin/restorecon</command> command changes the " -"type to <computeroutput>httpd_sys_content_t</computeroutput>:" +msgid "As the Linux root user, run the <command>/sbin/restorecon -v /web</command> command to change the type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <filename>/web</filename>, the <command>/sbin/restorecon</command> command changes the type to <computeroutput>httpd_sys_content_t</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, newly-created files and directories inherit the SELinux type of " -"their parent folders. When using this example, and before removing the " -"SELinux context added for <filename>/web/</filename>, files and directories " -"created in the <filename>/web/</filename> directory are labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> type." +msgid "By default, newly-created files and directories inherit the SELinux type of their parent folders. When using this example, and before removing the SELinux context added for <filename>/web/</filename>, files and directories created in the <filename>/web/</filename> directory are labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /" -"web</command> command to remove the context added for <filename>/web/</" -"filename>." +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /web</command> command to remove the context added for <filename>/web/</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -v /web</command> " -"command to restore the default SELinux context." +msgid "As the Linux root user, run the <command>/sbin/restorecon -v /web</command> command to restore the default SELinux context." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a new directory, and changing " -"the directory's file type (along with its contents) to a type used by Apache " -"HTTP Server. The configuration in this example is used if you want Apache " -"HTTP Server to use a different document root (instead of <filename>/var/www/" -"html/</filename>):" +msgid "The following example demonstrates creating a new directory, and changing the directory's file type (along with its contents) to a type used by Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of <filename>/var/www/html/</filename>):" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"httpd_sys_content_t "/web(/.*)?"</command> command to change the type of " -"the <filename>/web/</filename> directory and the files in it, to " -"<computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</" -"option> option adds a new record, and the <option>-t</option> option defines " -"a type (httpd_sys_content_t). The <computeroutput>"/web(/.*)?"</" -"computeroutput> regular expression causes the <command>semanage</command> " -"command to apply changes to the <filename>/web/</filename> directory, as " -"well as the files in it. Note: running this command does not directly change " -"the type - <filename>/web/</filename> and files in it are still labeled with " -"the <computeroutput>default_t</computeroutput> type:" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> command to change the type of the <filename>/web/</filename> directory and the files in it, to <computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (httpd_sys_content_t). The <computeroutput>"/web(/.*)?"</computeroutput> regular expression causes the <command>semanage</command> command to apply changes to the <filename>/web/</filename> directory, as well as the files in it. Note: running this command does not directly change the type - <filename>/web/</filename> and files in it are still labeled with the <computeroutput>default_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/." -"*)?"</command> command adds the following entry to <filename>/etc/selinux/" -"targeted/contexts/files/file_contexts.local</filename>:" +msgid "The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> command adds the following entry to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -R -v /web</" -"command> command to change the type of the <filename>/web/</filename> " -"directory, as well as all files in it. The <option>-R</option> is for " -"recursive, which means all files and directories under the <filename>/web/</" -"filename> directory are labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> type. Since the " -"<command>semanage</command> command added an entry to <filename>file." -"contexts.local</filename> for <computeroutput>/web(/.*)?</computeroutput>, " -"the <command>/sbin/restorecon</command> command changes the types to " -"<computeroutput>httpd_sys_content_t</computeroutput>:" +msgid "As the Linux root user, run the <command>/sbin/restorecon -R -v /web</command> command to change the type of the <filename>/web/</filename> directory, as well as all files in it. The <option>-R</option> is for recursive, which means all files and directories under the <filename>/web/</filename> directory are labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <computeroutput>/web(/.*)?</computeroutput>, the <command>/sbin/restorecon</command> command changes the types to <computeroutput>httpd_sys_content_t</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, newly-created files and directories inherit the SELinux type of " -"their parents. In this example, files and directories created in the " -"<filename>/web/</filename> directory will be labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> type." +msgid "By default, newly-created files and directories inherit the SELinux type of their parents. In this example, files and directories created in the <filename>/web/</filename> directory will be labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d "/" -"web(/.*)?"</command> command to remove the context added for " -"<computeroutput>"/web(/.*)?"</computeroutput>." +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d "/web(/.*)?"</command> command to remove the context added for <computeroutput>"/web(/.*)?"</computeroutput>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -R -v /web</" -"command> command to restore the default SELinux contexts." +msgid "As the Linux root user, run the <command>/sbin/restorecon -R -v /web</command> command to restore the default SELinux contexts." msgstr ""

#. Tag: title @@ -1362,41 +861,22 @@

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates adding and removing an SELinux context:" +msgid "The following example demonstrates adding and removing an SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"httpd_sys_content_t /test</command> command. The <filename>/test/</filename> " -"directory does not have to exist. This command adds the following context to " -"<filename>/etc/selinux/targeted/contexts/files/file_contexts.local</" -"filename>:" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /test</command> command. The <filename>/test/</filename> directory does not have to exist. This command adds the following context to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To remove the context, as the Linux root user, run the <command>/usr/sbin/" -"semanage fcontext -d <replaceable>file-name</replaceable>|" -"<replaceable>directory-name</replaceable></command> command, where " -"<replaceable>file-name</replaceable>|<replaceable>directory-name</" -"replaceable> is the first part in <filename>file_contexts.local</filename>. " -"The following is an example of a context in <filename>file_contexts.local</" -"filename>:" +msgid "To remove the context, as the Linux root user, run the <command>/usr/sbin/semanage fcontext -d <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command, where <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable> is the first part in <filename>file_contexts.local</filename>. The following is an example of a context in <filename>file_contexts.local</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"With the first part being <computeroutput>/test</computeroutput>. To prevent " -"the <filename>/test/</filename> directory from being labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> after running <command>/" -"sbin/restorecon</command>, or after a file system relabel, run the following " -"command as the Linux root user to delete the context from " -"<filename>file_contexts.local</filename>:" +msgid "With the first part being <computeroutput>/test</computeroutput>. To prevent the <filename>/test/</filename> directory from being labeled with the <computeroutput>httpd_sys_content_t</computeroutput> after running <command>/sbin/restorecon</command>, or after a file system relabel, run the following command as the Linux root user to delete the context from <filename>file_contexts.local</filename>:" msgstr ""

#. Tag: para @@ -1406,10 +886,7 @@

#. Tag: para #, no-c-format -msgid "" -"If the context is part of a regular expression, for example, " -"<computeroutput>/web(/.*)?</computeroutput>, use quotation marks around the " -"regular expression:" +msgid "If the context is part of a regular expression, for example, <computeroutput>/web(/.*)?</computeroutput>, use quotation marks around the regular expression:" msgstr ""

#. Tag: para @@ -1424,18 +901,12 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page for further information about <command>/usr/sbin/semanage</" -"command>." +msgid "manual page for further information about <command>/usr/sbin/semanage</command>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When changing the SELinux context with <command>/usr/sbin/semanage fcontext -" -"a</command>, use the full path to the file or directory to avoid files being " -"mislabeled after a file system relabel, or after the <command>/sbin/" -"restorecon</command> command is run." +msgid "When changing the SELinux context with <command>/usr/sbin/semanage fcontext -a</command>, use the full path to the file or directory to avoid files being mislabeled after a file system relabel, or after the <command>/sbin/restorecon</command> command is run." msgstr ""

#. Tag: title @@ -1445,37 +916,12 @@

#. Tag: para #, no-c-format -msgid "" -"For file systems that support extended attributes, when a file that lacks an " -"SELinux context on disk is accessed, it is treated as if it had a default " -"context as defined by SELinux policy. In common policies, this default " -"context uses the <computeroutput>file_t</computeroutput> type. This should " -"be the only use of this type, so that files without a context on disk can be " -"distinguished in policy, and generally kept inaccessible to confined " -"domains. The <computeroutput>file_t</computeroutput> type should not exist " -"on correctly-labeled file systems, because all files on a system running " -"SELinux should have an SELinux context, and the <computeroutput>file_t</" -"computeroutput> type is never used in file-context configuration<footnote> " -"<para> Files in <filename>/etc/selinux/targeted/contexts/files/</filename> " -"define contexts for files and directories. Files in this directory are read " -"by <command>restorecon</command> and <command>setfiles</command> to restore " -"files and directories to their default contexts. </para> </footnote>." +msgid "For file systems that support extended attributes, when a file that lacks an SELinux context on disk is accessed, it is treated as if it had a default context as defined by SELinux policy. In common policies, this default context uses the <computeroutput>file_t</computeroutput> type. This should be the only use of this type, so that files without a context on disk can be distinguished in policy, and generally kept inaccessible to confined domains. The <computeroutput>file_t</computeroutput> type should not exist on correctly-labeled file systems, because all files on a system running SELinux should have an SELinux context, and the <computeroutput>file_t</computeroutput> type is never used in file-context configuration<footnote> <para> Files in <filename>/etc/selinux/targeted/contexts/files/</filename> define contexts for files and directories. Files in this directory are read by <command>restorecon</command> and <command>setfiles</command> to restore files and directo ries to their default contexts. </para> </footnote>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>default_t</computeroutput> type is used on files that do " -"not match any other pattern in file-context configuration, so that such " -"files can be distinguished from files that do not have a context on disk, " -"and generally kept inaccessible to confined domains. If you create a new top-" -"level directory, such as <filename>/mydirectory/</filename>, this directory " -"may be labeled with the <computeroutput>default_t</computeroutput> type. If " -"services need access to such a directory, update the file-contexts " -"configuration for this location. Refer to <xref linkend="sect-Security-" -"Enhanced_Linux-SELinux_Contexts_Labeling_Files-" -"Persistent_Changes_semanage_fcontext" /> for details on adding a context to " -"the file-context configuration." +msgid "The <computeroutput>default_t</computeroutput> type is used on files that do not match any other pattern in file-context configuration, so that such files can be distinguished from files that do not have a context on disk, and generally kept inaccessible to confined domains. If you create a new top-level directory, such as <filename>/mydirectory/</filename>, this directory may be labeled with the <computeroutput>default_t</computeroutput> type. If services need access to such a directory, update the file-contexts configuration for this location. Refer to <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> for details on adding a context to the file-context configuration." msgstr ""

#. Tag: title @@ -1485,36 +931,17 @@

#. Tag: para #, no-c-format -msgid "" -"By default, when a file system that supports extended attributes is mounted, " -"the security context for each file is obtained from the <emphasis>security." -"selinux</emphasis> extended attribute of the file. Files in file systems " -"that do not support extended attributes are assigned a single, default " -"security context from the policy configuration, based on file system type." +msgid "By default, when a file system that supports extended attributes is mounted, the security context for each file is obtained from the <emphasis>security.selinux</emphasis> extended attribute of the file. Files in file systems that do not support extended attributes are assigned a single, default security context from the policy configuration, based on file system type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Use the <command>mount -o context</command> command to override existing " -"extended attributes, or to specify a different, default context for file " -"systems that do not support extended attributes. This is useful if you do " -"not trust a file system to supply the correct attributes, for example, " -"removable media used in multiple systems. The <command>mount -o context</" -"command> command can also be used to support labeling for file systems that " -"do not support extended attributes, such as File Allocation Table (FAT) or " -"NFS file systems. The context specified with the <option>context</option> is " -"not written to disk: the original contexts are preserved, and are seen when " -"mounting without a <option>context</option> option (if the file system had " -"extended attributes in the first place)." +msgid "Use the <command>mount -o context</command> command to override existing extended attributes, or to specify a different, default context for file systems that do not support extended attributes. This is useful if you do not trust a file system to supply the correct attributes, for example, removable media used in multiple systems. The <command>mount -o context</command> command can also be used to support labeling for file systems that do not support extended attributes, such as File Allocation Table (FAT) or NFS file systems. The context specified with the <option>context</option> is not written to disk: the original contexts are preserved, and are seen when mounting without a <option>context</option> option (if the file system had extended attributes in the first place)." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For further information about file system labeling, refer to James Morris's " -""Filesystem Labeling in SELinux" article: <ulink url="http://www." -"linuxjournal.com/article/7426" />." +msgid "For further information about file system labeling, refer to James Morris's "Filesystem Labeling in SELinux" article: <ulink url="http://www.linuxjournal.com/article/7426%5C" />." msgstr ""

#. Tag: title @@ -1524,52 +951,22 @@

#. Tag: para #, no-c-format -msgid "" -"To mount a file system with the specified context, overriding existing " -"contexts if they exist, or to specify a different, default context for a " -"file system that does not support extended attributes, as the Linux root " -"user, use the <command>mount -o context=<replaceable>SELinux_user:role:type:" -"level</replaceable></command> command when mounting the desired file system. " -"Context changes are not written to disk. By default, NFS mounts on the " -"client side are labeled with a default context defined by policy for NFS " -"file systems. In common policies, this default context uses the " -"<computeroutput>nfs_t</computeroutput> type. Without additional mount " -"options, this may prevent sharing NFS file systems via other services, such " -"as the Apache HTTP Server. The following example mounts an NFS file system " -"so that it can be shared via the Apache HTTP Server:" +msgid "To mount a file system with the specified context, overriding existing contexts if they exist, or to specify a different, default context for a file system that does not support extended attributes, as the Linux root user, use the <command>mount -o context=<replaceable>SELinux_user:role:type:level</replaceable></command> command when mounting the desired file system. Context changes are not written to disk. By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Without additional mount options, this may prevent sharing NFS file systems via other services, such as the Apache HTTP Server. The following example mounts an NFS file system so that it can be shared via the Apache HTTP Server:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Newly-created files and directories on this file system appear to have the " -"SELinux context specified with <option>-o context</option>; however, since " -"context changes are not written to disk for these situations, the context " -"specified with the <option>context</option> option is only retained if the " -"<option>context</option> option is used on the next mount, and if the same " -"context is specified." +msgid "Newly-created files and directories on this file system appear to have the SELinux context specified with <option>-o context</option>; however, since context changes are not written to disk for these situations, the context specified with the <option>context</option> option is only retained if the <option>context</option> option is used on the next mount, and if the same context is specified." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Type Enforcement is the main permission control used in SELinux targeted " -"policy. For the most part, SELinux users and roles can be ignored, so, when " -"overriding the SELinux context with <option>-o context</option>, use the " -"SELinux <computeroutput>system_u</computeroutput> user and " -"<computeroutput>object_r</computeroutput> role, and concentrate on the type. " -"If you are not using the MLS policy or multi-category security, use the " -"<computeroutput>s0</computeroutput> level." +msgid "Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored, so, when overriding the SELinux context with <option>-o context</option>, use the SELinux <computeroutput>system_u</computeroutput> user and <computeroutput>object_r</computeroutput> role, and concentrate on the type. If you are not using the MLS policy or multi-category security, use the <computeroutput>s0</computeroutput> level." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When a file system is mounted with a <option>context</option> option, " -"context changes (by users and processes) are prohibited. For example, " -"running <command>chcon</command> on a file system mounted with a " -"<option>context</option> option results in a <computeroutput>Operation not " -"supported</computeroutput> error." +msgid "When a file system is mounted with a <option>context</option> option, context changes (by users and processes) are prohibited. For example, running <command>chcon</command> on a file system mounted with a <option>context</option> option results in a <computeroutput>Operation not supported</computeroutput> error." msgstr ""

#. Tag: title @@ -1579,25 +976,12 @@

#. Tag: para #, no-c-format -msgid "" -"As mentioned in <xref linkend="sect-Security-Enhanced_Linux-" -"Working_with_SELinux-The_file_t_and_default_t_Types" />, on file systems " -"that support extended attributes, when a file that lacks an SELinux context " -"on disk is accessed, it is treated as if it had a default context as defined " -"by SELinux policy. In common policies, this default context uses the " -"<computeroutput>file_t</computeroutput> type. If it is desirable to use a " -"different default context, mount the file system with the " -"<option>defcontext</option> option." +msgid "As mentioned in <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-The_file_t_and_default_t_Types" />, on file systems that support extended attributes, when a file that lacks an SELinux context on disk is accessed, it is treated as if it had a default context as defined by SELinux policy. In common policies, this default context uses the <computeroutput>file_t</computeroutput> type. If it is desirable to use a different default context, mount the file system with the <option>defcontext</option> option." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example mounts a newly-created file system (on <filename>/dev/" -"sda2</filename>) to the newly-created <filename>/test/</filename> directory. " -"It assumes that there are no rules in <filename>/etc/selinux/targeted/" -"contexts/files/</filename> that define a context for the <filename>/test/</" -"filename> directory:" +msgid "The following example mounts a newly-created file system (on <filename>/dev/sda2</filename>) to the newly-created <filename>/test/</filename> directory. It assumes that there are no rules in <filename>/etc/selinux/targeted/contexts/files/</filename> that define a context for the <filename>/test/</filename> directory:" msgstr ""

#. Tag: para @@ -1607,30 +991,17 @@

#. Tag: para #, no-c-format -msgid "" -"the <option>defcontext</option> option defines that <computeroutput>system_u:" -"object_r:samba_share_t:s0</computeroutput> is "the default security context " -"for unlabeled files"<footnote> <para> Morris, James. "Filesystem Labeling " -"in SELinux". Published 1 October 2004. Accessed 14 October 2008: <ulink url=" -""http://www.linuxjournal.com/article/7426%5C" />. </para> </footnote>." +msgid "the <option>defcontext</option> option defines that <computeroutput>system_u:object_r:samba_share_t:s0</computeroutput> is "the default security context for unlabeled files"<footnote> <para> Morris, James. "Filesystem Labeling in SELinux". Published 1 October 2004. Accessed 14 October 2008: <ulink url="http://www.linuxjournal.com/article/7426%5C" />. </para> </footnote>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"when mounted, the root directory (<filename>/test/</filename>) of the file " -"system is treated as if it is labeled with the context specified by " -"<option>defcontext</option> (this label is not stored on disk). This affects " -"the labeling for files created under <filename>/test/</filename>: new files " -"inherit the <computeroutput>samba_share_t</computeroutput> type, and these " -"labels are stored on disk." +msgid "when mounted, the root directory (<filename>/test/</filename>) of the file system is treated as if it is labeled with the context specified by <option>defcontext</option> (this label is not stored on disk). This affects the labeling for files created under <filename>/test/</filename>: new files inherit the <computeroutput>samba_share_t</computeroutput> type, and these labels are stored on disk." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"files created under <filename>/test/</filename> while the file system was " -"mounted with a <option>defcontext</option> option retain their labels." +msgid "files created under <filename>/test/</filename> while the file system was mounted with a <option>defcontext</option> option retain their labels." msgstr ""

#. Tag: title @@ -1640,44 +1011,22 @@

#. Tag: para #, no-c-format -msgid "" -"By default, NFS mounts on the client side are labeled with a default context " -"defined by policy for NFS file systems. In common policies, this default " -"context uses the <computeroutput>nfs_t</computeroutput> type. Depending on " -"policy configuration, services, such as Apache HTTP Server and MySQL, may " -"not be able to read files labeled with the <computeroutput>nfs_t</" -"computeroutput> type. This may prevent file systems labeled with this type " -"from being mounted and then read or exported by other services." +msgid "By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Depending on policy configuration, services, such as Apache HTTP Server and MySQL, may not be able to read files labeled with the <computeroutput>nfs_t</computeroutput> type. This may prevent file systems labeled with this type from being mounted and then read or exported by other services." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you would like to mount an NFS file system and read or export that file " -"system with another service, use the <option>context</option> option when " -"mounting to override the <computeroutput>nfs_t</computeroutput> type. Use " -"the following context option to mount NFS file systems so that they can be " -"shared via the Apache HTTP Server:" +msgid "If you would like to mount an NFS file system and read or export that file system with another service, use the <option>context</option> option when mounting to override the <computeroutput>nfs_t</computeroutput> type. Use the following context option to mount NFS file systems so that they can be shared via the Apache HTTP Server:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Since context changes are not written to disk for these situations, the " -"context specified with the <option>context</option> option is only retained " -"if the <option>context</option> option is used on the next mount, and if the " -"same context is specified." +msgid "Since context changes are not written to disk for these situations, the context specified with the <option>context</option> option is only retained if the <option>context</option> option is used on the next mount, and if the same context is specified." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As an alternative to mounting file systems with <option>context</option> " -"options, Booleans can be turned on to allow services access to file systems " -"labeled with the <computeroutput>nfs_t</computeroutput> type. Refer to <xref " -"linkend="sect-Security-Enhanced_Linux-Booleans-Booleans_for_NFS_and_CIFS" /" -"> for instructions on configuring Booleans to allow services access to the " -"<computeroutput>nfs_t</computeroutput> type." +msgid "As an alternative to mounting file systems with <option>context</option> options, Booleans can be turned on to allow services access to file systems labeled with the <computeroutput>nfs_t</computeroutput> type. Refer to <xref linkend="sect-Security-Enhanced_Linux-Booleans-Booleans_for_NFS_and_CIFS" /> for instructions on configuring Booleans to allow services access to the <computeroutput>nfs_t</computeroutput> type." msgstr ""

#. Tag: title @@ -1687,55 +1036,27 @@

#. Tag: para #, no-c-format -msgid "" -"When mounting multiple mounts from the same NFS export, attempting to " -"override the SELinux context of each mount with a different context, results " -"in subsequent mount commands failing. In the following example, the NFS " -"server has a single export, <filename>/export</filename>, which has two " -"subdirectories, <filename>web/</filename> and <filename>database/</" -"filename>. The following commands attempt two mounts from a single NFS " -"export, and try to override the context for each one:" +msgid "When mounting multiple mounts from the same NFS export, attempting to override the SELinux context of each mount with a different context, results in subsequent mount commands failing. In the following example, the NFS server has a single export, <filename>/export</filename>, which has two subdirectories, <filename>web/</filename> and <filename>database/</filename>. The following commands attempt two mounts from a single NFS export, and try to override the context for each one:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The second mount command fails, and the following is logged to <filename>/" -"var/log/messages</filename>:" +msgid "The second mount command fails, and the following is logged to <filename>/var/log/messages</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To mount multiple mounts from a single NFS export, with each mount having a " -"different context, use the <option>-o nosharecache,context</option> options. " -"The following example mounts multiple mounts from a single NFS export, with " -"a different context for each mount (allowing a single service access to each " -"one):" +msgid "To mount multiple mounts from a single NFS export, with each mount having a different context, use the <option>-o nosharecache,context</option> options. The following example mounts multiple mounts from a single NFS export, with a different context for each mount (allowing a single service access to each one):" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, <computeroutput>server:/export/web</computeroutput> is " -"mounted locally to <filename>/local/web/</filename>, with all files being " -"labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"allowing Apache HTTP Server access. <computeroutput>server:/export/database</" -"computeroutput> is mounted locally to <filename>/local/database</filename>, " -"with all files being labeled with the <computeroutput>mysqld_db_t</" -"computeroutput> type, allowing MySQL access. These type changes are not " -"written to disk." +msgid "In this example, <computeroutput>server:/export/web</computeroutput> is mounted locally to <filename>/local/web/</filename>, with all files being labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, allowing Apache HTTP Server access. <computeroutput>server:/export/database</computeroutput> is mounted locally to <filename>/local/database</filename>, with all files being labeled with the <computeroutput>mysqld_db_t</computeroutput> type, allowing MySQL access. These type changes are not written to disk." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <option>nosharecache</option> options allows you to mount the same " -"subdirectory of an export multiple times with different contexts (for " -"example, mounting <filename>/export/web</filename> multiple times). Do not " -"mount the same subdirectory from an export multiple times with different " -"contexts, as this creates an overlapping mount, where files are accessible " -"under two different contexts." +msgid "The <option>nosharecache</option> options allows you to mount the same subdirectory of an export multiple times with different contexts (for example, mounting <filename>/export/web</filename> multiple times). Do not mount the same subdirectory from an export multiple times with different contexts, as this creates an overlapping mount, where files are accessible under two different contexts." msgstr ""

#. Tag: title @@ -1745,20 +1066,12 @@

#. Tag: para #, no-c-format -msgid "" -"To make context mounts persistent across remounting and reboots, add entries " -"for the file systems in <filename>/etc/fstab</filename> or an automounter " -"map, and use the desired context as a mount option. The following example " -"adds an entry to <filename>/etc/fstab</filename> for an NFS context mount:" +msgid "To make context mounts persistent across remounting and reboots, add entries for the file systems in <filename>/etc/fstab</filename> or an automounter map, and use the desired context as a mount option. The following example adds an entry to <filename>/etc/fstab</filename> for an NFS context mount:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://www.redhat.com/docs/en-US/" -"Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/s1-nfs-client-config.html" -"">Red Hat Enterprise Linux 5 Deployment Guide, Section 19.2. "NFS Client " -"Configuration"</ulink> for information about mounting NFS file systems." +msgid "Refer to the <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux 5 Deployment Guide, Section 19.2. "NFS Client Configuration"</ulink> for information about mounting NFS file systems." msgstr ""

#. Tag: title @@ -1768,10 +1081,7 @@

#. Tag: para #, no-c-format -msgid "" -"These sections describe what happens to SELinux contexts when copying, " -"moving, and archiving files and directories. Also, it explains how to " -"preserve contexts when copying and archiving." +msgid "These sections describe what happens to SELinux contexts when copying, moving, and archiving files and directories. Also, it explains how to preserve contexts when copying and archiving." msgstr ""

#. Tag: title @@ -1781,42 +1091,22 @@

#. Tag: para #, no-c-format -msgid "" -"When a file or directory is copied, a new file or directory is created if it " -"does not exist. That new file or directory's context is based on default-" -"labeling rules, not the original file or directory's context (unless options " -"were used to preserve the original context). For example, files created in " -"user home directories are labeled with the <computeroutput>user_home_t</" -"computeroutput> type:" +msgid "When a file or directory is copied, a new file or directory is created if it does not exist. That new file or directory's context is based on default-labeling rules, not the original file or directory's context (unless options were used to preserve the original context). For example, files created in user home directories are labeled with the <computeroutput>user_home_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If such a file is copied to another directory, such as <filename>/etc/</" -"filename>, the new file is created in accordance to default-labeling rules " -"for the <filename>/etc/</filename> directory. Copying a file (without " -"additional options) may not preserve the original context:" +msgid "If such a file is copied to another directory, such as <filename>/etc/</filename>, the new file is created in accordance to default-labeling rules for the <filename>/etc/</filename> directory. Copying a file (without additional options) may not preserve the original context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When <filename>file1</filename> is copied to <filename>/etc/</filename>, if " -"<filename>/etc/file1</filename> does not exist, <filename>/etc/file1</" -"filename> is created as a new file. As shown in the example above, " -"<filename>/etc/file1</filename> is labeled with the <computeroutput>etc_t</" -"computeroutput> type, in accordance to default-labeling rules." +msgid "When <filename>file1</filename> is copied to <filename>/etc/</filename>, if <filename>/etc/file1</filename> does not exist, <filename>/etc/file1</filename> is created as a new file. As shown in the example above, <filename>/etc/file1</filename> is labeled with the <computeroutput>etc_t</computeroutput> type, in accordance to default-labeling rules." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When a file is copied over an existing file, the existing file's context is " -"preserved, unless the user specified <command>cp</command> options to " -"preserve the context of the original file, such as <option>--" -"preserve=context</option>. SELinux policy may prevent contexts from being " -"preserved during copies." +msgid "When a file is copied over an existing file, the existing file's context is preserved, unless the user specified <command>cp</command> options to preserve the context of the original file, such as <option>--preserve=context</option>. SELinux policy may prevent contexts from being preserved during copies." msgstr ""

#. Tag: title @@ -1826,22 +1116,12 @@

#. Tag: para #, no-c-format -msgid "" -"When copying a file with the <command>cp</command> command, if no options " -"are given, the type is inherited from the targeted, parent directory:" +msgid "When copying a file with the <command>cp</command> command, if no options are given, the type is inherited from the targeted, parent directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, <filename>file1</filename> is created in a user's home " -"directory, and is labeled with the <computeroutput>user_home_t</" -"computeroutput> type. The <filename>/var/www/html/</filename> directory is " -"labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"as shown with the <command>ls -dZ /var/www/html/</command> command. When " -"<filename>file1</filename> is copied to <filename>/var/www/html/</filename>, " -"it inherits the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"as shown with the <command>ls -Z /var/www/html/file1</command> command." +msgid "In this example, <filename>file1</filename> is created in a user's home directory, and is labeled with the <computeroutput>user_home_t</computeroutput> type. The <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -dZ /var/www/html/</command> command. When <filename>file1</filename> is copied to <filename>/var/www/html/</filename>, it inherits the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -Z /var/www/html/file1</command> command." msgstr ""

#. Tag: title @@ -1851,24 +1131,12 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>cp --preserve=context</command> command to preserve " -"contexts when copying:" +msgid "Use the <command>cp --preserve=context</command> command to preserve contexts when copying:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, <filename>file1</filename> is created in a user's home " -"directory, and is labeled with the <computeroutput>user_home_t</" -"computeroutput> type. The <filename>/var/www/html/</filename> directory is " -"labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"as shown with the <command>ls -dZ /var/www/html/</command> command. Using " -"the <option>--preserve=context</option> option preserves SELinux contexts " -"during copy operations. As shown with the <command>ls -Z /var/www/html/" -"file1</command> command, the <filename>file1</filename> " -"<computeroutput>user_home_t</computeroutput> type was preserved when the " -"file was copied to <filename>/var/www/html/</filename>." +msgid "In this example, <filename>file1</filename> is created in a user's home directory, and is labeled with the <computeroutput>user_home_t</computeroutput> type. The <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -dZ /var/www/html/</command> command. Using the <option>--preserve=context</option> option preserves SELinux contexts during copy operations. As shown with the <command>ls -Z /var/www/html/file1</command> command, the <filename>file1</filename> <computeroutput>user_home_t</computeroutput> type was preserved when the file was copied to <filename>/var/www/html/</filename>." msgstr ""

#. Tag: title @@ -1878,18 +1146,12 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>cp -Z</command> command to change the destination copy's " -"context. The following example was performed in the user's home directory:" +msgid "Use the <command>cp -Z</command> command to change the destination copy's context. The following example was performed in the user's home directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, the context is defined with the <option>-Z</option> option. " -"Without the <option>-Z</option> option, <filename>file2</filename> would be " -"labeled with the <computeroutput>unconfined_u:object_r:user_home_t</" -"computeroutput> context." +msgid "In this example, the context is defined with the <option>-Z</option> option. Without the <option>-Z</option> option, <filename>file2</filename> would be labeled with the <computeroutput>unconfined_u:object_r:user_home_t</computeroutput> context." msgstr ""

#. Tag: title @@ -1899,32 +1161,17 @@

#. Tag: para #, no-c-format -msgid "" -"When a file is copied over an existing file, the existing file's context is " -"preserved (unless an option is used to preserve contexts). For example:" +msgid "When a file is copied over an existing file, the existing file's context is preserved (unless an option is used to preserve contexts). For example:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, two files are created: <filename>/etc/file1</filename>, " -"labeled with the <computeroutput>etc_t</computeroutput> type, and <filename>/" -"tmp/file2</filename>, labeled with the <computeroutput>user_tmp_t</" -"computeroutput> type. The <command>cp /tmp/file2 /etc/file1</command> " -"command overwrites <filename>file1</filename> with <filename>file2</" -"filename>. After copying, the <command>ls -Z /etc/file1</command> command " -"shows <filename>file1</filename> labeled with the <computeroutput>etc_t</" -"computeroutput> type, not the <computeroutput>user_tmp_t</computeroutput> " -"type from <filename>/tmp/file2</filename> that replaced <filename>/etc/" -"file1</filename>." +msgid "In this example, two files are created: <filename>/etc/file1</filename>, labeled with the <computeroutput>etc_t</computeroutput> type, and <filename>/tmp/file2</filename>, labeled with the <computeroutput>user_tmp_t</computeroutput> type. The <command>cp /tmp/file2 /etc/file1</command> command overwrites <filename>file1</filename> with <filename>file2</filename>. After copying, the <command>ls -Z /etc/file1</command> command shows <filename>file1</filename> labeled with the <computeroutput>etc_t</computeroutput> type, not the <computeroutput>user_tmp_t</computeroutput> type from <filename>/tmp/file2</filename> that replaced <filename>/etc/file1</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Copy files and directories, rather than moving them. This helps ensure they " -"are labeled with the correct SELinux contexts. Incorrect SELinux contexts " -"can prevent processes from accessing such files and directories." +msgid "Copy files and directories, rather than moving them. This helps ensure they are labeled with the correct SELinux contexts. Incorrect SELinux contexts can prevent processes from accessing such files and directories." msgstr ""

#. Tag: title @@ -1934,66 +1181,37 @@

#. Tag: para #, no-c-format -msgid "" -"File and directories keep their current SELinux context when they are moved. " -"In many cases, this is incorrect for the location they are being moved to. " -"The following example demonstrates moving a file from a user's home " -"directory to <filename>/var/www/html/</filename>, which is used by the " -"Apache HTTP Server. Since the file is moved, it does not inherit the correct " -"SELinux context:" +msgid "File and directories keep their current SELinux context when they are moved. In many cases, this is incorrect for the location they are being moved to. The following example demonstrates moving a file from a user's home directory to <filename>/var/www/html/</filename>, which is used by the Apache HTTP Server. Since the file is moved, it does not inherit the correct SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd</command> command without any arguments to change into " -"your home directory. Once in your home directory, run the <command>touch " -"file1</command> command to create a file. This file is labeled with the " -"<computeroutput>user_home_t</computeroutput> type:" +msgid "Run the <command>cd</command> command without any arguments to change into your home directory. Once in your home directory, run the <command>touch file1</command> command to create a file. This file is labeled with the <computeroutput>user_home_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -dZ /var/www/html/</command> command to view the SELinux " -"context of the <filename>/var/www/html/</filename> directory:" +msgid "Run the <command>ls -dZ /var/www/html/</command> command to view the SELinux context of the <filename>/var/www/html/</filename> directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, the <filename>/var/www/html/</filename> directory is labeled " -"with the <computeroutput>httpd_sys_content_t</computeroutput> type. Files " -"and directories created under the <filename>/var/www/html/</filename> " -"directory inherit this type, and as such, they are labeled with this type." +msgid "By default, the <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type. Files and directories created under the <filename>/var/www/html/</filename> directory inherit this type, and as such, they are labeled with this type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mv file1 /var/www/html/</command> " -"command to move <filename>file1</filename> to the <filename>/var/www/html/</" -"filename> directory. Since this file is moved, it keeps its current " -"<computeroutput>user_home_t</computeroutput> type:" +msgid "As the Linux root user, run the <command>mv file1 /var/www/html/</command> command to move <filename>file1</filename> to the <filename>/var/www/html/</filename> directory. Since this file is moved, it keeps its current <computeroutput>user_home_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, the Apache HTTP Server can not read files that are labeled with " -"the <computeroutput>user_home_t</computeroutput> type. If all files " -"comprising a web page are labeled with the <computeroutput>user_home_t</" -"computeroutput> type, or another type that the Apache HTTP Server can not " -"read, permission is denied when attempting to access them via Firefox or " -"text-based Web browsers." +msgid "By default, the Apache HTTP Server can not read files that are labeled with the <computeroutput>user_home_t</computeroutput> type. If all files comprising a web page are labeled with the <computeroutput>user_home_t</computeroutput> type, or another type that the Apache HTTP Server can not read, permission is denied when attempting to access them via Firefox or text-based Web browsers." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Moving files and directories with the <command>mv</command> command may " -"result in the wrong SELinux context, preventing processes, such as the " -"Apache HTTP Server and Samba, from accessing such files and directories." +msgid "Moving files and directories with the <command>mv</command> command may result in the wrong SELinux context, preventing processes, such as the Apache HTTP Server and Samba, from accessing such files and directories." msgstr ""

#. Tag: title @@ -2003,9 +1221,7 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/usr/sbin/matchpathcon</command> command to check if files " -"and directories have the correct SELinux context. From the" +msgid "Use the <command>/usr/sbin/matchpathcon</command> command to check if files and directories have the correct SELinux context. From the" msgstr ""

#. Tag: refentrytitle @@ -2015,63 +1231,32 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>matchpathcon</command> queries the system policy and " -"outputs the default security context associated with the file path." -""<footnote> <para> The <citerefentry><refentrytitle>matchpathcon</" -"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as " -"shipped with the <package>libselinux-utils</package> package in Fedora, is " -"written by Daniel Walsh. Any edits or changes in this version were done by " -"Murray McAllister. </para> </footnote>. The following example demonstrates " -"using the <command>/usr/sbin/matchpathcon</command> command to verify that " -"files in <filename>/var/www/html/</filename> directory are labeled correctly:" +msgid "manual page: "<command>matchpathcon</command> queries the system policy and outputs the default security context associated with the file path."<footnote> <para> The <citerefentry><refentrytitle>matchpathcon</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>libselinux-utils</package> package in Fedora, is written by Daniel Walsh. Any edits or changes in this version were done by Murray McAllister. </para> </footnote>. The following example demonstrates using the <command>/usr/sbin/matchpathcon</command> command to verify that files in <filename>/var/www/html/</filename> directory are labeled correctly:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /var/www/html/file{1,2,3}</" -"command> command to create three files (<filename>file1</filename>, " -"<filename>file2</filename>, and <filename>file3</filename>). These files " -"inherit the <computeroutput>httpd_sys_content_t</computeroutput> type from " -"the <filename>/var/www/html/</filename> directory:" +msgid "As the Linux root user, run the <command>touch /var/www/html/file{1,2,3}</command> command to create three files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). These files inherit the <computeroutput>httpd_sys_content_t</computeroutput> type from the <filename>/var/www/html/</filename> directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>chcon -t samba_share_t /var/www/" -"html/file1</command> command to change the <filename>file1</filename> type " -"to <computeroutput>samba_share_t</computeroutput>. Note: the Apache HTTP " -"Server can not read files or directories labeled with the " -"<computeroutput>samba_share_t</computeroutput> type." +msgid "As the Linux root user, run the <command>chcon -t samba_share_t /var/www/html/file1</command> command to change the <filename>file1</filename> type to <computeroutput>samba_share_t</computeroutput>. Note: the Apache HTTP Server can not read files or directories labeled with the <computeroutput>samba_share_t</computeroutput> type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/matchpathcon</command> <option>-V</option> option " -"compares the current SELinux context to the correct, default context in " -"SELinux policy. Run the <command>/usr/sbin/matchpathcon -V /var/www/html/*</" -"command> command to check all files in the <filename>/var/www/html/</" -"filename> directory:" +msgid "The <command>/usr/sbin/matchpathcon</command> <option>-V</option> option compares the current SELinux context to the correct, default context in SELinux policy. Run the <command>/usr/sbin/matchpathcon -V /var/www/html/*</command> command to check all files in the <filename>/var/www/html/</filename> directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following output from the <command>/usr/sbin/matchpathcon</command> " -"command explains that <filename>file1</filename> is labeled with the " -"<computeroutput>samba_share_t</computeroutput> type, but should be labeled " -"with the <computeroutput>httpd_sys_content_t</computeroutput> type:" +msgid "The following output from the <command>/usr/sbin/matchpathcon</command> command explains that <filename>file1</filename> is labeled with the <computeroutput>samba_share_t</computeroutput> type, but should be labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To resolve the label problem and allow the Apache HTTP Server access to " -"<filename>file1</filename>, as the Linux root user, run the <command>/sbin/" -"restorecon -v /var/www/html/file1</command> command:" +msgid "To resolve the label problem and allow the Apache HTTP Server access to <filename>file1</filename>, as the Linux root user, run the <command>/sbin/restorecon -v /var/www/html/file1</command> command:" msgstr ""

#. Tag: title @@ -2081,80 +1266,47 @@

#. Tag: para #, no-c-format -msgid "" -"<command>tar</command> does not retain extended attributes by default. Since " -"SELinux contexts are stored in extended attributes, contexts can be lost " -"when archiving files. Use <command>tar --selinux</command> to create " -"archives that retain contexts. If a Tar archive contains files without " -"extended attributes, or if you want the extended attributes to match the " -"system defaults, run the archive through <command>/sbin/restorecon</command>:" +msgid "<command>tar</command> does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use <command>tar --selinux</command> to create archives that retain contexts. If a Tar archive contains files without extended attributes, or if you want the extended attributes to match the system defaults, run the archive through <command>/sbin/restorecon</command>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Note: depending on the directory, you may need to be the Linux root user to " -"run the <command>/sbin/restorecon</command> command." +msgid "Note: depending on the directory, you may need to be the Linux root user to run the <command>/sbin/restorecon</command> command." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a Tar archive that retains " -"SELinux contexts:" +msgid "The following example demonstrates creating a Tar archive that retains SELinux contexts:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /var/www/html/</command> command to change into the " -"<filename>/var/www/html/</filename> directory. Once in this directory, as " -"the Linux root user, run the <command>tar --selinux -cf test.tar file{1,2,3}" -"</command> command to create a Tar archive named <filename>test.tar</" -"filename>." +msgid "Run the <command>cd /var/www/html/</command> command to change into the <filename>/var/www/html/</filename> directory. Once in this directory, as the Linux root user, run the <command>tar --selinux -cf test.tar file{1,2,3}</command> command to create a Tar archive named <filename>test.tar</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mkdir /test</command> command to " -"create a new directory, and then, run the <command>chmod 777 /test/</" -"command> command to allow all users full-access to the <filename>/test/</" -"filename> directory." +msgid "As the Linux root user, run the <command>mkdir /test</command> command to create a new directory, and then, run the <command>chmod 777 /test/</command> command to allow all users full-access to the <filename>/test/</filename> directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cp /var/www/html/test.tar /test/</command> command to copy " -"the <filename>test.tar</filename> file in to the <filename>/test/</filename> " -"directory." +msgid "Run the <command>cp /var/www/html/test.tar /test/</command> command to copy the <filename>test.tar</filename> file in to the <filename>/test/</filename> directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /test/</command> command to change into the <filename>/" -"test/</filename> directory. Once in this directory, run the <command>tar -" -"xvf test.tar</command> command to extract the Tar archive." +msgid "Run the <command>cd /test/</command> command to change into the <filename>/test/</filename> directory. Once in this directory, run the <command>tar -xvf test.tar</command> command to extract the Tar archive." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -lZ /test/</command> command to view the SELinux " -"contexts. The <computeroutput>httpd_sys_content_t</computeroutput> type has " -"been retained, rather than being changed to <computeroutput>default_t</" -"computeroutput>, which would have happened had the <option>--selinux</" -"option> not been used:" +msgid "Run the <command>ls -lZ /test/</command> command to view the SELinux contexts. The <computeroutput>httpd_sys_content_t</computeroutput> type has been retained, rather than being changed to <computeroutput>default_t</computeroutput>, which would have happened had the <option>--selinux</option> not been used:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If the <filename>/test/</filename> directory is no longer required, as the " -"Linux root user, run the <command> rm -ri /test/</command> command to remove " -"it, as well as all files in it." +msgid "If the <filename>/test/</filename> directory is no longer required, as the Linux root user, run the <command> rm -ri /test/</command> command to remove it, as well as all files in it." msgstr ""

#. Tag: refentrytitle @@ -2164,9 +1316,7 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page for further information about <command>tar</command>, such as " -"the <option>--xattrs</option> option that retains all extended attributes." +msgid "manual page for further information about <command>tar</command>, such as the <option>--xattrs</option> option that retains all extended attributes." msgstr ""

#. Tag: title @@ -2176,53 +1326,32 @@

#. Tag: para #, no-c-format -msgid "" -"<command>star</command> does not retain extended attributes by default. " -"Since SELinux contexts are stored in extended attributes, contexts can be " -"lost when archiving files. Use <command>star -xattr -H=exustar</command> to " -"create archives that retain contexts. The <package>star</package> package is " -"not installed by default. To install <command>star</command>, run the " -"<command>yum install star</command> command as the Linux root user." +msgid "<command>star</command> does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use <command>star -xattr -H=exustar</command> to create archives that retain contexts. The <package>star</package> package is not installed by default. To install <command>star</command>, run the <command>yum install star</command> command as the Linux root user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a Star archive that retains " -"SELinux contexts:" +msgid "The following example demonstrates creating a Star archive that retains SELinux contexts:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /var/www/html/</command> command to change into the " -"<filename>/var/www/html/</filename> directory. Once in this directory, as " -"the Linux root user, run the <command>star -xattr -H=exustar -c -f=test.star " -"file{1,2,3}</command> command to create a Star archive named <filename>test." -"star</filename>:" +msgid "Run the <command>cd /var/www/html/</command> command to change into the <filename>/var/www/html/</filename> directory. Once in this directory, as the Linux root user, run the <command>star -xattr -H=exustar -c -f=test.star file{1,2,3}</command> command to create a Star archive named <filename>test.star</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cp /var/www/html/test.star /test/</command> command to copy " -"the <filename>test.star</filename> file in to the <filename>/test/</" -"filename> directory." +msgid "Run the <command>cp /var/www/html/test.star /test/</command> command to copy the <filename>test.star</filename> file in to the <filename>/test/</filename> directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /test/</command> command to change into the <filename>/" -"test/</filename> directory. Once in this directory, run the <command>star -x " -"-f=test.star</command> command to extract the Star archive:" +msgid "Run the <command>cd /test/</command> command to change into the <filename>/test/</filename> directory. Once in this directory, run the <command>star -x -f=test.star</command> command to extract the Star archive:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If <command>star</command> is no longer required, as the Linux root user, " -"run the <command>yum remove star</command> command to remove the package." +msgid "If <command>star</command> is no longer required, as the Linux root user, run the <command>yum remove star</command> command to remove the package." msgstr ""

#. Tag: refentrytitle @@ -2258,52 +1387,35 @@ #~ "# /sbin/service setroubleshoot start\n" #~ "Starting setroubleshootd: [ OK ]"

-#~ msgid "" -#~ "/usr/sbin/semanage user -a -S targeted -P user -R "unconfined_r system_r" -#~ "" -r s0-s0:c0.c1023 unconfined_u" -#~ msgstr "" -#~ "/usr/sbin/semanage user -a -S targeted -P user -R "unconfined_r system_r" -#~ "" -r s0-s0:c0.c1023 unconfined_u" +#~ msgid "/usr/sbin/semanage user -a -S targeted -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u" +#~ msgstr "/usr/sbin/semanage user -a -S targeted -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u"

-#~ msgid "" -#~ "/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0." -#~ "c1023 __default__" -#~ msgstr "" -#~ "/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0." -#~ "c1023 __default__" +#~ msgid "/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 __default__" +#~ msgstr "/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 __default__"

-#~ msgid "" -#~ "/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0." -#~ "c1023 root" -#~ msgstr "" -#~ "/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0." -#~ "c1023 root" +#~ msgid "/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 root" +#~ msgstr "/usr/sbin/semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 root"

#~ msgid "/usr/sbin/semanage user -a -S targeted -P user -R guest_r guest_u" #~ msgstr "/usr/sbin/semanage user -a -S targeted -P user -R guest_r guest_u"

#~ msgid "/usr/sbin/semanage user -a -S targeted -P user -R xguest_r xguest_u" -#~ msgstr "" -#~ "/usr/sbin/semanage user -a -S targeted -P user -R xguest_r xguest_u" +#~ msgstr "/usr/sbin/semanage user -a -S targeted -P user -R xguest_r xguest_u"

#~ msgid "" #~ "# /usr/sbin/semanage boolean -l\n" #~ "SELinux boolean Description\n" #~ "\n" -#~ "ftp_home_dir -&gt; off Allow ftp to read and write " -#~ "files in the user home directories\n" +#~ "ftp_home_dir -&gt; off Allow ftp to read and write files in the user home directories\n" #~ "xen_use_nfs -&gt; off Allow xen to manage nfs files\n" -#~ "xguest_connect_network -&gt; on Allow xguest to configure " -#~ "Network Manager" +#~ "xguest_connect_network -&gt; on Allow xguest to configure Network Manager" #~ msgstr "" #~ "# /usr/sbin/semanage boolean -l\n" #~ "SELinux boolean Description\n" #~ "\n" -#~ "ftp_home_dir -&gt; off Allow ftp to read and write " -#~ "files in the user home directories\n" +#~ "ftp_home_dir -&gt; off Allow ftp to read and write files in the user home directories\n" #~ "xen_use_nfs -&gt; off Allow xen to manage nfs files\n" -#~ "xguest_connect_network -&gt; on Allow xguest to configure " -#~ "Network Manager" +#~ "xguest_connect_network -&gt; on Allow xguest to configure Network Manager"

#~ msgid "" #~ "$ /usr/sbin/getsebool -a\n" @@ -2324,14 +1436,12 @@ #~ "allow_console_login --&gt; off"

#~ msgid "" -#~ "$ /usr/sbin/getsebool allow_console_login allow_cvs_read_shadow " -#~ "allow_daemons_dump_core\n" +#~ "$ /usr/sbin/getsebool allow_console_login allow_cvs_read_shadow allow_daemons_dump_core\n" #~ "allow_console_login --&gt; off\n" #~ "allow_cvs_read_shadow --&gt; off\n" #~ "allow_daemons_dump_core --&gt; on" #~ msgstr "" -#~ "$ /usr/sbin/getsebool allow_console_login allow_cvs_read_shadow " -#~ "allow_daemons_dump_core\n" +#~ "$ /usr/sbin/getsebool allow_console_login allow_cvs_read_shadow allow_daemons_dump_core\n" #~ "allow_console_login --&gt; off\n" #~ "allow_cvs_read_shadow --&gt; off\n" #~ "allow_daemons_dump_core --&gt; on" @@ -2363,12 +1473,10 @@

#~ msgid "" #~ "$ /sbin/restorecon -v file1\n" -#~ "restorecon reset file1 context unconfined_u:object_r:samba_share_t:s0-&gt;" -#~ "system_u:object_r:user_home_t:s0" +#~ "restorecon reset file1 context unconfined_u:object_r:samba_share_t:s0-&gt;system_u:object_r:user_home_t:s0" #~ msgstr "" #~ "$ /sbin/restorecon -v file1\n" -#~ "restorecon reset file1 context unconfined_u:object_r:samba_share_t:s0-&gt;" -#~ "system_u:object_r:user_home_t:s0" +#~ "restorecon reset file1 context unconfined_u:object_r:samba_share_t:s0-&gt;system_u:object_r:user_home_t:s0"

#~ msgid "" #~ "# ls -dZ /web\n" @@ -2404,24 +1512,16 @@

#~ msgid "" #~ "# /sbin/restorecon -R -v /web/\n" -#~ "restorecon reset /web context unconfined_u:object_r:httpd_sys_content_t:" -#~ "s0-&gt;system_u:object_r:default_t:s0\n" -#~ "restorecon reset /web/file2 context unconfined_u:object_r:" -#~ "httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0\n" -#~ "restorecon reset /web/file3 context unconfined_u:object_r:" -#~ "httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0\n" -#~ "restorecon reset /web/file1 context unconfined_u:object_r:" -#~ "httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0" +#~ "restorecon reset /web context unconfined_u:object_r:httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0\n" +#~ "restorecon reset /web/file2 context unconfined_u:object_r:httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0\n" +#~ "restorecon reset /web/file3 context unconfined_u:object_r:httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0\n" +#~ "restorecon reset /web/file1 context unconfined_u:object_r:httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0" #~ msgstr "" #~ "# /sbin/restorecon -R -v /web/\n" -#~ "restorecon reset /web context unconfined_u:object_r:httpd_sys_content_t:" -#~ "s0-&gt;system_u:object_r:default_t:s0\n" -#~ "restorecon reset /web/file2 context unconfined_u:object_r:" -#~ "httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0\n" -#~ "restorecon reset /web/file3 context unconfined_u:object_r:" -#~ "httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0\n" -#~ "restorecon reset /web/file1 context unconfined_u:object_r:" -#~ "httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0" +#~ "restorecon reset /web context unconfined_u:object_r:httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0\n" +#~ "restorecon reset /web/file2 context unconfined_u:object_r:httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0\n" +#~ "restorecon reset /web/file3 context unconfined_u:object_r:httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0\n" +#~ "restorecon reset /web/file1 context unconfined_u:object_r:httpd_sys_content_t:s0-&gt;system_u:object_r:default_t:s0"

#~ msgid "" #~ "# ls -Z /etc/file1\n" @@ -2441,45 +1541,33 @@

#~ msgid "" #~ "# /sbin/restorecon -v /etc/file1\n" -#~ "restorecon reset /etc/file1 context unconfined_u:object_r:etc_t:s0-&gt;" -#~ "system_u:object_r:samba_share_t:s0" +#~ "restorecon reset /etc/file1 context unconfined_u:object_r:etc_t:s0-&gt;system_u:object_r:samba_share_t:s0" #~ msgstr "" #~ "# /sbin/restorecon -v /etc/file1\n" -#~ "restorecon reset /etc/file1 context unconfined_u:object_r:etc_t:s0-&gt;" -#~ "system_u:object_r:samba_share_t:s0" +#~ "restorecon reset /etc/file1 context unconfined_u:object_r:etc_t:s0-&gt;system_u:object_r:samba_share_t:s0"

#~ msgid "" #~ "# /sbin/restorecon -v /web\n" -#~ "restorecon reset /web context unconfined_u:object_r:default_t:s0-&gt;" -#~ "system_u:object_r:httpd_sys_content_t:s0" +#~ "restorecon reset /web context unconfined_u:object_r:default_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" #~ msgstr "" #~ "# /sbin/restorecon -v /web\n" -#~ "restorecon reset /web context unconfined_u:object_r:default_t:s0-&gt;" -#~ "system_u:object_r:httpd_sys_content_t:s0" +#~ "restorecon reset /web context unconfined_u:object_r:default_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0"

#~ msgid "/web(/.*)? system_u:object_r:httpd_sys_content_t:s0" #~ msgstr "/web(/.*)? system_u:object_r:httpd_sys_content_t:s0"

#~ msgid "" #~ "# /sbin/restorecon -R -v /web\n" -#~ "restorecon reset /web context unconfined_u:object_r:default_t:s0-&gt;" -#~ "system_u:object_r:httpd_sys_content_t:s0\n" -#~ "restorecon reset /web/file2 context unconfined_u:object_r:default_t:s0-" -#~ "&gt;system_u:object_r:httpd_sys_content_t:s0\n" -#~ "restorecon reset /web/file3 context unconfined_u:object_r:default_t:s0-" -#~ "&gt;system_u:object_r:httpd_sys_content_t:s0\n" -#~ "restorecon reset /web/file1 context unconfined_u:object_r:default_t:s0-" -#~ "&gt;system_u:object_r:httpd_sys_content_t:s0" +#~ "restorecon reset /web context unconfined_u:object_r:default_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0\n" +#~ "restorecon reset /web/file2 context unconfined_u:object_r:default_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0\n" +#~ "restorecon reset /web/file3 context unconfined_u:object_r:default_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0\n" +#~ "restorecon reset /web/file1 context unconfined_u:object_r:default_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" #~ msgstr "" #~ "# /sbin/restorecon -R -v /web\n" -#~ "restorecon reset /web context unconfined_u:object_r:default_t:s0-&gt;" -#~ "system_u:object_r:httpd_sys_content_t:s0\n" -#~ "restorecon reset /web/file2 context unconfined_u:object_r:default_t:s0-" -#~ "&gt;system_u:object_r:httpd_sys_content_t:s0\n" -#~ "restorecon reset /web/file3 context unconfined_u:object_r:default_t:s0-" -#~ "&gt;system_u:object_r:httpd_sys_content_t:s0\n" -#~ "restorecon reset /web/file1 context unconfined_u:object_r:default_t:s0-" -#~ "&gt;system_u:object_r:httpd_sys_content_t:s0" +#~ "restorecon reset /web context unconfined_u:object_r:default_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0\n" +#~ "restorecon reset /web/file2 context unconfined_u:object_r:default_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0\n" +#~ "restorecon reset /web/file3 context unconfined_u:object_r:default_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0\n" +#~ "restorecon reset /web/file1 context unconfined_u:object_r:default_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0"

#~ msgid "/test system_u:object_r:httpd_sys_content_t:s0" #~ msgstr "/test system_u:object_r:httpd_sys_content_t:s0" @@ -2491,12 +1579,8 @@ #~ "# mount server:/export /local/mount/point -o\\n" #~ "context="system_u:object_r:httpd_sys_content_t:s0""

-#~ msgid "" -#~ "# mount /dev/sda2 /test/ -o defcontext="system_u:object_r:samba_share_t:" -#~ "s0"" -#~ msgstr "" -#~ "# mount /dev/sda2 /test/ -o defcontext="system_u:object_r:samba_share_t:" -#~ "s0"" +#~ msgid "# mount /dev/sda2 /test/ -o defcontext="system_u:object_r:samba_share_t:s0"" +#~ msgstr "# mount /dev/sda2 /test/ -o defcontext="system_u:object_r:samba_share_t:s0""

#~ msgid "" #~ "# mount server:/export/web /local/web -o\\n" @@ -2551,46 +1635,38 @@ #~ "$ ls -Z file1\n" #~ "-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1\n" #~ "$ ls -dZ /var/www/html/\n" -#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/" -#~ "html/\n" +#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/\n" #~ "# cp file1 /var/www/html/\n" #~ "$ ls -Z /var/www/html/file1\n" -#~ "-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/" -#~ "www/html/file1" +#~ "-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/file1" #~ msgstr "" #~ "$ touch file1\n" #~ "$ ls -Z file1\n" #~ "-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1\n" #~ "$ ls -dZ /var/www/html/\n" -#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/" -#~ "html/\n" +#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/\n" #~ "# cp file1 /var/www/html/\n" #~ "$ ls -Z /var/www/html/file1\n" -#~ "-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/" -#~ "www/html/file1" +#~ "-rw-r--r-- root root unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/html/file1"

#~ msgid "" #~ "$ touch file1\n" #~ "$ ls -Z file1\n" #~ "-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1\n" #~ "$ ls -dZ /var/www/html/\n" -#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/" -#~ "html/\n" +#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/\n" #~ "# cp --preserve=context file1 /var/www/html/\n" #~ "$ ls -Z /var/www/html/file1\n" -#~ "-rw-r--r-- root root unconfined_u:object_r:user_home_t:s0 /var/www/html/" -#~ "file1" +#~ "-rw-r--r-- root root unconfined_u:object_r:user_home_t:s0 /var/www/html/file1" #~ msgstr "" #~ "$ touch file1\n" #~ "$ ls -Z file1\n" #~ "-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 file1\n" #~ "$ ls -dZ /var/www/html/\n" -#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/" -#~ "html/\n" +#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/\n" #~ "# cp --preserve=context file1 /var/www/html/\n" #~ "$ ls -Z /var/www/html/file1\n" -#~ "-rw-r--r-- root root unconfined_u:object_r:user_home_t:s0 /var/www/html/" -#~ "file1" +#~ "-rw-r--r-- root root unconfined_u:object_r:user_home_t:s0 /var/www/html/file1"

#~ msgid "" #~ "$ touch file1\n" @@ -2630,23 +1706,19 @@

#~ msgid "" #~ "$ ls -dZ /var/www/html/\n" -#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/" -#~ "html/" +#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/" #~ msgstr "" #~ "$ ls -dZ /var/www/html/\n" -#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/" -#~ "html/" +#~ "drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/"

#~ msgid "" #~ "# mv file1 /var/www/html/\n" #~ "# ls -Z /var/www/html/file1\n" -#~ "-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 /var/www/" -#~ "html/file1" +#~ "-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 /var/www/html/file1" #~ msgstr "" #~ "# mv file1 /var/www/html/\n" #~ "# ls -Z /var/www/html/file1\n" -#~ "-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 /var/www/" -#~ "html/file1" +#~ "-rw-rw-r-- user1 group1 unconfined_u:object_r:user_home_t:s0 /var/www/html/file1"

#~ msgid "" #~ "# touch /var/www/html/file{1,2,3}\n" @@ -2663,55 +1735,39 @@

#~ msgid "" #~ "$ /usr/sbin/matchpathcon -V /var/www/html/*\n" -#~ "/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, " -#~ "should be system_u:object_r:httpd_sys_content_t:s0\n" +#~ "/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0\n" #~ "/var/www/html/file2 verified.\n" #~ "/var/www/html/file3 verified." #~ msgstr "" #~ "$ /usr/sbin/matchpathcon -V /var/www/html/*\n" -#~ "/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, " -#~ "should be system_u:object_r:httpd_sys_content_t:s0\n" +#~ "/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0\n" #~ "/var/www/html/file2 verified.\n" #~ "/var/www/html/file3 verified."

-#~ msgid "" -#~ "/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, " -#~ "should be system_u:object_r:httpd_sys_content_t:s0" -#~ msgstr "" -#~ "/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, " -#~ "should be system_u:object_r:httpd_sys_content_t:s0" +#~ msgid "/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0" +#~ msgstr "/var/www/html/file1 has context unconfined_u:object_r:samba_share_t:s0, should be system_u:object_r:httpd_sys_content_t:s0"

#~ msgid "" #~ "# /sbin/restorecon -v /var/www/html/file1\n" -#~ "restorecon reset /var/www/html/file1 context unconfined_u:object_r:" -#~ "samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" +#~ "restorecon reset /var/www/html/file1 context unconfined_u:object_r:samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" #~ msgstr "" #~ "# /sbin/restorecon -v /var/www/html/file1\n" -#~ "restorecon reset /var/www/html/file1 context unconfined_u:object_r:" -#~ "samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0" +#~ "restorecon reset /var/www/html/file1 context unconfined_u:object_r:samba_share_t:s0-&gt;system_u:object_r:httpd_sys_content_t:s0"

-#~ msgid "" -#~ "$ tar -xvf <replaceable>archive.tar</replaceable> | /sbin/restorecon -f -" -#~ msgstr "" -#~ "$ tar -xvf <replaceable>archive.tar</replaceable> | /sbin/restorecon -f -" +#~ msgid "$ tar -xvf <replaceable>archive.tar</replaceable> | /sbin/restorecon -f -" +#~ msgstr "$ tar -xvf <replaceable>archive.tar</replaceable> | /sbin/restorecon -f -"

#~ msgid "" #~ "$ ls -lZ /test/\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file1\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file2\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file3\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file1\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file2\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file3\n" #~ "-rw-r--r-- user1 group1 unconfined_u:object_r:default_t:s0 test.tar" #~ msgstr "" #~ "$ ls -lZ /test/\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file1\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file2\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file3\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file1\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file2\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file3\n" #~ "-rw-r--r-- user1 group1 unconfined_u:object_r:default_t:s0 test.tar"

#~ msgid "" @@ -2730,19 +1786,13 @@

#~ msgid "" #~ "$ ls -lZ /test/\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file1\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file2\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file3\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file1\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file2\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file3\n" #~ "-rw-r--r-- user1 group1 unconfined_u:object_r:default_t:s0 test.star" #~ msgstr "" #~ "$ ls -lZ /test/\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file1\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file2\n" -#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 " -#~ "file3\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file1\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file2\n" +#~ "-rw-r--r-- user1 group1 unconfined_u:object_r:httpd_sys_content_t:s0 file3\n" #~ "-rw-r--r-- user1 group1 unconfined_u:object_r:default_t:s0 test.star"

Modified: community/branches/f13/fr-FR/Appendix.po =================================================================== --- community/branches/f13/fr-FR/Appendix.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Appendix.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,25 +1,26 @@ -# SOME DESCRIPTIVE TITLE. -# FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy +# Nicolas Maître nimai@fedoraproject.org, 2010. +# msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" -"Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" +"Project-Id-Version: fr\n" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-08-20 23:03+0100\n" +"Last-Translator: Nicolas Maître nimai@fedoraproject.org\n" +"Language-Team: French trans-fr@lists.fedoraproject.org\n" +"Language: fr\n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"Plural-Forms: nplurals=2; plural=(n > 1);\n"

#. Tag: title #, no-c-format msgid "Revision History" -msgstr "" +msgstr "Historique des révisions"

+# gné ? #. Tag: para #, no-c-format msgid "zing" -msgstr "" +msgstr "zing"

Modified: community/branches/f13/fr-FR/Author_Group.po =================================================================== --- community/branches/f13/fr-FR/Author_Group.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Author_Group.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,109 +1,105 @@ -# SOME DESCRIPTIVE TITLE. -# FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy +# Nicolas Maître nimai@fedoraproject.org, 2010. +# msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" -"Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" +"Project-Id-Version: docs-selinux-user-guide\n" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-08-20 17:38+0100\n" +"Last-Translator: Nicolas Maïtre nimai@fedoraproject.org\n" +"Language-Team: French trans-fr@lists.fedoraproject.org\n" +"Language: fr\n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"Plural-Forms: nplurals=2; plural=(n > 1);\n"

#. Tag: firstname #, no-c-format msgid "Murray" -msgstr "" +msgstr "Murray"

#. Tag: surname #, no-c-format msgid "McAllister" -msgstr "" +msgstr "McAllister"

#. Tag: orgname #, no-c-format msgid "Red Hat" -msgstr "" +msgstr "Red Hat"

#. Tag: orgdiv #, no-c-format msgid "Engineering Content Services" -msgstr "" +msgstr "Engineering Content Services"

#. Tag: firstname #, no-c-format msgid "Scott" -msgstr "" +msgstr "Scott"

#. Tag: surname #, no-c-format msgid "Radvan" -msgstr "" +msgstr "Radvan"

#. Tag: firstname #, no-c-format msgid "Daniel" -msgstr "" +msgstr "Daniel"

#. Tag: surname #, no-c-format msgid "Walsh" -msgstr "" +msgstr "Walsh"

#. Tag: orgdiv #, no-c-format msgid "Security Engineering" -msgstr "" +msgstr "Security Engineering"

#. Tag: firstname #, no-c-format msgid "Dominick" -msgstr "" +msgstr "Dominick"

#. Tag: surname #, no-c-format msgid "Grift" -msgstr "" +msgstr "Grift"

#. Tag: contrib #, no-c-format -msgid "" -"Technical editor for the Introduction, SELinux Contexts, Targeted Policy, " -"Working with SELinux, Confining Users, and Troubleshooting chapters." -msgstr "" +msgid "Technical editor for the Introduction, SELinux Contexts, Targeted Policy, Working with SELinux, Confining Users, and Troubleshooting chapters." +msgstr "Éditeur technique pour les chapitres « Introduction », « Contextes SELinux », « Politique ciblée », « Travailler avec SELinux », « Isolation des utilisateurs » et « Résolution des problèmes »."

#. Tag: firstname #, no-c-format msgid "Eric" -msgstr "" +msgstr "Eric"

#. Tag: surname #, no-c-format msgid "Paris" -msgstr "" +msgstr "Paris"

#. Tag: contrib #, no-c-format -msgid "" -"Technical editor for the Mounting File Systems and Raw Audit Messages " -"sections." -msgstr "" +msgid "Technical editor for the Mounting File Systems and Raw Audit Messages sections." +msgstr "Éditeur technique pour les sections « Montage de systèmes de fichiers » et « Messages d’audit bruts »."

#. Tag: firstname #, no-c-format msgid "James" -msgstr "" +msgstr "James"

#. Tag: surname #, no-c-format msgid "Morris" -msgstr "" +msgstr "Morris"

#. Tag: contrib #, no-c-format msgid "Technical editor for the Introduction and Targeted Policy chapters." -msgstr "" +msgstr "Éditeur technique pour les chapitres « Introduction » et « Politique ciblée »."

Modified: community/branches/f13/fr-FR/Book_Info.po =================================================================== --- community/branches/f13/fr-FR/Book_Info.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Book_Info.po 2010-11-21 23:12:12 UTC (rev 492) @@ -10,6 +10,7 @@ "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME EMAIL@ADDRESS\n" "Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: application/x-xml2pot; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -26,7 +27,5 @@

#. Tag: para #, no-c-format -msgid "" -"The SELinux User Guide assists users and administrators in managing and " -"using Security-Enhanced <trademark class="registered">Linux</trademark>." +msgid "The SELinux User Guide assists users and administrators in managing and using Security-Enhanced <trademark class="registered">Linux</trademark>." msgstr ""

Modified: community/branches/f13/fr-FR/Contexts_and_Attributes.po =================================================================== --- community/branches/f13/fr-FR/Contexts_and_Attributes.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Contexts_and_Attributes.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,357 +1,213 @@ -# SOME DESCRIPTIVE TITLE. -# FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy +# +# AUTHOR EMAIL@ADDRESS, YEAR., 2010. +# Nicolas Maître nimai@fedoraproject.org, 2010. msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" -"Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" +"Project-Id-Version: fr\n" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-08-25 15:40+0200\n" +"Last-Translator: Nicolas Maître nimai@fedoraproject.org\n" +"Language-Team: American English trans-fr@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"Plural-Forms: nplurals=2; plural=(n > 1);\n" +"X-Poedit-Basepath: .\n" +"X-Poedit-SearchPath-0: /mnt/dev/fedora/l10n\n" +"X-Generator: Lokalize 1.0\n"

#. Tag: title #, no-c-format msgid "SELinux Contexts" -msgstr "" +msgstr "Contextes SELinux"

#. Tag: para #, no-c-format -msgid "" -"Processes and files are labeled with an SELinux context that contains " -"additional information, such as an SELinux user, role, type, and, " -"optionally, a level. When running SELinux, all of this information is used " -"to make access control decisions. In Fedora, SELinux provides a combination " -"of Role-Based Access Control (RBAC), <trademark class="registered">Type " -"Enforcement</trademark> (TE), and, optionally, Multi-Level Security (MLS)." -msgstr "" +msgid "Processes and files are labeled with an SELinux context that contains additional information, such as an SELinux user, role, type, and, optionally, a level. When running SELinux, all of this information is used to make access control decisions. In Fedora, SELinux provides a combination of Role-Based Access Control (RBAC), <trademark class="registered">Type Enforcement</trademark> (TE), and, optionally, Multi-Level Security (MLS)." +msgstr "Les processus et les fichiers sont étiquetés avec un contexte SELinux qui contient des informations supplémentaires telles qu’un utilisateur SELinux, un rôle et optionnellement un niveau. Lorsque SELinux fonctionne, toutes ces informations sont utilisées pour prendre les décisions relatives au contrôle d’accès. Dans Fedora, SELinux fournit une combinaison de contrôle d'accès à base de rôles (Role-Based Access Control ou RBAC), de <trademark class="registered">Type Enforcement</trademark> (TE) et, optionnellement, de sécurité multiniveau (Multi-Level Security ou MLS)."

#. Tag: para #, no-c-format -msgid "" -"The following is an example showing SELinux context. SELinux contexts are " -"used on processes, Linux users, and files, on Linux operating systems that " -"run SELinux. Use the <command>ls -Z</command> command to view the SELinux " -"context of files and directories:" -msgstr "" +msgid "The following is an example showing SELinux context. SELinux contexts are used on processes, Linux users, and files, on Linux operating systems that run SELinux. Use the <command>ls -Z</command> command to view the SELinux context of files and directories:" +msgstr "L’exemple suivant illustre un contexte SELinux. Les contextes SELinux sont utilsés sur les processus, utilisateurs Linux et fichiers d’un système d’exploitation Linux avec SELinux. Utilisez la commande <command>ls -Z</command> pour voir le contexte SELinux de fichiers ou répertoires :"

#. Tag: para #, no-c-format -msgid "" -"SELinux contexts follow the <emphasis>SELinux user:role:type:level</" -"emphasis> syntax:" -msgstr "" +msgid "SELinux contexts follow the <emphasis>SELinux user:role:type:level</emphasis> syntax:" +msgstr "Les contextes SELinux suivent la syntaxe <emphasis>utilisateur SELinux:rôle:type:niveau</emphasis> :"

#. Tag: term #, no-c-format msgid "<emphasis>SELinux user</emphasis>" -msgstr "" +msgstr "<emphasis>Utilisateur SELinux</emphasis>"

+# « un intervalle précis de MLS » ? (comment traiter les accronymes anglais ?) #. Tag: para #, no-c-format -msgid "" -"The SELinux user identity is an identity known to the policy that is " -"authorized for a specific set of roles, and for a specific MLS range. Each " -"Linux user is mapped to an SELinux user via SELinux policy. This allows " -"Linux users to inherit the restrictions placed on SELinux users. The mapped " -"SELinux user identity is used in the SELinux context for processes in that " -"session, in order to define what roles and levels they can enter. Run the " -"<command>semanage login -l</command> command as the Linux root user to view " -"a list of mappings between SELinux and Linux user accounts:" -msgstr "" +msgid "The SELinux user identity is an identity known to the policy that is authorized for a specific set of roles, and for a specific MLS range. Each Linux user is mapped to an SELinux user via SELinux policy. This allows Linux users to inherit the restrictions placed on SELinux users. The mapped SELinux user identity is used in the SELinux context for processes in that session, in order to define what roles and levels they can enter. Run the <command>semanage login -l</command> command as the Linux root user to view a list of mappings between SELinux and Linux user accounts:" +msgstr "L’identité de l’utilisateur SELinux est une identité connue de la politique SELinux pour un ensemble précis de rôles et pour un intervalle précis de MLS. À chaque utilisateur Linux correspond un utilisateur SELinux via la politique SELinux. Ceci permet que les utilisateurs Linux héritent des restrictions placées sur les utilisateurs SELinux. L’identité de l’utilisateur SELinux correspondant est utilisée dans le contexte SELinux de la session de manière à définir les rôles et niveaux qui leur sont accessibles. Lancez la commande <command>semanage login -l</command> en tant qu’utilsateur Linux « root » pour visualiser la liste des correspondances entres les comptes utilisateur SELinux et Linux. "

#. Tag: para #, no-c-format -msgid "" -"Output may differ slightly from system to system. The <computeroutput>Login " -"Name</computeroutput> column lists Linux users, and the " -"<computeroutput>SELinux User</computeroutput> column lists which SELinux " -"user the Linux user is mapped to. For processes, the SELinux user limits " -"which roles and levels are accessible. The last column, <computeroutput>MLS/" -"MCS Range</computeroutput>, is the level used by Multi-Level Security (MLS) " -"and Multi-Category Security (MCS). Levels are briefly discussed later." -msgstr "" +msgid "Output may differ slightly from system to system. The <computeroutput>Login Name</computeroutput> column lists Linux users, and the <computeroutput>SELinux User</computeroutput> column lists which SELinux user the Linux user is mapped to. For processes, the SELinux user limits which roles and levels are accessible. The last column, <computeroutput>MLS/MCS Range</computeroutput>, is the level used by Multi-Level Security (MLS) and Multi-Category Security (MCS). Levels are briefly discussed later." +msgstr "La sortie peut légèrement différer d’un système à l’autre. La colonne <computeroutput>Login Name</computeroutput> liste les utilisateurs Linux et la colonne <computeroutput>SELinux User</computeroutput> liste l’utilisateur correspondant. Pour les processus, l’utilisateur SELinux limite les rôles et niveaux accessibles. La dernière colonne, <computeroutput>MLS/MCS Range</computeroutput>, est le niveau utilisé par la sécurité multiniveau (MLS) et la sécurité multicatégorie (Multi-Category Security ou MCS). Les niveaux seront brièvement discutés plus tard."

#. Tag: term #, no-c-format msgid "<emphasis>role</emphasis>" -msgstr "" +msgstr "<emphasis>rôle</emphasis>"

+# !!! #. Tag: para -#, no-c-format -msgid "" -"Part of SELinux is the Role-Based Access Control (RBAC) security model. The " -"role is an attribute of RBAC. SELinux users are authorized for roles, and " -"roles are authorized for domains. The role serves as an intermediary between " -"domains and SELinux users. The roles that can be entered determine which " -"domains can be entered - ultimately, this controls which object types can be " -"accessed. This helps reduce vulnerability to privilege escalation attacks." -msgstr "" +#, fuzzy, no-c-format +msgid "Part of SELinux is the Role-Based Access Control (RBAC) security model. The role is an attribute of RBAC. SELinux users are authorized for roles, and roles are authorized for domains. The role serves as an intermediary between domains and SELinux users. The roles that can be entered determine which domains can be entered - ultimately, this controls which object types can be accessed. This helps reduce vulnerability to privilege escalation attacks." +msgstr "L’un des composants de SELinux est le modèle de sécurité de contrôle d'accès à base de rôles (RBAC) . Le rôle est un attribut de RBAC. Les utilisateurs SELinux sont autorisés"

#. Tag: term #, no-c-format msgid "<emphasis>type</emphasis>" -msgstr "" +msgstr "<emphasis>type</emphasis>"

#. Tag: para #, no-c-format -msgid "" -"The type is an attribute of Type Enforcement. The type defines a domain for " -"processes, and a type for files. SELinux policy rules define how types can " -"access each other, whether it be a domain accessing a type, or a domain " -"accessing another domain. Access is only allowed if a specific SELinux " -"policy rule exists that allows it." +msgid "The type is an attribute of Type Enforcement. The type defines a domain for processes, and a type for files. SELinux policy rules define how types can access each other, whether it be a domain accessing a type, or a domain accessing another domain. Access is only allowed if a specific SELinux policy rule exists that allows it." msgstr ""

#. Tag: term #, no-c-format msgid "<emphasis>level</emphasis>" -msgstr "" +msgstr "<emphasis>niveau</emphasis>"

#. Tag: para #, no-c-format -msgid "" -"The level is an attribute of MLS and Multi-Category Security (MCS). An MLS " -"range is a pair of levels, written as <emphasis>lowlevel-highlevel</" -"emphasis> if the levels differ, or <emphasis>lowlevel</emphasis> if the " -"levels are identical (<computeroutput>s0-s0</computeroutput> is the same as " -"<computeroutput>s0</computeroutput>). Each level is a sensitivity-category " -"pair, with categories being optional. If there are categories, the level is " -"written as <emphasis>sensitivity:category-set</emphasis>. If there are no " -"categories, it is written as <emphasis>sensitivity</emphasis>." +msgid "The level is an attribute of MLS and Multi-Category Security (MCS). An MLS range is a pair of levels, written as <emphasis>lowlevel-highlevel</emphasis> if the levels differ, or <emphasis>lowlevel</emphasis> if the levels are identical (<computeroutput>s0-s0</computeroutput> is the same as <computeroutput>s0</computeroutput>). Each level is a sensitivity-category pair, with categories being optional. If there are categories, the level is written as <emphasis>sensitivity:category-set</emphasis>. If there are no categories, it is written as <emphasis>sensitivity</emphasis>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If the category set is a contiguous series, it can be abbreviated. For " -"example, <computeroutput>c0.c3</computeroutput> is the same as " -"<computeroutput>c0,c1,c2,c3</computeroutput>. The <filename>/etc/selinux/" -"targeted/setrans.conf</filename> file maps levels (<computeroutput>s0:c0</" -"computeroutput>) to human-readable form (ie. " -"<computeroutput>CompanyConfidential</computeroutput>). Do not edit " -"<filename>setrans.conf</filename> with a text editor: use <command>semanage</" -"command> to make changes. Refer to the" +msgid "If the category set is a contiguous series, it can be abbreviated. For example, <computeroutput>c0.c3</computeroutput> is the same as <computeroutput>c0,c1,c2,c3</computeroutput>. The <filename>/etc/selinux/targeted/setrans.conf</filename> file maps levels (<computeroutput>s0:c0</computeroutput>) to human-readable form (ie. <computeroutput>CompanyConfidential</computeroutput>). Do not edit <filename>setrans.conf</filename> with a text editor: use <command>semanage</command> to make changes. Refer to the" msgstr ""

#. Tag: refentrytitle #, no-c-format msgid "semanage" -msgstr "" +msgstr "semanage"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page for further information. In Fedora, targeted policy enforces " -"MCS, and in MCS, there is just one sensitivity, <computeroutput>s0</" -"computeroutput>. MCS in Fedora supports 1024 different categories: " -"<computeroutput>c0</computeroutput> through to <computeroutput>c1023</" -"computeroutput>. <computeroutput>s0-s0:c0.c1023</computeroutput> is " -"sensitivity <computeroutput>s0</computeroutput> and authorized for all " -"categories." +msgid "manual page for further information. In Fedora, targeted policy enforces MCS, and in MCS, there is just one sensitivity, <computeroutput>s0</computeroutput>. MCS in Fedora supports 1024 different categories: <computeroutput>c0</computeroutput> through to <computeroutput>c1023</computeroutput>. <computeroutput>s0-s0:c0.c1023</computeroutput> is sensitivity <computeroutput>s0</computeroutput> and authorized for all categories." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"MLS enforces the <ulink url="http://en.wikipedia.org/wiki/Bell-" -"LaPadula_model">Bell-La Padula Mandatory Access Model</ulink>, and is used " -"in Labeled Security Protection Profile (LSPP) environments. To use MLS " -"restrictions, install the <package>selinux-policy-mls</package> package, and " -"configure MLS to be the default SELinux policy. The MLS policy shipped with " -"Fedora omits many program domains that were not part of the evaluated " -"configuration, and therefore, MLS on a desktop workstation is unusable (no " -"support for the X Window System); however, an MLS policy from the <ulink url=" -""http://oss.tresys.com/projects/refpolicy%5C%22%3Eupstream SELinux Reference " -"Policy</ulink> can be built that includes all program domains." +msgid "MLS enforces the <ulink url="http://en.wikipedia.org/wiki/Bell-LaPadula_model%5C%22%3EBell-La Padula Mandatory Access Model</ulink>, and is used in Labeled Security Protection Profile (LSPP) environments. To use MLS restrictions, install the <package>selinux-policy-mls</package> package, and configure MLS to be the default SELinux policy. The MLS policy shipped with Fedora omits many program domains that were not part of the evaluated configuration, and therefore, MLS on a desktop workstation is unusable (no support for the X Window System); however, an MLS policy from the <ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3Eupstream SELinux Reference Policy</ulink> can be built that includes all program domains." msgstr ""

#. Tag: title #, no-c-format msgid "Domain Transitions" -msgstr "" +msgstr "Transitions de domaine"

#. Tag: para #, no-c-format -msgid "" -"A process in one domain transitions to another domain by executing an " -"application that has the <computeroutput>entrypoint</computeroutput> type " -"for the new domain. The <computeroutput>entrypoint</computeroutput> " -"permission is used in SELinux policy, and controls which applications can be " -"used to enter a domain. The following example demonstrates a domain " -"transition:" +msgid "A process in one domain transitions to another domain by executing an application that has the <computeroutput>entrypoint</computeroutput> type for the new domain. The <computeroutput>entrypoint</computeroutput> permission is used in SELinux policy, and controls which applications can be used to enter a domain. The following example demonstrates a domain transition:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"A user wants to change their password. To do this, they run the " -"<command>passwd</command> application. The <filename>/usr/bin/passwd</" -"filename> executable is labeled with the <computeroutput>passwd_exec_t</" -"computeroutput> type:" +msgid "A user wants to change their password. To do this, they run the <command>passwd</command> application. The <filename>/usr/bin/passwd</filename> executable is labeled with the <computeroutput>passwd_exec_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <application>passwd</application> application accesses <filename>/etc/" -"shadow</filename>, which is labeled with the <computeroutput>shadow_t</" -"computeroutput> type:" +msgid "The <application>passwd</application> application accesses <filename>/etc/shadow</filename>, which is labeled with the <computeroutput>shadow_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"An SELinux policy rule states that processes running in the " -"<computeroutput>passwd_t</computeroutput> domain are allowed to read and " -"write to files labeled with the <computeroutput>shadow_t</computeroutput> " -"type. The <computeroutput>shadow_t</computeroutput> type is only applied to " -"files that are required for a password change. This includes <filename>/etc/" -"gshadow</filename>, <filename>/etc/shadow</filename>, and their backup files." +msgid "An SELinux policy rule states that processes running in the <computeroutput>passwd_t</computeroutput> domain are allowed to read and write to files labeled with the <computeroutput>shadow_t</computeroutput> type. The <computeroutput>shadow_t</computeroutput> type is only applied to files that are required for a password change. This includes <filename>/etc/gshadow</filename>, <filename>/etc/shadow</filename>, and their backup files." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"An SELinux policy rule states that the <computeroutput>passwd_t</" -"computeroutput> domain has <computeroutput>entrypoint</computeroutput> " -"permission to the <computeroutput>passwd_exec_t</computeroutput> type." +msgid "An SELinux policy rule states that the <computeroutput>passwd_t</computeroutput> domain has <computeroutput>entrypoint</computeroutput> permission to the <computeroutput>passwd_exec_t</computeroutput> type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When a user runs the <command>/usr/bin/passwd</command> application, the " -"user's shell process transitions to the <computeroutput>passwd_t</" -"computeroutput> domain. With SELinux, since the default action is to deny, " -"and a rule exists that allows (among other things) applications running in " -"the <computeroutput>passwd_t</computeroutput> domain to access files labeled " -"with the <computeroutput>shadow_t</computeroutput> type, the " -"<application>passwd</application> application is allowed to access " -"<filename>/etc/shadow</filename>, and update the user's password." +msgid "When a user runs the <command>/usr/bin/passwd</command> application, the user's shell process transitions to the <computeroutput>passwd_t</computeroutput> domain. With SELinux, since the default action is to deny, and a rule exists that allows (among other things) applications running in the <computeroutput>passwd_t</computeroutput> domain to access files labeled with the <computeroutput>shadow_t</computeroutput> type, the <application>passwd</application> application is allowed to access <filename>/etc/shadow</filename>, and update the user's password." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This example is not exhaustive, and is used as a basic example to explain " -"domain transition. Although there is an actual rule that allows subjects " -"running in the <computeroutput>passwd_t</computeroutput> domain to access " -"objects labeled with the <computeroutput>shadow_t</computeroutput> file " -"type, other SELinux policy rules must be met before the subject can " -"transition to a new domain. In this example, Type Enforcement ensures:" +msgid "This example is not exhaustive, and is used as a basic example to explain domain transition. Although there is an actual rule that allows subjects running in the <computeroutput>passwd_t</computeroutput> domain to access objects labeled with the <computeroutput>shadow_t</computeroutput> file type, other SELinux policy rules must be met before the subject can transition to a new domain. In this example, Type Enforcement ensures:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"the <computeroutput>passwd_t</computeroutput> domain can only be entered by " -"executing an application labeled with the <computeroutput>passwd_exec_t</" -"computeroutput> type; can only execute from authorized shared libraries, " -"such as the <computeroutput>lib_t</computeroutput> type; and can not execute " -"any other applications." +msgid "the <computeroutput>passwd_t</computeroutput> domain can only be entered by executing an application labeled with the <computeroutput>passwd_exec_t</computeroutput> type; can only execute from authorized shared libraries, such as the <computeroutput>lib_t</computeroutput> type; and can not execute any other applications." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"only authorized domains, such as <computeroutput>passwd_t</computeroutput>, " -"can write to files labeled with the <computeroutput>shadow_t</" -"computeroutput> type. Even if other processes are running with superuser " -"privileges, those processes can not write to files labeled with the " -"<computeroutput>shadow_t</computeroutput> type, as they are not running in " -"the <computeroutput>passwd_t</computeroutput> domain." +msgid "only authorized domains, such as <computeroutput>passwd_t</computeroutput>, can write to files labeled with the <computeroutput>shadow_t</computeroutput> type. Even if other processes are running with superuser privileges, those processes can not write to files labeled with the <computeroutput>shadow_t</computeroutput> type, as they are not running in the <computeroutput>passwd_t</computeroutput> domain." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"only authorized domains can transition to the <computeroutput>passwd_t</" -"computeroutput> domain. For example, the <systemitem class="daemon" -"">sendmail</systemitem> process running in the <computeroutput>sendmail_t</" -"computeroutput> domain does not have a legitimate reason to execute " -"<command>passwd</command>; therefore, it can never transition to the " -"<computeroutput>passwd_t</computeroutput> domain." +msgid "only authorized domains can transition to the <computeroutput>passwd_t</computeroutput> domain. For example, the <systemitem class="daemon">sendmail</systemitem> process running in the <computeroutput>sendmail_t</computeroutput> domain does not have a legitimate reason to execute <command>passwd</command>; therefore, it can never transition to the <computeroutput>passwd_t</computeroutput> domain." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"processes running in the <computeroutput>passwd_t</computeroutput> domain " -"can only read and write to authorized types, such as files labeled with the " -"<computeroutput>etc_t</computeroutput> or <computeroutput>shadow_t</" -"computeroutput> types. This prevents the <application>passwd</application> " -"application from being tricked into reading or writing arbitrary files." +msgid "processes running in the <computeroutput>passwd_t</computeroutput> domain can only read and write to authorized types, such as files labeled with the <computeroutput>etc_t</computeroutput> or <computeroutput>shadow_t</computeroutput> types. This prevents the <application>passwd</application> application from being tricked into reading or writing arbitrary files." msgstr ""

#. Tag: title #, no-c-format msgid "SELinux Contexts for Processes" -msgstr "" +msgstr "Contextes SELinux pour les processus"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>ps -eZ</command> command to view the SELinux context for " -"processes. For example:" -msgstr "" +msgid "Use the <command>ps -eZ</command> command to view the SELinux context for processes. For example:" +msgstr "Utilisez la commande <command>ps -eZ</command> pour voir le contexte SELinux des processus."

#. Tag: para #, no-c-format -msgid "" -"Open a terminal, such as <menuchoice><guimenu>Applications</" -"guimenu><guisubmenu>System Tools</guisubmenu><guimenuitem>Terminal</" -"guimenuitem></menuchoice>." -msgstr "" +msgid "Open a terminal, such as <menuchoice><guimenu>Applications</guimenu><guisubmenu>System Tools</guisubmenu><guimenuitem>Terminal</guimenuitem></menuchoice>." +msgstr "Ouvrez un terminal, via <menuchoice><guimenu>Applications</guimenu><guisubmenu>Outils sysème</guisubmenu><guimenuitem>Terminal</guimenuitem></menuchoice>."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>/usr/bin/passwd</command> command. Do not enter a new " -"password." -msgstr "" +msgid "Run the <command>/usr/bin/passwd</command> command. Do not enter a new password." +msgstr "Lancez la commande <command>/usr/bin/passwd</command>. N’entrez pas de nouveau mot de passe."

#. Tag: para #, no-c-format -msgid "" -"Open a new tab, or another terminal, and run the <command>ps -eZ | grep " -"passwd</command> command. The output is similar to the following:" -msgstr "" +msgid "Open a new tab, or another terminal, and run the <command>ps -eZ | grep passwd</command> command. The output is similar to the following:" +msgstr "Ouvrez un nouvel onglet ou un autre terminal et lancez la commande <command>ps -eZ | grep passwd</command>. La sortie ressemble à ce qui suit :"

#. Tag: para #, no-c-format -msgid "" -"In the first tab/terminal, press <userinput>Ctrl+C</userinput> to cancel the " -"<application>passwd</application> application." -msgstr "" +msgid "In the first tab/terminal, press <userinput>Ctrl+C</userinput> to cancel the <application>passwd</application> application." +msgstr "Dans le premier onglet/terminal. pressez les touches <userinput>Ctrl+C</userinput> pour interrompre l’application <application>passwd</application>."

#. Tag: para #, no-c-format -msgid "" -"In this example, when the <filename>/usr/bin/passwd</filename> application " -"(labeled with the <computeroutput>passwd_exec_t</computeroutput> type) is " -"executed, the user's shell process transitions to the " -"<computeroutput>passwd_t</computeroutput> domain. Remember: the type defines " -"a domain for processes, and a type for files." +msgid "In this example, when the <filename>/usr/bin/passwd</filename> application (labeled with the <computeroutput>passwd_exec_t</computeroutput> type) is executed, the user's shell process transitions to the <computeroutput>passwd_t</computeroutput> domain. Remember: the type defines a domain for processes, and a type for files." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Use the <command>ps -eZ</command> command to view the SELinux contexts for " -"running processes. The following is a limited example of the output, and may " -"differ on your system:" +msgid "Use the <command>ps -eZ</command> command to view the SELinux contexts for running processes. The following is a limited example of the output, and may differ on your system:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>system_r</computeroutput> role is used for system " -"processes, such as daemons. Type Enforcement then separates each domain." +msgid "The <computeroutput>system_r</computeroutput> role is used for system processes, such as daemons. Type Enforcement then separates each domain." msgstr ""

#. Tag: title @@ -361,22 +217,10 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>id -Z</command> command to view the SELinux context " -"associated with your Linux user:" +msgid "Use the <command>id -Z</command> command to view the SELinux context associated with your Linux user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In Fedora, Linux users run unconfined by default. This SELinux context shows " -"that the Linux user is mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user, running as the <computeroutput>unconfined_r</" -"computeroutput> role, and is running in the <computeroutput>unconfined_t</" -"computeroutput> domain. <computeroutput>s0-s0</computeroutput> is an MLS " -"range, which in this case, is the same as just <computeroutput>s0</" -"computeroutput>. The categories the user has access to is defined by " -"<computeroutput>c0.c1023</computeroutput>, which is all categories " -"(<computeroutput>c0</computeroutput> through to <computeroutput>c1023</" -"computeroutput>)." +msgid "In Fedora, Linux users run unconfined by default. This SELinux context shows that the Linux user is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user, running as the <computeroutput>unconfined_r</computeroutput> role, and is running in the <computeroutput>unconfined_t</computeroutput> domain. <computeroutput>s0-s0</computeroutput> is an MLS range, which in this case, is the same as just <computeroutput>s0</computeroutput>. The categories the user has access to is defined by <computeroutput>c0.c1023</computeroutput>, which is all categories (<computeroutput>c0</computeroutput> through to <computeroutput>c1023</computeroutput>)." msgstr ""

Modified: community/branches/f13/fr-FR/Further_Information.po =================================================================== --- community/branches/f13/fr-FR/Further_Information.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Further_Information.po 2010-11-21 23:12:12 UTC (rev 492) @@ -10,6 +10,7 @@ "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME EMAIL@ADDRESS\n" "Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: application/x-xml2pot; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -26,23 +27,17 @@

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://fedoraproject.org/wiki/GeertWarrink%5C%22%3EGeert Warrink</" -"ulink> (translation - Dutch)" +msgid "<ulink url="http://fedoraproject.org/wiki/GeertWarrink%5C%22%3EGeert Warrink</ulink> (translation - Dutch)" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://fedoraproject.org/wiki/User:Beckerde%5C%22%3EDomingo Becker</" -"ulink> (translation - Spanish)" +msgid "<ulink url="http://fedoraproject.org/wiki/User:Beckerde%5C%22%3EDomingo Becker</ulink> (translation - Spanish)" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://fedoraproject.org/wiki/User:Logan%5C%22%3EDaniel Cabrera</" -"ulink> (translation - Spanish)" +msgid "<ulink url="http://fedoraproject.org/wiki/User:Logan%5C%22%3EDaniel Cabrera</ulink> (translation - Spanish)" msgstr ""

#. Tag: title @@ -57,43 +52,27 @@

#. Tag: para #, no-c-format -msgid "" -"From the NSA <ulink url="http://www.nsa.gov/research/selinux/contrib.shtml" -"">Contributors to SELinux</ulink> page:" +msgid "From the NSA <ulink url="http://www.nsa.gov/research/selinux/contrib.shtml%5C%22%3EContributors to SELinux</ulink> page:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<emphasis>Researchers in NSA's National Information Assurance Research " -"Laboratory (NIARL) designed and implemented flexible mandatory access " -"controls in the major subsystems of the Linux kernel and implemented the new " -"operating system components provided by the Flask architecture, namely the " -"security server and the access vector cache. The NSA researchers reworked " -"the LSM-based SELinux for inclusion in Linux 2.6. NSA has also led the " -"development of similar controls for the X Window System (XACE/XSELinux) and " -"for Xen (XSM/Flask).</emphasis>" +msgid "<emphasis>Researchers in NSA's National Information Assurance Research Laboratory (NIARL) designed and implemented flexible mandatory access controls in the major subsystems of the Linux kernel and implemented the new operating system components provided by the Flask architecture, namely the security server and the access vector cache. The NSA researchers reworked the LSM-based SELinux for inclusion in Linux 2.6. NSA has also led the development of similar controls for the X Window System (XACE/XSELinux) and for Xen (XSM/Flask).</emphasis>" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Main SELinux website: <ulink url="http://www.nsa.gov/research/selinux/index." -"shtml" />." +msgid "Main SELinux website: <ulink url="http://www.nsa.gov/research/selinux/index.shtml%5C" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux documentation: <ulink url="http://www.nsa.gov/research/selinux/docs." -"shtml" />." +msgid "SELinux documentation: <ulink url="http://www.nsa.gov/research/selinux/docs.shtml%5C" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux background: <ulink url="http://www.nsa.gov/research/selinux/" -"background.shtml" />." +msgid "SELinux background: <ulink url="http://www.nsa.gov/research/selinux/background.shtml%5C" />." msgstr ""

#. Tag: title @@ -103,23 +82,17 @@

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> are the " -"upstream for:" +msgid "<ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> are the upstream for:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://userspace.selinuxproject.org/trac/%5C%22%3ESELinux userland " -"libraries and tools</ulink>." +msgid "<ulink url="http://userspace.selinuxproject.org/trac/%5C%22%3ESELinux userland libraries and tools</ulink>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference " -"Policy</ulink>." +msgid "<ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference Policy</ulink>." msgstr ""

#. Tag: title @@ -134,8 +107,7 @@

#. Tag: para #, no-c-format -msgid "" -"Planet SELinux (blogs): <ulink url="http://selinuxnews.org/planet/%5C" />." +msgid "Planet SELinux (blogs): <ulink url="http://selinuxnews.org/planet/%5C" />." msgstr ""

#. Tag: title @@ -150,9 +122,7 @@

#. Tag: para #, no-c-format -msgid "" -"User resources, including links to documentation, mailing lists, websites, " -"and tools: <ulink url="http://selinuxproject.org/page/User_Resources%5C" />." +msgid "User resources, including links to documentation, mailing lists, websites, and tools: <ulink url="http://selinuxproject.org/page/User_Resources%5C" />." msgstr ""

#. Tag: title @@ -162,21 +132,12 @@

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://www.redhat.com/docs/en-US/" -"Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/index.html">Red Hat " -"Enterprise Linux Deployment Guide</ulink> contains an SELinux <ulink url=" -""http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/" -"Deployment_Guide/selg-chapter-0054.html">References</ulink> section, that " -"has links to SELinux tutorials, general information, and the technology " -"behind SELinux." +msgid "The <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux Deployment Guide</ulink> contains an SELinux <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen...</ulink> section, that has links to SELinux tutorials, general information, and the technology behind SELinux." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/" -"selinux-guide/index.html">Red Hat Enterprise Linux 4 SELinux Guide</ulink>." +msgid "The <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/in... Hat Enterprise Linux 4 SELinux Guide</ulink>." msgstr ""

#. Tag: title @@ -191,23 +152,17 @@

#. Tag: para #, no-c-format -msgid "" -"Troubleshooting: <ulink url="http://fedoraproject.org/wiki/SELinux/" -"Troubleshooting" />." +msgid "Troubleshooting: <ulink url="http://fedoraproject.org/wiki/SELinux/Troubleshooting%5C" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/" -"selinux-faq-fc5/" />." +msgid "Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux Managing Confined Services Guide: <ulink url="http://docs." -"fedoraproject.org/selinux-managing-confined-services-guide/" />" +msgid "SELinux Managing Confined Services Guide: <ulink url="http://docs.fedoraproject.org/selinux-managing-confined-services-guide/%5C" />" msgstr ""

#. Tag: title

Modified: community/branches/f13/fr-FR/Introduction.po =================================================================== --- community/branches/f13/fr-FR/Introduction.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Introduction.po 2010-11-21 23:12:12 UTC (rev 492) @@ -10,6 +10,7 @@ "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME EMAIL@ADDRESS\n" "Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: application/x-xml2pot; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -21,125 +22,42 @@

#. Tag: para #, no-c-format -msgid "" -"Security-Enhanced Linux (SELinux) is an implementation of a " -"<firstterm>mandatory access control</firstterm> mechanism in the Linux " -"kernel, checking for allowed operations after standard " -"<firstterm>discretionary access controls</firstterm> are checked. It was " -"created by the National Security Agency and can enforce rules on files and " -"processes in a Linux system, and on their actions, based on defined policy." +msgid "Security-Enhanced Linux (SELinux) is an implementation of a <firstterm>mandatory access control</firstterm> mechanism in the Linux kernel, checking for allowed operations after standard <firstterm>discretionary access controls</firstterm> are checked. It was created by the National Security Agency and can enforce rules on files and processes in a Linux system, and on their actions, based on defined policy." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When using SELinux, files, including directories and devices, are referred " -"to as objects. Processes, such as a user running a command or the <trademark " -"class="registered">Mozilla</trademark><trademark class="registered"> " -"Firefox</trademark> application, are referred to as subjects. Most operating " -"systems use a Discretionary Access Control (DAC) system that controls how " -"subjects interact with objects, and how subjects interact with each other. " -"On operating systems using DAC, users control the permissions of files " -"(objects) that they own. For example, on <trademark class="registered" -"">Linux</trademark> operating systems, users could make their home " -"directories world-readable, giving users and processes (subjects) access to " -"potentially sensitive information, with no further protection over this " -"unwanted action." +msgid "When using SELinux, files, including directories and devices, are referred to as objects. Processes, such as a user running a command or the <trademark class="registered">Mozilla</trademark><trademark class="registered"> Firefox</trademark> application, are referred to as subjects. Most operating systems use a Discretionary Access Control (DAC) system that controls how subjects interact with objects, and how subjects interact with each other. On operating systems using DAC, users control the permissions of files (objects) that they own. For example, on <trademark class="registered">Linux</trademark> operating systems, users could make their home directories world-readable, giving users and processes (subjects) access to potentially sensitive information, with no further protection over this unwanted action." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Relying on DAC mechanisms alone is fundamentally inadequate for strong " -"system security. DAC access decisions are only based on user identity and " -"ownership, ignoring other security-relevant information such as the role of " -"the user, the function and trustworthiness of the program, and the " -"sensitivity and integrity of the data. Each user has complete discretion " -"over their files, making it impossible to enforce a system-wide security " -"policy. Furthermore, every program run by a user inherits all of the " -"permissions granted to the user and is free to change access to the user's " -"files, so no protection is provided against malicious software. Many system " -"services and privileged programs must run with coarse-grained privileges " -"that far exceed their requirements, so that a flaw in any one of these " -"programs could be exploited to obtain further system access.<footnote> " -"<para> "Integrating Flexible Support for Security Policies into the Linux " -"Operating System", by Peter Loscocco and Stephen Smalley. This paper was " -"originally prepared for the National Security Agency and is, consequently, " -"in the public domain. Refer to the <ulink url="http://www.nsa.gov/research/" -"_files/selinux/papers/freenix01/index.shtml">original paper</ulink> for " -"details and the document as it was first released. Any edits and changes " -"were done by Murray McAllister. </para> </footnote>" +msgid "Relying on DAC mechanisms alone is fundamentally inadequate for strong system security. DAC access decisions are only based on user identity and ownership, ignoring other security-relevant information such as the role of the user, the function and trustworthiness of the program, and the sensitivity and integrity of the data. Each user has complete discretion over their files, making it impossible to enforce a system-wide security policy. Furthermore, every program run by a user inherits all of the permissions granted to the user and is free to change access to the user's files, so no protection is provided against malicious software. Many system services and privileged programs must run with coarse-grained privileges that far exceed their requirements, so that a flaw in any one of these programs could be exploited to obtain further system access.<footnote> <para> "Integrating Flexible Support for Security Policies into the Linux Operating System", by Peter Loscocco and Stephen Smalley. This paper was originally prepared for the National Security Agency and is, consequently, in the public domain. Refer to the <ulink url="http://www.nsa.gov/research/_files/selinux/papers/freenix01/index.shtml%5C%2... paper</ulink> for details and the document as it was first released. Any edits and changes were done by Murray McAllister. </para> </footnote>" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following is an example of permissions used on Linux operating systems " -"that do not run Security-Enhanced Linux (SELinux). The permissions and " -"output in these examples may differ from your system. Use the <command>ls -" -"l</command> command to view file permissions:" +msgid "The following is an example of permissions used on Linux operating systems that do not run Security-Enhanced Linux (SELinux). The permissions and output in these examples may differ from your system. Use the <command>ls -l</command> command to view file permissions:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The first three permission bits, <computeroutput>rwx</computeroutput>, " -"control the access the Linux <computeroutput>user1</computeroutput> user (in " -"this case, the owner) has to <filename>file1</filename>. The next three " -"permission bits, <computeroutput>rw-</computeroutput>, control the access " -"the Linux <computeroutput>group1</computeroutput> group has to " -"<filename>file1</filename>. The last three permission bits, " -"<computeroutput>r--</computeroutput>, control the access everyone else has " -"to <filename>file1</filename>, which includes all users and processes." +msgid "The first three permission bits, <computeroutput>rwx</computeroutput>, control the access the Linux <computeroutput>user1</computeroutput> user (in this case, the owner) has to <filename>file1</filename>. The next three permission bits, <computeroutput>rw-</computeroutput>, control the access the Linux <computeroutput>group1</computeroutput> group has to <filename>file1</filename>. The last three permission bits, <computeroutput>r--</computeroutput>, control the access everyone else has to <filename>file1</filename>, which includes all users and processes." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Security-Enhanced Linux (SELinux) adds Mandatory Access Control (MAC) to the " -"Linux kernel, and is enabled by default in Fedora. A general purpose MAC " -"architecture needs the ability to enforce an administratively-set security " -"policy over all processes and files in the system, basing decisions on " -"labels containing a variety of security-relevant information. When properly " -"implemented, it enables a system to adequately defend itself and offers " -"critical support for application security by protecting against the " -"tampering with, and bypassing of, secured applications. MAC provides strong " -"separation of applications that permits the safe execution of untrustworthy " -"applications. Its ability to limit the privileges associated with executing " -"processes limits the scope of potential damage that can result from the " -"exploitation of vulnerabilities in applications and system services. MAC " -"enables information to be protected from legitimate users with limited " -"authorization as well as from authorized users who have unwittingly executed " -"malicious applications.<footnote> <para> "Meeting Critical Security " -"Objectives with Security-Enhanced Linux", by Peter Loscocco and Stephen " -"Smalley. This paper was originally prepared for the National Security Agency " -"and is, consequently, in the public domain. Refer to the <ulink url="http://" -"www.nsa.gov/research/_files/selinux/papers/ottawa01/index.shtml">original " -"paper</ulink> for details and the document as it was first released. Any " -"edits and changes were done by Murray McAllister. </para> </footnote>" +msgid "Security-Enhanced Linux (SELinux) adds Mandatory Access Control (MAC) to the Linux kernel, and is enabled by default in Fedora. A general purpose MAC architecture needs the ability to enforce an administratively-set security policy over all processes and files in the system, basing decisions on labels containing a variety of security-relevant information. When properly implemented, it enables a system to adequately defend itself and offers critical support for application security by protecting against the tampering with, and bypassing of, secured applications. MAC provides strong separation of applications that permits the safe execution of untrustworthy applications. Its ability to limit the privileges associated with executing processes limits the scope of potential damage that can result from the exploitation of vulnerabilities in applications and system services. MAC enables information to be protected from legitimate users with limited authorization as well as f rom authorized users who have unwittingly executed malicious applications.<footnote> <para> "Meeting Critical Security Objectives with Security-Enhanced Linux", by Peter Loscocco and Stephen Smalley. This paper was originally prepared for the National Security Agency and is, consequently, in the public domain. Refer to the <ulink url="http://www.nsa.gov/research/_files/selinux/papers/ottawa01/index.shtml%5C%22... paper</ulink> for details and the document as it was first released. Any edits and changes were done by Murray McAllister. </para> </footnote>" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following is an example of the labels containing security-relevant " -"information that are used on processes, Linux users, and files, on Linux " -"operating systems that run SELinux. This information is called the SELinux " -"<emphasis>context</emphasis>, and is viewed using the <command>ls -Z</" -"command> command:" +msgid "The following is an example of the labels containing security-relevant information that are used on processes, Linux users, and files, on Linux operating systems that run SELinux. This information is called the SELinux <emphasis>context</emphasis>, and is viewed using the <command>ls -Z</command> command:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, SELinux provides a user (<computeroutput>unconfined_u</" -"computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type " -"(<computeroutput>user_home_t</computeroutput>), and a level " -"(<computeroutput>s0</computeroutput>). This information is used to make " -"access control decisions. With DAC, access is controlled based only on Linux " -"user and group IDs. It is important to remember that SELinux policy rules " -"are checked <emphasis>after</emphasis> DAC rules. SELinux policy rules are " -"not used if DAC rules deny access first." +msgid "In this example, SELinux provides a user (<computeroutput>unconfined_u</computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type (<computeroutput>user_home_t</computeroutput>), and a level (<computeroutput>s0</computeroutput>). This information is used to make access control decisions. With DAC, access is controlled based only on Linux user and group IDs. It is important to remember that SELinux policy rules are checked <emphasis>after</emphasis> DAC rules. SELinux policy rules are not used if DAC rules deny access first." msgstr ""

#. Tag: title @@ -149,11 +67,7 @@

#. Tag: para #, no-c-format -msgid "" -"On Linux operating systems that run SELinux, there are Linux users as well " -"as SELinux users. SELinux users are part of SELinux policy. Linux users are " -"mapped to SELinux users. To avoid confusion, this guide uses "Linux user" " -"and "SELinux user" to differentiate between the two." +msgid "On Linux operating systems that run SELinux, there are Linux users as well as SELinux users. SELinux users are part of SELinux policy. Linux users are mapped to SELinux users. To avoid confusion, this guide uses "Linux user" and "SELinux user" to differentiate between the two." msgstr ""

#. Tag: title @@ -163,51 +77,27 @@

#. Tag: para #, no-c-format -msgid "" -"All processes and files are labeled with a type. A type defines a domain for " -"processes, and a type for files. Processes are separated from each other by " -"running in their own domains, and SELinux policy rules define how processes " -"interact with files, as well as how processes interact with each other. " -"Access is only allowed if an SELinux policy rule exists that specifically " -"allows it." +msgid "All processes and files are labeled with a type. A type defines a domain for processes, and a type for files. Processes are separated from each other by running in their own domains, and SELinux policy rules define how processes interact with files, as well as how processes interact with each other. Access is only allowed if an SELinux policy rule exists that specifically allows it." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Fine-grained access control. Stepping beyond traditional <trademark class=" -""registered">UNIX</trademark> permissions that are controlled at user " -"discretion and based on Linux user and group IDs, SELinux access decisions " -"are based on all available information, such as an SELinux user, role, type, " -"and, optionally, a level." +msgid "Fine-grained access control. Stepping beyond traditional <trademark class="registered">UNIX</trademark> permissions that are controlled at user discretion and based on Linux user and group IDs, SELinux access decisions are based on all available information, such as an SELinux user, role, type, and, optionally, a level." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux policy is administratively-defined, enforced system-wide, and is not " -"set at user discretion." +msgid "SELinux policy is administratively-defined, enforced system-wide, and is not set at user discretion." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Reduced vulnerability to privilege escalation attacks. One example: since " -"processes run in domains, and are therefore separated from each other, and " -"because SELinux policy rules define how processes access files and other " -"processes, if a process is compromised, the attacker only has access to the " -"normal functions of that process, and to files the process has been " -"configured to have access to. For example, if the Apache HTTP Server is " -"compromised, an attacker can not use that process to read files in user home " -"directories, unless a specific SELinux policy rule was added or configured " -"to allow such access." +msgid "Reduced vulnerability to privilege escalation attacks. One example: since processes run in domains, and are therefore separated from each other, and because SELinux policy rules define how processes access files and other processes, if a process is compromised, the attacker only has access to the normal functions of that process, and to files the process has been configured to have access to. For example, if the Apache HTTP Server is compromised, an attacker can not use that process to read files in user home directories, unless a specific SELinux policy rule was added or configured to allow such access." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux can be used to enforce data confidentiality and integrity, as well " -"as protecting processes from untrusted inputs." +msgid "SELinux can be used to enforce data confidentiality and integrity, as well as protecting processes from untrusted inputs." msgstr ""

#. Tag: para @@ -232,11 +122,7 @@

#. Tag: para #, no-c-format -msgid "" -"SELinux is designed to enhance existing security solutions, not replace " -"them. Even when running SELinux, continue to follow good security practices, " -"such as keeping software up-to-date, using hard-to-guess passwords, " -"firewalls, and so on." +msgid "SELinux is designed to enhance existing security solutions, not replace them. Even when running SELinux, continue to follow good security practices, such as keeping software up-to-date, using hard-to-guess passwords, firewalls, and so on." msgstr ""

#. Tag: title @@ -251,101 +137,42 @@

#. Tag: para #, no-c-format -msgid "" -"The default action is deny. If an SELinux policy rule does not exist to " -"allow access, such as for a process opening a file, access is denied." +msgid "The default action is deny. If an SELinux policy rule does not exist to allow access, such as for a process opening a file, access is denied." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux can confine Linux users. A number of confined SELinux users exist in " -"SELinux policy. Linux users can be mapped to confined SELinux users to take " -"advantage of the security rules and mechanisms applied to them. For example, " -"mapping a Linux user to the SELinux user_u user, results in a Linux user " -"that is not able to run (unless configured otherwise) set user ID (setuid) " -"applications, such as <command>sudo</command> and <command>su</command>, as " -"well as preventing them from executing files and applications in their home " -"directory - if configured, this prevents users from executing malicious " -"files from their home directories." +msgid "SELinux can confine Linux users. A number of confined SELinux users exist in SELinux policy. Linux users can be mapped to confined SELinux users to take advantage of the security rules and mechanisms applied to them. For example, mapping a Linux user to the SELinux user_u user, results in a Linux user that is not able to run (unless configured otherwise) set user ID (setuid) applications, such as <command>sudo</command> and <command>su</command>, as well as preventing them from executing files and applications in their home directory - if configured, this prevents users from executing malicious files from their home directories." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Process separation is used. Processes run in their own domains, preventing " -"processes from accessing files used by other processes, as well as " -"preventing processes from accessing other processes. For example, when " -"running SELinux, unless otherwise configured, an attacker can not compromise " -"a Samba server, and then use that Samba server as an attack vector to read " -"and write to files used by other processes, such as databases used by " -"<trademark class="registered">MySQL</trademark>." +msgid "Process separation is used. Processes run in their own domains, preventing processes from accessing files used by other processes, as well as preventing processes from accessing other processes. For example, when running SELinux, unless otherwise configured, an attacker can not compromise a Samba server, and then use that Samba server as an attack vector to read and write to files used by other processes, such as databases used by <trademark class="registered">MySQL</trademark>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux helps limit the damage made by configuration mistakes. <ulink url=" -""http://en.wikipedia.org/wiki/Domain_Name_System%5C%22%3EDomain Name System (DNS)" -"</ulink> servers often replicate information between each other in what is " -"known as a zone transfer. Attackers can use zone transfers to update DNS " -"servers with false information. When running the <ulink url="https://www." -"isc.org/software/bind">Berkeley Internet Name Domain (BIND)</ulink> as a " -"DNS server in Fedora, even if an administrator forgets to limit which " -"servers can perform a zone transfer, the default SELinux policy prevents " -"zone files <footnote> <para> Text files that include information, such as " -"hostname to IP address mappings, that are used by DNS servers. </para> </" -"footnote> from being updated via zone transfers, by the BIND <systemitem " -"class="daemon">named</systemitem> daemon itself, and by other processes." +msgid "SELinux helps limit the damage made by configuration mistakes. <ulink url="http://en.wikipedia.org/wiki/Domain_Name_System%5C%22%3EDomain Name System (DNS)</ulink> servers often replicate information between each other in what is known as a zone transfer. Attackers can use zone transfers to update DNS servers with false information. When running the <ulink url="https://www.isc.org/software/bind%5C%22%3EBerkeley Internet Name Domain (BIND)</ulink> as a DNS server in Fedora, even if an administrator forgets to limit which servers can perform a zone transfer, the default SELinux policy prevents zone files <footnote> <para> Text files that include information, such as hostname to IP address mappings, that are used by DNS servers. </para> </footnote> from being updated via zone transfers, by the BIND <systemitem class="daemon">named</systemitem> daemon itself, and by other processes." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://www.redhatmagazine.com/%5C%22%3E<trademark class=" -""registered">Red Hat</trademark> Magazine</ulink> article, <ulink url=" -""http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-" -"hat-enterprise-linux-4/">Risk report: Three years of Red Hat Enterprise " -"Linux 4</ulink><footnote> <para> Cox, Mark. "Risk report: Three years of " -"Red Hat Enterprise Linux 4". Published 26 February 2008. Accessed 27 August " -"2009: <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-" -"three-years-of-red-hat-enterprise-linux-4/" />. </para> </footnote>, for " -"exploits that were restricted due to the default SELinux targeted policy in " -"<trademark class="registered">Red Hat</trademark> Enterprise <trademark " -"class="registered">Linux</trademark> 4." +msgid "Refer to the <ulink url="http://www.redhatmagazine.com/%5C%22%3E<trademark class="registered">Red Hat</trademark> Magazine</ulink> article, <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-hat-... report: Three years of Red Hat Enterprise Linux 4</ulink><footnote> <para> Cox, Mark. "Risk report: Three years of Red Hat Enterprise Linux 4". Published 26 February 2008. Accessed 27 August 2009: <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-hat-..." />. </para> </footnote>, for exploits that were restricted due to the default SELinux targeted policy in <trademark class="registered">Red Hat</trademark> Enterprise <trademark class="registered">Linux</trademark> 4." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://www.linuxworld.com%5C%22%3ELinuxWorld.com</ulink> " -"article, <ulink url="http://www.linuxworld.com/news/2008/022408-selinux." -"html?page=1">A seatbelt for server software: SELinux blocks real-world " -"exploits</ulink><footnote> <para> Marti, Don. "A seatbelt for server " -"software: SELinux blocks real-world exploits". Published 24 February 2008. " -"Accessed 27 August 2009: <ulink url="http://www.linuxworld.com/" -"news/2008/022408-selinux.html?page=1" />. </para> </footnote>, for " -"background information about SELinux, and information about various exploits " -"that SELinux has prevented." +msgid "Refer to the <ulink url="http://www.linuxworld.com%5C%22%3ELinuxWorld.com</ulink> article, <ulink url="http://www.linuxworld.com/news/2008/022408-selinux.html?page=1%5C%22%3EA seatbelt for server software: SELinux blocks real-world exploits</ulink><footnote> <para> Marti, Don. "A seatbelt for server software: SELinux blocks real-world exploits". Published 24 February 2008. Accessed 27 August 2009: <ulink url="http://www.linuxworld.com/news/2008/022408-selinux.html?page=1%5C" />. </para> </footnote>, for background information about SELinux, and information about various exploits that SELinux has prevented." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to James Morris's <ulink url="http://james-morris.livejournal." -"com/25421.html">SELinux mitigates remote root vulnerability in OpenPegasus</" -"ulink> blog post for information about an exploit in <ulink url="http://www." -"openpegasus.org/">OpenPegasus</ulink> that was mitigated by SELinux as " -"shipped with Red Hat Enterprise Linux 4 and 5." +msgid "Refer to James Morris's <ulink url="http://james-morris.livejournal.com/25421.html%5C%22%3ESELinux mitigates remote root vulnerability in OpenPegasus</ulink> blog post for information about an exploit in <ulink url="http://www.openpegasus.org/%5C%22%3EOpenPegasus</ulink> that was mitigated by SELinux as shipped with Red Hat Enterprise Linux 4 and 5." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> website " -"has an <ulink url="http://www.tresys.com/innovation.php%5C%22%3ESELinux " -"Mitigation News</ulink> section (on the right-hand side), that lists recent " -"exploits that have been mitigated or prevented by SELinux." +msgid "The <ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> website has an <ulink url="http://www.tresys.com/innovation.php%5C%22%3ESELinux Mitigation News</ulink> section (on the right-hand side), that lists recent exploits that have been mitigated or prevented by SELinux." msgstr ""

#. Tag: title @@ -355,23 +182,12 @@

#. Tag: para #, no-c-format -msgid "" -"SELinux is a Linux security module that is built into the Linux kernel. " -"SELinux is driven by loadable policy rules. When security-relevant access is " -"taking place, such as when a process attempts to open a file, the operation " -"is intercepted in the kernel by SELinux. If an SELinux policy rule allows " -"the operation, it continues, otherwise, the operation is blocked and the " -"process receives an error." +msgid "SELinux is a Linux security module that is built into the Linux kernel. SELinux is driven by loadable policy rules. When security-relevant access is taking place, such as when a process attempts to open a file, the operation is intercepted in the kernel by SELinux. If an SELinux policy rule allows the operation, it continues, otherwise, the operation is blocked and the process receives an error." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux decisions, such as allowing or disallowing access, are cached. This " -"cache is known as the Access Vector Cache (AVC). Caching decisions decreases " -"how often SELinux policy rules need to be checked, which increases " -"performance. Remember that SELinux policy rules have no effect if DAC rules " -"deny access first." +msgid "SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). Caching decisions decreases how often SELinux policy rules need to be checked, which increases performance. Remember that SELinux policy rules have no effect if DAC rules deny access first." msgstr ""

#. Tag: title @@ -381,16 +197,12 @@

#. Tag: para #, no-c-format -msgid "" -"Refer to the following for information about running SELinux on operating " -"systems:" +msgid "Refer to the following for information about running SELinux on operating systems:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Hardened Gentoo: <ulink url="http://www.gentoo.org/proj/en/hardened/selinux/" -"selinux-handbook.xml" />." +msgid "Hardened Gentoo: <ulink url="http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml%5C" />." msgstr ""

#. Tag: para @@ -400,25 +212,15 @@

#. Tag: para #, no-c-format -msgid "" -"Ubuntu: <ulink url="https://wiki.ubuntu.com/SELinux%5C" /> and <ulink url=" -""https://help.ubuntu.com/community/SELinux%5C" />." +msgid "Ubuntu: <ulink url="https://wiki.ubuntu.com/SELinux%5C" /> and <ulink url="https://help.ubuntu.com/community/SELinux%5C" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Red Hat Enterprise Linux: <ulink url="http://www.redhat.com/docs/en-US/" -"Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/selg-overview.html">Red " -"Hat Enterprise Linux Deployment Guide</ulink> and <ulink url="http://www." -"redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/">Red Hat " -"Enterprise Linux 4 SELinux Guide</ulink>." +msgid "Red Hat Enterprise Linux: <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux Deployment Guide</ulink> and <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/%5... Hat Enterprise Linux 4 SELinux Guide</ulink>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Fedora: <ulink url="http://fedoraproject.org/wiki/SELinux%5C" /> and the " -"<ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3EFedora Core 5 " -"SELinux FAQ</ulink>." +msgid "Fedora: <ulink url="http://fedoraproject.org/wiki/SELinux%5C" /> and the <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3EFedora Core 5 SELinux FAQ</ulink>." msgstr ""

Modified: community/branches/f13/fr-FR/Managing_Users.po =================================================================== --- community/branches/f13/fr-FR/Managing_Users.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Managing_Users.po 2010-11-21 23:12:12 UTC (rev 492) @@ -10,6 +10,7 @@ "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME EMAIL@ADDRESS\n" "Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: application/x-xml2pot; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -21,16 +22,7 @@

#. Tag: para #, no-c-format -msgid "" -"A number of confined SELinux users are available in Fedora&nbsp;&PRODVER;. " -"Each Linux user is mapped to an SELinux user via SELinux policy, allowing " -"Linux users to inherit the restrictions placed on SELinux users, for example " -"(depending on the user), not being able to: run the X Window System; use " -"networking; run setuid applications (unless SELinux policy permits it); or " -"run the <command>su</command> and <command>sudo</command> commands. This " -"helps protect the system from the user. Refer to <xref linkend="sect-" -"Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users" /> " -"for further information about confined users." +msgid "A number of confined SELinux users are available in Fedora&nbsp;&PRODVER;. Each Linux user is mapped to an SELinux user via SELinux policy, allowing Linux users to inherit the restrictions placed on SELinux users, for example (depending on the user), not being able to: run the X Window System; use networking; run setuid applications (unless SELinux policy permits it); or run the <command>su</command> and <command>sudo</command> commands. This helps protect the system from the user. Refer to <xref linkend="sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users" /> for further information about confined users." msgstr ""

#. Tag: title @@ -40,21 +32,12 @@

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>semanage login -l</command> command " -"to view the mapping between Linux users and SELinux users:" +msgid "As the Linux root user, run the <command>semanage login -l</command> command to view the mapping between Linux users and SELinux users:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux " -"<computeroutput>__default__</computeroutput> login by default (which is in " -"turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> " -"user). When a Linux user is created with the <command>useradd</command> " -"command, if no options are specified, they are mapped to the SELinux " -"<computeroutput>unconfined_u</computeroutput> user. The following defines " -"the default-mapping:" +msgid "In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is in turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). When a Linux user is created with the <command>useradd</command> command, if no options are specified, they are mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user. The following defines the default-mapping:" msgstr ""

#. Tag: title @@ -64,87 +47,42 @@

#. Tag: para #, no-c-format -msgid "" -"Linux users mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user run in the <computeroutput>unconfined_t</" -"computeroutput> domain. This is seen by running the <command>id -Z</command> " -"command while logged-in as a Linux user mapped to " -"<computeroutput>unconfined_u</computeroutput>:" +msgid "Linux users mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user run in the <computeroutput>unconfined_t</computeroutput> domain. This is seen by running the <command>id -Z</command> command while logged-in as a Linux user mapped to <computeroutput>unconfined_u</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When Linux users run in the <computeroutput>unconfined_t</computeroutput> " -"domain, SELinux policy rules are applied, but policy rules exist that allow " -"Linux users running in the <computeroutput>unconfined_t</computeroutput> " -"domain almost all access. If unconfined Linux users execute an application " -"that SELinux policy defines can transition from the " -"<computeroutput>unconfined_t</computeroutput> domain to its own confined " -"domain, unconfined Linux users are still subject to the restrictions of that " -"confined domain. The security benefit of this is that, even though a Linux " -"user is running unconfined, the application remains confined, and therefore, " -"the exploitation of a flaw in the application can be limited by policy. " -"Note: this does not protect the system from the user. Instead, the user and " -"the system are being protected from possible damage caused by a flaw in the " -"application." +msgid "When Linux users run in the <computeroutput>unconfined_t</computeroutput> domain, SELinux policy rules are applied, but policy rules exist that allow Linux users running in the <computeroutput>unconfined_t</computeroutput> domain almost all access. If unconfined Linux users execute an application that SELinux policy defines can transition from the <computeroutput>unconfined_t</computeroutput> domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy. Note: this does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When creating Linux users with <command>useradd</command>, use the <option>-" -"Z</option> option to specify which SELinux user they are mapped to. The " -"following example creates a new Linux user, useruuser, and maps that user to " -"the SELinux <computeroutput>user_u</computeroutput> user. Linux users mapped " -"to the SELinux <computeroutput>user_u</computeroutput> user run in the " -"<computeroutput>user_t</computeroutput> domain. In this domain, Linux users " -"are unable to run setuid applications unless SELinux policy permits it (such " -"as <command>passwd</command>), and can not run <command>su</command> or " -"<command>sudo</command>, preventing them from becoming the Linux root user " -"with these commands." +msgid "When creating Linux users with <command>useradd</command>, use the <option>-Z</option> option to specify which SELinux user they are mapped to. The following example creates a new Linux user, useruuser, and maps that user to the SELinux <computeroutput>user_u</computeroutput> user. Linux users mapped to the SELinux <computeroutput>user_u</computeroutput> user run in the <computeroutput>user_t</computeroutput> domain. In this domain, Linux users are unable to run setuid applications unless SELinux policy permits it (such as <command>passwd</command>), and can not run <command>su</command> or <command>sudo</command>, preventing them from becoming the Linux root user with these commands." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/useradd -Z user_u " -"useruuser</command> command to create a new Linux user (useruuser) that is " -"mapped to the SELinux <computeroutput>user_u</computeroutput> user." +msgid "As the Linux root user, run the <command>/usr/sbin/useradd -Z user_u useruuser</command> command to create a new Linux user (useruuser) that is mapped to the SELinux <computeroutput>user_u</computeroutput> user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>semanage login -l</command> command " -"to view the mapping between the Linux <computeroutput>useruuser</" -"computeroutput> user and <computeroutput>user_u</computeroutput>:" +msgid "As the Linux root user, run the <command>semanage login -l</command> command to view the mapping between the Linux <computeroutput>useruuser</computeroutput> user and <computeroutput>user_u</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>passwd useruuser</command> command " -"to assign a password to the Linux useruuser user:" +msgid "As the Linux root user, run the <command>passwd useruuser</command> command to assign a password to the Linux useruuser user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Log out of your current session, and log in as the Linux useruuser user. " -"When you log in, pam_selinux maps the Linux user to an SELinux user (in this " -"case, <computeroutput>user_u</computeroutput>), and sets up the resulting " -"SELinux context. The Linux user's shell is then launched with this context. " -"Run the <command>id -Z</command> command to view the context of a Linux user:" +msgid "Log out of your current session, and log in as the Linux useruuser user. When you log in, pam_selinux maps the Linux user to an SELinux user (in this case, <computeroutput>user_u</computeroutput>), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run the <command>id -Z</command> command to view the context of a Linux user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Log out of the Linux useruuser's session, and log back in with your account. " -"If you do not want the Linux useruuser user, run the <command>/usr/sbin/" -"userdel -r useruuser</command> command as the Linux root user to remove it, " -"along with its home directory." +msgid "Log out of the Linux useruuser's session, and log back in with your account. If you do not want the Linux useruuser user, run the <command>/usr/sbin/userdel -r useruuser</command> command as the Linux root user to remove it, along with its home directory." msgstr ""

#. Tag: title @@ -154,29 +92,17 @@

#. Tag: para #, no-c-format -msgid "" -"If a Linux user is mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user (the default behavior), and you would like to change " -"which SELinux user they are mapped to, use the <command>semanage login</" -"command> command. The following example creates a new Linux user named " -"newuser, then maps that Linux user to the SELinux <computeroutput>user_u</" -"computeroutput> user:" +msgid "If a Linux user is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user (the default behavior), and you would like to change which SELinux user they are mapped to, use the <command>semanage login</command> command. The following example creates a new Linux user named newuser, then maps that Linux user to the SELinux <computeroutput>user_u</computeroutput> user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> " -"command to create a new Linux user (newuser). Since this user uses the " -"default mapping, it does not appear in the <command>/usr/sbin/semanage login " -"-l</command> output:" +msgid "As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> command to create a new Linux user (newuser). Since this user uses the default mapping, it does not appear in the <command>/usr/sbin/semanage login -l</command> output:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To map the Linux newuser user to the SELinux <computeroutput>user_u</" -"computeroutput> user, run the following command as the Linux root user:" +msgid "To map the Linux newuser user to the SELinux <computeroutput>user_u</computeroutput> user, run the following command as the Linux root user:" msgstr ""

#. Tag: para @@ -186,43 +112,27 @@

#. Tag: para #, no-c-format -msgid "" -"The <option>-a</option> option adds a new record, and the <option>-s</" -"option> option specifies the SELinux user to map a Linux user to. The last " -"argument, <computeroutput>newuser</computeroutput>, is the Linux user you " -"want mapped to the specified SELinux user." +msgid "The <option>-a</option> option adds a new record, and the <option>-s</option> option specifies the SELinux user to map a Linux user to. The last argument, <computeroutput>newuser</computeroutput>, is the Linux user you want mapped to the specified SELinux user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To view the mapping between the Linux newuser user and " -"<computeroutput>user_u</computeroutput>, run the <command>semanage login -l</" -"command> command as the Linux root user:" +msgid "To view the mapping between the Linux newuser user and <computeroutput>user_u</computeroutput>, run the <command>semanage login -l</command> command as the Linux root user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>passwd newuser</command> command to " -"assign a password to the Linux newuser user:" +msgid "As the Linux root user, run the <command>passwd newuser</command> command to assign a password to the Linux newuser user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Log out of your current session, and log in as the Linux newuser user. Run " -"the <command>id -Z</command> command to view the newuser's SELinux context:" +msgid "Log out of your current session, and log in as the Linux newuser user. Run the <command>id -Z</command> command to view the newuser's SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Log out of the Linux newuser's session, and log back in with your account. " -"If you do not want the Linux newuser user, run the <command>userdel -r " -"newuser</command> command as the Linux root user to remove it, along with " -"its home directory. Also, the mapping between the Linux newuser user and " -"<computeroutput>user_u</computeroutput> is removed:" +msgid "Log out of the Linux newuser's session, and log back in with your account. If you do not want the Linux newuser user, run the <command>userdel -r newuser</command> command as the Linux root user to remove it, along with its home directory. Also, the mapping between the Linux newuser user and <computeroutput>user_u</computeroutput> is removed:" msgstr ""

#. Tag: title @@ -232,54 +142,32 @@

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux " -"<computeroutput>__default__</computeroutput> login by default (which is in " -"turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> " -"user). If you would like new Linux users, and Linux users not specifically " -"mapped to an SELinux user to be confined by default, change the default " -"mapping with the <command>semanage login</command> command." +msgid "In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is in turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). If you would like new Linux users, and Linux users not specifically mapped to an SELinux user to be confined by default, change the default mapping with the <command>semanage login</command> command." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For example, run the following command as the Linux root user to change the " -"default mapping from <computeroutput>unconfined_u</computeroutput> to " -"<computeroutput>user_u</computeroutput>:" +msgid "For example, run the following command as the Linux root user to change the default mapping from <computeroutput>unconfined_u</computeroutput> to <computeroutput>user_u</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<command>/usr/sbin/semanage login -m -S targeted -s "user_u" -r s0 " -"__default__</command>" +msgid "<command>/usr/sbin/semanage login -m -S targeted -s "user_u" -r s0 __default__</command>" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>semanage login -l</command> command as the Linux root user " -"to verify the <computeroutput>__default__</computeroutput> login is mapped " -"to <computeroutput>user_u</computeroutput>:" +msgid "Run the <command>semanage login -l</command> command as the Linux root user to verify the <computeroutput>__default__</computeroutput> login is mapped to <computeroutput>user_u</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If a new Linux user is created and an SELinux user is not specified, or if " -"an existing Linux user logs in and does not match a specific entry from the " -"<command>semanage login -l</command> output, they are mapped to " -"<computeroutput>user_u</computeroutput>, as per the " -"<computeroutput>__default__</computeroutput> login." +msgid "If a new Linux user is created and an SELinux user is not specified, or if an existing Linux user logs in and does not match a specific entry from the <command>semanage login -l</command> output, they are mapped to <computeroutput>user_u</computeroutput>, as per the <computeroutput>__default__</computeroutput> login." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To change back to the default behavior, run the following command as the " -"Linux root user to map the <computeroutput>__default__</computeroutput> " -"login to the SELinux <computeroutput>unconfined_u</computeroutput> user:" +msgid "To change back to the default behavior, run the following command as the Linux root user to map the <computeroutput>__default__</computeroutput> login to the SELinux <computeroutput>unconfined_u</computeroutput> user:" msgstr ""

#. Tag: title @@ -289,14 +177,7 @@

#. Tag: para #, no-c-format -msgid "" -"The <package>xguest</package> package provides a kiosk user account. This " -"account is used to secure machines that people walk up to and use, such as " -"those at libraries, banks, airports, information kiosks, and coffee shops. " -"The kiosk user account is very limited: essentially, it only allows users to " -"log in and use <application>Firefox</application> to browse Internet " -"websites. Any changes made while logged in with his account, such as " -"creating files or changing settings, are lost when you log out." +msgid "The <package>xguest</package> package provides a kiosk user account. This account is used to secure machines that people walk up to and use, such as those at libraries, banks, airports, information kiosks, and coffee shops. The kiosk user account is very limited: essentially, it only allows users to log in and use <application>Firefox</application> to browse Internet websites. Any changes made while logged in with his account, such as creating files or changing settings, are lost when you log out." msgstr ""

#. Tag: para @@ -306,38 +187,22 @@

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run <command>yum install xguest</command> command to " -"install the <package>xguest</package> package. Install dependencies as " -"required." +msgid "As the Linux root user, run <command>yum install xguest</command> command to install the <package>xguest</package> package. Install dependencies as required." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In order to allow the kiosk account to be used by a variety of people, the " -"account is not password-protected, and as such, the account can only be " -"protected if SELinux is running in enforcing mode. Before logging in with " -"this account, use the <command>getenforce</command> command to confirm that " -"SELinux is running in enforcing mode:" +msgid "In order to allow the kiosk account to be used by a variety of people, the account is not password-protected, and as such, the account can only be protected if SELinux is running in enforcing mode. Before logging in with this account, use the <command>getenforce</command> command to confirm that SELinux is running in enforcing mode:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If this is not the case, refer to <xref linkend="sect-Security-" -"Enhanced_Linux-Working_with_SELinux-SELinux_Modes" /> for information about " -"changing to enforcing mode. It is not possible to log in with this account " -"if SELinux is in permissive mode or disabled." +msgid "If this is not the case, refer to <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Modes" /> for information about changing to enforcing mode. It is not possible to log in with this account if SELinux is in permissive mode or disabled." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"You can only log in to this account via the GNOME Display Manager (GDM). " -"Once the <package>xguest</package> package is installed, a " -"<computeroutput>Guest</computeroutput> account is added to GDM. To log in, " -"click on the <computeroutput>Guest</computeroutput> account:" +msgid "You can only log in to this account via the GNOME Display Manager (GDM). Once the <package>xguest</package> package is installed, a <computeroutput>Guest</computeroutput> account is added to GDM. To log in, click on the <computeroutput>Guest</computeroutput> account:" msgstr ""

#. Tag: title @@ -347,26 +212,12 @@

#. Tag: para #, no-c-format -msgid "" -"Not allowing Linux users to execute applications (which inherit users' " -"permissions) in their home directories and <filename>/tmp/</filename>, which " -"they have write access to, helps prevent flawed or malicious applications " -"from modifying files that users own. In Fedora&nbsp;&PRODVER;, by default, " -"Linux users in the <computeroutput>guest_t</computeroutput> and " -"<computeroutput>xguest_t</computeroutput> domains can not execute " -"applications in their home directories or <filename>/tmp/</filename>; " -"however, by default, Linux users in the <computeroutput>user_t</" -"computeroutput> and <computeroutput>staff_t</computeroutput> domains can." +msgid "Not allowing Linux users to execute applications (which inherit users' permissions) in their home directories and <filename>/tmp/</filename>, which they have write access to, helps prevent flawed or malicious applications from modifying files that users own. In Fedora&nbsp;&PRODVER;, by default, Linux users in the <computeroutput>guest_t</computeroutput> and <computeroutput>xguest_t</computeroutput> domains can not execute applications in their home directories or <filename>/tmp/</filename>; however, by default, Linux users in the <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Booleans are available to change this behavior, and are configured with the " -"<command>setsebool</command> command. The <command>setsebool</command> " -"command must be run as the Linux root user. The <command>setsebool -P</" -"command> command makes persistent changes. Do not use the <option>-P</" -"option> option if you do not want changes to persist across reboots:" +msgid "Booleans are available to change this behavior, and are configured with the <command>setsebool</command> command. The <command>setsebool</command> command must be run as the Linux root user. The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots:" msgstr ""

#. Tag: title @@ -376,10 +227,7 @@

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>allow</emphasis> Linux users in the <computeroutput>guest_t</" -"computeroutput> domain to execute applications in their home directories and " -"<filename>/tmp/</filename>:" +msgid "To <emphasis>allow</emphasis> Linux users in the <computeroutput>guest_t</computeroutput> domain to execute applications in their home directories and <filename>/tmp/</filename>:" msgstr ""

#. Tag: para @@ -394,10 +242,7 @@

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>allow</emphasis> Linux users in the <computeroutput>xguest_t</" -"computeroutput> domain to execute applications in their home directories and " -"<filename>/tmp/</filename>:" +msgid "To <emphasis>allow</emphasis> Linux users in the <computeroutput>xguest_t</computeroutput> domain to execute applications in their home directories and <filename>/tmp/</filename>:" msgstr ""

#. Tag: para @@ -412,10 +257,7 @@

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>prevent</emphasis> Linux users in the <computeroutput>user_t</" -"computeroutput> domain from executing applications in their home directories " -"and <filename>/tmp/</filename>:" +msgid "To <emphasis>prevent</emphasis> Linux users in the <computeroutput>user_t</computeroutput> domain from executing applications in their home directories and <filename>/tmp/</filename>:" msgstr ""

#. Tag: para @@ -430,10 +272,7 @@

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>prevent</emphasis> Linux users in the <computeroutput>staff_t</" -"computeroutput> domain from executing applications in their home directories " -"and <filename>/tmp/</filename>:" +msgid "To <emphasis>prevent</emphasis> Linux users in the <computeroutput>staff_t</computeroutput> domain from executing applications in their home directories and <filename>/tmp/</filename>:" msgstr ""

#. Tag: para

Modified: community/branches/f13/fr-FR/Preface.po =================================================================== --- community/branches/f13/fr-FR/Preface.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Preface.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,67 +1,51 @@ -# SOME DESCRIPTIVE TITLE. -# FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy +# Nicolas Maître nimai@fedoraproject.org, 2010. +# msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" -"Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" +"Project-Id-Version: fr\n" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-08-20 22:58+0100\n" +"Last-Translator: Nicolas Maître nimai@fedoraproject.org\n" +"Language-Team: French trans-fr@lists.fedoraproject.org\n" +"Language: fr\n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"Plural-Forms: nplurals=2; plural=(n > 1);\n"

#. Tag: title #, no-c-format msgid "Preface" -msgstr "" +msgstr "Préface"

#. Tag: para #, no-c-format -msgid "" -"The Fedora&nbsp;&PRODVER; SELinux User Guide is for people with minimal or " -"no experience with SELinux. Although system administration experience is not " -"necessary, content in this guide is written for system administration tasks. " -"This guide provides an introduction to fundamental concepts and practical " -"applications of SELinux. After reading this guide you should have an " -"intermediate understanding of SELinux." -msgstr "" +msgid "The Fedora&nbsp;&PRODVER; SELinux User Guide is for people with minimal or no experience with SELinux. Although system administration experience is not necessary, content in this guide is written for system administration tasks. This guide provides an introduction to fundamental concepts and practical applications of SELinux. After reading this guide you should have an intermediate understanding of SELinux." +msgstr "Le guide de l’utilisateur SELinux Fedora&nbsp;&PRODVER; est destiné aux personnes qui n’ont pas ou peu d’expérience avec SELinux. Bien qu’aucune expérience d’administration système ne soit requise, le contenu de ce guide a été écrit pour des tâches d’administration système. Ce guide fournit une introduction aux concepts fondamentaux et aux applications pratiques de SELinux. Après la lecture de ce guide, vous devriez posséder un niveau de compréhension intermédiaire de SELinux."

#. Tag: para #, no-c-format -msgid "" -"Thank you to everyone who offered encouragement, help, and testing - it is " -"most appreciated. Very special thanks to:" -msgstr "" +msgid "Thank you to everyone who offered encouragement, help, and testing - it is most appreciated. Very special thanks to:" +msgstr "Merci à tous ceux qui ont offert leurs encouragements, leur aide ou qui ont pris part aux tests — c’est apprécié au plus haut point. Un merci tout particulier à :"

#. Tag: para #, no-c-format -msgid "" -"Dominick Grift, Stephen Smalley, and Russell Coker for their contributions, " -"help, and patience." -msgstr "" +msgid "Dominick Grift, Stephen Smalley, and Russell Coker for their contributions, help, and patience." +msgstr "Dominick Grift, Stephen Smalley et Russell Coker pour leurs contributions, leur aide et leur patience."

#. Tag: para #, no-c-format -msgid "" -"Karsten Wade for his help, adding a component for this guide to <ulink url=" -""https://bugzilla.redhat.com/%5C%22%3E Red Hat Bugzilla</ulink>, and sorting out " -"web hosting on <ulink url="http://docs.fedoraproject.org/%5C" />." -msgstr "" +msgid "Karsten Wade for his help, adding a component for this guide to <ulink url="https://bugzilla.redhat.com/%5C%22%3E Red Hat Bugzilla</ulink>, and sorting out web hosting on <ulink url="http://docs.fedoraproject.org/%5C" />." +msgstr "Karsten Wade pour son aide, pour avoir ajouté un composant pour ce guide au <ulink url="https://bugzilla.redhat.com/%5C%22%3EBugzilla Red Hat</ulink> et pour s’être occupé de l’hébergement web sur ulink url="http://docs.fedoraproject.org/%5C" />."

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://fedoraproject.org/wiki/Infrastructure%5C%22%3EFedora " -"Infrastructure Team</ulink> for providing hosting." -msgstr "" +msgid "The <ulink url="http://fedoraproject.org/wiki/Infrastructure%5C%22%3EFedora Infrastructure Team</ulink> for providing hosting." +msgstr "L’<ulink url="http://fedoraproject.org/wiki/Infrastructure%5C%22%3E%C3%A9quipe « Infrastructure Fedora »</ulink> pour avoir fourni l’hébergement."

+# Je suis pas absolument sûr du sens... #. Tag: para #, no-c-format -msgid "" -"Jens-Ulrik Petersen for making sure the Red Hat Brisbane office has up-to-" -"date Fedora mirrors." -msgstr "" +msgid "Jens-Ulrik Petersen for making sure the Red Hat Brisbane office has up-to-date Fedora mirrors." +msgstr "Jens-Ulrik Petersen pour s’être assuré que les miroirs Fedora du bureau Red Hat de Brisbane soient toujours à jour."

Modified: community/branches/f13/fr-FR/Revision_History.po =================================================================== --- community/branches/f13/fr-FR/Revision_History.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Revision_History.po 2010-11-21 23:12:12 UTC (rev 492) @@ -10,6 +10,7 @@ "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME EMAIL@ADDRESS\n" "Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: application/x-xml2pot; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -56,10 +57,7 @@

#. Tag: member #, no-c-format -msgid "" -"Resolving <ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=472986" -"">Red Hat Bugzilla #472986, "httpd does not write to /etc/httpd/logs/"</" -"ulink>" +msgid "Resolving <ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=472986%5C%22%3ERed Hat Bugzilla #472986, "httpd does not write to /etc/httpd/logs/"</ulink>" msgstr ""

#. Tag: member @@ -74,6 +72,5 @@

#. Tag: member #, no-c-format -msgid "" -"Initial content release on <ulink url="http://docs.fedoraproject.org/%5C" />" +msgid "Initial content release on <ulink url="http://docs.fedoraproject.org/%5C" />" msgstr ""

Modified: community/branches/f13/fr-FR/SELinux_User_Guide.po =================================================================== --- community/branches/f13/fr-FR/SELinux_User_Guide.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/SELinux_User_Guide.po 2010-11-21 23:12:12 UTC (rev 492) @@ -0,0 +1,14 @@ +# +# AUTHOR EMAIL@ADDRESS, YEAR. +# +msgid "" +msgstr "" +"Project-Id-Version: 0\n" +"POT-Creation-Date: 2010-04-15T00:19:31\n" +"PO-Revision-Date: 2010-04-15T00:19:31\n" +"Last-Translator: Automatically generated\n" +"Language-Team: None\n" +"MIME-Version: 1.0\n" +"Content-Type: application/x-publican; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +

Modified: community/branches/f13/fr-FR/Security-Enhanced_Linux.po =================================================================== --- community/branches/f13/fr-FR/Security-Enhanced_Linux.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Security-Enhanced_Linux.po 2010-11-21 23:12:12 UTC (rev 492) @@ -0,0 +1,14 @@ +# +# AUTHOR EMAIL@ADDRESS, YEAR. +# +msgid "" +msgstr "" +"Project-Id-Version: 0\n" +"POT-Creation-Date: 2010-04-15T00:19:31\n" +"PO-Revision-Date: 2010-04-15T00:19:31\n" +"Last-Translator: Automatically generated\n" +"Language-Team: None\n" +"MIME-Version: 1.0\n" +"Content-Type: application/x-publican; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +

Modified: community/branches/f13/fr-FR/Targeted_Policy.po =================================================================== --- community/branches/f13/fr-FR/Targeted_Policy.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Targeted_Policy.po 2010-11-21 23:12:12 UTC (rev 492) @@ -10,6 +10,7 @@ "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME EMAIL@ADDRESS\n" "Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: application/x-xml2pot; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -21,26 +22,12 @@

#. Tag: para #, no-c-format -msgid "" -"Targeted policy is the default SELinux policy used in Fedora. When using " -"targeted policy, processes that are targeted run in a confined domain, and " -"processes that are not targeted run in an unconfined domain. For example, by " -"default, logged in users run in the <computeroutput>unconfined_t</" -"computeroutput> domain, and system processes started by init run in the " -"<computeroutput>initrc_t</computeroutput> domain - both of these domains are " -"unconfined." +msgid "Targeted policy is the default SELinux policy used in Fedora. When using targeted policy, processes that are targeted run in a confined domain, and processes that are not targeted run in an unconfined domain. For example, by default, logged in users run in the <computeroutput>unconfined_t</computeroutput> domain, and system processes started by init run in the <computeroutput>initrc_t</computeroutput> domain - both of these domains are unconfined." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Unconfined domains (as well as confined domains) are subject to executable " -"and writeable memory checks. By default, subjects running in an unconfined " -"domain can not allocate writeable memory and execute it. This reduces " -"vulnerability to <ulink url="http://en.wikipedia.org/wiki/Buffer_overflow" -"">buffer overflow attacks</ulink>. These memory checks are disabled by " -"setting Booleans, which allow the SELinux policy to be modified at runtime. " -"Boolean configuration is discussed later." +msgid "Unconfined domains (as well as confined domains) are subject to executable and writeable memory checks. By default, subjects running in an unconfined domain can not allocate writeable memory and execute it. This reduces vulnerability to <ulink url="http://en.wikipedia.org/wiki/Buffer_overflow%5C%22%3Ebuffer overflow attacks</ulink>. These memory checks are disabled by setting Booleans, which allow the SELinux policy to be modified at runtime. Boolean configuration is discussed later." msgstr ""

#. Tag: title @@ -50,105 +37,52 @@

#. Tag: para #, no-c-format -msgid "" -"Almost every service that listens on a network is confined in Fedora. Also, " -"most processes that run as the Linux root user and perform tasks for users, " -"such as the <application>passwd</application> application, are confined. " -"When a process is confined, it runs in its own domain, such as the " -"<systemitem class="daemon">httpd</systemitem> process running in the " -"<computeroutput>httpd_t</computeroutput> domain. If a confined process is " -"compromised by an attacker, depending on SELinux policy configuration, an " -"attacker's access to resources and the possible damage they can do is " -"limited." +msgid "Almost every service that listens on a network is confined in Fedora. Also, most processes that run as the Linux root user and perform tasks for users, such as the <application>passwd</application> application, are confined. When a process is confined, it runs in its own domain, such as the <systemitem class="daemon">httpd</systemitem> process running in the <computeroutput>httpd_t</computeroutput> domain. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates how SELinux prevents the Apache HTTP " -"Server (<systemitem class="daemon">httpd</systemitem>) from reading files " -"that are not correctly labeled, such as files intended for use by Samba. " -"This is an example, and should not be used in production. It assumes that " -"the <package>httpd</package>, <package>wget</package>, " -"<package>setroubleshoot-server</package>, <package>dbus</package> and " -"<package>audit</package> packages are installed, that the SELinux targeted " -"policy is used, and that SELinux is running in enforcing mode:" +msgid "The following example demonstrates how SELinux prevents the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) from reading files that are not correctly labeled, such as files intended for use by Samba. This is an example, and should not be used in production. It assumes that the <package>httpd</package>, <package>wget</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>sestatus</command> command to confirm that SELinux is " -"enabled, is running in enforcing mode, and that targeted policy is being " -"used:" +msgid "Run the <command>sestatus</command> command to confirm that SELinux is enabled, is running in enforcing mode, and that targeted policy is being used:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>SELinux status: enabled</computeroutput> is returned when " -"SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> " -"is returned when SELinux is running in enforcing mode. " -"<computeroutput>Policy from config file: targeted</computeroutput> is " -"returned when the SELinux targeted policy is used." +msgid "<computeroutput>SELinux status: enabled</computeroutput> is returned when SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> is returned when SELinux is running in enforcing mode. <computeroutput>Policy from config file: targeted</computeroutput> is returned when the SELinux targeted policy is used." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /var/www/html/testfile</" -"command> command to create a file." +msgid "As the Linux root user, run the <command>touch /var/www/html/testfile</command> command to create a file." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/testfile</command> command to view the " -"SELinux context:" +msgid "Run the <command>ls -Z /var/www/html/testfile</command> command to view the SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users run unconfined in Fedora, which is why the " -"<filename>testfile</filename> file is labeled with the SELinux " -"<computeroutput>unconfined_u</computeroutput> user. RBAC is used for " -"processes, not files. Roles do not have a meaning for files - the " -"<computeroutput>object_r</computeroutput> role is a generic role used for " -"files (on persistent storage and network file systems). Under the <filename>/" -"proc/</filename> directory, files related to processes may use the " -"<computeroutput>system_r</computeroutput> role.<footnote> <para> When using " -"other policies, such as MLS, other roles may be used, for example, " -"<computeroutput>secadm_r</computeroutput>. </para> </footnote> The " -"<computeroutput>httpd_sys_content_t</computeroutput> type allows the " -"<systemitem class="daemon">httpd</systemitem> process to access this file." +msgid "By default, Linux users run unconfined in Fedora, which is why the <filename>testfile</filename> file is labeled with the SELinux <computeroutput>unconfined_u</computeroutput> user. RBAC is used for processes, not files. Roles do not have a meaning for files - the <computeroutput>object_r</computeroutput> role is a generic role used for files (on persistent storage and network file systems). Under the <filename>/proc/</filename> directory, files related to processes may use the <computeroutput>system_r</computeroutput> role.<footnote> <para> When using other policies, such as MLS, other roles may be used, for example, <computeroutput>secadm_r</computeroutput>. </para> </footnote> The <computeroutput>httpd_sys_content_t</computeroutput> type allows the <systemitem class="daemon">httpd</systemitem> process to access this file." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>service httpd start</command> " -"command to start the <systemitem class="daemon">httpd</systemitem> " -"process. The output is as follows if <systemitem class="daemon">httpd</" -"systemitem> starts successfully:" +msgid "As the Linux root user, run the <command>service httpd start</command> command to start the <systemitem class="daemon">httpd</systemitem> process. The output is as follows if <systemitem class="daemon">httpd</systemitem> starts successfully:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Change into a directory where your Linux user has write access to, and run " -"the <command>wget http://localhost/testfile</command> command. Unless there " -"are changes to the default configuration, this command succeeds:" +msgid "Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/testfile</command> command. Unless there are changes to the default configuration, this command succeeds:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>chcon</command> command relabels files; however, such label " -"changes do not survive when the file system is relabeled. For permanent " -"changes that survive a file system relabel, use the <command>semanage</" -"command> command, which is discussed later. As the Linux root user, run the " -"following command to change the type to a type used by Samba:" +msgid "The <command>chcon</command> command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the <command>semanage</command> command, which is discussed later. As the Linux root user, run the following command to change the type to a type used by Samba:" msgstr ""

#. Tag: para @@ -158,66 +92,37 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/testfile</command> command to view the " -"changes:" +msgid "Run the <command>ls -Z /var/www/html/testfile</command> command to view the changes:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Note: the current DAC permissions allow the <systemitem class="daemon" -"">httpd</systemitem> process access to <filename>testfile</filename>. " -"Change into a directory where your Linux user has write access to, and run " -"the <command>wget http://localhost/testfile</command> command. Unless there " -"are changes to the default configuration, this command fails:" +msgid "Note: the current DAC permissions allow the <systemitem class="daemon">httpd</systemitem> process access to <filename>testfile</filename>. Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/testfile</command> command. Unless there are changes to the default configuration, this command fails:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>rm -i /var/www/html/testfile</" -"command> command to remove <filename>testfile</filename>." +msgid "As the Linux root user, run the <command>rm -i /var/www/html/testfile</command> command to remove <filename>testfile</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you do not require <systemitem class="daemon">httpd</systemitem> to be " -"running, as the Linux root user, run the <command>service httpd stop</" -"command> command to stop <systemitem class="daemon">httpd</systemitem>:" +msgid "If you do not require <systemitem class="daemon">httpd</systemitem> to be running, as the Linux root user, run the <command>service httpd stop</command> command to stop <systemitem class="daemon">httpd</systemitem>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This example demonstrates the additional security added by SELinux. Although " -"DAC rules allowed the <systemitem class="daemon">httpd</systemitem> " -"process access to <filename>testfile</filename> in step 7, because the file " -"was labeled with a type that the <systemitem class="daemon">httpd</" -"systemitem> process does not have access to, SELinux denied access. After " -"step 7, an error similar to the following is logged to <filename>/var/log/" -"messages</filename>:" +msgid "This example demonstrates the additional security added by SELinux. Although DAC rules allowed the <systemitem class="daemon">httpd</systemitem> process access to <filename>testfile</filename> in step 7, because the file was labeled with a type that the <systemitem class="daemon">httpd</systemitem> process does not have access to, SELinux denied access. After step 7, an error similar to the following is logged to <filename>/var/log/messages</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Previous log files may use a <filename>/var/log/messages." -"<replaceable>YYYYMMDD</replaceable></filename> format. When running " -"<application>syslog-ng</application>, previous log files may use a " -"<filename>/var/log/messages.<replaceable>X</replaceable></filename> format. " -"If the <systemitem class="daemon">setroubleshootd</systemitem> and " -"<systemitem class="daemon">auditd</systemitem> processes are running, " -"errors similar to the following are logged to <filename>/var/log/audit/audit." -"log</filename>:" +msgid "Previous log files may use a <filename>/var/log/messages.<replaceable>YYYYMMDD</replaceable></filename> format. When running <application>syslog-ng</application>, previous log files may use a <filename>/var/log/messages.<replaceable>X</replaceable></filename> format. If the <systemitem class="daemon">setroubleshootd</systemitem> and <systemitem class="daemon">auditd</systemitem> processes are running, errors similar to the following are logged to <filename>/var/log/audit/audit.log</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Also, an error similar to the following is logged to <filename>/var/log/" -"httpd/error_log</filename>:" +msgid "Also, an error similar to the following is logged to <filename>/var/log/httpd/error_log</filename>:" msgstr ""

#. Tag: title @@ -227,65 +132,27 @@

#. Tag: para #, no-c-format -msgid "" -"Unconfined processes run in unconfined domains, for example, init programs " -"run in the unconfined <computeroutput>initrc_t</computeroutput> domain, " -"unconfined kernel processes run in the <computeroutput>kernel_t</" -"computeroutput> domain, and unconfined Linux users run in the " -"<computeroutput>unconfined_t</computeroutput> domain. For unconfined " -"processes, SELinux policy rules are applied, but policy rules exist that " -"allow processes running in unconfined domains almost all access. Processes " -"running in unconfined domains fall back to using DAC rules exclusively. If " -"an unconfined process is compromised, SELinux does not prevent an attacker " -"from gaining access to system resources and data, but of course, DAC rules " -"are still used. SELinux is a security enhancement on top of DAC rules - it " -"does not replace them." +msgid "Unconfined processes run in unconfined domains, for example, init programs run in the unconfined <computeroutput>initrc_t</computeroutput> domain, unconfined kernel processes run in the <computeroutput>kernel_t</computeroutput> domain, and unconfined Linux users run in the <computeroutput>unconfined_t</computeroutput> domain. For unconfined processes, SELinux policy rules are applied, but policy rules exist that allow processes running in unconfined domains almost all access. Processes running in unconfined domains fall back to using DAC rules exclusively. If an unconfined process is compromised, SELinux does not prevent an attacker from gaining access to system resources and data, but of course, DAC rules are still used. SELinux is a security enhancement on top of DAC rules - it does not replace them." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates how the Apache HTTP Server (<systemitem " -"class="daemon">httpd</systemitem>) can access data intended for use by " -"Samba, when running unconfined. Note: in Fedora, the <systemitem class=" -""daemon">httpd</systemitem> process runs in the confined " -"<computeroutput>httpd_t</computeroutput> domain by default. This is an " -"example, and should not be used in production. It assumes that the " -"<package>httpd</package>, <package>wget</package>, <package>setroubleshoot-" -"server</package>, <package>dbus</package> and <package>audit</package> " -"packages are installed, that the SELinux targeted policy is used, and that " -"SELinux is running in enforcing mode:" +msgid "The following example demonstrates how the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) can access data intended for use by Samba, when running unconfined. Note: in Fedora, the <systemitem class="daemon">httpd</systemitem> process runs in the confined <computeroutput>httpd_t</computeroutput> domain by default. This is an example, and should not be used in production. It assumes that the <package>httpd</package>, <package>wget</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /var/www/html/test2file</" -"command> command to create a file." +msgid "As the Linux root user, run the <command>touch /var/www/html/test2file</command> command to create a file." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/test2file</command> command to view the " -"SELinux context:" +msgid "Run the <command>ls -Z /var/www/html/test2file</command> command to view the SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users run unconfined in Fedora, which is why the " -"<filename>test2file</filename> file is labeled with the SELinux " -"<computeroutput>unconfined_u</computeroutput> user. RBAC is used for " -"processes, not files. Roles do not have a meaning for files - the " -"<computeroutput>object_r</computeroutput> role is a generic role used for " -"files (on persistent storage and network file systems). Under the <filename>/" -"proc/</filename> directory, files related to processes may use the " -"<computeroutput>system_r</computeroutput> role.<footnote> <para> When using " -"other policies, such as MLS, other roles may also be used, for example, " -"<computeroutput>secadm_r</computeroutput>. </para> </footnote> The " -"<computeroutput>httpd_sys_content_t</computeroutput> type allows the " -"<systemitem class="daemon">httpd</systemitem> process to access this file." +msgid "By default, Linux users run unconfined in Fedora, which is why the <filename>test2file</filename> file is labeled with the SELinux <computeroutput>unconfined_u</computeroutput> user. RBAC is used for processes, not files. Roles do not have a meaning for files - the <computeroutput>object_r</computeroutput> role is a generic role used for files (on persistent storage and network file systems). Under the <filename>/proc/</filename> directory, files related to processes may use the <computeroutput>system_r</computeroutput> role.<footnote> <para> When using other policies, such as MLS, other roles may also be used, for example, <computeroutput>secadm_r</computeroutput>. </para> </footnote> The <computeroutput>httpd_sys_content_t</computeroutput> type allows the <systemitem class="daemon">httpd</systemitem> process to access this file." msgstr ""

#. Tag: para @@ -295,33 +162,22 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/test2file</command> command to view the " -"changes:" +msgid "Run the <command>ls -Z /var/www/html/test2file</command> command to view the changes:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>service httpd status</command> command to confirm that the " -"<systemitem class="daemon">httpd</systemitem> process is not running:" +msgid "Run the <command>service httpd status</command> command to confirm that the <systemitem class="daemon">httpd</systemitem> process is not running:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If the output differs, run the <command>service httpd stop</command> command " -"as the Linux root user to stop the <systemitem class="daemon">httpd</" -"systemitem> process:" +msgid "If the output differs, run the <command>service httpd stop</command> command as the Linux root user to stop the <systemitem class="daemon">httpd</systemitem> process:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To make the <systemitem class="daemon">httpd</systemitem> process run " -"unconfined, run the following command as the Linux root user to change the " -"type of <filename>/usr/sbin/httpd</filename>, to a type that does not " -"transition to a confined domain:" +msgid "To make the <systemitem class="daemon">httpd</systemitem> process run unconfined, run the following command as the Linux root user to change the type of <filename>/usr/sbin/httpd</filename>, to a type that does not transition to a confined domain:" msgstr ""

#. Tag: para @@ -331,83 +187,47 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that " -"<filename>/usr/sbin/httpd</filename> is labeled with the " -"<computeroutput>unconfined_exec_t</computeroutput> type:" +msgid "Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that <filename>/usr/sbin/httpd</filename> is labeled with the <computeroutput>unconfined_exec_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ps -eZ | grep httpd</command> command to view the " -"<systemitem class="daemon">httpd</systemitem> running in the " -"<computeroutput>unconfined_t</computeroutput> domain:" +msgid "Run the <command>ps -eZ | grep httpd</command> command to view the <systemitem class="daemon">httpd</systemitem> running in the <computeroutput>unconfined_t</computeroutput> domain:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Change into a directory where your Linux user has write access to, and run " -"the <command>wget http://localhost/test2file</command> command. Unless there " -"are changes to the default configuration, this command succeeds:" +msgid "Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/test2file</command> command. Unless there are changes to the default configuration, this command succeeds:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Although the <systemitem class="daemon">httpd</systemitem> process does " -"not have access to files labeled with the <computeroutput>samba_share_t</" -"computeroutput> type, <systemitem class="daemon">httpd</systemitem> is " -"running in the unconfined <computeroutput>unconfined_t</computeroutput> " -"domain, and falls back to using DAC rules, and as such, the <command>wget</" -"command> command succeeds. Had <systemitem class="daemon">httpd</" -"systemitem> been running in the confined <computeroutput>httpd_t</" -"computeroutput> domain, the <command>wget</command> command would have " -"failed." +msgid "Although the <systemitem class="daemon">httpd</systemitem> process does not have access to files labeled with the <computeroutput>samba_share_t</computeroutput> type, <systemitem class="daemon">httpd</systemitem> is running in the unconfined <computeroutput>unconfined_t</computeroutput> domain, and falls back to using DAC rules, and as such, the <command>wget</command> command succeeds. Had <systemitem class="daemon">httpd</systemitem> been running in the confined <computeroutput>httpd_t</computeroutput> domain, the <command>wget</command> command would have failed." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>restorecon</command> command restores the default SELinux " -"context for files. As the Linux root user, run the <command>restorecon -v /" -"usr/sbin/httpd</command> command to restore the default SELinux context for " -"<filename>/usr/sbin/httpd</filename>:" +msgid "The <command>restorecon</command> command restores the default SELinux context for files. As the Linux root user, run the <command>restorecon -v /usr/sbin/httpd</command> command to restore the default SELinux context for <filename>/usr/sbin/httpd</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that " -"<filename>/usr/sbin/httpd</filename> is labeled with the " -"<computeroutput>httpd_exec_t</computeroutput> type:" +msgid "Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that <filename>/usr/sbin/httpd</filename> is labeled with the <computeroutput>httpd_exec_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/service httpd restart</" -"command> command to restart <systemitem class="daemon">httpd</systemitem>. " -"After restarting, run the <command>ps -eZ | grep httpd</command> to confirm " -"that <systemitem class="daemon">httpd</systemitem> is running in the " -"confined <computeroutput>httpd_t</computeroutput> domain:" +msgid "As the Linux root user, run the <command>/sbin/service httpd restart</command> command to restart <systemitem class="daemon">httpd</systemitem>. After restarting, run the <command>ps -eZ | grep httpd</command> to confirm that <systemitem class="daemon">httpd</systemitem> is running in the confined <computeroutput>httpd_t</computeroutput> domain:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>rm -i /var/www/html/test2file</" -"command> command to remove <filename>test2file</filename>." +msgid "As the Linux root user, run the <command>rm -i /var/www/html/test2file</command> command to remove <filename>test2file</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The examples in these sections demonstrate how data can be protected from a " -"compromised confined-process (protected by SELinux), as well as how data is " -"more accessible to an attacker from a compromised unconfined-process (not " -"protected by SELinux)." +msgid "The examples in these sections demonstrate how data can be protected from a compromised confined-process (protected by SELinux), as well as how data is more accessible to an attacker from a compromised unconfined-process (not protected by SELinux)." msgstr ""

#. Tag: title @@ -417,84 +237,47 @@

#. Tag: para #, no-c-format -msgid "" -"Each Linux user is mapped to an SELinux user via SELinux policy. This allows " -"Linux users to inherit the restrictions on SELinux users. This Linux user " -"mapping is seen by running the <command>semanage login -l</command> command " -"as the Linux root user:" +msgid "Each Linux user is mapped to an SELinux user via SELinux policy. This allows Linux users to inherit the restrictions on SELinux users. This Linux user mapping is seen by running the <command>semanage login -l</command> command as the Linux root user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux " -"<computeroutput>__default__</computeroutput> login by default (which is " -"mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). " -"The following defines the default-mapping:" +msgid "In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). The following defines the default-mapping:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates adding a new Linux user, and that Linux " -"user being mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user. It assumes that the Linux root user is running " -"unconfined, as it does by default in Fedora&nbsp;&PRODVER;:" +msgid "The following example demonstrates adding a new Linux user, and that Linux user being mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user. It assumes that the Linux root user is running unconfined, as it does by default in Fedora&nbsp;&PRODVER;:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> " -"command to create a new Linux user named newuser." +msgid "As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> command to create a new Linux user named newuser." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>passwd newuser</command> command to " -"assign a password to the Linux newuser user:" +msgid "As the Linux root user, run the <command>passwd newuser</command> command to assign a password to the Linux newuser user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Log out of your current session, and log in as the Linux newuser user. When " -"you log in, pam_selinux maps the Linux user to an SELinux user (in this " -"case, unconfined_u), and sets up the resulting SELinux context. The Linux " -"user's shell is then launched with this context. Run the <command>id -Z</" -"command> command to view the context of a Linux user:" +msgid "Log out of your current session, and log in as the Linux newuser user. When you log in, pam_selinux maps the Linux user to an SELinux user (in this case, unconfined_u), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run the <command>id -Z</command> command to view the context of a Linux user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Log out of the Linux newuser's session, and log in with your account. If you " -"do not want the Linux newuser user, run the <command>/usr/sbin/userdel -r " -"newuser</command> command as the Linux root user to remove it, along with " -"the Linux newuser's home directory." +msgid "Log out of the Linux newuser's session, and log in with your account. If you do not want the Linux newuser user, run the <command>/usr/sbin/userdel -r newuser</command> command as the Linux root user to remove it, along with the Linux newuser's home directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Confined and unconfined Linux users are subject to executable and writeable " -"memory checks, and are also restricted by MCS (and MLS, if the MLS policy is " -"used). If unconfined Linux users execute an application that SELinux policy " -"defines can transition from the <computeroutput>unconfined_t</" -"computeroutput> domain to its own confined domain, unconfined Linux users " -"are still subject to the restrictions of that confined domain. The security " -"benefit of this is that, even though a Linux user is running unconfined, the " -"application remains confined, and therefore, the exploitation of a flaw in " -"the application can be limited by policy. Note: this does not protect the " -"system from the user. Instead, the user and the system are being protected " -"from possible damage caused by a flaw in the application." +msgid "Confined and unconfined Linux users are subject to executable and writeable memory checks, and are also restricted by MCS (and MLS, if the MLS policy is used). If unconfined Linux users execute an application that SELinux policy defines can transition from the <computeroutput>unconfined_t</computeroutput> domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy. Note: this does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following confined SELinux users are available in Fedora&nbsp;&PRODVER;:" +msgid "The following confined SELinux users are available in Fedora&nbsp;&PRODVER;:" msgstr ""

#. Tag: title @@ -599,69 +382,35 @@

#. Tag: para #, no-c-format -msgid "" -"Linux users in the <computeroutput>guest_t</computeroutput>, " -"<computeroutput>xguest_t</computeroutput>, and <computeroutput>user_t</" -"computeroutput> domains can only run set user ID (setuid) applications if " -"SELinux policy permits it (such as <command>passwd</command>). They can not " -"run the <command>su</command> and <command>/usr/bin/sudo</command> setuid " -"applications, and therefore, can not use these applications to become the " -"Linux root user." +msgid "Linux users in the <computeroutput>guest_t</computeroutput>, <computeroutput>xguest_t</computeroutput>, and <computeroutput>user_t</computeroutput> domains can only run set user ID (setuid) applications if SELinux policy permits it (such as <command>passwd</command>). They can not run the <command>su</command> and <command>/usr/bin/sudo</command> setuid applications, and therefore, can not use these applications to become the Linux root user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Linux users in the <computeroutput>guest_t</computeroutput> domain have no " -"network access, and can only log in via a terminal (including <systemitem " -"class="daemon">ssh</systemitem>; they can log in via <systemitem class=" -""daemon">ssh</systemitem>, but can not use <systemitem class="daemon" -"">ssh</systemitem> to connect to another system)." +msgid "Linux users in the <computeroutput>guest_t</computeroutput> domain have no network access, and can only log in via a terminal (including <systemitem class="daemon">ssh</systemitem>; they can log in via <systemitem class="daemon">ssh</systemitem>, but can not use <systemitem class="daemon">ssh</systemitem> to connect to another system)." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The only network access Linux users in the <computeroutput>xguest_t</" -"computeroutput> domain have is <application>Firefox</application> connecting " -"to web pages." +msgid "The only network access Linux users in the <computeroutput>xguest_t</computeroutput> domain have is <application>Firefox</application> connecting to web pages." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Linux users in the <computeroutput>xguest_t</computeroutput>, " -"<computeroutput>user_t</computeroutput> and <computeroutput>staff_t</" -"computeroutput> domains can log in via the X Window System and a terminal." +msgid "Linux users in the <computeroutput>xguest_t</computeroutput>, <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can log in via the X Window System and a terminal." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users in the <computeroutput>staff_t</computeroutput> " -"domain do not have permissions to execute applications with <command>/usr/" -"bin/sudo</command>. These permissions must be configured by an administrator." +msgid "By default, Linux users in the <computeroutput>staff_t</computeroutput> domain do not have permissions to execute applications with <command>/usr/bin/sudo</command>. These permissions must be configured by an administrator." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users in the <computeroutput>guest_t</computeroutput> and " -"<computeroutput>xguest_t</computeroutput> domains can not execute " -"applications in their home directories or <filename>/tmp/</filename>, " -"preventing them from executing applications (which inherit users' " -"permissions) in directories they have write access to. This helps prevent " -"flawed or malicious applications from modifying files users' own." +msgid "By default, Linux users in the <computeroutput>guest_t</computeroutput> and <computeroutput>xguest_t</computeroutput> domains can not execute applications in their home directories or <filename>/tmp/</filename>, preventing them from executing applications (which inherit users' permissions) in directories they have write access to. This helps prevent flawed or malicious applications from modifying files users' own." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users in the <computeroutput>user_t</computeroutput> and " -"<computeroutput>staff_t</computeroutput> domains can execute applications in " -"their home directories and <filename>/tmp/</filename>. Refer to <xref " -"linkend="sect-Security-Enhanced_Linux-Confining_Users-" -"Booleans_for_Users_Executing_Applications" /> for information about " -"allowing and preventing users from executing applications in their home " -"directories and <filename>/tmp/</filename>." +msgid "By default, Linux users in the <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can execute applications in their home directories and <filename>/tmp/</filename>. Refer to <xref linkend="sect-Security-Enhanced_Linux-Confining_Users-Booleans_for_Users_Executing_Applications" /> for information about allowing and preventing users from executing applications in their home directories and <filename>/tmp/</filename>." msgstr ""

Modified: community/branches/f13/fr-FR/Trademarks.po =================================================================== --- community/branches/f13/fr-FR/Trademarks.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Trademarks.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,72 +1,60 @@ -# SOME DESCRIPTIVE TITLE. -# FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy +# Nicolas Maître nimai@fedoraproject.org, 2010. +# msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" -"Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" +"Project-Id-Version: fr\n" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-08-20 23:39+0100\n" +"Last-Translator: Nicolas Maître nimai@fedoraproject.org\n" +"Language-Team: French trans-fr@lists.fedoraproject.org\n" +"Language: fr\n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"Plural-Forms: nplurals=2; plural=(n > 1);\n"

#. Tag: title #, no-c-format msgid "Trademark Information" -msgstr "" +msgstr "Informations sur les marques déposées"

#. Tag: para #, no-c-format -msgid "" -"<trademark class="registered">Linux</trademark> is the registered " -"trademark of Linus Torvalds in the U.S. and other countries." -msgstr "" +msgid "<trademark class="registered">Linux</trademark> is the registered trademark of Linus Torvalds in the U.S. and other countries." +msgstr "<trademark class="registered">Linux</trademark> est la marque déposée de Linus Torvalds aux États-Unis et dans d’autres pays."

#. Tag: para #, no-c-format msgid "UNIX is a registered trademark of The Open Group." -msgstr "" +msgstr "UNIX est une marque déposée de l’Open Group."

#. Tag: para #, no-c-format -msgid "" -"Type Enforcement is a trademark of Secure Computing, LLC, a wholly owned " -"subsidiary of McAfee, Inc., registered in the U.S. and in other countries. " -"Neither McAfee nor Secure Computing, LLC, has consented to the use or " -"reference to this trademark by the author outside of this guide." -msgstr "" +msgid "Type Enforcement is a trademark of Secure Computing, LLC, a wholly owned subsidiary of McAfee, Inc., registered in the U.S. and in other countries. Neither McAfee nor Secure Computing, LLC, has consented to the use or reference to this trademark by the author outside of this guide." +msgstr "Type Enforcement est une marque de Secure Computing, LLC, une filiale détenue à 100% par McAfee, Inc., déposée aux États-Unis et dans d’autres pays. Ni McAfee, ni Secure Computing, LLC n’a consenti à l’usage ou à la référence à cette marque par l’auteur en dehors de ce guide."

#. Tag: para #, no-c-format msgid "Apache is a trademark of The Apache Software Foundation." -msgstr "" +msgstr "Apache est une marque déposée de The Apache Software Foundation."

#. Tag: para #, no-c-format -msgid "" -"MySQL is a trademark or registered trademark of MySQL AB in the U.S. and " -"other countries." -msgstr "" +msgid "MySQL is a trademark or registered trademark of MySQL AB in the U.S. and other countries." +msgstr "MySQL est une marque déposée de MySQL AB aux États-Unis et dans d’autres pays."

#. Tag: para #, no-c-format -msgid "" -"Other products mentioned may be trademarks of their respective corporations." -msgstr "" +msgid "Other products mentioned may be trademarks of their respective corporations." +msgstr "Les autres produits mentionnés peuvent être des marques de leurs sociétés respectives."

#. Tag: title #, no-c-format msgid "Source Code" -msgstr "" +msgstr "Code source"

#. Tag: para #, no-c-format -msgid "" -"The XML source for this guide is available at <ulink url="http://svn." -"fedorahosted.org/svn/selinuxguide/">http://svn.fedorahosted.org/svn/" -"selinuxguide/</ulink>" -msgstr "" +msgid "The XML source for this guide is available at <ulink url="http://svn.fedorahosted.org/svn/selinuxguide/%5C%22%3Ehttp://svn.fedorahoste...</ulink>" +msgstr "Les sources XML de ce guide sont disponibles sur <ulink url="http://svn.fedorahosted.org/svn/selinuxguide/%5C%22%3Ehttp://svn.fedorahoste...</ulink>."

Modified: community/branches/f13/fr-FR/Troubleshooting.po =================================================================== --- community/branches/f13/fr-FR/Troubleshooting.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Troubleshooting.po 2010-11-21 23:12:12 UTC (rev 492) @@ -10,6 +10,7 @@ "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME EMAIL@ADDRESS\n" "Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: application/x-xml2pot; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -21,11 +22,7 @@

#. Tag: para #, no-c-format -msgid "" -"The following chapter describes what happens when SELinux denies access; the " -"top three causes of problems; where to find information about correct " -"labeling; analyzing SELinux denials; and creating custom policy modules with " -"<command>audit2allow</command>." +msgid "The following chapter describes what happens when SELinux denies access; the top three causes of problems; where to find information about correct labeling; analyzing SELinux denials; and creating custom policy modules with <command>audit2allow</command>." msgstr ""

#. Tag: title @@ -35,12 +32,7 @@

#. Tag: para #, no-c-format -msgid "" -"SELinux decisions, such as allowing or disallowing access, are cached. This " -"cache is known as the Access Vector Cache (AVC). Denial messages are logged " -"when SELinux denies access. These denials are also known as "AVC denials", " -"and are logged to a different location, depending on which daemons are " -"running:" +msgid "SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). Denial messages are logged when SELinux denies access. These denials are also known as "AVC denials", and are logged to a different location, depending on which daemons are running:" msgstr ""

#. Tag: segtitle @@ -80,40 +72,22 @@

#. Tag: seg #, no-c-format -msgid "" -"<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial " -"messages also sent to <filename>/var/log/messages</filename>" +msgid "<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial messages also sent to <filename>/var/log/messages</filename>" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you are running the X Window System, have the <package>setroubleshoot</" -"package> and <package>setroubleshoot-server</package> packages installed, " -"and the <systemitem class="daemon">setroubleshootd</systemitem> and " -"<systemitem class="daemon">auditd</systemitem> daemons are running, a " -"warning is displayed when access is denied by SELinux:" +msgid "If you are running the X Window System, have the <package>setroubleshoot</package> and <package>setroubleshoot-server</package> packages installed, and the <systemitem class="daemon">setroubleshootd</systemitem> and <systemitem class="daemon">auditd</systemitem> daemons are running, a warning is displayed when access is denied by SELinux:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Clicking on 'Show' presents a detailed analysis of why SELinux denied " -"access, and a possible solution for allowing access. If you are not running " -"the X Window System, it is less obvious when access is denied by SELinux. " -"For example, users browsing your website may receive an error similar to the " -"following:" +msgid "Clicking on 'Show' presents a detailed analysis of why SELinux denied access, and a possible solution for allowing access. If you are not running the X Window System, it is less obvious when access is denied by SELinux. For example, users browsing your website may receive an error similar to the following:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For these situations, if DAC rules (standard Linux permissions) allow " -"access, check <filename>/var/log/messages</filename> and <filename>/var/log/" -"audit/audit.log</filename> for <computeroutput>"SELinux is preventing"</" -"computeroutput> and <computeroutput>"denied"</computeroutput> errors " -"respectively. This can be done by running the following commands as the " -"Linux root user:" +msgid "For these situations, if DAC rules (standard Linux permissions) allow access, check <filename>/var/log/messages</filename> and <filename>/var/log/audit/audit.log</filename> for <computeroutput>"SELinux is preventing"</computeroutput> and <computeroutput>"denied"</computeroutput> errors respectively. This can be done by running the following commands as the Linux root user:" msgstr ""

#. Tag: para @@ -133,10 +107,7 @@

#. Tag: para #, no-c-format -msgid "" -"The following sections describe the top three causes of problems: labeling " -"problems, configuring Booleans and ports for services, and evolving SELinux " -"rules." +msgid "The following sections describe the top three causes of problems: labeling problems, configuring Booleans and ports for services, and evolving SELinux rules." msgstr ""

#. Tag: title @@ -146,54 +117,22 @@

#. Tag: para #, no-c-format -msgid "" -"On systems running SELinux, all processes and files are labeled with a label " -"that contains security-relevant information. This information is called the " -"SELinux context. If these labels are wrong, access may be denied. If an " -"application is labeled incorrectly, the process it transitions to may not " -"have the correct label, possibly causing SELinux to deny access, and the " -"process being able to create mislabeled files." +msgid "On systems running SELinux, all processes and files are labeled with a label that contains security-relevant information. This information is called the SELinux context. If these labels are wrong, access may be denied. If an application is labeled incorrectly, the process it transitions to may not have the correct label, possibly causing SELinux to deny access, and the process being able to create mislabeled files." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"A common cause of labeling problems is when a non-standard directory is used " -"for a service. For example, instead of using <filename>/var/www/html/</" -"filename> for a website, an administrator wants to use <filename>/srv/myweb/" -"</filename>. On Fedora&nbsp;&PRODVER;, the <filename>/srv/</filename> " -"directory is labeled with the <computeroutput>var_t</computeroutput> type. " -"Files and directories created and <filename>/srv/</filename> inherit this " -"type. Also, newly-created top-level directories (such as <filename>/myserver/" -"</filename>) may be labeled with the <computeroutput>default_t</" -"computeroutput> type. SELinux prevents the Apache HTTP Server (<systemitem " -"class="daemon">httpd</systemitem>) from accessing both of these types. To " -"allow access, SELinux must know that the files in <filename>/srv/myweb/</" -"filename> are to be accessible to <systemitem class="daemon">httpd</" -"systemitem>:" +msgid "A common cause of labeling problems is when a non-standard directory is used for a service. For example, instead of using <filename>/var/www/html/</filename> for a website, an administrator wants to use <filename>/srv/myweb/</filename>. On Fedora&nbsp;&PRODVER;, the <filename>/srv/</filename> directory is labeled with the <computeroutput>var_t</computeroutput> type. Files and directories created and <filename>/srv/</filename> inherit this type. Also, newly-created top-level directories (such as <filename>/myserver/</filename>) may be labeled with the <computeroutput>default_t</computeroutput> type. SELinux prevents the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) from accessing both of these types. To allow access, SELinux must know that the files in <filename>/srv/myweb/</filename> are to be accessible to <systemitem class="daemon">httpd</systemitem>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This <command>semanage</command> command adds the context for the <filename>/" -"srv/myweb/</filename> directory (and all files and directories under it) to " -"the SELinux file-context configuration<footnote> <para> Files in <filename>/" -"etc/selinux/targeted/contexts/files/</filename> define contexts for files " -"and directories. Files in this directory are read by <command>restorecon</" -"command> and <command>setfiles</command> to restore files and directories to " -"their default contexts. </para> </footnote>. The <command>semanage</command> " -"command does not change the context. As the Linux root user, run the " -"<command>restorecon</command> command to apply the changes:" +msgid "This <command>semanage</command> command adds the context for the <filename>/srv/myweb/</filename> directory (and all files and directories under it) to the SELinux file-context configuration<footnote> <para> Files in <filename>/etc/selinux/targeted/contexts/files/</filename> define contexts for files and directories. Files in this directory are read by <command>restorecon</command> and <command>setfiles</command> to restore files and directories to their default contexts. </para> </footnote>. The <command>semanage</command> command does not change the context. As the Linux root user, run the <command>restorecon</command> command to apply the changes:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to <xref linkend="sect-Security-Enhanced_Linux-" -"SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> " -"for further information about adding contexts to the file-context " -"configuration." +msgid "Refer to <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> for further information about adding contexts to the file-context configuration." msgstr ""

#. Tag: title @@ -203,39 +142,22 @@

#. Tag: para #, no-c-format -msgid "" -"The <command>matchpathcon</command> command checks the context of a file " -"path and compares it to the default label for that path. The following " -"example demonstrates using <command>matchpathcon</command> on a directory " -"that contains incorrectly labeled files:" +msgid "The <command>matchpathcon</command> command checks the context of a file path and compares it to the default label for that path. The following example demonstrates using <command>matchpathcon</command> on a directory that contains incorrectly labeled files:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, the <filename>index.html</filename> and <filename>page1." -"html</filename> files are labeled with the <computeroutput>user_home_t</" -"computeroutput> type. This type is used for files in user home directories. " -"Using the <command>mv</command> command to move files from your home " -"directory may result in files being labeled with the " -"<computeroutput>user_home_t</computeroutput> type. This type should not " -"exist outside of home directories. Use the <command>restorecon</command> " -"command to restore such files to their correct type:" +msgid "In this example, the <filename>index.html</filename> and <filename>page1.html</filename> files are labeled with the <computeroutput>user_home_t</computeroutput> type. This type is used for files in user home directories. Using the <command>mv</command> command to move files from your home directory may result in files being labeled with the <computeroutput>user_home_t</computeroutput> type. This type should not exist outside of home directories. Use the <command>restorecon</command> command to restore such files to their correct type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To restore the context for all files under a directory, use the <option>-R</" -"option> option:" +msgid "To restore the context for all files under a directory, use the <option>-R</option> option:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to <xref linkend="sect-Security-Enhanced_Linux-" -"Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context" /> for a " -"more detailed example of <command>matchpathcon</command>." +msgid "Refer to <xref linkend="sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context" /> for a more detailed example of <command>matchpathcon</command>." msgstr ""

#. Tag: title @@ -245,42 +167,22 @@

#. Tag: para #, no-c-format -msgid "" -"Services can be run in a variety of ways. To cater for this, you must tell " -"SELinux how you are running services. This can be achieved via Booleans that " -"allow parts of SELinux policy to be changed at runtime, without any " -"knowledge of SELinux policy writing. This allows changes, such as allowing " -"services access to NFS file systems, without reloading or recompiling " -"SELinux policy. Also, running services on non-default port numbers requires " -"policy configuration to be updated via the <command>semanage</command> " -"command." +msgid "Services can be run in a variety of ways. To cater for this, you must tell SELinux how you are running services. This can be achieved via Booleans that allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing. This allows changes, such as allowing services access to NFS file systems, without reloading or recompiling SELinux policy. Also, running services on non-default port numbers requires policy configuration to be updated via the <command>semanage</command> command." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For example, to allow the Apache HTTP Server to communicate with MySQL, turn " -"the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean on:" +msgid "For example, to allow the Apache HTTP Server to communicate with MySQL, turn the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean on:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If access is denied for a particular service, use the <command>getsebool</" -"command> and <command>grep</command> commands to see if any Booleans are " -"available to allow access. For example, use the <command>getsebool -a | grep " -"ftp</command> command to search for FTP related Booleans:" +msgid "If access is denied for a particular service, use the <command>getsebool</command> and <command>grep</command> commands to see if any Booleans are available to allow access. For example, use the <command>getsebool -a | grep ftp</command> command to search for FTP related Booleans:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For a list of Booleans and whether they are on or off, run the <command>/usr/" -"sbin/getsebool -a</command> command. For a list of Booleans, an explanation " -"of what each one is, and whether they are on or off, run the <command>/usr/" -"sbin/semanage boolean -l</command> command as the Linux root user. Refer to " -"<xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans" -"" /> for information about listing and configuring Booleans." +msgid "For a list of Booleans and whether they are on or off, run the <command>/usr/sbin/getsebool -a</command> command. For a list of Booleans, an explanation of what each one is, and whether they are on or off, run the <command>/usr/sbin/semanage boolean -l</command> command as the Linux root user. Refer to <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans" /> for information about listing and configuring Booleans." msgstr ""

#. Tag: title @@ -290,52 +192,27 @@

#. Tag: para #, no-c-format -msgid "" -"Depending on policy configuration, services may only be allowed to run on " -"certain port numbers. Attempting to change the port a service runs on " -"without changing policy may result in the service failing to start. For " -"example, run the <command>semanage port -l | grep http</command> command as " -"the Linux root user to list <systemitem class="daemon">http</systemitem> " -"related ports:" +msgid "Depending on policy configuration, services may only be allowed to run on certain port numbers. Attempting to change the port a service runs on without changing policy may result in the service failing to start. For example, run the <command>semanage port -l | grep http</command> command as the Linux root user to list <systemitem class="daemon">http</systemitem> related ports:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>http_port_t</computeroutput> port type defines the ports " -"Apache HTTP Server can listen on, which in this case, are TCP ports 80, 443, " -"488, 8008, 8009, and 8443. If an administrator configures <filename>httpd." -"conf</filename> so that <systemitem class="daemon">httpd</systemitem> " -"listens on port 9876 (<option>Listen 9876</option>), but policy is not " -"updated to reflect this, the <command>service httpd start</command> command " -"fails:" +msgid "The <computeroutput>http_port_t</computeroutput> port type defines the ports Apache HTTP Server can listen on, which in this case, are TCP ports 80, 443, 488, 8008, 8009, and 8443. If an administrator configures <filename>httpd.conf</filename> so that <systemitem class="daemon">httpd</systemitem> listens on port 9876 (<option>Listen 9876</option>), but policy is not updated to reflect this, the <command>service httpd start</command> command fails:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"An SELinux denial similar to the following is logged to <filename>/var/log/" -"audit/audit.log</filename>:" +msgid "An SELinux denial similar to the following is logged to <filename>/var/log/audit/audit.log</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To allow <systemitem class="daemon">httpd</systemitem> to listen on a port " -"that is not listed for the <computeroutput>http_port_t</computeroutput> port " -"type, run the <command>semanage port</command> command to add a port to " -"policy configuration<footnote> <para> The <command>semanage port -a</" -"command> command adds an entry to the <filename>/etc/selinux/targeted/" -"modules/active/ports.local</filename> file. Note: by default, this file can " -"only be viewed by the Linux root user. </para> </footnote>:" +msgid "To allow <systemitem class="daemon">httpd</systemitem> to listen on a port that is not listed for the <computeroutput>http_port_t</computeroutput> port type, run the <command>semanage port</command> command to add a port to policy configuration<footnote> <para> The <command>semanage port -a</command> command adds an entry to the <filename>/etc/selinux/targeted/modules/active/ports.local</filename> file. Note: by default, this file can only be viewed by the Linux root user. </para> </footnote>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <option>-a</option> option adds a new record; the <option>-t</option> " -"option defines a type; and the <option>-p</option> option defines a " -"protocol. The last argument is the port number to add." +msgid "The <option>-a</option> option adds a new record; the <option>-t</option> option defines a type; and the <option>-p</option> option defines a protocol. The last argument is the port number to add." msgstr ""

#. Tag: title @@ -345,23 +222,12 @@

#. Tag: para #, no-c-format -msgid "" -"Applications may be broken, causing SELinux to deny access. Also, SELinux " -"rules are evolving - SELinux may not have seen an application running in a " -"certain way, possibly causing it to deny access, even though the application " -"is working as expected. For example, if a new version of PostgreSQL is " -"released, it may perform actions the current policy has not seen before, " -"causing access to be denied, even though access should be allowed." +msgid "Applications may be broken, causing SELinux to deny access. Also, SELinux rules are evolving - SELinux may not have seen an application running in a certain way, possibly causing it to deny access, even though the application is working as expected. For example, if a new version of PostgreSQL is released, it may perform actions the current policy has not seen before, causing access to be denied, even though access should be allowed." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For these situations, after access is denied, use <command>audit2allow</" -"command> to create a custom policy module to allow access. Refer to <xref " -"linkend="sect-Security-Enhanced_Linux-Fixing_Problems-" -"Allowing_Access_audit2allow" /> for information about using " -"<command>audit2allow</command>." +msgid "For these situations, after access is denied, use <command>audit2allow</command> to create a custom policy module to allow access. Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow" /> for information about using <command>audit2allow</command>." msgstr ""

#. Tag: title @@ -371,14 +237,7 @@

#. Tag: para #, no-c-format -msgid "" -"The following sections help troubleshoot issues. They go over: checking " -"Linux permissions, which are checked before SELinux rules; possible causes " -"of SELinux denying access, but no denials being logged; manual pages for " -"services, which contain information about labeling and Booleans; permissive " -"domains, for allowing one process to run permissive, rather than the whole " -"system; how to search for and view denial messages; analyzing denials; and " -"creating custom policy modules with <command>audit2allow</command>." +msgid "The following sections help troubleshoot issues. They go over: checking Linux permissions, which are checked before SELinux rules; possible causes of SELinux denying access, but no denials being logged; manual pages for services, which contain information about labeling and Booleans; permissive domains, for allowing one process to run permissive, rather than the whole system; how to search for and view denial messages; analyzing denials; and creating custom policy modules with <command>audit2allow</command>." msgstr ""

#. Tag: title @@ -388,50 +247,27 @@

#. Tag: para #, no-c-format -msgid "" -"When access is denied, check standard Linux permissions. As mentioned in " -"<xref linkend="chap-Security-Enhanced_Linux-Introduction" />, most " -"operating systems use a Discretionary Access Control (DAC) system to control " -"access, allowing users to control the permissions of files that they own. " -"SELinux policy rules are checked after DAC rules. SELinux policy rules are " -"not used if DAC rules deny access first." +msgid "When access is denied, check standard Linux permissions. As mentioned in <xref linkend="chap-Security-Enhanced_Linux-Introduction" />, most operating systems use a Discretionary Access Control (DAC) system to control access, allowing users to control the permissions of files that they own. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If access is denied and no SELinux denials are logged, use the <command>ls -" -"l</command> command to view the standard Linux permissions:" +msgid "If access is denied and no SELinux denials are logged, use the <command>ls -l</command> command to view the standard Linux permissions:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, <filename>index.html</filename> is owned by the root user " -"and group. The root user has read and write permissions (<computeroutput>-" -"rw</computeroutput>), and members of the root group have read permissions " -"(<computeroutput>-r-</computeroutput>). Everyone else has no access " -"(<computeroutput>---</computeroutput>). By default, such permissions do not " -"allow <systemitem class="daemon">httpd</systemitem> to read this file. To " -"resolve this issue, use the <command>chown</command> command to change the " -"owner and group. This command must be run as the Linux root user:" +msgid "In this example, <filename>index.html</filename> is owned by the root user and group. The root user has read and write permissions (<computeroutput>-rw</computeroutput>), and members of the root group have read permissions (<computeroutput>-r-</computeroutput>). Everyone else has no access (<computeroutput>---</computeroutput>). By default, such permissions do not allow <systemitem class="daemon">httpd</systemitem> to read this file. To resolve this issue, use the <command>chown</command> command to change the owner and group. This command must be run as the Linux root user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This assumes the default configuration, in which <systemitem class="daemon" -"">httpd</systemitem> runs as the Linux apache user. If you run <systemitem " -"class="daemon">httpd</systemitem> with a different user, replace " -"<computeroutput>apache:apache</computeroutput> with that user." +msgid "This assumes the default configuration, in which <systemitem class="daemon">httpd</systemitem> runs as the Linux apache user. If you run <systemitem class="daemon">httpd</systemitem> with a different user, replace <computeroutput>apache:apache</computeroutput> with that user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://fedoraproject.org/wiki/Docs/Drafts/" -"AdministrationGuide/Permissions">Fedora Documentation Project "Permissions" -""</ulink> draft for information about managing Linux permissions." +msgid "Refer to the <ulink url="http://fedoraproject.org/wiki/Docs/Drafts/AdministrationGuide/Permissions%5C... Documentation Project "Permissions"</ulink> draft for information about managing Linux permissions." msgstr ""

#. Tag: title @@ -441,24 +277,12 @@

#. Tag: para #, no-c-format -msgid "" -"In certain situations, AVC denials may not be logged when SELinux denies " -"access. Applications and system library functions often probe for more " -"access than required to perform their tasks. To maintain least privilege " -"without filling audit logs with AVC denials for harmless application " -"probing, the policy can silence AVC denials without allowing a permission by " -"using <computeroutput>dontaudit</computeroutput> rules. These rules are " -"common in standard policy. The downside of <computeroutput>dontaudit</" -"computeroutput> is that, although SELinux denies access, denial messages are " -"not logged, making troubleshooting hard." +msgid "In certain situations, AVC denials may not be logged when SELinux denies access. Applications and system library functions often probe for more access than required to perform their tasks. To maintain least privilege without filling audit logs with AVC denials for harmless application probing, the policy can silence AVC denials without allowing a permission by using <computeroutput>dontaudit</computeroutput> rules. These rules are common in standard policy. The downside of <computeroutput>dontaudit</computeroutput> is that, although SELinux denies access, denial messages are not logged, making troubleshooting hard." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To temporarily disable <computeroutput>dontaudit</computeroutput> rules, " -"allowing all denials to be logged, run the following command as the Linux " -"root user:" +msgid "To temporarily disable <computeroutput>dontaudit</computeroutput> rules, allowing all denials to be logged, run the following command as the Linux root user:" msgstr ""

#. Tag: para @@ -468,24 +292,12 @@

#. Tag: para #, no-c-format -msgid "" -"The <option>-D</option> option disables <computeroutput>dontaudit</" -"computeroutput> rules; the <option>-B</option> option rebuilds policy. After " -"running <command>semodule -DB</command>, try exercising the application that " -"was encountering permission problems, and see if SELinux denials &mdash; " -"relevant to the application &mdash; are now being logged. Take care in " -"deciding which denials should be allowed, as some should be ignored and " -"handled via <computeroutput>dontaudit</computeroutput> rules. If in doubt, " -"or in search of guidance, contact other SELinux users and developers on an " -"SELinux list, such as <ulink url="http://www.redhat.com/mailman/listinfo/" -"fedora-selinux-list">fedora-selinux-list</ulink>." +msgid "The <option>-D</option> option disables <computeroutput>dontaudit</computeroutput> rules; the <option>-B</option> option rebuilds policy. After running <command>semodule -DB</command>, try exercising the application that was encountering permission problems, and see if SELinux denials &mdash; relevant to the application &mdash; are now being logged. Take care in deciding which denials should be allowed, as some should be ignored and handled via <computeroutput>dontaudit</computeroutput> rules. If in doubt, or in search of guidance, contact other SELinux users and developers on an SELinux list, such as <ulink url="http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-se...</ulink>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To rebuild policy and enable <computeroutput>dontaudit</computeroutput> " -"rules, run the following command as the Linux root user:" +msgid "To rebuild policy and enable <computeroutput>dontaudit</computeroutput> rules, run the following command as the Linux root user:" msgstr ""

#. Tag: para @@ -495,21 +307,12 @@

#. Tag: para #, no-c-format -msgid "" -"This restores the policy to its original state. For a full list of " -"<computeroutput>dontaudit</computeroutput> rules, run the <command>sesearch " -"--dontaudit</command> command. Narrow down searches using the <option>-s " -"<replaceable>domain</replaceable></option> option and the <command>grep</" -"command> command. For example:" +msgid "This restores the policy to its original state. For a full list of <computeroutput>dontaudit</computeroutput> rules, run the <command>sesearch --dontaudit</command> command. Narrow down searches using the <option>-s <replaceable>domain</replaceable></option> option and the <command>grep</command> command. For example:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-" -"Raw_Audit_Messages" /> and <xref linkend="sect-Security-Enhanced_Linux-" -"Fixing_Problems-sealert_Messages" /> for information about analyzing " -"denials." +msgid "Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> and <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" /> for information about analyzing denials." msgstr ""

#. Tag: title @@ -519,13 +322,7 @@

#. Tag: para #, no-c-format -msgid "" -"Manual pages for services contain valuable information, such as what file " -"type to use for a given situation, and Booleans to change the access a " -"service has (such as <systemitem class="daemon">httpd</systemitem> " -"accessing NFS file systems). This information may be in the standard manual " -"page, or a manual page with <computeroutput>selinux</computeroutput> " -"prepended or appended." +msgid "Manual pages for services contain valuable information, such as what file type to use for a given situation, and Booleans to change the access a service has (such as <systemitem class="daemon">httpd</systemitem> accessing NFS file systems). This information may be in the standard manual page, or a manual page with <computeroutput>selinux</computeroutput> prepended or appended." msgstr ""

#. Tag: para @@ -540,11 +337,7 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page has information about what file type to use for a given " -"situation, as well as Booleans to allow scripts, sharing files, accessing " -"directories inside user home directories, and so on. Other manual pages with " -"SELinux information for services include:" +msgid "manual page has information about what file type to use for a given situation, as well as Booleans to allow scripts, sharing files, accessing directories inside user home directories, and so on. Other manual pages with SELinux information for services include:" msgstr ""

#. Tag: para @@ -559,11 +352,7 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes that files and directories to be exported via Samba " -"must be labeled with the <computeroutput>samba_share_t</computeroutput> " -"type, as well as Booleans to allow files labeled with types other than " -"<computeroutput>samba_share_t</computeroutput> to be exported via Samba." +msgid "manual page describes that files and directories to be exported via Samba must be labeled with the <computeroutput>samba_share_t</computeroutput> type, as well as Booleans to allow files labeled with types other than <computeroutput>samba_share_t</computeroutput> to be exported via Samba." msgstr ""

#. Tag: para @@ -578,11 +367,7 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes that, by default, file systems can not be exported via " -"NFS, and that to allow file systems to be exported, Booleans such as " -"<computeroutput>nfs_export_all_ro</computeroutput> or " -"<computeroutput>nfs_export_all_rw</computeroutput> must be turned on." +msgid "manual page describes that, by default, file systems can not be exported via NFS, and that to allow file systems to be exported, Booleans such as <computeroutput>nfs_export_all_ro</computeroutput> or <computeroutput>nfs_export_all_rw</computeroutput> must be turned on." msgstr ""

#. Tag: para @@ -597,10 +382,7 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes what file type to use for a given situation (see the " -"<computeroutput>Red Hat SELinux BIND Security Profile</computeroutput> " -"section). The" +msgid "manual page describes what file type to use for a given situation (see the <computeroutput>Red Hat SELinux BIND Security Profile</computeroutput> section). The" msgstr ""

#. Tag: refentrytitle @@ -610,18 +392,12 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes that, by default, <systemitem class="daemon">named</" -"systemitem> can not write to master zone files, and to allow such access, " -"the <computeroutput>named_write_master_zones</computeroutput> Boolean must " -"be turned on." +msgid "manual page describes that, by default, <systemitem class="daemon">named</systemitem> can not write to master zone files, and to allow such access, the <computeroutput>named_write_master_zones</computeroutput> Boolean must be turned on." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The information in manual pages helps you configure the correct file types " -"and Booleans, helping to prevent SELinux from denying access." +msgid "The information in manual pages helps you configure the correct file types and Booleans, helping to prevent SELinux from denying access." msgstr ""

#. Tag: title @@ -631,64 +407,32 @@

#. Tag: para #, no-c-format -msgid "" -"When SELinux is running in permissive mode, SELinux does not deny access, " -"but denials are logged for actions that would have been denied if running in " -"enforcing mode. Previously, it was not possible to make a single domain " -"permissive (remember: processes run in domains). In certain situations, this " -"led to making the whole system permissive to troubleshoot issues." +msgid "When SELinux is running in permissive mode, SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode. Previously, it was not possible to make a single domain permissive (remember: processes run in domains). In certain situations, this led to making the whole system permissive to troubleshoot issues." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Fedora&nbsp;&PRODVER; includes permissive domains, where an administrator " -"can configure a single process (domain) to run permissive, rather than " -"making the whole system permissive. SELinux checks are still performed for " -"permissive domains; however, the kernel allows access and reports an AVC " -"denial for situations where SELinux would have denied access. Permissive " -"domains are also available in Fedora 9 (with the latest updates applied)." +msgid "Fedora&nbsp;&PRODVER; includes permissive domains, where an administrator can configure a single process (domain) to run permissive, rather than making the whole system permissive. SELinux checks are still performed for permissive domains; however, the kernel allows access and reports an AVC denial for situations where SELinux would have denied access. Permissive domains are also available in Fedora 9 (with the latest updates applied)." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In Red Hat Enterprise Linux 4 and 5, <computeroutput><replaceable>domain</" -"replaceable>_disable_trans</computeroutput> Booleans are available to " -"prevent an application from transitioning to a confined domain, and " -"therefore, the process runs in an unconfined domain, such as " -"<computeroutput>initrc_t</computeroutput>. Turning such Booleans on can " -"cause major problems. For example, if the " -"<computeroutput>httpd_disable_trans</computeroutput> Boolean is turned on:" +msgid "In Red Hat Enterprise Linux 4 and 5, <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> Booleans are available to prevent an application from transitioning to a confined domain, and therefore, the process runs in an unconfined domain, such as <computeroutput>initrc_t</computeroutput>. Turning such Booleans on can cause major problems. For example, if the <computeroutput>httpd_disable_trans</computeroutput> Boolean is turned on:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<systemitem class="daemon">httpd</systemitem> runs in the unconfined " -"<computeroutput>initrc_t</computeroutput> domain. Files created by processes " -"running in the <computeroutput>initrc_t</computeroutput> domain may not have " -"the same labeling rules applied as files created by a process running in the " -"<computeroutput>httpd_t</computeroutput> domain, potentially allowing " -"processes to create mislabeled files. This causes access problems later on." +msgid "<systemitem class="daemon">httpd</systemitem> runs in the unconfined <computeroutput>initrc_t</computeroutput> domain. Files created by processes running in the <computeroutput>initrc_t</computeroutput> domain may not have the same labeling rules applied as files created by a process running in the <computeroutput>httpd_t</computeroutput> domain, potentially allowing processes to create mislabeled files. This causes access problems later on." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"confined domains that are allowed to communicate with " -"<computeroutput>httpd_t</computeroutput> can not communicate with " -"<computeroutput>initrc_t</computeroutput>, possibly causing additional " -"failures." +msgid "confined domains that are allowed to communicate with <computeroutput>httpd_t</computeroutput> can not communicate with <computeroutput>initrc_t</computeroutput>, possibly causing additional failures." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput><replaceable>domain</replaceable>_disable_trans</" -"computeroutput> Booleans were removed from Fedora 7, even though there was " -"no replacement. Permissive domains solve the above issues: transition rules " -"apply, and files are created with the correct labels." +msgid "The <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> Booleans were removed from Fedora 7, even though there was no replacement. Permissive domains solve the above issues: transition rules apply, and files are created with the correct labels." msgstr ""

#. Tag: para @@ -698,22 +442,12 @@

#. Tag: para #, no-c-format -msgid "" -"making a single process (domain) run permissive to troubleshoot an issue, " -"rather than putting the entire system at risk by making the entire system " -"permissive." +msgid "making a single process (domain) run permissive to troubleshoot an issue, rather than putting the entire system at risk by making the entire system permissive." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"creating policies for new applications. Previously, it was recommended that " -"a minimal policy be created, and then the entire machine put into permissive " -"mode, so that the application could run, but SELinux denials still logged. " -"<command>audit2allow</command> could then be used to help write the policy. " -"This put the whole system at risk. With permissive domains, only the domain " -"in the new policy can be marked permissive, without putting the whole system " -"at risk." +msgid "creating policies for new applications. Previously, it was recommended that a minimal policy be created, and then the entire machine put into permissive mode, so that the application could run, but SELinux denials still logged. <command>audit2allow</command> could then be used to help write the policy. This put the whole system at risk. With permissive domains, only the domain in the new policy can be marked permissive, without putting the whole system at risk." msgstr ""

#. Tag: title @@ -723,13 +457,7 @@

#. Tag: para #, no-c-format -msgid "" -"To make a domain permissive, run the <command>semanage permissive -a " -"<replaceable>domain</replaceable></command> command, where " -"<replaceable>domain</replaceable> is the domain you want to make permissive. " -"For example, run the following command as the Linux root user to make the " -"<computeroutput>httpd_t</computeroutput> domain (the domain the Apache HTTP " -"Server runs in) permissive:" +msgid "To make a domain permissive, run the <command>semanage permissive -a <replaceable>domain</replaceable></command> command, where <replaceable>domain</replaceable> is the domain you want to make permissive. For example, run the following command as the Linux root user to make the <computeroutput>httpd_t</computeroutput> domain (the domain the Apache HTTP Server runs in) permissive:" msgstr ""

#. Tag: para @@ -739,18 +467,12 @@

#. Tag: para #, no-c-format -msgid "" -"To view a list of domains you have made permissive, run the " -"<command>semodule -l | grep permissive</command> command as the Linux root " -"user. For example:" +msgid "To view a list of domains you have made permissive, run the <command>semodule -l | grep permissive</command> command as the Linux root user. For example:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you no longer want a domain to be permissive, run the <command>semanage " -"permissive -d <replaceable>domain</replaceable></command> command as the " -"Linux root user. For example:" +msgid "If you no longer want a domain to be permissive, run the <command>semanage permissive -d <replaceable>domain</replaceable></command> command as the Linux root user. For example:" msgstr ""

#. Tag: para @@ -765,38 +487,22 @@

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>SYSCALL</computeroutput> message is different for " -"permissive domains. The following is an example AVC denial (and the " -"associated system call) from the Apache HTTP Server:" +msgid "The <computeroutput>SYSCALL</computeroutput> message is different for permissive domains. The following is an example AVC denial (and the associated system call) from the Apache HTTP Server:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, the <computeroutput>httpd_t</computeroutput> domain is not " -"permissive, and as such, the action is denied, and the " -"<computeroutput>SYSCALL</computeroutput> message contains " -"<computeroutput>success=no</computeroutput>. The following is an example AVC " -"denial for the same situation, except the <command>semanage permissive -a " -"httpd_t</command> command has been run to make the <computeroutput>httpd_t</" -"computeroutput> domain permissive:" +msgid "By default, the <computeroutput>httpd_t</computeroutput> domain is not permissive, and as such, the action is denied, and the <computeroutput>SYSCALL</computeroutput> message contains <computeroutput>success=no</computeroutput>. The following is an example AVC denial for the same situation, except the <command>semanage permissive -a httpd_t</command> command has been run to make the <computeroutput>httpd_t</computeroutput> domain permissive:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this case, although an AVC denial was logged, access was not denied, as " -"shown by <computeroutput>success=yes</computeroutput> in the " -"<computeroutput>SYSCALL</computeroutput> message." +msgid "In this case, although an AVC denial was logged, access was not denied, as shown by <computeroutput>success=yes</computeroutput> in the <computeroutput>SYSCALL</computeroutput> message." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24537.html" -"">"Permissive Domains"</ulink> blog entry for further information about " -"permissive domains." +msgid "Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24537.html%5C%22%3E%5C%22Permissive Domains"</ulink> blog entry for further information about permissive domains." msgstr ""

#. Tag: title @@ -806,17 +512,7 @@

#. Tag: para #, no-c-format -msgid "" -"This section assumes the <package>setroubleshoot</package>, " -"<package>setroubleshoot-server</package>, <package>dbus</package> and " -"<package>audit</package> packages are installed, and that the <systemitem " -"class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</" -"systemitem>, and <systemitem class="daemon">setroubleshootd</systemitem> " -"daemons are running. Refer to <xref linkend="sect-Security-Enhanced_Linux-" -"Working_with_SELinux-Which_Log_File_is_Used" /> for information about " -"starting these daemons. A number of tools are available for searching for " -"and viewing SELinux denials, such as <command>ausearch</command>, " -"<command>aureport</command>, and <command>sealert</command>." +msgid "This section assumes the <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, and that the <systemitem class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</systemitem>, and <systemitem class="daemon">setroubleshootd</systemitem> daemons are running. Refer to <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Which_Log_File_is_Used" /> for information about starting these daemons. A number of tools are available for searching for and viewing SELinux denials, such as <command>ausearch</command>, <command>aureport</command>, and <command>sealert</command>." msgstr ""

#. Tag: title @@ -826,22 +522,12 @@

#. Tag: para #, no-c-format -msgid "" -"The <package>audit</package> package provides <command>ausearch</command>. " -"From the" +msgid "The <package>audit</package> package provides <command>ausearch</command>. From the" msgstr ""

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>ausearch</command> is a tool that can query the " -"audit daemon logs based for events based on different search criteria" -""<footnote> <para> From the <citerefentry><refentrytitle>ausearch</" -"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as " -"shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. " -"</para> </footnote>. The <command>ausearch</command> tool accesses " -"<filename>/var/log/audit/audit.log</filename>, and as such, must be run as " -"the Linux root user:" +msgid "manual page: "<command>ausearch</command> is a tool that can query the audit daemon logs based for events based on different search criteria"<footnote> <para> From the <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. The <command>ausearch</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user:" msgstr ""

#. Tag: segtitle @@ -886,16 +572,7 @@

#. Tag: para #, no-c-format -msgid "" -"To search for SELinux denials for a particular service, use the <option>-c " -"<replaceable>comm-name</replaceable></option> option, where " -"<replaceable>comm-name</replaceable> "is the executable’s name"<footnote> " -"<para> From the <citerefentry><refentrytitle>ausearch</" -"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as " -"shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. " -"</para> </footnote>, for example, <systemitem class="daemon">httpd</" -"systemitem> for the Apache HTTP Server, and <systemitem class="daemon" -"">smbd</systemitem> for Samba:" +msgid "To search for SELinux denials for a particular service, use the <option>-c <replaceable>comm-name</replaceable></option> option, where <replaceable>comm-name</replaceable> "is the executable’s name"<footnote> <para> From the <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>, for example, <systemitem class="daemon">httpd</systemitem> for the Apache HTTP Server, and <systemitem class="daemon">smbd</systemitem> for Samba:" msgstr ""

#. Tag: para @@ -925,24 +602,12 @@

#. Tag: para #, no-c-format -msgid "" -"The <package>audit</package> package provides <command>aureport</command>. " -"From the" +msgid "The <package>audit</package> package provides <command>aureport</command>. From the" msgstr ""

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>aureport</command> is a tool that produces summary " -"reports of the audit system logs"<footnote> <para> From the " -"<citerefentry><refentrytitle>aureport</refentrytitle><manvolnum>8</" -"manvolnum></citerefentry> manual page, as shipped with the <package>audit</" -"package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. The " -"<command>aureport</command> tool accesses <filename>/var/log/audit/audit." -"log</filename>, and as such, must be run as the Linux root user. To view a " -"list of SELinux denials and how often each one occurred, run the " -"<command>aureport -a</command> command. The following is example output that " -"includes two denials:" +msgid "manual page: "<command>aureport</command> is a tool that produces summary reports of the audit system logs"<footnote> <para> From the <citerefentry><refentrytitle>aureport</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. The <command>aureport</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user. To view a list of SELinux denials and how often each one occurred, run the <command>aureport -a</command> command. The following is example output that includes two denials:" msgstr ""

#. Tag: citerefentry @@ -957,57 +622,32 @@

#. Tag: para #, no-c-format -msgid "" -"The <package>setroubleshoot-server</package> package provides " -"<command>sealert</command>, which reads denial messages translated by " -"<package>setroubleshoot-server</package>. Denials are assigned IDs, as seen " -"in <filename>/var/log/messages</filename>. The following is an example " -"denial from <filename>messages</filename>:" +msgid "The <package>setroubleshoot-server</package> package provides <command>sealert</command>, which reads denial messages translated by <package>setroubleshoot-server</package>. Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. The following is an example denial from <filename>messages</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, the denial ID is <computeroutput>84e0b04d-d0ad-4347-8317-" -"22e74f6cd020</computeroutput>. The <option>-l</option> option takes an ID as " -"an argument. Running the <command>sealert -l 84e0b04d-d0ad-4347-8317-" -"22e74f6cd020</command> command presents a detailed analysis of why SELinux " -"denied access, and a possible solution for allowing access." +msgid "In this example, the denial ID is <computeroutput>84e0b04d-d0ad-4347-8317-22e74f6cd020</computeroutput>. The <option>-l</option> option takes an ID as an argument. Running the <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> command presents a detailed analysis of why SELinux denied access, and a possible solution for allowing access." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you are running the X Window System, have the <package>setroubleshoot</" -"package> and <package>setroubleshoot-server</package> packages installed, " -"and the <systemitem class="daemon">setroubleshootd</systemitem>, " -"<systemitem class="daemon">dbus</systemitem> and <systemitem class="daemon" -"">auditd</systemitem> daemons are running, a warning is displayed when " -"access is denied by SELinux. Clicking on 'Show' launches the " -"<command>sealert</command> GUI, and displays denials in HTML output:" +msgid "If you are running the X Window System, have the <package>setroubleshoot</package> and <package>setroubleshoot-server</package> packages installed, and the <systemitem class="daemon">setroubleshootd</systemitem>, <systemitem class="daemon">dbus</systemitem> and <systemitem class="daemon">auditd</systemitem> daemons are running, a warning is displayed when access is denied by SELinux. Clicking on 'Show' launches the <command>sealert</command> GUI, and displays denials in HTML output:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>sealert -b</command> command to launch the " -"<command>sealert</command> GUI." +msgid "Run the <command>sealert -b</command> command to launch the <command>sealert</command> GUI." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>sealert -l \*</command> command to view a detailed " -"analysis of all denials." +msgid "Run the <command>sealert -l \*</command> command to view a detailed analysis of all denials." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>sealert -a /var/log/audit/audit.log " -"-H &gt; audit.html</command> command to create a HTML version of the " -"<command>sealert</command> analysis, as seen with the <command>sealert</" -"command> GUI." +msgid "As the Linux root user, run the <command>sealert -a /var/log/audit/audit.log -H &gt; audit.html</command> command to create a HTML version of the <command>sealert</command> analysis, as seen with the <command>sealert</command> GUI." msgstr ""

#. Tag: citerefentry @@ -1022,13 +662,7 @@

#. Tag: para #, no-c-format -msgid "" -"Raw audit messages are logged to <filename>/var/log/audit/audit.log</" -"filename>. The following is an example AVC denial (and the associated system " -"call) that occurred when the Apache HTTP Server (running in the " -"<computeroutput>httpd_t</computeroutput> domain) attempted to access the " -"<filename>/var/www/html/file1</filename> file (labeled with the " -"<computeroutput>samba_share_t</computeroutput> type):" +msgid "Raw audit messages are logged to <filename>/var/log/audit/audit.log</filename>. The following is an example AVC denial (and the associated system call) that occurred when the Apache HTTP Server (running in the <computeroutput>httpd_t</computeroutput> domain) attempted to access the <filename>/var/www/html/file1</filename> file (labeled with the <computeroutput>samba_share_t</computeroutput> type):" msgstr ""

#. Tag: term @@ -1038,14 +672,7 @@

#. Tag: para #, no-c-format -msgid "" -"The item in braces indicates the permission that was denied. " -"<computeroutput>getattr</computeroutput> indicates the source process was " -"trying to read the target file's status information. This occurs before " -"reading files. This action is denied due to the file being accessed having " -"the wrong label. Commonly seen permissions include <computeroutput>getattr</" -"computeroutput>, <computeroutput>read</computeroutput>, and " -"<computeroutput>write</computeroutput>." +msgid "The item in braces indicates the permission that was denied. <computeroutput>getattr</computeroutput> indicates the source process was trying to read the target file's status information. This occurs before reading files. This action is denied due to the file being accessed having the wrong label. Commonly seen permissions include <computeroutput>getattr</computeroutput>, <computeroutput>read</computeroutput>, and <computeroutput>write</computeroutput>." msgstr ""

#. Tag: term @@ -1055,11 +682,7 @@

#. Tag: para #, no-c-format -msgid "" -"The executable that launched the process. The full path of the executable is " -"found in the <computeroutput>exe=</computeroutput> section of the system " -"call (<computeroutput>SYSCALL</computeroutput>) message, which in this case, " -"is <computeroutput>exe="/usr/sbin/httpd"</computeroutput>." +msgid "The executable that launched the process. The full path of the executable is found in the <computeroutput>exe=</computeroutput> section of the system call (<computeroutput>SYSCALL</computeroutput>) message, which in this case, is <computeroutput>exe="/usr/sbin/httpd"</computeroutput>." msgstr ""

#. Tag: term @@ -1074,95 +697,52 @@

#. Tag: term #, no-c-format -msgid "" -"scontext="<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>"" +msgid "scontext="<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>"" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The SELinux context of the process that attempted the denied action. In this " -"case, it is the SELinux context of the Apache HTTP Server, which is running " -"in the <computeroutput>httpd_t</computeroutput> domain." +msgid "The SELinux context of the process that attempted the denied action. In this case, it is the SELinux context of the Apache HTTP Server, which is running in the <computeroutput>httpd_t</computeroutput> domain." msgstr ""

#. Tag: term #, no-c-format -msgid "" -"tcontext="<replaceable>unconfined_u:object_r:samba_share_t:s0</replaceable>" -""" +msgid "tcontext="<replaceable>unconfined_u:object_r:samba_share_t:s0</replaceable>"" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The SELinux context of the object (target) the process attempted to access. " -"In this case, it is the SELinux context of <filename>file1</filename>. Note: " -"the <computeroutput>samba_share_t</computeroutput> type is not accessible to " -"processes running in the <computeroutput>httpd_t</computeroutput> domain." +msgid "The SELinux context of the object (target) the process attempted to access. In this case, it is the SELinux context of <filename>file1</filename>. Note: the <computeroutput>samba_share_t</computeroutput> type is not accessible to processes running in the <computeroutput>httpd_t</computeroutput> domain." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In certain situations, the <computeroutput>tcontext</computeroutput> may " -"match the <computeroutput>scontext</computeroutput>, for example, when a " -"process attempts to execute a system service that will change " -"characteristics of that running process, such as the user ID. Also, the " -"<computeroutput>tcontext</computeroutput> may match the " -"<computeroutput>scontext</computeroutput> when a process tries to use more " -"resources (such as memory) than normal limits allow, resulting in a security " -"check to see if that process is allowed to break those limits." +msgid "In certain situations, the <computeroutput>tcontext</computeroutput> may match the <computeroutput>scontext</computeroutput>, for example, when a process attempts to execute a system service that will change characteristics of that running process, such as the user ID. Also, the <computeroutput>tcontext</computeroutput> may match the <computeroutput>scontext</computeroutput> when a process tries to use more resources (such as memory) than normal limits allow, resulting in a security check to see if that process is allowed to break those limits." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"From the system call (<computeroutput>SYSCALL</computeroutput>) message, two " -"items are of interest:" +msgid "From the system call (<computeroutput>SYSCALL</computeroutput>) message, two items are of interest:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>success=<replaceable>no</replaceable></computeroutput>: " -"indicates whether the denial (AVC) was enforced or not. " -"<computeroutput>success=no</computeroutput> indicates the system call was " -"not successful (SELinux denied access). <computeroutput>success=yes</" -"computeroutput> indicates the system call was successful - this can be seen " -"for permissive domains or unconfined domains, such as " -"<computeroutput>initrc_t</computeroutput> and <computeroutput>kernel_t</" -"computeroutput>." +msgid "<computeroutput>success=<replaceable>no</replaceable></computeroutput>: indicates whether the denial (AVC) was enforced or not. <computeroutput>success=no</computeroutput> indicates the system call was not successful (SELinux denied access). <computeroutput>success=yes</computeroutput> indicates the system call was successful - this can be seen for permissive domains or unconfined domains, such as <computeroutput>initrc_t</computeroutput> and <computeroutput>kernel_t</computeroutput>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>exe="<replaceable>/usr/sbin/httpd</replaceable>"</" -"computeroutput>: the full path to the executable that launched the process, " -"which in this case, is <computeroutput>exe="/usr/sbin/httpd"</" -"computeroutput>." +msgid "<computeroutput>exe="<replaceable>/usr/sbin/httpd</replaceable>"</computeroutput>: the full path to the executable that launched the process, which in this case, is <computeroutput>exe="/usr/sbin/httpd"</computeroutput>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"An incorrect file type is a common cause for SELinux denying access. To " -"start troubleshooting, compare the source context (<computeroutput>scontext</" -"computeroutput>) with the target context (<computeroutput>tcontext</" -"computeroutput>). Should the process (<computeroutput>scontext</" -"computeroutput>) be accessing such an object (<computeroutput>tcontext</" -"computeroutput>)? For example, the Apache HTTP Server " -"(<computeroutput>httpd_t</computeroutput>) should only be accessing types " -"specified in the" +msgid "An incorrect file type is a common cause for SELinux denying access. To start troubleshooting, compare the source context (<computeroutput>scontext</computeroutput>) with the target context (<computeroutput>tcontext</computeroutput>). Should the process (<computeroutput>scontext</computeroutput>) be accessing such an object (<computeroutput>tcontext</computeroutput>)? For example, the Apache HTTP Server (<computeroutput>httpd_t</computeroutput>) should only be accessing types specified in the" msgstr ""

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page, such as <computeroutput>httpd_sys_content_t</computeroutput>, " -"<computeroutput>public_content_t</computeroutput>, and so on, unless " -"configured otherwise." +msgid "manual page, such as <computeroutput>httpd_sys_content_t</computeroutput>, <computeroutput>public_content_t</computeroutput>, and so on, unless configured otherwise." msgstr ""

#. Tag: title @@ -1172,22 +752,12 @@

#. Tag: para #, no-c-format -msgid "" -"Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. " -"The following is an example AVC denial (logged to <filename>messages</" -"filename>) that occurred when the Apache HTTP Server (running in the " -"<computeroutput>httpd_t</computeroutput> domain) attempted to access the " -"<filename>/var/www/html/file1</filename> file (labeled with the " -"<computeroutput>samba_share_t</computeroutput> type):" +msgid "Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. The following is an example AVC denial (logged to <filename>messages</filename>) that occurred when the Apache HTTP Server (running in the <computeroutput>httpd_t</computeroutput> domain) attempted to access the <filename>/var/www/html/file1</filename> file (labeled with the <computeroutput>samba_share_t</computeroutput> type):" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As suggested, run the <command>sealert -l 84e0b04d-d0ad-4347-8317-" -"22e74f6cd020</command> command to view the complete message. This command " -"only works on the local machine, and presents the same information as the " -"<command>sealert</command> GUI:" +msgid "As suggested, run the <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> command to view the complete message. This command only works on the local machine, and presents the same information as the <command>sealert</command> GUI:" msgstr ""

#. Tag: term @@ -1197,12 +767,7 @@

#. Tag: para #, no-c-format -msgid "" -"A brief summary of the denied action. This is the same as the denial in " -"<filename>/var/log/messages</filename>. In this example, the <systemitem " -"class="daemon">httpd</systemitem> process was denied access to a file " -"(<filename>file1</filename>), which is labeled with the " -"<computeroutput>samba_share_t</computeroutput> type." +msgid "A brief summary of the denied action. This is the same as the denial in <filename>/var/log/messages</filename>. In this example, the <systemitem class="daemon">httpd</systemitem> process was denied access to a file (<filename>file1</filename>), which is labeled with the <computeroutput>samba_share_t</computeroutput> type." msgstr ""

#. Tag: term @@ -1212,12 +777,7 @@

#. Tag: para #, no-c-format -msgid "" -"A more verbose description. In this example, <filename>file1</filename> is " -"labeled with the <computeroutput>samba_share_t</computeroutput> type. This " -"type is used for files and directories that you want to export via Samba. " -"The description suggests changing the type to a type that can be accessed by " -"the Apache HTTP Server and Samba, if such access is desired." +msgid "A more verbose description. In this example, <filename>file1</filename> is labeled with the <computeroutput>samba_share_t</computeroutput> type. This type is used for files and directories that you want to export via Samba. The description suggests changing the type to a type that can be accessed by the Apache HTTP Server and Samba, if such access is desired." msgstr ""

#. Tag: term @@ -1227,11 +787,7 @@

#. Tag: para #, no-c-format -msgid "" -"A suggestion for how to allow access. This may be relabeling files, turning " -"a Boolean on, or making a local policy module. In this case, the suggestion " -"is to label the file with a type accessible to both the Apache HTTP Server " -"and Samba." +msgid "A suggestion for how to allow access. This may be relabeling files, turning a Boolean on, or making a local policy module. In this case, the suggestion is to label the file with a type accessible to both the Apache HTTP Server and Samba." msgstr ""

#. Tag: term @@ -1241,11 +797,7 @@

#. Tag: para #, no-c-format -msgid "" -"A suggested command to allow access and resolve the denial. In this example, " -"it gives the command to change the <filename>file1</filename> type to " -"<computeroutput>public_content_t</computeroutput>, which is accessible to " -"the Apache HTTP Server and Samba." +msgid "A suggested command to allow access and resolve the denial. In this example, it gives the command to change the <filename>file1</filename> type to <computeroutput>public_content_t</computeroutput>, which is accessible to the Apache HTTP Server and Samba." msgstr ""

#. Tag: term @@ -1255,19 +807,12 @@

#. Tag: para #, no-c-format -msgid "" -"Information that is useful in bug reports, such as the policy package name " -"and version (<computeroutput>selinux-policy-3.5.13-11.fc12</" -"computeroutput>), but may not help towards solving why the denial occurred." +msgid "Information that is useful in bug reports, such as the policy package name and version (<computeroutput>selinux-policy-3.5.13-11.fc12</computeroutput>), but may not help towards solving why the denial occurred." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The raw audit messages from <filename>/var/log/audit/audit.log</filename> " -"that are associated with the denial. Refer to <xref linkend="sect-Security-" -"Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> for information about " -"each item in the AVC denial." +msgid "The raw audit messages from <filename>/var/log/audit/audit.log</filename> that are associated with the denial. Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> for information about each item in the AVC denial." msgstr ""

#. Tag: title @@ -1277,9 +822,7 @@

#. Tag: para #, no-c-format -msgid "" -"Do not use the example in this section in production. It is used only to " -"demonstrate the use of <command>audit2allow</command>." +msgid "Do not use the example in this section in production. It is used only to demonstrate the use of <command>audit2allow</command>." msgstr ""

#. Tag: para @@ -1294,58 +837,27 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>audit2allow</command> - generate SELinux policy " -"allow rules from logs of denied operations"<footnote> <para> From the " -"<citerefentry><refentrytitle>audit2allow</refentrytitle><manvolnum>1</" -"manvolnum></citerefentry> manual page, as shipped with the " -"<package>policycoreutils</package> package in Fedora&nbsp;&PRODVER;. </para> " -"</footnote>. After analyzing denials as per <xref linkend="sect-Security-" -"Enhanced_Linux-Fixing_Problems-sealert_Messages" />, and if no label " -"changes or Booleans allowed access, use <command>audit2allow</command> to " -"create a local policy module. After access is denied by SELinux, running the " -"<command>audit2allow</command> command presents Type Enforcement rules that " -"allow the previously denied access." +msgid "manual page: "<command>audit2allow</command> - generate SELinux policy allow rules from logs of denied operations"<footnote> <para> From the <citerefentry><refentrytitle>audit2allow</refentrytitle><manvolnum>1</manvolnum></citerefentry> manual page, as shipped with the <package>policycoreutils</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. After analyzing denials as per <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" />, and if no label changes or Booleans allowed access, use <command>audit2allow</command> to create a local policy module. After access is denied by SELinux, running the <command>audit2allow</command> command presents Type Enforcement rules that allow the previously denied access." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates using <command>audit2allow</command> to " -"create a policy module:" +msgid "The following example demonstrates using <command>audit2allow</command> to create a policy module:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"A denial and the associated system call are logged to <filename>/var/log/" -"audit/audit.log</filename>:" +msgid "A denial and the associated system call are logged to <filename>/var/log/audit/audit.log</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, <application>certwatch</application> (<computeroutput>comm=" -""certwatch"</computeroutput>) was denied write access (<computeroutput>" -"{ write }</computeroutput>) to a directory labeled with the " -"<computeroutput>var_t</computeroutput> type " -"(<computeroutput>tcontext=system_u:object_r:var_t:s0</computeroutput>). " -"Analyze the denial as per <xref linkend="sect-Security-Enhanced_Linux-" -"Fixing_Problems-sealert_Messages" />. If no label changes or Booleans " -"allowed access, use <command>audit2allow</command> to create a local policy " -"module." +msgid "In this example, <application>certwatch</application> (<computeroutput>comm="certwatch"</computeroutput>) was denied write access (<computeroutput>{ write }</computeroutput>) to a directory labeled with the <computeroutput>var_t</computeroutput> type (<computeroutput>tcontext=system_u:object_r:var_t:s0</computeroutput>). Analyze the denial as per <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" />. If no label changes or Booleans allowed access, use <command>audit2allow</command> to create a local policy module." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"With a denial logged, such as the <computeroutput>certwatch</computeroutput> " -"denial in step 1, run the <command>audit2allow -w -a</command> command to " -"produce a human-readable description of why access was denied. The <option>-" -"a</option> option causes all audit logs to be read. The <option>-w</option> " -"option produces the human-readable description. The <command>audit2allow</" -"command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as " -"such, must be run as the Linux root user:" +msgid "With a denial logged, such as the <computeroutput>certwatch</computeroutput> denial in step 1, run the <command>audit2allow -w -a</command> command to produce a human-readable description of why access was denied. The <option>-a</option> option causes all audit logs to be read. The <option>-w</option> option produces the human-readable description. The <command>audit2allow</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user:" msgstr ""

#. Tag: para @@ -1355,71 +867,35 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>audit2allow -a</command> command to view the Type " -"Enforcement rule that allows the denied access:" +msgid "Run the <command>audit2allow -a</command> command to view the Type Enforcement rule that allows the denied access:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Missing Type Enforcement rules are usually caused by bugs in SELinux policy, " -"and should be reported in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed " -"Hat Bugzilla</ulink>. For Fedora, create bugs against the " -"<computeroutput>Fedora</computeroutput> product, and select the " -"<computeroutput>selinux-policy</computeroutput> component. Include the " -"output of the <command>audit2allow -w -a</command> and <command>audit2allow -" -"a</command> commands in such bug reports." +msgid "Missing Type Enforcement rules are usually caused by bugs in SELinux policy, and should be reported in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat Bugzilla</ulink>. For Fedora, create bugs against the <computeroutput>Fedora</computeroutput> product, and select the <computeroutput>selinux-policy</computeroutput> component. Include the output of the <command>audit2allow -w -a</command> and <command>audit2allow -a</command> commands in such bug reports." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To use the rule displayed by <command>audit2allow -a</command>, run the " -"<command>audit2allow -a -M <replaceable>mycertwatch</replaceable></command> " -"command as the Linux root user to create custom module. The <option>-M</" -"option> option creates a Type Enforcement file (<filename>.te</filename>) " -"with the name specified with <option>-M</option>, in your current working " -"directory:" +msgid "To use the rule displayed by <command>audit2allow -a</command>, run the <command>audit2allow -a -M <replaceable>mycertwatch</replaceable></command> command as the Linux root user to create custom module. The <option>-M</option> option creates a Type Enforcement file (<filename>.te</filename>) with the name specified with <option>-M</option>, in your current working directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Also, <command>audit2allow</command> compiles the Type Enforcement rule into " -"a policy package (<filename>.pp</filename>). To install the module, run the " -"<command>/usr/sbin/semodule -i <replaceable>mycertwatch.pp</replaceable></" -"command> command as the Linux root user." +msgid "Also, <command>audit2allow</command> compiles the Type Enforcement rule into a policy package (<filename>.pp</filename>). To install the module, run the <command>/usr/sbin/semodule -i <replaceable>mycertwatch.pp</replaceable></command> command as the Linux root user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Modules created with <command>audit2allow</command> may allow more access " -"than required. It is recommended that policy created with " -"<command>audit2allow</command> be posted to an SELinux list, such as <ulink " -"url="http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-" -"selinux-list</ulink>, for review. If you believe their is a bug in policy, " -"create a bug in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat " -"Bugzilla</ulink>." +msgid "Modules created with <command>audit2allow</command> may allow more access than required. It is recommended that policy created with <command>audit2allow</command> be posted to an SELinux list, such as <ulink url="http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-se...</ulink>, for review. If you believe their is a bug in policy, create a bug in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat Bugzilla</ulink>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you have multiple denials from multiple processes, but only want to " -"create a custom policy for a single process, use the <command>grep</command> " -"command to narrow down the input for <command>audit2allow</command>. The " -"following example demonstrates using <command>grep</command> to only send " -"denials related to <command>certwatch</command> through " -"<command>audit2allow</command>:" +msgid "If you have multiple denials from multiple processes, but only want to create a custom policy for a single process, use the <command>grep</command> command to narrow down the input for <command>audit2allow</command>. The following example demonstrates using <command>grep</command> to only send denials related to <command>certwatch</command> through <command>audit2allow</command>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24750.html" -"">"Using audit2allow to build policy modules. Revisited."</ulink> blog " -"entry for further information about using <command>audit2allow</command> to " -"build policy modules." +msgid "Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24750.html%5C%22%3E%5C%22Using audit2allow to build policy modules. Revisited."</ulink> blog entry for further information about using <command>audit2allow</command> to build policy modules." msgstr ""

Modified: community/branches/f13/fr-FR/Working_With_SELinux.po =================================================================== --- community/branches/f13/fr-FR/Working_With_SELinux.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/fr-FR/Working_With_SELinux.po 2010-11-21 23:12:12 UTC (rev 492) @@ -10,6 +10,7 @@ "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME EMAIL@ADDRESS\n" "Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: application/x-xml2pot; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -21,14 +22,7 @@

#. Tag: para #, no-c-format -msgid "" -"The following sections give a brief overview of the main SELinux packages in " -"Fedora; installing and updating packages; which log files are used; the main " -"SELinux configuration file; enabling and disabling SELinux; SELinux modes; " -"configuring Booleans; temporarily and persistently changing file and " -"directory labels; overriding file system labels with the <command>mount</" -"command> command; mounting NFS file systems; and how to preserve SELinux " -"contexts when copying and archiving files and directories." +msgid "The following sections give a brief overview of the main SELinux packages in Fedora; installing and updating packages; which log files are used; the main SELinux configuration file; enabling and disabling SELinux; SELinux modes; configuring Booleans; temporarily and persistently changing file and directory labels; overriding file system labels with the <command>mount</command> command; mounting NFS file systems; and how to preserve SELinux contexts when copying and archiving files and directories." msgstr ""

#. Tag: title @@ -38,132 +32,62 @@

#. Tag: para #, no-c-format -msgid "" -"In Fedora, the SELinux packages are installed by default, unless they are " -"manually excluded during installation. By default, SELinux targeted policy " -"is used, and SELinux runs in enforcing mode. The following is a brief " -"description of the main SELinux packages:" +msgid "In Fedora, the SELinux packages are installed by default, unless they are manually excluded during installation. By default, SELinux targeted policy is used, and SELinux runs in enforcing mode. The following is a brief description of the main SELinux packages:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>policycoreutils</package>: provides utilities, such as " -"<command>semanage</command>, <command>restorecon</command>, " -"<command>audit2allow</command>, <command>semodule</command>, " -"<command>load_policy</command>, and <command>setsebool</command>, for " -"operating and managing SELinux." +msgid "<package>policycoreutils</package>: provides utilities, such as <command>semanage</command>, <command>restorecon</command>, <command>audit2allow</command>, <command>semodule</command>, <command>load_policy</command>, and <command>setsebool</command>, for operating and managing SELinux." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>policycoreutils-gui</package>: provides <command>system-config-" -"selinux</command>, a graphical tool for managing SELinux." +msgid "<package>policycoreutils-gui</package>: provides <command>system-config-selinux</command>, a graphical tool for managing SELinux." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>selinux-policy</package>: provides the SELinux Reference Policy. " -"The SELinux Reference Policy is a complete SELinux policy, and is used as a " -"basis for other policies, such as the SELinux targeted policy. Refer to the " -"Tresys Technology <ulink url="http://oss.tresys.com/projects/refpolicy" -"">SELinux Reference Policy</ulink> page for further information. The " -"<package>selinux-policy-devel</package> package provides development tools, " -"such as <command>/usr/share/selinux/devel/policygentool</command> and " -"<command>/usr/share/selinux/devel/policyhelp</command>, as well as example " -"policy files. This package was merged into the <package>selinux-policy</" -"package> package." +msgid "<package>selinux-policy</package>: provides the SELinux Reference Policy. The SELinux Reference Policy is a complete SELinux policy, and is used as a basis for other policies, such as the SELinux targeted policy. Refer to the Tresys Technology <ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference Policy</ulink> page for further information. The <package>selinux-policy-devel</package> package provides development tools, such as <command>/usr/share/selinux/devel/policygentool</command> and <command>/usr/share/selinux/devel/policyhelp</command>, as well as example policy files. This package was merged into the <package>selinux-policy</package> package." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>selinux-policy-<replaceable>policy</replaceable></package>: " -"provides SELinux policies. For targeted policy, install <package>selinux-" -"policy-targeted</package>. For MLS, install <package>selinux-policy-mls</" -"package>. In Fedora 8, the strict policy was merged into targeted policy, " -"allowing confined and unconfined users to co-exist on the same system." +msgid "<package>selinux-policy-<replaceable>policy</replaceable></package>: provides SELinux policies. For targeted policy, install <package>selinux-policy-targeted</package>. For MLS, install <package>selinux-policy-mls</package>. In Fedora 8, the strict policy was merged into targeted policy, allowing confined and unconfined users to co-exist on the same system." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>setroubleshoot-server</package>: translates denial messages, " -"produced when access is denied by SELinux, into detailed descriptions that " -"are viewed with <command>sealert</command> (which is provided by this " -"package)." +msgid "<package>setroubleshoot-server</package>: translates denial messages, produced when access is denied by SELinux, into detailed descriptions that are viewed with <command>sealert</command> (which is provided by this package)." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>setools</package>, <package>setools-gui</package>, and " -"<package>setools-console</package>: these packages provide the <ulink url=" -""http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools " -"distribution</ulink>, a number of tools and libraries for analyzing and " -"querying policy, audit log monitoring and reporting, and file context " -"management<footnote> <para> Brindle, Joshua. "Re: blurb for fedora setools " -"packages" Email to Murray McAllister. 1 November 2008. Any edits or changes " -"in this version were done by Murray McAllister. </para> </footnote>. The " -"<package>setools</package> package is a meta-package for SETools. The " -"<package>setools-gui</package> package provides the <command>apol</command>, " -"<command>seaudit</command>, and <command>sediffx</command> tools. The " -"<package>setools-console</package> package provides the <command>seaudit-" -"report</command>, <command>sechecker</command>, <command>sediff</command>, " -"<command>seinfo</command>, <command>sesearch</command>, <command>findcon</" -"command>, <command>replcon</command>, and <command>indexcon</command> " -"command line tools. Refer to the <ulink url="http://oss.tresys.com/projects/" -"setools">Tresys Technology SETools</ulink> page for information about these " -"tools." +msgid "<package>setools</package>, <package>setools-gui</package>, and <package>setools-console</package>: these packages provide the <ulink url="http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools distribution</ulink>, a number of tools and libraries for analyzing and querying policy, audit log monitoring and reporting, and file context management<footnote> <para> Brindle, Joshua. "Re: blurb for fedora setools packages" Email to Murray McAllister. 1 November 2008. Any edits or changes in this version were done by Murray McAllister. </para> </footnote>. The <package>setools</package> package is a meta-package for SETools. The <package>setools-gui</package> package provides the <command>apol</command>, <command>seaudit</command>, and <command>sediffx</command> tools. The <package>setools-console</package> package provides the <command>seaudit-report</command>, <command>sechecker</command>, <command>sediff</command>, <command>seinfo</command>, <command>sesear ch</command>, <command>findcon</command>, <command>replcon</command>, and <command>indexcon</command> command line tools. Refer to the <ulink url="http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools</ulink> page for information about these tools." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>libselinux-utils</package>: provides the <command>avcstat</" -"command>, <command>getenforce</command>, <command>getsebool</command>, " -"<command>matchpathcon</command>, <command>selinuxconlist</command>, " -"<command>selinuxdefcon</command>, <command>selinuxenabled</command>, " -"<command>setenforce</command>, <command>togglesebool</command> tools." +msgid "<package>libselinux-utils</package>: provides the <command>avcstat</command>, <command>getenforce</command>, <command>getsebool</command>, <command>matchpathcon</command>, <command>selinuxconlist</command>, <command>selinuxdefcon</command>, <command>selinuxenabled</command>, <command>setenforce</command>, <command>togglesebool</command> tools." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<package>mcstrans</package>: translates levels, such as <computeroutput>s0-" -"s0:c0.c1023</computeroutput>, to an easier to read form, such as " -"<computeroutput>SystemLow-SystemHigh</computeroutput>. This package is not " -"installed by default." +msgid "<package>mcstrans</package>: translates levels, such as <computeroutput>s0-s0:c0.c1023</computeroutput>, to an easier to read form, such as <computeroutput>SystemLow-SystemHigh</computeroutput>. This package is not installed by default." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To install packages in Fedora, as the Linux root user, run the <command>yum " -"install <replaceable>package-name</replaceable></command> command. For " -"example, to install the <package>mcstrans</package> package, run the " -"<command>yum install mcstrans</command> command. To upgrade all installed " -"packages in Fedora, run the <command>yum update</command> command." +msgid "To install packages in Fedora, as the Linux root user, run the <command>yum install <replaceable>package-name</replaceable></command> command. For example, to install the <package>mcstrans</package> package, run the <command>yum install mcstrans</command> command. To upgrade all installed packages in Fedora, run the <command>yum update</command> command." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to <ulink url="http://docs.fedoraproject.org/yum/en/%5C%22%3EManaging " -"Software with yum</ulink><footnote> <para> Managing Software with yum, " -"written by Stuart Ellis, edited by Paul W. Frields, Rodrigo Menezes, and " -"Hugo Cisneiros. </para> </footnote> for further information about using " -"<command>yum</command> to manage packages." +msgid "Refer to <ulink url="http://docs.fedoraproject.org/yum/en/%5C%22%3EManaging Software with yum</ulink><footnote> <para> Managing Software with yum, written by Stuart Ellis, edited by Paul W. Frields, Rodrigo Menezes, and Hugo Cisneiros. </para> </footnote> for further information about using <command>yum</command> to manage packages." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In previous versions of Fedora, the <package>selinux-policy-devel</package> " -"package is required when making a local policy module with " -"<command>audit2allow -M</command>." +msgid "In previous versions of Fedora, the <package>selinux-policy-devel</package> package is required when making a local policy module with <command>audit2allow -M</command>." msgstr ""

#. Tag: title @@ -173,53 +97,27 @@

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, the <package>dbus</package>, " -"<package>setroubleshoot-server</package> and <package>audit</package> " -"packages are installed if packages are not removed from the default package " -"selection." +msgid "In Fedora&nbsp;&PRODVER;, the <package>dbus</package>, <package>setroubleshoot-server</package> and <package>audit</package> packages are installed if packages are not removed from the default package selection." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"SELinux denial messages, such as the following, are written to <filename>/" -"var/log/audit/audit.log</filename> by default:" +msgid "SELinux denial messages, such as the following, are written to <filename>/var/log/audit/audit.log</filename> by default:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Also, if <systemitem class="daemon">setroubleshootd</systemitem> is " -"running, denial messages from <filename>/var/log/audit/audit.log</filename> " -"are translated to an easier-to-read form and sent to <filename>/var/log/" -"messages</filename>:" +msgid "Also, if <systemitem class="daemon">setroubleshootd</systemitem> is running, denial messages from <filename>/var/log/audit/audit.log</filename> are translated to an easier-to-read form and sent to <filename>/var/log/messages</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, <systemitem class="daemon">setroubleshootd</" -"systemitem> no longer constantly runs as a service, however it is still used " -"to analyze the AVC messages. Two new programs act as a method to start " -"setroubleshoot when needed: <systemitem class="daemon">sedispatch</" -"systemitem> and <systemitem class="daemon">seapplet</systemitem>. " -"<systemitem class="daemon">sedispatch</systemitem> runs as part of the " -"audit subsystem, and via <systemitem class="daemon">dbus</systemitem>, " -"sends a message when an AVC denial occurs, which will go straight to " -"<systemitem class="daemon">setroubleshootd</systemitem> if it is already " -"running, or it will start <systemitem class="daemon">setroubleshootd</" -"systemitem> if it is not running. <systemitem class="daemon">seapplet</" -"systemitem> is a tool which runs in the system's toolbar, waiting for dbus " -"messages in <systemitem class="daemon">setroubleshootd</systemitem>, and " -"will launch the notification bubble, allowing the user to review the denial." +msgid "In Fedora&nbsp;&PRODVER;, <systemitem class="daemon">setroubleshootd</systemitem> no longer constantly runs as a service, however it is still used to analyze the AVC messages. Two new programs act as a method to start setroubleshoot when needed: <systemitem class="daemon">sedispatch</systemitem> and <systemitem class="daemon">seapplet</systemitem>. <systemitem class="daemon">sedispatch</systemitem> runs as part of the audit subsystem, and via <systemitem class="daemon">dbus</systemitem>, sends a message when an AVC denial occurs, which will go straight to <systemitem class="daemon">setroubleshootd</systemitem> if it is already running, or it will start <systemitem class="daemon">setroubleshootd</systemitem> if it is not running. <systemitem class="daemon">seapplet</systemitem> is a tool which runs in the system's toolbar, waiting for dbus messages in <systemitem class="daemon">setroubleshootd</systemitem>, and will launch the notification bubble, all owing the user to review the denial." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Denial messages are sent to a different location, depending on which daemons " -"are running:" +msgid "Denial messages are sent to a different location, depending on which daemons are running:" msgstr ""

#. Tag: segtitle @@ -259,9 +157,7 @@

#. Tag: seg #, no-c-format -msgid "" -"<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial " -"messages also sent to <filename>/var/log/messages</filename>" +msgid "<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial messages also sent to <filename>/var/log/messages</filename>" msgstr ""

#. Tag: title @@ -271,27 +167,17 @@

#. Tag: para #, no-c-format -msgid "" -"To configure the <systemitem class="daemon">auditd</systemitem>, " -"<systemitem class="daemon">rsyslogd</systemitem>, and <systemitem class=" -""daemon">setroubleshootd</systemitem> daemons to automatically start at " -"boot, run the following commands as the Linux root user:" +msgid "To configure the <systemitem class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</systemitem>, and <systemitem class="daemon">setroubleshootd</systemitem> daemons to automatically start at boot, run the following commands as the Linux root user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Use the <command>service <replaceable>service-name</replaceable> status</" -"command> command to check if these services are running, for example:" +msgid "Use the <command>service <replaceable>service-name</replaceable> status</command> command to check if these services are running, for example:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If the above services are not running (<computeroutput><replaceable>service-" -"name</replaceable> is stopped</computeroutput>), use the <command>service " -"<replaceable>service-name</replaceable> start</command> command as the Linux " -"root user to start them. For example:" +msgid "If the above services are not running (<computeroutput><replaceable>service-name</replaceable> is stopped</computeroutput>), use the <command>service <replaceable>service-name</replaceable> start</command> command as the Linux root user to start them. For example:" msgstr ""

#. Tag: title @@ -301,10 +187,7 @@

#. Tag: para #, no-c-format -msgid "" -"The <filename>/etc/selinux/config</filename> file is the main SELinux " -"configuration file. It controls the SELinux mode and the SELinux policy to " -"use:" +msgid "The <filename>/etc/selinux/config</filename> file is the main SELinux configuration file. It controls the SELinux mode and the SELinux policy to use:" msgstr ""

#. Tag: term @@ -314,15 +197,7 @@

#. Tag: para #, no-c-format -msgid "" -"The <option>SELINUX</option> option sets the mode SELinux runs in. SELinux " -"has three modes: enforcing, permissive, and disabled. When using enforcing " -"mode, SELinux policy is enforced, and SELinux denies access based on SELinux " -"policy rules. Denial messages are logged. When using permissive mode, " -"SELinux policy is not enforced. SELinux does not deny access, but denials " -"are logged for actions that would have been denied if running SELinux in " -"enforcing mode. When using disabled mode, SELinux is disabled (the SELinux " -"module is not registered with the Linux kernel), and only DAC rules are used." +msgid "The <option>SELINUX</option> option sets the mode SELinux runs in. SELinux has three modes: enforcing, permissive, and disabled. When using enforcing mode, SELinux policy is enforced, and SELinux denies access based on SELinux policy rules. Denial messages are logged. When using permissive mode, SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running SELinux in enforcing mode. When using disabled mode, SELinux is disabled (the SELinux module is not registered with the Linux kernel), and only DAC rules are used." msgstr ""

#. Tag: term @@ -332,23 +207,12 @@

#. Tag: para #, no-c-format -msgid "" -"The <option>SELINUXTYPE</option> option sets the SELinux policy to use. " -"Targeted policy is the default policy. Only change this option if you want " -"to use the MLS policy. To use the MLS policy, install the <package>selinux-" -"policy-mls</package> package; configure <option>SELINUXTYPE=mls</option> in " -"<filename>/etc/selinux/config</filename>; and reboot your system." +msgid "The <option>SELINUXTYPE</option> option sets the SELinux policy to use. Targeted policy is the default policy. Only change this option if you want to use the MLS policy. To use the MLS policy, install the <package>selinux-policy-mls</package> package; configure <option>SELINUXTYPE=mls</option> in <filename>/etc/selinux/config</filename>; and reboot your system." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When systems run with SELinux in permissive or disabled mode, users have " -"permission to label files incorrectly. Also, files created while SELinux is " -"disabled are not labeled. This causes problems when changing to enforcing " -"mode. To prevent incorrectly labeled and unlabeled files from causing " -"problems, file systems are automatically relabeled when changing from " -"disabled mode to permissive or enforcing mode." +msgid "When systems run with SELinux in permissive or disabled mode, users have permission to label files incorrectly. Also, files created while SELinux is disabled are not labeled. This causes problems when changing to enforcing mode. To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from disabled mode to permissive or enforcing mode." msgstr ""

#. Tag: title @@ -358,41 +222,22 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/usr/sbin/getenforce</command> or <command>/usr/sbin/" -"sestatus</command> commands to check the status of SELinux. The " -"<command>getenforce</command> command returns <computeroutput>Enforcing</" -"computeroutput>, <computeroutput>Permissive</computeroutput>, or " -"<computeroutput>Disabled</computeroutput>. The <command>getenforce</command> " -"command returns <computeroutput>Enforcing</computeroutput> when SELinux is " -"enabled (SELinux policy rules are enforced):" +msgid "Use the <command>/usr/sbin/getenforce</command> or <command>/usr/sbin/sestatus</command> commands to check the status of SELinux. The <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput>, <computeroutput>Permissive</computeroutput>, or <computeroutput>Disabled</computeroutput>. The <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput> when SELinux is enabled (SELinux policy rules are enforced):" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>getenforce</command> command returns " -"<computeroutput>Permissive</computeroutput> when SELinux is enabled, but " -"SELinux policy rules are not enforced, and only DAC rules are used. The " -"<command>getenforce</command> command returns <computeroutput>Disabled</" -"computeroutput> if SELinux is disabled." +msgid "The <command>getenforce</command> command returns <computeroutput>Permissive</computeroutput> when SELinux is enabled, but SELinux policy rules are not enforced, and only DAC rules are used. The <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput> if SELinux is disabled." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>sestatus</command> command returns the SELinux status and the " -"SELinux policy being used:" +msgid "The <command>sestatus</command> command returns the SELinux status and the SELinux policy being used:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>SELinux status: enabled</computeroutput> is returned when " -"SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> " -"is returned when SELinux is running in enforcing mode. " -"<computeroutput>Policy from config file: targeted</computeroutput> is " -"returned when the SELinux targeted policy is used." +msgid "<computeroutput>SELinux status: enabled</computeroutput> is returned when SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> is returned when SELinux is running in enforcing mode. <computeroutput>Policy from config file: targeted</computeroutput> is returned when the SELinux targeted policy is used." msgstr ""

#. Tag: title @@ -402,17 +247,12 @@

#. Tag: para #, no-c-format -msgid "" -"On systems with SELinux disabled, the <computeroutput>SELINUX=disabled</" -"computeroutput> option is configured in <filename>/etc/selinux/config</" -"filename>:" +msgid "On systems with SELinux disabled, the <computeroutput>SELINUX=disabled</computeroutput> option is configured in <filename>/etc/selinux/config</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Also, the <command>getenforce</command> command returns " -"<computeroutput>Disabled</computeroutput>:" +msgid "Also, the <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput>:" msgstr ""

#. Tag: para @@ -422,97 +262,47 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>rpm -qa | grep selinux</command>, <command>rpm -q " -"policycoreutils</command>, and <command>rpm -qa | grep setroubleshoot</" -"command> commands to confirm that the SELinux packages are installed. This " -"guide assumes the following packages are installed: <package>selinux-policy-" -"targeted</package>, <package>selinux-policy</package>, <package>libselinux</" -"package>, <package>libselinux-python</package>, <package>libselinux-utils</" -"package>, <package>policycoreutils</package>, <package>setroubleshoot</" -"package>, <package>setroubleshoot-server</package>, <package>setroubleshoot-" -"plugins</package>. If these packages are not installed, as the Linux root " -"user, install them via the <command>yum install <replaceable>package-name</" -"replaceable></command> command. The following packages are optional: " -"<package>policycoreutils-gui</package>, <package>setroubleshoot</package>, " -"<package>selinux-policy-devel</package>, and <package>mcstrans</package>." +msgid "Use the <command>rpm -qa | grep selinux</command>, <command>rpm -q policycoreutils</command>, and <command>rpm -qa | grep setroubleshoot</command> commands to confirm that the SELinux packages are installed. This guide assumes the following packages are installed: <package>selinux-policy-targeted</package>, <package>selinux-policy</package>, <package>libselinux</package>, <package>libselinux-python</package>, <package>libselinux-utils</package>, <package>policycoreutils</package>, <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>setroubleshoot-plugins</package>. If these packages are not installed, as the Linux root user, install them via the <command>yum install <replaceable>package-name</replaceable></command> command. The following packages are optional: <package>policycoreutils-gui</package>, <package>setroubleshoot</package>, <package>selinux-policy-devel</package>, and <package>mcstrans</package>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Before SELinux is enabled, each file on the file system must be labeled with " -"an SELinux context. Before this happens, confined domains may be denied " -"access, preventing your system from booting correctly. To prevent this, " -"configure <computeroutput>SELINUX=permissive</computeroutput> in <filename>/" -"etc/selinux/config</filename>:" +msgid "Before SELinux is enabled, each file on the file system must be labeled with an SELinux context. Before this happens, confined domains may be denied access, preventing your system from booting correctly. To prevent this, configure <computeroutput>SELINUX=permissive</computeroutput> in <filename>/etc/selinux/config</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>reboot</command> command to restart " -"the system. During the next boot, file systems are labeled. The label " -"process labels all files with an SELinux context:" +msgid "As the Linux root user, run the <command>reboot</command> command to restart the system. During the next boot, file systems are labeled. The label process labels all files with an SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Each <computeroutput>*</computeroutput> character on the bottom line " -"represents 1000 files that have been labeled. In the above example, four " -"<computeroutput>*</computeroutput> characters represent 4000 files have been " -"labeled. The time it takes to label all files depends upon the number of " -"files on the system, and the speed of the hard disk drives. On modern " -"systems, this process can take as little as 10 minutes." +msgid "Each <computeroutput>*</computeroutput> character on the bottom line represents 1000 files that have been labeled. In the above example, four <computeroutput>*</computeroutput> characters represent 4000 files have been labeled. The time it takes to label all files depends upon the number of files on the system, and the speed of the hard disk drives. On modern systems, this process can take as little as 10 minutes." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In permissive mode, SELinux policy is not enforced, but denials are still " -"logged for actions that would have been denied if running in enforcing mode. " -"Before changing to enforcing mode, as the Linux root user, run the " -"<command>grep "SELinux is preventing" /var/log/messages</command> command " -"as the Linux root user to confirm that SELinux did not deny actions during " -"the last boot. If SELinux did not deny actions during the last boot, this " -"command does not return any output. Refer to <xref linkend="chap-Security-" -"Enhanced_Linux-Troubleshooting" /> for troubleshooting information if " -"SELinux denied access during boot." +msgid "In permissive mode, SELinux policy is not enforced, but denials are still logged for actions that would have been denied if running in enforcing mode. Before changing to enforcing mode, as the Linux root user, run the <command>grep "SELinux is preventing" /var/log/messages</command> command as the Linux root user to confirm that SELinux did not deny actions during the last boot. If SELinux did not deny actions during the last boot, this command does not return any output. Refer to <xref linkend="chap-Security-Enhanced_Linux-Troubleshooting" /> for troubleshooting information if SELinux denied access during boot." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If there were no denial messages in <filename>/var/log/messages</filename>, " -"configure <computeroutput>SELINUX=enforcing</computeroutput> in <filename>/" -"etc/selinux/config</filename>:" +msgid "If there were no denial messages in <filename>/var/log/messages</filename>, configure <computeroutput>SELINUX=enforcing</computeroutput> in <filename>/etc/selinux/config</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Reboot your system. After reboot, confirm that the <command>getenforce</" -"command> command returns <computeroutput>Enforcing</computeroutput>:" +msgid "Reboot your system. After reboot, confirm that the <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage login -l</" -"command> command to view the mapping between SELinux and Linux users. The " -"output should be as follows:" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage login -l</command> command to view the mapping between SELinux and Linux users. The output should be as follows:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If this is not the case, run the following commands as the Linux root user " -"to fix the user mappings. It is safe to ignore the <computeroutput>SELinux-" -"user<replaceable> username</replaceable> is already defined</computeroutput> " -"warnings if they occur, where <replaceable>username</replaceable> can be " -"<computeroutput>unconfined_u</computeroutput>, <computeroutput>guest_u</" -"computeroutput>, or <computeroutput>xguest_u</computeroutput>:" +msgid "If this is not the case, run the following commands as the Linux root user to fix the user mappings. It is safe to ignore the <computeroutput>SELinux-user<replaceable> username</replaceable> is already defined</computeroutput> warnings if they occur, where <replaceable>username</replaceable> can be <computeroutput>unconfined_u</computeroutput>, <computeroutput>guest_u</computeroutput>, or <computeroutput>xguest_u</computeroutput>:" msgstr ""

#. Tag: title @@ -522,16 +312,12 @@

#. Tag: para #, no-c-format -msgid "" -"To disable SELinux, configure <option>SELINUX=disabled</option> in " -"<filename>/etc/selinux/config</filename>:" +msgid "To disable SELinux, configure <option>SELINUX=disabled</option> in <filename>/etc/selinux/config</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Reboot your system. After reboot, confirm that the <command>getenforce</" -"command> command returns <computeroutput>Disabled</computeroutput>:" +msgid "Reboot your system. After reboot, confirm that the <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput>:" msgstr ""

#. Tag: title @@ -546,17 +332,12 @@

#. Tag: para #, no-c-format -msgid "" -"Enforcing: SELinux policy is enforced. SELinux denies access based on " -"SELinux policy rules." +msgid "Enforcing: SELinux policy is enforced. SELinux denies access based on SELinux policy rules." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Permissive: SELinux policy is not enforced. SELinux does not deny access, " -"but denials are logged for actions that would have been denied if running in " -"enforcing mode." +msgid "Permissive: SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode." msgstr ""

#. Tag: para @@ -566,21 +347,12 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/usr/sbin/setenforce</command> command to change between " -"enforcing and permissive mode. Changes made with <command>/usr/sbin/" -"setenforce</command> do not persist across reboots. To change to enforcing " -"mode, as the Linux root user, run the <command>/usr/sbin/setenforce 1</" -"command> command. To change to permissive mode, run the <command>/usr/sbin/" -"setenforce 0</command> command. Use the <command>/usr/sbin/getenforce</" -"command> command to view the current SELinux mode." +msgid "Use the <command>/usr/sbin/setenforce</command> command to change between enforcing and permissive mode. Changes made with <command>/usr/sbin/setenforce</command> do not persist across reboots. To change to enforcing mode, as the Linux root user, run the <command>/usr/sbin/setenforce 1</command> command. To change to permissive mode, run the <command>/usr/sbin/setenforce 0</command> command. Use the <command>/usr/sbin/getenforce</command> command to view the current SELinux mode." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Persistent mode changes are covered in <xref linkend="sect-Security-" -"Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux" />." +msgid "Persistent mode changes are covered in <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux" />." msgstr ""

#. Tag: title @@ -590,11 +362,7 @@

#. Tag: para #, no-c-format -msgid "" -"Booleans allow parts of SELinux policy to be changed at runtime, without any " -"knowledge of SELinux policy writing. This allows changes, such as allowing " -"services access to NFS file systems, without reloading or recompiling " -"SELinux policy." +msgid "Booleans allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing. This allows changes, such as allowing services access to NFS file systems, without reloading or recompiling SELinux policy." msgstr ""

#. Tag: title @@ -604,43 +372,27 @@

#. Tag: para #, no-c-format -msgid "" -"For a list of Booleans, an explanation of what each one is, and whether they " -"are on or off, run the <command>semanage boolean -l</command> command as the " -"Linux root user. The following example does not list all Booleans:" +msgid "For a list of Booleans, an explanation of what each one is, and whether they are on or off, run the <command>semanage boolean -l</command> command as the Linux root user. The following example does not list all Booleans:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>SELinux boolean</computeroutput> column lists Boolean " -"names. The <computeroutput>Description</computeroutput> column lists whether " -"the Booleans are on or off, and what they do." +msgid "The <computeroutput>SELinux boolean</computeroutput> column lists Boolean names. The <computeroutput>Description</computeroutput> column lists whether the Booleans are on or off, and what they do." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In the following example, the <computeroutput>ftp_home_dir</computeroutput> " -"Boolean is off, preventing the FTP daemon (<systemitem class="daemon" -"">vsftpd</systemitem>) from reading and writing to files in user home " -"directories:" +msgid "In the following example, the <computeroutput>ftp_home_dir</computeroutput> Boolean is off, preventing the FTP daemon (<systemitem class="daemon">vsftpd</systemitem>) from reading and writing to files in user home directories:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>getsebool -a</command> command lists Booleans, whether they are " -"on or off, but does not give a description of each one. The following " -"example does not list all Booleans:" +msgid "The <command>getsebool -a</command> command lists Booleans, whether they are on or off, but does not give a description of each one. The following example does not list all Booleans:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>getsebool <replaceable>boolean-name</replaceable></command> " -"command to only list the status of the <replaceable>boolean-name</" -"replaceable> Boolean:" +msgid "Run the <command>getsebool <replaceable>boolean-name</replaceable></command> command to only list the status of the <replaceable>boolean-name</replaceable> Boolean:" msgstr ""

#. Tag: para @@ -655,66 +407,42 @@

#. Tag: para #, no-c-format -msgid "" -"The <command>setsebool <replaceable>boolean-name</replaceable> " -"<replaceable>x</replaceable></command> command turns Booleans on or off, " -"where <replaceable>boolean-name</replaceable> is a Boolean name, and " -"<replaceable>x</replaceable> is either <option>on</option> to turn the " -"Boolean on, or <option>off</option> to turn it off." +msgid "The <command>setsebool <replaceable>boolean-name</replaceable> <replaceable>x</replaceable></command> command turns Booleans on or off, where <replaceable>boolean-name</replaceable> is a Boolean name, and <replaceable>x</replaceable> is either <option>on</option> to turn the Boolean on, or <option>off</option> to turn it off." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates configuring the " -"<computeroutput>httpd_can_network_connect_db</computeroutput> Boolean:" +msgid "The following example demonstrates configuring the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, the <computeroutput>httpd_can_network_connect_db</" -"computeroutput> Boolean is off, preventing Apache HTTP Server scripts and " -"modules from connecting to database servers:" +msgid "By default, the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean is off, preventing Apache HTTP Server scripts and modules from connecting to database servers:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To temporarily enable Apache HTTP Server scripts and modules to connect to " -"database servers, run the <command>setsebool httpd_can_network_connect_db " -"on</command> command as the Linux root user." +msgid "To temporarily enable Apache HTTP Server scripts and modules to connect to database servers, run the <command>setsebool httpd_can_network_connect_db on</command> command as the Linux root user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Use the <command>getsebool httpd_can_network_connect_db</command> command to " -"verify the Boolean is turned on:" +msgid "Use the <command>getsebool httpd_can_network_connect_db</command> command to verify the Boolean is turned on:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This allows Apache HTTP Server scripts and modules to connect to database " -"servers." +msgid "This allows Apache HTTP Server scripts and modules to connect to database servers." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"This change is not persistent across reboots. To make changes persistent " -"across reboots, run the <command>setsebool -P <replaceable>boolean-name</" -"replaceable> on</command> command as the Linux root user:" +msgid "This change is not persistent across reboots. To make changes persistent across reboots, run the <command>setsebool -P <replaceable>boolean-name</replaceable> on</command> command as the Linux root user:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To temporarily revert to the default behavior, as the Linux root user, run " -"the <command>setsebool httpd_can_network_connect_db off</command> command. " -"For changes that persist across reboots, run the <command>setsebool -P " -"httpd_can_network_connect_db off</command> command." +msgid "To temporarily revert to the default behavior, as the Linux root user, run the <command>setsebool httpd_can_network_connect_db off</command> command. For changes that persist across reboots, run the <command>setsebool -P httpd_can_network_connect_db off</command> command." msgstr ""

#. Tag: title @@ -724,34 +452,17 @@

#. Tag: para #, no-c-format -msgid "" -"By default, NFS mounts on the client side are labeled with a default context " -"defined by policy for NFS file systems. In common policies, this default " -"context uses the <computeroutput>nfs_t</computeroutput> type. Also, by " -"default, Samba shares mounted on the client side are labeled with a default " -"context defined by policy. In common policies, this default context uses the " -"<computeroutput>cifs_t</computeroutput> type." +msgid "By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Also, by default, Samba shares mounted on the client side are labeled with a default context defined by policy. In common policies, this default context uses the <computeroutput>cifs_t</computeroutput> type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Depending on policy configuration, services may not be able to read files " -"labeled with the <computeroutput>nfs_t</computeroutput> or " -"<computeroutput>cifs_t</computeroutput> types. This may prevent file systems " -"labeled with these types from being mounted and then read or exported by " -"other services. Booleans can be turned on or off to control which services " -"are allowed to access the <computeroutput>nfs_t</computeroutput> and " -"<computeroutput>cifs_t</computeroutput> types." +msgid "Depending on policy configuration, services may not be able to read files labeled with the <computeroutput>nfs_t</computeroutput> or <computeroutput>cifs_t</computeroutput> types. This may prevent file systems labeled with these types from being mounted and then read or exported by other services. Booleans can be turned on or off to control which services are allowed to access the <computeroutput>nfs_t</computeroutput> and <computeroutput>cifs_t</computeroutput> types." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>setsebool</command> and <command>semanage</command> commands " -"must be run as the Linux root user. The <command>setsebool -P</command> " -"command makes persistent changes. Do not use the <option>-P</option> option " -"if you do not want changes to persist across reboots:" +msgid "The <command>setsebool</command> and <command>semanage</command> commands must be run as the Linux root user. The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots:" msgstr ""

#. Tag: title @@ -761,9 +472,7 @@

#. Tag: para #, no-c-format -msgid "" -"To allow access to NFS file systems (files labeled with the " -"<computeroutput>nfs_t</computeroutput> type):" +msgid "To allow access to NFS file systems (files labeled with the <computeroutput>nfs_t</computeroutput> type):" msgstr ""

#. Tag: para @@ -773,9 +482,7 @@

#. Tag: para #, no-c-format -msgid "" -"To allow access to Samba file systems (files labeled with the " -"<computeroutput>cifs_t</computeroutput> type):" +msgid "To allow access to Samba file systems (files labeled with the <computeroutput>cifs_t</computeroutput> type):" msgstr ""

#. Tag: para @@ -850,18 +557,12 @@

#. Tag: para #, no-c-format -msgid "" -"These Booleans exist in SELinux policy as shipped with Fedora&nbsp;" -"&PRODVER;. They may not exist in policy shipped with other versions of " -"Fedora or other operating systems." +msgid "These Booleans exist in SELinux policy as shipped with Fedora&nbsp;&PRODVER;. They may not exist in policy shipped with other versions of Fedora or other operating systems." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to the SELinux Managing Confined Services Guide:<ulink url="http://" -"docs.fedoraproject.org/selinux-managing-confined-services-guide" /> for " -"more information relating to SELinux Booleans." +msgid "Refer to the SELinux Managing Confined Services Guide:<ulink url="http://docs.fedoraproject.org/selinux-managing-confined-services-guide%5C" /> for more information relating to SELinux Booleans." msgstr ""

#. Tag: title @@ -871,31 +572,17 @@

#. Tag: para #, no-c-format -msgid "" -"On systems running SELinux, all processes and files are labeled in a way " -"that represents security-relevant information. This information is called " -"the SELinux context. For files, this is viewed using the <command>ls -Z</" -"command> command:" +msgid "On systems running SELinux, all processes and files are labeled in a way that represents security-relevant information. This information is called the SELinux context. For files, this is viewed using the <command>ls -Z</command> command:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, SELinux provides a user (<computeroutput>unconfined_u</" -"computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type " -"(<computeroutput>user_home_t</computeroutput>), and a level " -"(<computeroutput>s0</computeroutput>). This information is used to make " -"access control decisions. On DAC systems, access is controlled based on " -"Linux user and group IDs. SELinux policy rules are checked after DAC rules. " -"SELinux policy rules are not used if DAC rules deny access first." +msgid "In this example, SELinux provides a user (<computeroutput>unconfined_u</computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type (<computeroutput>user_home_t</computeroutput>), and a level (<computeroutput>s0</computeroutput>). This information is used to make access control decisions. On DAC systems, access is controlled based on Linux user and group IDs. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"There are multiple commands for managing the SELinux context for files, such " -"as <command>chcon</command>, <command>semanage fcontext</command>, and " -"<command>restorecon</command>." +msgid "There are multiple commands for managing the SELinux context for files, such as <command>chcon</command>, <command>semanage fcontext</command>, and <command>restorecon</command>." msgstr ""

#. Tag: title @@ -905,14 +592,7 @@

#. Tag: para #, no-c-format -msgid "" -"The <command>chcon</command> command changes the SELinux context for files. " -"However, changes made with the <command>chcon</command> command do not " -"survive a file system relabel, or the execution of the <command>/sbin/" -"restorecon</command> command. SELinux policy controls whether users are able " -"to modify the SELinux context for any given file. When using <command>chcon</" -"command>, users provide all or part of the SELinux context to change. An " -"incorrect file type is a common cause of SELinux denying access." +msgid "The <command>chcon</command> command changes the SELinux context for files. However, changes made with the <command>chcon</command> command do not survive a file system relabel, or the execution of the <command>/sbin/restorecon</command> command. SELinux policy controls whether users are able to modify the SELinux context for any given file. When using <command>chcon</command>, users provide all or part of the SELinux context to change. An incorrect file type is a common cause of SELinux denying access." msgstr ""

#. Tag: title @@ -922,23 +602,12 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>chcon -t <replaceable>type</replaceable> <replaceable>file-" -"name</replaceable></command> command to change the file type, where " -"<replaceable>type</replaceable> is a type, such as " -"<computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>file-" -"name</replaceable> is a file or directory name." +msgid "Run the <command>chcon -t <replaceable>type</replaceable> <replaceable>file-name</replaceable></command> command to change the file type, where <replaceable>type</replaceable> is a type, such as <computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>file-name</replaceable> is a file or directory name." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>chcon -R -t <replaceable>type</replaceable> " -"<replaceable>directory-name</replaceable></command> command to change the " -"type of the directory and its contents, where <replaceable>type</" -"replaceable> is a type, such as <computeroutput>httpd_sys_content_t</" -"computeroutput>, and <replaceable>directory-name</replaceable> is a " -"directory name." +msgid "Run the <command>chcon -R -t <replaceable>type</replaceable> <replaceable>directory-name</replaceable></command> command to change the type of the directory and its contents, where <replaceable>type</replaceable> is a type, such as <computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>directory-name</replaceable> is a directory name." msgstr ""

#. Tag: title @@ -948,70 +617,42 @@

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates changing the type, and no other " -"attributes of the SELinux context:" +msgid "The following example demonstrates changing the type, and no other attributes of the SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd</command> command without arguments to change into your " -"home directory." +msgid "Run the <command>cd</command> command without arguments to change into your home directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>touch file1</command> command to create a new file. Use the " -"<command>ls -Z file1</command> command to view the SELinux context for " -"<filename>file1</filename>:" +msgid "Run the <command>touch file1</command> command to create a new file. Use the <command>ls -Z file1</command> command to view the SELinux context for <filename>file1</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, the SELinux context for <filename>file1</filename> includes " -"the SELinux <computeroutput>unconfined_u</computeroutput> user, " -"<computeroutput>object_r</computeroutput> role, <computeroutput>user_home_t</" -"computeroutput> type, and the <computeroutput>s0</computeroutput> level. For " -"a description of each part of the SELinux context, refer to <xref linkend=" -""chap-Security-Enhanced_Linux-SELinux_Contexts" />." +msgid "In this example, the SELinux context for <filename>file1</filename> includes the SELinux <computeroutput>unconfined_u</computeroutput> user, <computeroutput>object_r</computeroutput> role, <computeroutput>user_home_t</computeroutput> type, and the <computeroutput>s0</computeroutput> level. For a description of each part of the SELinux context, refer to <xref linkend="chap-Security-Enhanced_Linux-SELinux_Contexts" />." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>chcon -t samba_share_t file1</command> command to change " -"the type to <computeroutput>samba_share_t</computeroutput>. The <option>-t</" -"option> option only changes the type. View the change with <command>ls -Z " -"file1</command>:" +msgid "Run the <command>chcon -t samba_share_t file1</command> command to change the type to <computeroutput>samba_share_t</computeroutput>. The <option>-t</option> option only changes the type. View the change with <command>ls -Z file1</command>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/sbin/restorecon -v file1</command> command to restore the " -"SELinux context for the <filename>file1</filename> file. Use the <option>-v</" -"option> option to view what changes:" +msgid "Use the <command>/sbin/restorecon -v file1</command> command to restore the SELinux context for the <filename>file1</filename> file. Use the <option>-v</option> option to view what changes:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, the previous type, <computeroutput>samba_share_t</" -"computeroutput>, is restored to the correct, <computeroutput>user_home_t</" -"computeroutput> type. When using targeted policy (the default SELinux policy " -"in Fedora 11), the <command>/sbin/restorecon</command> command reads the " -"files in the <filename>/etc/selinux/targeted/contexts/files/</filename> " -"directory, to see which SELinux context files should have." +msgid "In this example, the previous type, <computeroutput>samba_share_t</computeroutput>, is restored to the correct, <computeroutput>user_home_t</computeroutput> type. When using targeted policy (the default SELinux policy in Fedora 11), the <command>/sbin/restorecon</command> command reads the files in the <filename>/etc/selinux/targeted/contexts/files/</filename> directory, to see which SELinux context files should have." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The example in this section works the same for directories, for example, if " -"<filename>file1</filename> was a directory." +msgid "The example in this section works the same for directories, for example, if <filename>file1</filename> was a directory." msgstr ""

#. Tag: title @@ -1021,39 +662,22 @@

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a new directory, and changing " -"the directory's file type (along with its contents) to a type used by the " -"Apache HTTP Server. The configuration in this example is used if you want " -"Apache HTTP Server to use a different document root (instead of <filename>/" -"var/www/html/</filename>):" +msgid "The following example demonstrates creating a new directory, and changing the directory's file type (along with its contents) to a type used by the Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of <filename>/var/www/html/</filename>):" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mkdir /web</command> command to " -"create a new directory, and then the <command>touch /web/file{1,2,3}</" -"command> command to create 3 empty files (<filename>file1</filename>, " -"<filename>file2</filename>, and <filename>file3</filename>). The <filename>/" -"web/</filename> directory and files in it are labeled with the " -"<computeroutput>default_t</computeroutput> type:" +msgid "As the Linux root user, run the <command>mkdir /web</command> command to create a new directory, and then the <command>touch /web/file{1,2,3}</command> command to create 3 empty files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). The <filename>/web/</filename> directory and files in it are labeled with the <computeroutput>default_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>chcon -R -t httpd_sys_content_t /" -"web/</command> command to change the type of the <filename>/web/</filename> " -"directory (and its contents) to <computeroutput>httpd_sys_content_t</" -"computeroutput>:" +msgid "As the Linux root user, run the <command>chcon -R -t httpd_sys_content_t /web/</command> command to change the type of the <filename>/web/</filename> directory (and its contents) to <computeroutput>httpd_sys_content_t</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -R -v /web/</" -"command> command to restore the default SELinux contexts:" +msgid "As the Linux root user, run the <command>/sbin/restorecon -R -v /web/</command> command to restore the default SELinux contexts:" msgstr ""

#. Tag: para @@ -1073,9 +697,7 @@

#. Tag: para #, no-c-format -msgid "" -"Type Enforcement is the main permission control used in SELinux targeted " -"policy. For the most part, SELinux users and roles can be ignored." +msgid "Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored." msgstr ""

#. Tag: title @@ -1085,20 +707,7 @@

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext</command> command changes the " -"SELinux context for files. When using targeted policy, changes made with " -"this command are added to the <filename>/etc/selinux/targeted/contexts/files/" -"file_contexts</filename> file if the changes are to files that exists in " -"<filename>file_contexts</filename>, or are added to <filename>file_contexts." -"local</filename> for new files and directories, such as creating a " -"<filename>/web/</filename> directory. <command>setfiles</command>, which is " -"used when a file system is relabeled, and <command>/sbin/restorecon</" -"command>, which restores the default SELinux contexts, read these files. " -"This means that changes made by <command>/usr/sbin/semanage fcontext</" -"command> are persistent, even if the file system is relabeled. SELinux " -"policy controls whether users are able to modify the SELinux context for any " -"given file." +msgid "The <command>/usr/sbin/semanage fcontext</command> command changes the SELinux context for files. When using targeted policy, changes made with this command are added to the <filename>/etc/selinux/targeted/contexts/files/file_contexts</filename> file if the changes are to files that exists in <filename>file_contexts</filename>, or are added to <filename>file_contexts.local</filename> for new files and directories, such as creating a <filename>/web/</filename> directory. <command>setfiles</command>, which is used when a file system is relabeled, and <command>/sbin/restorecon</command>, which restores the default SELinux contexts, read these files. This means that changes made by <command>/usr/sbin/semanage fcontext</command> are persistent, even if the file system is relabeled. SELinux policy controls whether users are able to modify the SELinux context for any given file." msgstr ""

#. Tag: para @@ -1108,19 +717,12 @@

#. Tag: para #, no-c-format -msgid "" -"Run the <command>/usr/sbin/semanage fcontext -a <replaceable>options</" -"replaceable> <replaceable>file-name</replaceable>|<replaceable>directory-" -"name</replaceable></command> command, remembering to use the full path to " -"the file or directory." +msgid "Run the <command>/usr/sbin/semanage fcontext -a <replaceable>options</replaceable> <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command, remembering to use the full path to the file or directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>/sbin/restorecon -v <replaceable>file-name</replaceable>|" -"<replaceable>directory-name</replaceable></command> command to apply the " -"context changes." +msgid "Run the <command>/sbin/restorecon -v <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command to apply the context changes." msgstr ""

#. Tag: title @@ -1130,66 +732,37 @@

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates changing a file's type, and no other " -"attributes of the SELinux context:" +msgid "The following example demonstrates changing a file's type, and no other attributes of the SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /etc/file1</command> command " -"to create a new file. By default, newly-created files in the <filename>/etc/" -"</filename> directory are labeled with the <computeroutput>etc_t</" -"computeroutput> type:" +msgid "As the Linux root user, run the <command>touch /etc/file1</command> command to create a new file. By default, newly-created files in the <filename>/etc/</filename> directory are labeled with the <computeroutput>etc_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"samba_share_t /etc/file1</command> command to change the <filename>file1</" -"filename> type to <computeroutput>samba_share_t</computeroutput>. The " -"<option>-a</option> option adds a new record, and the <option>-t</option> " -"option defines a type (<computeroutput>samba_share_t</computeroutput>). " -"Note: running this command does not directly change the type - " -"<filename>file1</filename> is still labeled with the <computeroutput>etc_t</" -"computeroutput> type:" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</command> command to change the <filename>file1</filename> type to <computeroutput>samba_share_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (<computeroutput>samba_share_t</computeroutput>). Note: running this command does not directly change the type - <filename>file1</filename> is still labeled with the <computeroutput>etc_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</" -"command> command adds the following entry to <filename>/etc/selinux/targeted/" -"contexts/files/file_contexts.local</filename>:" +msgid "The <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</command> command adds the following entry to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -v /etc/file1</" -"command> command to change the type. Since the <command>semanage</command> " -"command added an entry to <filename>file.contexts.local</filename> for " -"<filename>/etc/file1</filename>, the <command>/sbin/restorecon</command> " -"command changes the type to <computeroutput>samba_share_t</computeroutput>:" +msgid "As the Linux root user, run the <command>/sbin/restorecon -v /etc/file1</command> command to change the type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <filename>/etc/file1</filename>, the <command>/sbin/restorecon</command> command changes the type to <computeroutput>samba_share_t</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>rm -i /etc/file1</command> command " -"to remove <filename>file1</filename>." +msgid "As the Linux root user, run the <command>rm -i /etc/file1</command> command to remove <filename>file1</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /etc/" -"file1</command> command to remove the context added for <filename>/etc/" -"file1</filename>. When the context is removed, running <command>restorecon</" -"command> changes the type to <computeroutput>etc_t</computeroutput>, rather " -"than <computeroutput>samba_share_t</computeroutput>." +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /etc/file1</command> command to remove the context added for <filename>/etc/file1</filename>. When the context is removed, running <command>restorecon</command> changes the type to <computeroutput>etc_t</computeroutput>, rather than <computeroutput>samba_share_t</computeroutput>." msgstr ""

#. Tag: title @@ -1199,156 +772,82 @@

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a new directory and changing " -"that directory's file type, to a type used by Apache HTTP Server:" +msgid "The following example demonstrates creating a new directory and changing that directory's file type, to a type used by Apache HTTP Server:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mkdir /web</command> command to " -"create a new directory. This directory is labeled with the " -"<computeroutput>default_t</computeroutput> type:" +msgid "As the Linux root user, run the <command>mkdir /web</command> command to create a new directory. This directory is labeled with the <computeroutput>default_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>ls</command> <option>-d</option> option makes <command>ls</" -"command> list information about a directory, rather than its contents, and " -"the <option>-Z</option> option makes <command>ls</command> display the " -"SELinux context (in this example, <computeroutput>unconfined_u:object_r:" -"default_t:s0</computeroutput>)." +msgid "The <command>ls</command> <option>-d</option> option makes <command>ls</command> list information about a directory, rather than its contents, and the <option>-Z</option> option makes <command>ls</command> display the SELinux context (in this example, <computeroutput>unconfined_u:object_r:default_t:s0</computeroutput>)." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"httpd_sys_content_t /web</command> command to change the <filename>/web/</" -"filename> type to <computeroutput>httpd_sys_content_t</computeroutput>. The " -"<option>-a</option> option adds a new record, and the <option>-t</option> " -"option defines a type (<computeroutput>httpd_sys_content_t</" -"computeroutput>). Note: running this command does not directly change the " -"type - <filename>/web/</filename> is still labeled with the " -"<computeroutput>default_t</computeroutput> type:" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</command> command to change the <filename>/web/</filename> type to <computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (<computeroutput>httpd_sys_content_t</computeroutput>). Note: running this command does not directly change the type - <filename>/web/</filename> is still labeled with the <computeroutput>default_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</" -"command> command adds the following entry to <command>/etc/selinux/targeted/" -"contexts/files/file_contexts.local</command>:" +msgid "The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</command> command adds the following entry to <command>/etc/selinux/targeted/contexts/files/file_contexts.local</command>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -v /web</command> " -"command to change the type. Since the <command>semanage</command> command " -"added an entry to <filename>file.contexts.local</filename> for <filename>/" -"web</filename>, the <command>/sbin/restorecon</command> command changes the " -"type to <computeroutput>httpd_sys_content_t</computeroutput>:" +msgid "As the Linux root user, run the <command>/sbin/restorecon -v /web</command> command to change the type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <filename>/web</filename>, the <command>/sbin/restorecon</command> command changes the type to <computeroutput>httpd_sys_content_t</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, newly-created files and directories inherit the SELinux type of " -"their parent folders. When using this example, and before removing the " -"SELinux context added for <filename>/web/</filename>, files and directories " -"created in the <filename>/web/</filename> directory are labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> type." +msgid "By default, newly-created files and directories inherit the SELinux type of their parent folders. When using this example, and before removing the SELinux context added for <filename>/web/</filename>, files and directories created in the <filename>/web/</filename> directory are labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /" -"web</command> command to remove the context added for <filename>/web/</" -"filename>." +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /web</command> command to remove the context added for <filename>/web/</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -v /web</command> " -"command to restore the default SELinux context." +msgid "As the Linux root user, run the <command>/sbin/restorecon -v /web</command> command to restore the default SELinux context." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a new directory, and changing " -"the directory's file type (along with its contents) to a type used by Apache " -"HTTP Server. The configuration in this example is used if you want Apache " -"HTTP Server to use a different document root (instead of <filename>/var/www/" -"html/</filename>):" +msgid "The following example demonstrates creating a new directory, and changing the directory's file type (along with its contents) to a type used by Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of <filename>/var/www/html/</filename>):" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"httpd_sys_content_t "/web(/.*)?"</command> command to change the type of " -"the <filename>/web/</filename> directory and the files in it, to " -"<computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</" -"option> option adds a new record, and the <option>-t</option> option defines " -"a type (httpd_sys_content_t). The <computeroutput>"/web(/.*)?"</" -"computeroutput> regular expression causes the <command>semanage</command> " -"command to apply changes to the <filename>/web/</filename> directory, as " -"well as the files in it. Note: running this command does not directly change " -"the type - <filename>/web/</filename> and files in it are still labeled with " -"the <computeroutput>default_t</computeroutput> type:" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> command to change the type of the <filename>/web/</filename> directory and the files in it, to <computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (httpd_sys_content_t). The <computeroutput>"/web(/.*)?"</computeroutput> regular expression causes the <command>semanage</command> command to apply changes to the <filename>/web/</filename> directory, as well as the files in it. Note: running this command does not directly change the type - <filename>/web/</filename> and files in it are still labeled with the <computeroutput>default_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/." -"*)?"</command> command adds the following entry to <filename>/etc/selinux/" -"targeted/contexts/files/file_contexts.local</filename>:" +msgid "The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> command adds the following entry to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -R -v /web</" -"command> command to change the type of the <filename>/web/</filename> " -"directory, as well as all files in it. The <option>-R</option> is for " -"recursive, which means all files and directories under the <filename>/web/</" -"filename> directory are labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> type. Since the " -"<command>semanage</command> command added an entry to <filename>file." -"contexts.local</filename> for <computeroutput>/web(/.*)?</computeroutput>, " -"the <command>/sbin/restorecon</command> command changes the types to " -"<computeroutput>httpd_sys_content_t</computeroutput>:" +msgid "As the Linux root user, run the <command>/sbin/restorecon -R -v /web</command> command to change the type of the <filename>/web/</filename> directory, as well as all files in it. The <option>-R</option> is for recursive, which means all files and directories under the <filename>/web/</filename> directory are labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <computeroutput>/web(/.*)?</computeroutput>, the <command>/sbin/restorecon</command> command changes the types to <computeroutput>httpd_sys_content_t</computeroutput>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, newly-created files and directories inherit the SELinux type of " -"their parents. In this example, files and directories created in the " -"<filename>/web/</filename> directory will be labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> type." +msgid "By default, newly-created files and directories inherit the SELinux type of their parents. In this example, files and directories created in the <filename>/web/</filename> directory will be labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d "/" -"web(/.*)?"</command> command to remove the context added for " -"<computeroutput>"/web(/.*)?"</computeroutput>." +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d "/web(/.*)?"</command> command to remove the context added for <computeroutput>"/web(/.*)?"</computeroutput>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -R -v /web</" -"command> command to restore the default SELinux contexts." +msgid "As the Linux root user, run the <command>/sbin/restorecon -R -v /web</command> command to restore the default SELinux contexts." msgstr ""

#. Tag: title @@ -1358,41 +857,22 @@

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates adding and removing an SELinux context:" +msgid "The following example demonstrates adding and removing an SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"httpd_sys_content_t /test</command> command. The <filename>/test/</filename> " -"directory does not have to exist. This command adds the following context to " -"<filename>/etc/selinux/targeted/contexts/files/file_contexts.local</" -"filename>:" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /test</command> command. The <filename>/test/</filename> directory does not have to exist. This command adds the following context to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To remove the context, as the Linux root user, run the <command>/usr/sbin/" -"semanage fcontext -d <replaceable>file-name</replaceable>|" -"<replaceable>directory-name</replaceable></command> command, where " -"<replaceable>file-name</replaceable>|<replaceable>directory-name</" -"replaceable> is the first part in <filename>file_contexts.local</filename>. " -"The following is an example of a context in <filename>file_contexts.local</" -"filename>:" +msgid "To remove the context, as the Linux root user, run the <command>/usr/sbin/semanage fcontext -d <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command, where <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable> is the first part in <filename>file_contexts.local</filename>. The following is an example of a context in <filename>file_contexts.local</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"With the first part being <computeroutput>/test</computeroutput>. To prevent " -"the <filename>/test/</filename> directory from being labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> after running <command>/" -"sbin/restorecon</command>, or after a file system relabel, run the following " -"command as the Linux root user to delete the context from " -"<filename>file_contexts.local</filename>:" +msgid "With the first part being <computeroutput>/test</computeroutput>. To prevent the <filename>/test/</filename> directory from being labeled with the <computeroutput>httpd_sys_content_t</computeroutput> after running <command>/sbin/restorecon</command>, or after a file system relabel, run the following command as the Linux root user to delete the context from <filename>file_contexts.local</filename>:" msgstr ""

#. Tag: para @@ -1402,10 +882,7 @@

#. Tag: para #, no-c-format -msgid "" -"If the context is part of a regular expression, for example, " -"<computeroutput>/web(/.*)?</computeroutput>, use quotation marks around the " -"regular expression:" +msgid "If the context is part of a regular expression, for example, <computeroutput>/web(/.*)?</computeroutput>, use quotation marks around the regular expression:" msgstr ""

#. Tag: para @@ -1420,18 +897,12 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page for further information about <command>/usr/sbin/semanage</" -"command>." +msgid "manual page for further information about <command>/usr/sbin/semanage</command>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When changing the SELinux context with <command>/usr/sbin/semanage fcontext -" -"a</command>, use the full path to the file or directory to avoid files being " -"mislabeled after a file system relabel, or after the <command>/sbin/" -"restorecon</command> command is run." +msgid "When changing the SELinux context with <command>/usr/sbin/semanage fcontext -a</command>, use the full path to the file or directory to avoid files being mislabeled after a file system relabel, or after the <command>/sbin/restorecon</command> command is run." msgstr ""

#. Tag: title @@ -1441,37 +912,12 @@

#. Tag: para #, no-c-format -msgid "" -"For file systems that support extended attributes, when a file that lacks an " -"SELinux context on disk is accessed, it is treated as if it had a default " -"context as defined by SELinux policy. In common policies, this default " -"context uses the <computeroutput>file_t</computeroutput> type. This should " -"be the only use of this type, so that files without a context on disk can be " -"distinguished in policy, and generally kept inaccessible to confined " -"domains. The <computeroutput>file_t</computeroutput> type should not exist " -"on correctly-labeled file systems, because all files on a system running " -"SELinux should have an SELinux context, and the <computeroutput>file_t</" -"computeroutput> type is never used in file-context configuration<footnote> " -"<para> Files in <filename>/etc/selinux/targeted/contexts/files/</filename> " -"define contexts for files and directories. Files in this directory are read " -"by <command>restorecon</command> and <command>setfiles</command> to restore " -"files and directories to their default contexts. </para> </footnote>." +msgid "For file systems that support extended attributes, when a file that lacks an SELinux context on disk is accessed, it is treated as if it had a default context as defined by SELinux policy. In common policies, this default context uses the <computeroutput>file_t</computeroutput> type. This should be the only use of this type, so that files without a context on disk can be distinguished in policy, and generally kept inaccessible to confined domains. The <computeroutput>file_t</computeroutput> type should not exist on correctly-labeled file systems, because all files on a system running SELinux should have an SELinux context, and the <computeroutput>file_t</computeroutput> type is never used in file-context configuration<footnote> <para> Files in <filename>/etc/selinux/targeted/contexts/files/</filename> define contexts for files and directories. Files in this directory are read by <command>restorecon</command> and <command>setfiles</command> to restore files and directo ries to their default contexts. </para> </footnote>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>default_t</computeroutput> type is used on files that do " -"not match any other pattern in file-context configuration, so that such " -"files can be distinguished from files that do not have a context on disk, " -"and generally kept inaccessible to confined domains. If you create a new top-" -"level directory, such as <filename>/mydirectory/</filename>, this directory " -"may be labeled with the <computeroutput>default_t</computeroutput> type. If " -"services need access to such a directory, update the file-contexts " -"configuration for this location. Refer to <xref linkend="sect-Security-" -"Enhanced_Linux-SELinux_Contexts_Labeling_Files-" -"Persistent_Changes_semanage_fcontext" /> for details on adding a context to " -"the file-context configuration." +msgid "The <computeroutput>default_t</computeroutput> type is used on files that do not match any other pattern in file-context configuration, so that such files can be distinguished from files that do not have a context on disk, and generally kept inaccessible to confined domains. If you create a new top-level directory, such as <filename>/mydirectory/</filename>, this directory may be labeled with the <computeroutput>default_t</computeroutput> type. If services need access to such a directory, update the file-contexts configuration for this location. Refer to <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> for details on adding a context to the file-context configuration." msgstr ""

#. Tag: title @@ -1481,36 +927,17 @@

#. Tag: para #, no-c-format -msgid "" -"By default, when a file system that supports extended attributes is mounted, " -"the security context for each file is obtained from the <emphasis>security." -"selinux</emphasis> extended attribute of the file. Files in file systems " -"that do not support extended attributes are assigned a single, default " -"security context from the policy configuration, based on file system type." +msgid "By default, when a file system that supports extended attributes is mounted, the security context for each file is obtained from the <emphasis>security.selinux</emphasis> extended attribute of the file. Files in file systems that do not support extended attributes are assigned a single, default security context from the policy configuration, based on file system type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Use the <command>mount -o context</command> command to override existing " -"extended attributes, or to specify a different, default context for file " -"systems that do not support extended attributes. This is useful if you do " -"not trust a file system to supply the correct attributes, for example, " -"removable media used in multiple systems. The <command>mount -o context</" -"command> command can also be used to support labeling for file systems that " -"do not support extended attributes, such as File Allocation Table (FAT) or " -"NFS file systems. The context specified with the <option>context</option> is " -"not written to disk: the original contexts are preserved, and are seen when " -"mounting without a <option>context</option> option (if the file system had " -"extended attributes in the first place)." +msgid "Use the <command>mount -o context</command> command to override existing extended attributes, or to specify a different, default context for file systems that do not support extended attributes. This is useful if you do not trust a file system to supply the correct attributes, for example, removable media used in multiple systems. The <command>mount -o context</command> command can also be used to support labeling for file systems that do not support extended attributes, such as File Allocation Table (FAT) or NFS file systems. The context specified with the <option>context</option> is not written to disk: the original contexts are preserved, and are seen when mounting without a <option>context</option> option (if the file system had extended attributes in the first place)." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"For further information about file system labeling, refer to James Morris's " -""Filesystem Labeling in SELinux" article: <ulink url="http://www." -"linuxjournal.com/article/7426" />." +msgid "For further information about file system labeling, refer to James Morris's "Filesystem Labeling in SELinux" article: <ulink url="http://www.linuxjournal.com/article/7426%5C" />." msgstr ""

#. Tag: title @@ -1520,52 +947,22 @@

#. Tag: para #, no-c-format -msgid "" -"To mount a file system with the specified context, overriding existing " -"contexts if they exist, or to specify a different, default context for a " -"file system that does not support extended attributes, as the Linux root " -"user, use the <command>mount -o context=<replaceable>SELinux_user:role:type:" -"level</replaceable></command> command when mounting the desired file system. " -"Context changes are not written to disk. By default, NFS mounts on the " -"client side are labeled with a default context defined by policy for NFS " -"file systems. In common policies, this default context uses the " -"<computeroutput>nfs_t</computeroutput> type. Without additional mount " -"options, this may prevent sharing NFS file systems via other services, such " -"as the Apache HTTP Server. The following example mounts an NFS file system " -"so that it can be shared via the Apache HTTP Server:" +msgid "To mount a file system with the specified context, overriding existing contexts if they exist, or to specify a different, default context for a file system that does not support extended attributes, as the Linux root user, use the <command>mount -o context=<replaceable>SELinux_user:role:type:level</replaceable></command> command when mounting the desired file system. Context changes are not written to disk. By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Without additional mount options, this may prevent sharing NFS file systems via other services, such as the Apache HTTP Server. The following example mounts an NFS file system so that it can be shared via the Apache HTTP Server:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Newly-created files and directories on this file system appear to have the " -"SELinux context specified with <option>-o context</option>; however, since " -"context changes are not written to disk for these situations, the context " -"specified with the <option>context</option> option is only retained if the " -"<option>context</option> option is used on the next mount, and if the same " -"context is specified." +msgid "Newly-created files and directories on this file system appear to have the SELinux context specified with <option>-o context</option>; however, since context changes are not written to disk for these situations, the context specified with the <option>context</option> option is only retained if the <option>context</option> option is used on the next mount, and if the same context is specified." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Type Enforcement is the main permission control used in SELinux targeted " -"policy. For the most part, SELinux users and roles can be ignored, so, when " -"overriding the SELinux context with <option>-o context</option>, use the " -"SELinux <computeroutput>system_u</computeroutput> user and " -"<computeroutput>object_r</computeroutput> role, and concentrate on the type. " -"If you are not using the MLS policy or multi-category security, use the " -"<computeroutput>s0</computeroutput> level." +msgid "Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored, so, when overriding the SELinux context with <option>-o context</option>, use the SELinux <computeroutput>system_u</computeroutput> user and <computeroutput>object_r</computeroutput> role, and concentrate on the type. If you are not using the MLS policy or multi-category security, use the <computeroutput>s0</computeroutput> level." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When a file system is mounted with a <option>context</option> option, " -"context changes (by users and processes) are prohibited. For example, " -"running <command>chcon</command> on a file system mounted with a " -"<option>context</option> option results in a <computeroutput>Operation not " -"supported</computeroutput> error." +msgid "When a file system is mounted with a <option>context</option> option, context changes (by users and processes) are prohibited. For example, running <command>chcon</command> on a file system mounted with a <option>context</option> option results in a <computeroutput>Operation not supported</computeroutput> error." msgstr ""

#. Tag: title @@ -1575,25 +972,12 @@

#. Tag: para #, no-c-format -msgid "" -"As mentioned in <xref linkend="sect-Security-Enhanced_Linux-" -"Working_with_SELinux-The_file_t_and_default_t_Types" />, on file systems " -"that support extended attributes, when a file that lacks an SELinux context " -"on disk is accessed, it is treated as if it had a default context as defined " -"by SELinux policy. In common policies, this default context uses the " -"<computeroutput>file_t</computeroutput> type. If it is desirable to use a " -"different default context, mount the file system with the " -"<option>defcontext</option> option." +msgid "As mentioned in <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-The_file_t_and_default_t_Types" />, on file systems that support extended attributes, when a file that lacks an SELinux context on disk is accessed, it is treated as if it had a default context as defined by SELinux policy. In common policies, this default context uses the <computeroutput>file_t</computeroutput> type. If it is desirable to use a different default context, mount the file system with the <option>defcontext</option> option." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example mounts a newly-created file system (on <filename>/dev/" -"sda2</filename>) to the newly-created <filename>/test/</filename> directory. " -"It assumes that there are no rules in <filename>/etc/selinux/targeted/" -"contexts/files/</filename> that define a context for the <filename>/test/</" -"filename> directory:" +msgid "The following example mounts a newly-created file system (on <filename>/dev/sda2</filename>) to the newly-created <filename>/test/</filename> directory. It assumes that there are no rules in <filename>/etc/selinux/targeted/contexts/files/</filename> that define a context for the <filename>/test/</filename> directory:" msgstr ""

#. Tag: para @@ -1603,30 +987,17 @@

#. Tag: para #, no-c-format -msgid "" -"the <option>defcontext</option> option defines that <computeroutput>system_u:" -"object_r:samba_share_t:s0</computeroutput> is "the default security context " -"for unlabeled files"<footnote> <para> Morris, James. "Filesystem Labeling " -"in SELinux". Published 1 October 2004. Accessed 14 October 2008: <ulink url=" -""http://www.linuxjournal.com/article/7426%5C" />. </para> </footnote>." +msgid "the <option>defcontext</option> option defines that <computeroutput>system_u:object_r:samba_share_t:s0</computeroutput> is "the default security context for unlabeled files"<footnote> <para> Morris, James. "Filesystem Labeling in SELinux". Published 1 October 2004. Accessed 14 October 2008: <ulink url="http://www.linuxjournal.com/article/7426%5C" />. </para> </footnote>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"when mounted, the root directory (<filename>/test/</filename>) of the file " -"system is treated as if it is labeled with the context specified by " -"<option>defcontext</option> (this label is not stored on disk). This affects " -"the labeling for files created under <filename>/test/</filename>: new files " -"inherit the <computeroutput>samba_share_t</computeroutput> type, and these " -"labels are stored on disk." +msgid "when mounted, the root directory (<filename>/test/</filename>) of the file system is treated as if it is labeled with the context specified by <option>defcontext</option> (this label is not stored on disk). This affects the labeling for files created under <filename>/test/</filename>: new files inherit the <computeroutput>samba_share_t</computeroutput> type, and these labels are stored on disk." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"files created under <filename>/test/</filename> while the file system was " -"mounted with a <option>defcontext</option> option retain their labels." +msgid "files created under <filename>/test/</filename> while the file system was mounted with a <option>defcontext</option> option retain their labels." msgstr ""

#. Tag: title @@ -1636,44 +1007,22 @@

#. Tag: para #, no-c-format -msgid "" -"By default, NFS mounts on the client side are labeled with a default context " -"defined by policy for NFS file systems. In common policies, this default " -"context uses the <computeroutput>nfs_t</computeroutput> type. Depending on " -"policy configuration, services, such as Apache HTTP Server and MySQL, may " -"not be able to read files labeled with the <computeroutput>nfs_t</" -"computeroutput> type. This may prevent file systems labeled with this type " -"from being mounted and then read or exported by other services." +msgid "By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Depending on policy configuration, services, such as Apache HTTP Server and MySQL, may not be able to read files labeled with the <computeroutput>nfs_t</computeroutput> type. This may prevent file systems labeled with this type from being mounted and then read or exported by other services." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If you would like to mount an NFS file system and read or export that file " -"system with another service, use the <option>context</option> option when " -"mounting to override the <computeroutput>nfs_t</computeroutput> type. Use " -"the following context option to mount NFS file systems so that they can be " -"shared via the Apache HTTP Server:" +msgid "If you would like to mount an NFS file system and read or export that file system with another service, use the <option>context</option> option when mounting to override the <computeroutput>nfs_t</computeroutput> type. Use the following context option to mount NFS file systems so that they can be shared via the Apache HTTP Server:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Since context changes are not written to disk for these situations, the " -"context specified with the <option>context</option> option is only retained " -"if the <option>context</option> option is used on the next mount, and if the " -"same context is specified." +msgid "Since context changes are not written to disk for these situations, the context specified with the <option>context</option> option is only retained if the <option>context</option> option is used on the next mount, and if the same context is specified." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As an alternative to mounting file systems with <option>context</option> " -"options, Booleans can be turned on to allow services access to file systems " -"labeled with the <computeroutput>nfs_t</computeroutput> type. Refer to <xref " -"linkend="sect-Security-Enhanced_Linux-Booleans-Booleans_for_NFS_and_CIFS" /" -"> for instructions on configuring Booleans to allow services access to the " -"<computeroutput>nfs_t</computeroutput> type." +msgid "As an alternative to mounting file systems with <option>context</option> options, Booleans can be turned on to allow services access to file systems labeled with the <computeroutput>nfs_t</computeroutput> type. Refer to <xref linkend="sect-Security-Enhanced_Linux-Booleans-Booleans_for_NFS_and_CIFS" /> for instructions on configuring Booleans to allow services access to the <computeroutput>nfs_t</computeroutput> type." msgstr ""

#. Tag: title @@ -1683,55 +1032,27 @@

#. Tag: para #, no-c-format -msgid "" -"When mounting multiple mounts from the same NFS export, attempting to " -"override the SELinux context of each mount with a different context, results " -"in subsequent mount commands failing. In the following example, the NFS " -"server has a single export, <filename>/export</filename>, which has two " -"subdirectories, <filename>web/</filename> and <filename>database/</" -"filename>. The following commands attempt two mounts from a single NFS " -"export, and try to override the context for each one:" +msgid "When mounting multiple mounts from the same NFS export, attempting to override the SELinux context of each mount with a different context, results in subsequent mount commands failing. In the following example, the NFS server has a single export, <filename>/export</filename>, which has two subdirectories, <filename>web/</filename> and <filename>database/</filename>. The following commands attempt two mounts from a single NFS export, and try to override the context for each one:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The second mount command fails, and the following is logged to <filename>/" -"var/log/messages</filename>:" +msgid "The second mount command fails, and the following is logged to <filename>/var/log/messages</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To mount multiple mounts from a single NFS export, with each mount having a " -"different context, use the <option>-o nosharecache,context</option> options. " -"The following example mounts multiple mounts from a single NFS export, with " -"a different context for each mount (allowing a single service access to each " -"one):" +msgid "To mount multiple mounts from a single NFS export, with each mount having a different context, use the <option>-o nosharecache,context</option> options. The following example mounts multiple mounts from a single NFS export, with a different context for each mount (allowing a single service access to each one):" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, <computeroutput>server:/export/web</computeroutput> is " -"mounted locally to <filename>/local/web/</filename>, with all files being " -"labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"allowing Apache HTTP Server access. <computeroutput>server:/export/database</" -"computeroutput> is mounted locally to <filename>/local/database</filename>, " -"with all files being labeled with the <computeroutput>mysqld_db_t</" -"computeroutput> type, allowing MySQL access. These type changes are not " -"written to disk." +msgid "In this example, <computeroutput>server:/export/web</computeroutput> is mounted locally to <filename>/local/web/</filename>, with all files being labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, allowing Apache HTTP Server access. <computeroutput>server:/export/database</computeroutput> is mounted locally to <filename>/local/database</filename>, with all files being labeled with the <computeroutput>mysqld_db_t</computeroutput> type, allowing MySQL access. These type changes are not written to disk." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <option>nosharecache</option> options allows you to mount the same " -"subdirectory of an export multiple times with different contexts (for " -"example, mounting <filename>/export/web</filename> multiple times). Do not " -"mount the same subdirectory from an export multiple times with different " -"contexts, as this creates an overlapping mount, where files are accessible " -"under two different contexts." +msgid "The <option>nosharecache</option> options allows you to mount the same subdirectory of an export multiple times with different contexts (for example, mounting <filename>/export/web</filename> multiple times). Do not mount the same subdirectory from an export multiple times with different contexts, as this creates an overlapping mount, where files are accessible under two different contexts." msgstr ""

#. Tag: title @@ -1741,20 +1062,12 @@

#. Tag: para #, no-c-format -msgid "" -"To make context mounts persistent across remounting and reboots, add entries " -"for the file systems in <filename>/etc/fstab</filename> or an automounter " -"map, and use the desired context as a mount option. The following example " -"adds an entry to <filename>/etc/fstab</filename> for an NFS context mount:" +msgid "To make context mounts persistent across remounting and reboots, add entries for the file systems in <filename>/etc/fstab</filename> or an automounter map, and use the desired context as a mount option. The following example adds an entry to <filename>/etc/fstab</filename> for an NFS context mount:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://www.redhat.com/docs/en-US/" -"Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/s1-nfs-client-config.html" -"">Red Hat Enterprise Linux 5 Deployment Guide, Section 19.2. "NFS Client " -"Configuration"</ulink> for information about mounting NFS file systems." +msgid "Refer to the <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux 5 Deployment Guide, Section 19.2. "NFS Client Configuration"</ulink> for information about mounting NFS file systems." msgstr ""

#. Tag: title @@ -1764,10 +1077,7 @@

#. Tag: para #, no-c-format -msgid "" -"These sections describe what happens to SELinux contexts when copying, " -"moving, and archiving files and directories. Also, it explains how to " -"preserve contexts when copying and archiving." +msgid "These sections describe what happens to SELinux contexts when copying, moving, and archiving files and directories. Also, it explains how to preserve contexts when copying and archiving." msgstr ""

#. Tag: title @@ -1777,42 +1087,22 @@

#. Tag: para #, no-c-format -msgid "" -"When a file or directory is copied, a new file or directory is created if it " -"does not exist. That new file or directory's context is based on default-" -"labeling rules, not the original file or directory's context (unless options " -"were used to preserve the original context). For example, files created in " -"user home directories are labeled with the <computeroutput>user_home_t</" -"computeroutput> type:" +msgid "When a file or directory is copied, a new file or directory is created if it does not exist. That new file or directory's context is based on default-labeling rules, not the original file or directory's context (unless options were used to preserve the original context). For example, files created in user home directories are labeled with the <computeroutput>user_home_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If such a file is copied to another directory, such as <filename>/etc/</" -"filename>, the new file is created in accordance to default-labeling rules " -"for the <filename>/etc/</filename> directory. Copying a file (without " -"additional options) may not preserve the original context:" +msgid "If such a file is copied to another directory, such as <filename>/etc/</filename>, the new file is created in accordance to default-labeling rules for the <filename>/etc/</filename> directory. Copying a file (without additional options) may not preserve the original context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When <filename>file1</filename> is copied to <filename>/etc/</filename>, if " -"<filename>/etc/file1</filename> does not exist, <filename>/etc/file1</" -"filename> is created as a new file. As shown in the example above, " -"<filename>/etc/file1</filename> is labeled with the <computeroutput>etc_t</" -"computeroutput> type, in accordance to default-labeling rules." +msgid "When <filename>file1</filename> is copied to <filename>/etc/</filename>, if <filename>/etc/file1</filename> does not exist, <filename>/etc/file1</filename> is created as a new file. As shown in the example above, <filename>/etc/file1</filename> is labeled with the <computeroutput>etc_t</computeroutput> type, in accordance to default-labeling rules." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"When a file is copied over an existing file, the existing file's context is " -"preserved, unless the user specified <command>cp</command> options to " -"preserve the context of the original file, such as <option>--" -"preserve=context</option>. SELinux policy may prevent contexts from being " -"preserved during copies." +msgid "When a file is copied over an existing file, the existing file's context is preserved, unless the user specified <command>cp</command> options to preserve the context of the original file, such as <option>--preserve=context</option>. SELinux policy may prevent contexts from being preserved during copies." msgstr ""

#. Tag: title @@ -1822,22 +1112,12 @@

#. Tag: para #, no-c-format -msgid "" -"When copying a file with the <command>cp</command> command, if no options " -"are given, the type is inherited from the targeted, parent directory:" +msgid "When copying a file with the <command>cp</command> command, if no options are given, the type is inherited from the targeted, parent directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, <filename>file1</filename> is created in a user's home " -"directory, and is labeled with the <computeroutput>user_home_t</" -"computeroutput> type. The <filename>/var/www/html/</filename> directory is " -"labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"as shown with the <command>ls -dZ /var/www/html/</command> command. When " -"<filename>file1</filename> is copied to <filename>/var/www/html/</filename>, " -"it inherits the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"as shown with the <command>ls -Z /var/www/html/file1</command> command." +msgid "In this example, <filename>file1</filename> is created in a user's home directory, and is labeled with the <computeroutput>user_home_t</computeroutput> type. The <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -dZ /var/www/html/</command> command. When <filename>file1</filename> is copied to <filename>/var/www/html/</filename>, it inherits the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -Z /var/www/html/file1</command> command." msgstr ""

#. Tag: title @@ -1847,24 +1127,12 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>cp --preserve=context</command> command to preserve " -"contexts when copying:" +msgid "Use the <command>cp --preserve=context</command> command to preserve contexts when copying:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, <filename>file1</filename> is created in a user's home " -"directory, and is labeled with the <computeroutput>user_home_t</" -"computeroutput> type. The <filename>/var/www/html/</filename> directory is " -"labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"as shown with the <command>ls -dZ /var/www/html/</command> command. Using " -"the <option>--preserve=context</option> option preserves SELinux contexts " -"during copy operations. As shown with the <command>ls -Z /var/www/html/" -"file1</command> command, the <filename>file1</filename> " -"<computeroutput>user_home_t</computeroutput> type was preserved when the " -"file was copied to <filename>/var/www/html/</filename>." +msgid "In this example, <filename>file1</filename> is created in a user's home directory, and is labeled with the <computeroutput>user_home_t</computeroutput> type. The <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -dZ /var/www/html/</command> command. Using the <option>--preserve=context</option> option preserves SELinux contexts during copy operations. As shown with the <command>ls -Z /var/www/html/file1</command> command, the <filename>file1</filename> <computeroutput>user_home_t</computeroutput> type was preserved when the file was copied to <filename>/var/www/html/</filename>." msgstr ""

#. Tag: title @@ -1874,18 +1142,12 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>cp -Z</command> command to change the destination copy's " -"context. The following example was performed in the user's home directory:" +msgid "Use the <command>cp -Z</command> command to change the destination copy's context. The following example was performed in the user's home directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, the context is defined with the <option>-Z</option> option. " -"Without the <option>-Z</option> option, <filename>file2</filename> would be " -"labeled with the <computeroutput>unconfined_u:object_r:user_home_t</" -"computeroutput> context." +msgid "In this example, the context is defined with the <option>-Z</option> option. Without the <option>-Z</option> option, <filename>file2</filename> would be labeled with the <computeroutput>unconfined_u:object_r:user_home_t</computeroutput> context." msgstr ""

#. Tag: title @@ -1895,32 +1157,17 @@

#. Tag: para #, no-c-format -msgid "" -"When a file is copied over an existing file, the existing file's context is " -"preserved (unless an option is used to preserve contexts). For example:" +msgid "When a file is copied over an existing file, the existing file's context is preserved (unless an option is used to preserve contexts). For example:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"In this example, two files are created: <filename>/etc/file1</filename>, " -"labeled with the <computeroutput>etc_t</computeroutput> type, and <filename>/" -"tmp/file2</filename>, labeled with the <computeroutput>user_tmp_t</" -"computeroutput> type. The <command>cp /tmp/file2 /etc/file1</command> " -"command overwrites <filename>file1</filename> with <filename>file2</" -"filename>. After copying, the <command>ls -Z /etc/file1</command> command " -"shows <filename>file1</filename> labeled with the <computeroutput>etc_t</" -"computeroutput> type, not the <computeroutput>user_tmp_t</computeroutput> " -"type from <filename>/tmp/file2</filename> that replaced <filename>/etc/" -"file1</filename>." +msgid "In this example, two files are created: <filename>/etc/file1</filename>, labeled with the <computeroutput>etc_t</computeroutput> type, and <filename>/tmp/file2</filename>, labeled with the <computeroutput>user_tmp_t</computeroutput> type. The <command>cp /tmp/file2 /etc/file1</command> command overwrites <filename>file1</filename> with <filename>file2</filename>. After copying, the <command>ls -Z /etc/file1</command> command shows <filename>file1</filename> labeled with the <computeroutput>etc_t</computeroutput> type, not the <computeroutput>user_tmp_t</computeroutput> type from <filename>/tmp/file2</filename> that replaced <filename>/etc/file1</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Copy files and directories, rather than moving them. This helps ensure they " -"are labeled with the correct SELinux contexts. Incorrect SELinux contexts " -"can prevent processes from accessing such files and directories." +msgid "Copy files and directories, rather than moving them. This helps ensure they are labeled with the correct SELinux contexts. Incorrect SELinux contexts can prevent processes from accessing such files and directories." msgstr ""

#. Tag: title @@ -1930,66 +1177,37 @@

#. Tag: para #, no-c-format -msgid "" -"File and directories keep their current SELinux context when they are moved. " -"In many cases, this is incorrect for the location they are being moved to. " -"The following example demonstrates moving a file from a user's home " -"directory to <filename>/var/www/html/</filename>, which is used by the " -"Apache HTTP Server. Since the file is moved, it does not inherit the correct " -"SELinux context:" +msgid "File and directories keep their current SELinux context when they are moved. In many cases, this is incorrect for the location they are being moved to. The following example demonstrates moving a file from a user's home directory to <filename>/var/www/html/</filename>, which is used by the Apache HTTP Server. Since the file is moved, it does not inherit the correct SELinux context:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd</command> command without any arguments to change into " -"your home directory. Once in your home directory, run the <command>touch " -"file1</command> command to create a file. This file is labeled with the " -"<computeroutput>user_home_t</computeroutput> type:" +msgid "Run the <command>cd</command> command without any arguments to change into your home directory. Once in your home directory, run the <command>touch file1</command> command to create a file. This file is labeled with the <computeroutput>user_home_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -dZ /var/www/html/</command> command to view the SELinux " -"context of the <filename>/var/www/html/</filename> directory:" +msgid "Run the <command>ls -dZ /var/www/html/</command> command to view the SELinux context of the <filename>/var/www/html/</filename> directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, the <filename>/var/www/html/</filename> directory is labeled " -"with the <computeroutput>httpd_sys_content_t</computeroutput> type. Files " -"and directories created under the <filename>/var/www/html/</filename> " -"directory inherit this type, and as such, they are labeled with this type." +msgid "By default, the <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type. Files and directories created under the <filename>/var/www/html/</filename> directory inherit this type, and as such, they are labeled with this type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mv file1 /var/www/html/</command> " -"command to move <filename>file1</filename> to the <filename>/var/www/html/</" -"filename> directory. Since this file is moved, it keeps its current " -"<computeroutput>user_home_t</computeroutput> type:" +msgid "As the Linux root user, run the <command>mv file1 /var/www/html/</command> command to move <filename>file1</filename> to the <filename>/var/www/html/</filename> directory. Since this file is moved, it keeps its current <computeroutput>user_home_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"By default, the Apache HTTP Server can not read files that are labeled with " -"the <computeroutput>user_home_t</computeroutput> type. If all files " -"comprising a web page are labeled with the <computeroutput>user_home_t</" -"computeroutput> type, or another type that the Apache HTTP Server can not " -"read, permission is denied when attempting to access them via Firefox or " -"text-based Web browsers." +msgid "By default, the Apache HTTP Server can not read files that are labeled with the <computeroutput>user_home_t</computeroutput> type. If all files comprising a web page are labeled with the <computeroutput>user_home_t</computeroutput> type, or another type that the Apache HTTP Server can not read, permission is denied when attempting to access them via Firefox or text-based Web browsers." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Moving files and directories with the <command>mv</command> command may " -"result in the wrong SELinux context, preventing processes, such as the " -"Apache HTTP Server and Samba, from accessing such files and directories." +msgid "Moving files and directories with the <command>mv</command> command may result in the wrong SELinux context, preventing processes, such as the Apache HTTP Server and Samba, from accessing such files and directories." msgstr ""

#. Tag: title @@ -1999,9 +1217,7 @@

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/usr/sbin/matchpathcon</command> command to check if files " -"and directories have the correct SELinux context. From the" +msgid "Use the <command>/usr/sbin/matchpathcon</command> command to check if files and directories have the correct SELinux context. From the" msgstr ""

#. Tag: refentrytitle @@ -2011,63 +1227,32 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>matchpathcon</command> queries the system policy and " -"outputs the default security context associated with the file path." -""<footnote> <para> The <citerefentry><refentrytitle>matchpathcon</" -"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as " -"shipped with the <package>libselinux-utils</package> package in Fedora, is " -"written by Daniel Walsh. Any edits or changes in this version were done by " -"Murray McAllister. </para> </footnote>. The following example demonstrates " -"using the <command>/usr/sbin/matchpathcon</command> command to verify that " -"files in <filename>/var/www/html/</filename> directory are labeled correctly:" +msgid "manual page: "<command>matchpathcon</command> queries the system policy and outputs the default security context associated with the file path."<footnote> <para> The <citerefentry><refentrytitle>matchpathcon</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>libselinux-utils</package> package in Fedora, is written by Daniel Walsh. Any edits or changes in this version were done by Murray McAllister. </para> </footnote>. The following example demonstrates using the <command>/usr/sbin/matchpathcon</command> command to verify that files in <filename>/var/www/html/</filename> directory are labeled correctly:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /var/www/html/file{1,2,3}</" -"command> command to create three files (<filename>file1</filename>, " -"<filename>file2</filename>, and <filename>file3</filename>). These files " -"inherit the <computeroutput>httpd_sys_content_t</computeroutput> type from " -"the <filename>/var/www/html/</filename> directory:" +msgid "As the Linux root user, run the <command>touch /var/www/html/file{1,2,3}</command> command to create three files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). These files inherit the <computeroutput>httpd_sys_content_t</computeroutput> type from the <filename>/var/www/html/</filename> directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>chcon -t samba_share_t /var/www/" -"html/file1</command> command to change the <filename>file1</filename> type " -"to <computeroutput>samba_share_t</computeroutput>. Note: the Apache HTTP " -"Server can not read files or directories labeled with the " -"<computeroutput>samba_share_t</computeroutput> type." +msgid "As the Linux root user, run the <command>chcon -t samba_share_t /var/www/html/file1</command> command to change the <filename>file1</filename> type to <computeroutput>samba_share_t</computeroutput>. Note: the Apache HTTP Server can not read files or directories labeled with the <computeroutput>samba_share_t</computeroutput> type." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/matchpathcon</command> <option>-V</option> option " -"compares the current SELinux context to the correct, default context in " -"SELinux policy. Run the <command>/usr/sbin/matchpathcon -V /var/www/html/*</" -"command> command to check all files in the <filename>/var/www/html/</" -"filename> directory:" +msgid "The <command>/usr/sbin/matchpathcon</command> <option>-V</option> option compares the current SELinux context to the correct, default context in SELinux policy. Run the <command>/usr/sbin/matchpathcon -V /var/www/html/*</command> command to check all files in the <filename>/var/www/html/</filename> directory:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following output from the <command>/usr/sbin/matchpathcon</command> " -"command explains that <filename>file1</filename> is labeled with the " -"<computeroutput>samba_share_t</computeroutput> type, but should be labeled " -"with the <computeroutput>httpd_sys_content_t</computeroutput> type:" +msgid "The following output from the <command>/usr/sbin/matchpathcon</command> command explains that <filename>file1</filename> is labeled with the <computeroutput>samba_share_t</computeroutput> type, but should be labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"To resolve the label problem and allow the Apache HTTP Server access to " -"<filename>file1</filename>, as the Linux root user, run the <command>/sbin/" -"restorecon -v /var/www/html/file1</command> command:" +msgid "To resolve the label problem and allow the Apache HTTP Server access to <filename>file1</filename>, as the Linux root user, run the <command>/sbin/restorecon -v /var/www/html/file1</command> command:" msgstr ""

#. Tag: title @@ -2077,80 +1262,47 @@

#. Tag: para #, no-c-format -msgid "" -"<command>tar</command> does not retain extended attributes by default. Since " -"SELinux contexts are stored in extended attributes, contexts can be lost " -"when archiving files. Use <command>tar --selinux</command> to create " -"archives that retain contexts. If a Tar archive contains files without " -"extended attributes, or if you want the extended attributes to match the " -"system defaults, run the archive through <command>/sbin/restorecon</command>:" +msgid "<command>tar</command> does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use <command>tar --selinux</command> to create archives that retain contexts. If a Tar archive contains files without extended attributes, or if you want the extended attributes to match the system defaults, run the archive through <command>/sbin/restorecon</command>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Note: depending on the directory, you may need to be the Linux root user to " -"run the <command>/sbin/restorecon</command> command." +msgid "Note: depending on the directory, you may need to be the Linux root user to run the <command>/sbin/restorecon</command> command." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a Tar archive that retains " -"SELinux contexts:" +msgid "The following example demonstrates creating a Tar archive that retains SELinux contexts:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /var/www/html/</command> command to change into the " -"<filename>/var/www/html/</filename> directory. Once in this directory, as " -"the Linux root user, run the <command>tar --selinux -cf test.tar file{1,2,3}" -"</command> command to create a Tar archive named <filename>test.tar</" -"filename>." +msgid "Run the <command>cd /var/www/html/</command> command to change into the <filename>/var/www/html/</filename> directory. Once in this directory, as the Linux root user, run the <command>tar --selinux -cf test.tar file{1,2,3}</command> command to create a Tar archive named <filename>test.tar</filename>." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mkdir /test</command> command to " -"create a new directory, and then, run the <command>chmod 777 /test/</" -"command> command to allow all users full-access to the <filename>/test/</" -"filename> directory." +msgid "As the Linux root user, run the <command>mkdir /test</command> command to create a new directory, and then, run the <command>chmod 777 /test/</command> command to allow all users full-access to the <filename>/test/</filename> directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cp /var/www/html/test.tar /test/</command> command to copy " -"the <filename>test.tar</filename> file in to the <filename>/test/</filename> " -"directory." +msgid "Run the <command>cp /var/www/html/test.tar /test/</command> command to copy the <filename>test.tar</filename> file in to the <filename>/test/</filename> directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /test/</command> command to change into the <filename>/" -"test/</filename> directory. Once in this directory, run the <command>tar -" -"xvf test.tar</command> command to extract the Tar archive." +msgid "Run the <command>cd /test/</command> command to change into the <filename>/test/</filename> directory. Once in this directory, run the <command>tar -xvf test.tar</command> command to extract the Tar archive." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -lZ /test/</command> command to view the SELinux " -"contexts. The <computeroutput>httpd_sys_content_t</computeroutput> type has " -"been retained, rather than being changed to <computeroutput>default_t</" -"computeroutput>, which would have happened had the <option>--selinux</" -"option> not been used:" +msgid "Run the <command>ls -lZ /test/</command> command to view the SELinux contexts. The <computeroutput>httpd_sys_content_t</computeroutput> type has been retained, rather than being changed to <computeroutput>default_t</computeroutput>, which would have happened had the <option>--selinux</option> not been used:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If the <filename>/test/</filename> directory is no longer required, as the " -"Linux root user, run the <command> rm -ri /test/</command> command to remove " -"it, as well as all files in it." +msgid "If the <filename>/test/</filename> directory is no longer required, as the Linux root user, run the <command> rm -ri /test/</command> command to remove it, as well as all files in it." msgstr ""

#. Tag: refentrytitle @@ -2160,9 +1312,7 @@

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page for further information about <command>tar</command>, such as " -"the <option>--xattrs</option> option that retains all extended attributes." +msgid "manual page for further information about <command>tar</command>, such as the <option>--xattrs</option> option that retains all extended attributes." msgstr ""

#. Tag: title @@ -2172,53 +1322,32 @@

#. Tag: para #, no-c-format -msgid "" -"<command>star</command> does not retain extended attributes by default. " -"Since SELinux contexts are stored in extended attributes, contexts can be " -"lost when archiving files. Use <command>star -xattr -H=exustar</command> to " -"create archives that retain contexts. The <package>star</package> package is " -"not installed by default. To install <command>star</command>, run the " -"<command>yum install star</command> command as the Linux root user." +msgid "<command>star</command> does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use <command>star -xattr -H=exustar</command> to create archives that retain contexts. The <package>star</package> package is not installed by default. To install <command>star</command>, run the <command>yum install star</command> command as the Linux root user." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a Star archive that retains " -"SELinux contexts:" +msgid "The following example demonstrates creating a Star archive that retains SELinux contexts:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /var/www/html/</command> command to change into the " -"<filename>/var/www/html/</filename> directory. Once in this directory, as " -"the Linux root user, run the <command>star -xattr -H=exustar -c -f=test.star " -"file{1,2,3}</command> command to create a Star archive named <filename>test." -"star</filename>:" +msgid "Run the <command>cd /var/www/html/</command> command to change into the <filename>/var/www/html/</filename> directory. Once in this directory, as the Linux root user, run the <command>star -xattr -H=exustar -c -f=test.star file{1,2,3}</command> command to create a Star archive named <filename>test.star</filename>:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cp /var/www/html/test.star /test/</command> command to copy " -"the <filename>test.star</filename> file in to the <filename>/test/</" -"filename> directory." +msgid "Run the <command>cp /var/www/html/test.star /test/</command> command to copy the <filename>test.star</filename> file in to the <filename>/test/</filename> directory." msgstr ""

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /test/</command> command to change into the <filename>/" -"test/</filename> directory. Once in this directory, run the <command>star -x " -"-f=test.star</command> command to extract the Star archive:" +msgid "Run the <command>cd /test/</command> command to change into the <filename>/test/</filename> directory. Once in this directory, run the <command>star -x -f=test.star</command> command to extract the Star archive:" msgstr ""

#. Tag: para #, no-c-format -msgid "" -"If <command>star</command> is no longer required, as the Linux root user, " -"run the <command>yum remove star</command> command to remove the package." +msgid "If <command>star</command> is no longer required, as the Linux root user, run the <command>yum remove star</command> command to remove the package." msgstr ""

#. Tag: refentrytitle

Modified: community/branches/f13/ru-RU/Appendix.po =================================================================== --- community/branches/f13/ru-RU/Appendix.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Appendix.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,7 +1,6 @@ # SOME DESCRIPTIVE TITLE. # FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" @@ -10,6 +9,7 @@ "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME EMAIL@ADDRESS\n" "Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: application/x-xml2pot; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -17,9 +17,9 @@ #. Tag: title #, no-c-format msgid "Revision History" -msgstr "" +msgstr "История исправлений"

#. Tag: para #, no-c-format msgid "zing" -msgstr "" +msgstr "zing"

Modified: community/branches/f13/ru-RU/Author_Group.po =================================================================== --- community/branches/f13/ru-RU/Author_Group.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Author_Group.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,109 +1,107 @@ # SOME DESCRIPTIVE TITLE. # FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-08-24 11:10+0500\n" +"Last-Translator: Alexey Cicin daydrim@gmail.com\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n"

#. Tag: firstname #, no-c-format msgid "Murray" -msgstr "" +msgstr "Murray"

#. Tag: surname #, no-c-format msgid "McAllister" -msgstr "" +msgstr "McAllister"

#. Tag: orgname #, no-c-format msgid "Red Hat" -msgstr "" +msgstr "Red Hat"

#. Tag: orgdiv #, no-c-format msgid "Engineering Content Services" -msgstr "" +msgstr "Engineering Content Services (Отдел Инженерной Документации)"

#. Tag: firstname #, no-c-format msgid "Scott" -msgstr "" +msgstr "Scott"

#. Tag: surname #, no-c-format msgid "Radvan" -msgstr "" +msgstr "Radvan"

#. Tag: firstname #, no-c-format msgid "Daniel" -msgstr "" +msgstr "Daniel"

#. Tag: surname #, no-c-format msgid "Walsh" -msgstr "" +msgstr "Walsh"

#. Tag: orgdiv #, no-c-format msgid "Security Engineering" -msgstr "" +msgstr "Security Engineering (Инженер Безопасности)"

#. Tag: firstname #, no-c-format msgid "Dominick" -msgstr "" +msgstr "Dominick"

#. Tag: surname #, no-c-format msgid "Grift" -msgstr "" +msgstr "Grift"

#. Tag: contrib #, no-c-format -msgid "" -"Technical editor for the Introduction, SELinux Contexts, Targeted Policy, " -"Working with SELinux, Confining Users, and Troubleshooting chapters." -msgstr "" +msgid "Technical editor for the Introduction, SELinux Contexts, Targeted Policy, Working with SELinux, Confining Users, and Troubleshooting chapters." +msgstr "Технический редактор глав Введение, Контексты SELinux, Целевая политика Targeted, Работа с SELinux, Управление пользователями и Устранение проблем."

#. Tag: firstname #, no-c-format msgid "Eric" -msgstr "" +msgstr "Eric"

#. Tag: surname #, no-c-format msgid "Paris" -msgstr "" +msgstr "Paris"

#. Tag: contrib #, no-c-format -msgid "" -"Technical editor for the Mounting File Systems and Raw Audit Messages " -"sections." -msgstr "" +msgid "Technical editor for the Mounting File Systems and Raw Audit Messages sections." +msgstr "Технический редактор разделов Монтирование файловых систем и Необработанные сообщения аудита."

#. Tag: firstname #, no-c-format msgid "James" -msgstr "" +msgstr "James"

#. Tag: surname #, no-c-format msgid "Morris" -msgstr "" +msgstr "Morris"

#. Tag: contrib #, no-c-format msgid "Technical editor for the Introduction and Targeted Policy chapters." -msgstr "" +msgstr "Технический редактор глав Введение и Целевая Политика."

Modified: community/branches/f13/ru-RU/Book_Info.po =================================================================== --- community/branches/f13/ru-RU/Book_Info.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Book_Info.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,32 +1,33 @@ # SOME DESCRIPTIVE TITLE. # FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-07-29 23:48+0500\n" +"Last-Translator: Alexey Cicin daydrim@gmail.com\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n" +"X-Poedit-SourceCharset: utf-8\n"

#. Tag: title #, no-c-format msgid "Security-Enhanced Linux" -msgstr "" +msgstr "Security-Enhanced Linux. Linux с улучшенной безопасностью"

#. Tag: subtitle #, no-c-format msgid "User Guide" -msgstr "" +msgstr "Руководство Пользователя"

#. Tag: para #, no-c-format -msgid "" -"The SELinux User Guide assists users and administrators in managing and " -"using Security-Enhanced <trademark class="registered">Linux</trademark>." -msgstr "" +msgid "The SELinux User Guide assists users and administrators in managing and using Security-Enhanced <trademark class="registered">Linux</trademark>." +msgstr "Руководство Пользователя SELinux разработано, чтобы помочь пользователям и администраторам в управлении и использовании Security-Enhanced <trademark class="registered">Linux</trademark>."

Modified: community/branches/f13/ru-RU/Contexts_and_Attributes.po =================================================================== --- community/branches/f13/ru-RU/Contexts_and_Attributes.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Contexts_and_Attributes.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,382 +1,228 @@ # SOME DESCRIPTIVE TITLE. # FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-08-04 10:43+0500\n" +"Last-Translator: Alexey Cicin daydrim@gmail.com\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n" +"X-Poedit-SourceCharset: utf-8\n"

#. Tag: title #, no-c-format msgid "SELinux Contexts" -msgstr "" +msgstr "Контексты SELinux"

#. Tag: para #, no-c-format -msgid "" -"Processes and files are labeled with an SELinux context that contains " -"additional information, such as an SELinux user, role, type, and, " -"optionally, a level. When running SELinux, all of this information is used " -"to make access control decisions. In Fedora, SELinux provides a combination " -"of Role-Based Access Control (RBAC), <trademark class="registered">Type " -"Enforcement</trademark> (TE), and, optionally, Multi-Level Security (MLS)." -msgstr "" +msgid "Processes and files are labeled with an SELinux context that contains additional information, such as an SELinux user, role, type, and, optionally, a level. When running SELinux, all of this information is used to make access control decisions. In Fedora, SELinux provides a combination of Role-Based Access Control (RBAC), <trademark class="registered">Type Enforcement</trademark> (TE), and, optionally, Multi-Level Security (MLS)." +msgstr "Процессы и файлы маркируются метками - контекстом SELinux, который содержит информацию: пользователь SELinux, роль, тип и уровень (опционально). Когда SELinux включен, вся эта информация используется для принятия решения о предоставлении доступа. В Fedora, SELinux предоставляет сочетание ролевого управления доступом (Role-Based Access Control (RBAC), <trademark class="registered">Type Enforcement</trademark> (TE), и опциаонально многоуровневой модели безопасности, Multi-Level Security (MLS)."

#. Tag: para #, no-c-format -msgid "" -"The following is an example showing SELinux context. SELinux contexts are " -"used on processes, Linux users, and files, on Linux operating systems that " -"run SELinux. Use the <command>ls -Z</command> command to view the SELinux " -"context of files and directories:" -msgstr "" +msgid "The following is an example showing SELinux context. SELinux contexts are used on processes, Linux users, and files, on Linux operating systems that run SELinux. Use the <command>ls -Z</command> command to view the SELinux context of files and directories:" +msgstr "В следующем примере показывается контект SELinux. Контекст SELinux используется для процессов, пользователей Linux и файлов в операционной системе Linux, запущенной с SELinux. Используя команду <command>ls -Z</command> можно увидеть контекст SELinux для файлов и директорий:"

#. Tag: para #, no-c-format -msgid "" -"SELinux contexts follow the <emphasis>SELinux user:role:type:level</" -"emphasis> syntax:" -msgstr "" +msgid "SELinux contexts follow the <emphasis>SELinux user:role:type:level</emphasis> syntax:" +msgstr "В контексте SELinux используется следующий синтаксис <emphasis>SELinux user:role:type:level</emphasis>:"

#. Tag: term #, no-c-format msgid "<emphasis>SELinux user</emphasis>" -msgstr "" +msgstr "<emphasis>пользователь SELinux</emphasis>"

#. Tag: para #, no-c-format -msgid "" -"The SELinux user identity is an identity known to the policy that is " -"authorized for a specific set of roles, and for a specific MLS range. Each " -"Linux user is mapped to an SELinux user via SELinux policy. This allows " -"Linux users to inherit the restrictions placed on SELinux users. The mapped " -"SELinux user identity is used in the SELinux context for processes in that " -"session, in order to define what roles and levels they can enter. Run the " -"<command>semanage login -l</command> command as the Linux root user to view " -"a list of mappings between SELinux and Linux user accounts:" -msgstr "" +msgid "The SELinux user identity is an identity known to the policy that is authorized for a specific set of roles, and for a specific MLS range. Each Linux user is mapped to an SELinux user via SELinux policy. This allows Linux users to inherit the restrictions placed on SELinux users. The mapped SELinux user identity is used in the SELinux context for processes in that session, in order to define what roles and levels they can enter. Run the <command>semanage login -l</command> command as the Linux root user to view a list of mappings between SELinux and Linux user accounts:" +msgstr "Пользователь SELinux - это сущность определённая в политике, которая отвечает за определённый набор ролей и за определённый набор MLS уровней. Каждый пользователь Linux сопоставлен пользователю SELinux посредством политики SELinux. Это позволяет пользователям Linux наследовать ограничения установленные на пользователей SELinux. Сопоставленные сущности пользователей SELinux используются в контексте SELinux для процессов в сессии, в порядке определения для каких ролей и уровней они применимы. Для того, чтобы посмотреть сопоставление между пользователя� �и SELinux и Linux используется команда <command>semanage login -l</command>:"

#. Tag: para #, no-c-format -msgid "" -"Output may differ slightly from system to system. The <computeroutput>Login " -"Name</computeroutput> column lists Linux users, and the " -"<computeroutput>SELinux User</computeroutput> column lists which SELinux " -"user the Linux user is mapped to. For processes, the SELinux user limits " -"which roles and levels are accessible. The last column, <computeroutput>MLS/" -"MCS Range</computeroutput>, is the level used by Multi-Level Security (MLS) " -"and Multi-Category Security (MCS). Levels are briefly discussed later." -msgstr "" +msgid "Output may differ slightly from system to system. The <computeroutput>Login Name</computeroutput> column lists Linux users, and the <computeroutput>SELinux User</computeroutput> column lists which SELinux user the Linux user is mapped to. For processes, the SELinux user limits which roles and levels are accessible. The last column, <computeroutput>MLS/MCS Range</computeroutput>, is the level used by Multi-Level Security (MLS) and Multi-Category Security (MCS). Levels are briefly discussed later." +msgstr "Вывод команды может отличаться между операционными системами. В столбце <computeroutput>Login Name</computeroutput> перечислены пользователи Linux, а в столбце <computeroutput>SELinux User</computeroutput> показаны с какими пользователями SELinux они сопоставлены. Для процессов пользователи SELinux ограничивают доступность ролей и уровней. В последнем столбце <computeroutput>MLS/MCS Range</computeroutput> показан уровень который используется в Multi-Level Security (MLS) and Multi-Category Security (MCS), данные механизмы будут рассмотрены позже."

#. Tag: term #, no-c-format msgid "<emphasis>role</emphasis>" -msgstr "" +msgstr "<emphasis>роль</emphasis>"

+# Нет точного перевода. +# Мне кажется можно ссылать на понятия и определения отсюда: +# http://www.opennet.ru/base/sec/intro_selinux.txt.html #. Tag: para #, no-c-format -msgid "" -"Part of SELinux is the Role-Based Access Control (RBAC) security model. The " -"role is an attribute of RBAC. SELinux users are authorized for roles, and " -"roles are authorized for domains. The role serves as an intermediary between " -"domains and SELinux users. The roles that can be entered determine which " -"domains can be entered - ultimately, this controls which object types can be " -"accessed. This helps reduce vulnerability to privilege escalation attacks." -msgstr "" +msgid "Part of SELinux is the Role-Based Access Control (RBAC) security model. The role is an attribute of RBAC. SELinux users are authorized for roles, and roles are authorized for domains. The role serves as an intermediary between domains and SELinux users. The roles that can be entered determine which domains can be entered - ultimately, this controls which object types can be accessed. This helps reduce vulnerability to privilege escalation attacks." +msgstr "Роль - это часть модели безопасности Ролевого управления доступом Role-Based Access Control (RBAC). Роль - это атрибут RBAC. Пользователи SELinux, авторитетны для ролей, а роль авторитетна для доменов. Определённая роль определяет какие домены могут быть доступны для пользователей с этой ролью. Роль служит промежуточным звеном между доменами и пользователями SELinux. Роль, которой обладает пользователь, определяет в какие домены может попасть пользователь - фактически, этот механизм управляет доступностью объектов. Таким образом, уменьшается риск, связ анный с уязвимостью повышения привелегий в системе."

#. Tag: term #, no-c-format msgid "<emphasis>type</emphasis>" -msgstr "" +msgstr "<emphasis>тип</emphasis>"

#. Tag: para #, no-c-format -msgid "" -"The type is an attribute of Type Enforcement. The type defines a domain for " -"processes, and a type for files. SELinux policy rules define how types can " -"access each other, whether it be a domain accessing a type, or a domain " -"accessing another domain. Access is only allowed if a specific SELinux " -"policy rule exists that allows it." -msgstr "" +msgid "The type is an attribute of Type Enforcement. The type defines a domain for processes, and a type for files. SELinux policy rules define how types can access each other, whether it be a domain accessing a type, or a domain accessing another domain. Access is only allowed if a specific SELinux policy rule exists that allows it." +msgstr "Тип - это атрибут Type Enforcement. Тип определяет домен для процессов и тип для файлов. Правила политики SELinux определяют как типы взаимодействуют друг с другом, является ли тип доменом, получающим доступ к типу, или доменом, получающим доступ к другому домену. Доступ разрешается, только если существует определенное правило политики SELinux позволяющих данное действие."

#. Tag: term #, no-c-format msgid "<emphasis>level</emphasis>" -msgstr "" +msgstr "<emphasis>уровень</emphasis>"

#. Tag: para #, no-c-format -msgid "" -"The level is an attribute of MLS and Multi-Category Security (MCS). An MLS " -"range is a pair of levels, written as <emphasis>lowlevel-highlevel</" -"emphasis> if the levels differ, or <emphasis>lowlevel</emphasis> if the " -"levels are identical (<computeroutput>s0-s0</computeroutput> is the same as " -"<computeroutput>s0</computeroutput>). Each level is a sensitivity-category " -"pair, with categories being optional. If there are categories, the level is " -"written as <emphasis>sensitivity:category-set</emphasis>. If there are no " -"categories, it is written as <emphasis>sensitivity</emphasis>." -msgstr "" +msgid "The level is an attribute of MLS and Multi-Category Security (MCS). An MLS range is a pair of levels, written as <emphasis>lowlevel-highlevel</emphasis> if the levels differ, or <emphasis>lowlevel</emphasis> if the levels are identical (<computeroutput>s0-s0</computeroutput> is the same as <computeroutput>s0</computeroutput>). Each level is a sensitivity-category pair, with categories being optional. If there are categories, the level is written as <emphasis>sensitivity:category-set</emphasis>. If there are no categories, it is written as <emphasis>sensitivity</emphasis>." +msgstr "Уровень - это атрибут многоуровневого управления доступом MLS и MCS. Пространство MLS - это пара уровней, записанных в виде <emphasis>lowlevel-highlevel</emphasis>, если уровни в данной паре отличаются или, если не отличаются, то <emphasis>lowlevel</emphasis>. То есть (<computeroutput>s0-s0</computeroutput> то же самое, что и <computeroutput>s0</computeroutput>). Если дополнительно определены категории, то уровень записывается как <emphasis>sensitivity:category-set</emphasis>. Если категории не определены, то запись выглядит как <emphasis>sensitivity</emphasis>."

#. Tag: para #, no-c-format -msgid "" -"If the category set is a contiguous series, it can be abbreviated. For " -"example, <computeroutput>c0.c3</computeroutput> is the same as " -"<computeroutput>c0,c1,c2,c3</computeroutput>. The <filename>/etc/selinux/" -"targeted/setrans.conf</filename> file maps levels (<computeroutput>s0:c0</" -"computeroutput>) to human-readable form (ie. " -"<computeroutput>CompanyConfidential</computeroutput>). Do not edit " -"<filename>setrans.conf</filename> with a text editor: use <command>semanage</" -"command> to make changes. Refer to the" -msgstr "" +msgid "If the category set is a contiguous series, it can be abbreviated. For example, <computeroutput>c0.c3</computeroutput> is the same as <computeroutput>c0,c1,c2,c3</computeroutput>. The <filename>/etc/selinux/targeted/setrans.conf</filename> file maps levels (<computeroutput>s0:c0</computeroutput>) to human-readable form (ie. <computeroutput>CompanyConfidential</computeroutput>). Do not edit <filename>setrans.conf</filename> with a text editor: use <command>semanage</command> to make changes. Refer to the" +msgstr "Если набор категорий является непрерывной последовательностью, он может быть приведён к сокращённой форме записи. Например <computeroutput>c0.c3</computeroutput> - это тоже самое, что <computeroutput>c0,c1,c2,c3</computeroutput>. В файле <filename>/etc/selinux/targeted/setrans.conf</filename> хранится описание уровней (<computeroutput>s0:c0</computeroutput>) в удобочитаемом формате (таким как <computeroutput>CompanyConfidential</computeroutput>). Не редактируйте <filename>setrans.conf</filename> с помощью текстового редактора: необходимо использовать команду <command>semanage</command> для внесения изменений. Согласно с"

#. Tag: refentrytitle #, no-c-format msgid "semanage" -msgstr "" +msgstr "semanage"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page for further information. In Fedora, targeted policy enforces " -"MCS, and in MCS, there is just one sensitivity, <computeroutput>s0</" -"computeroutput>. MCS in Fedora supports 1024 different categories: " -"<computeroutput>c0</computeroutput> through to <computeroutput>c1023</" -"computeroutput>. <computeroutput>s0-s0:c0.c1023</computeroutput> is " -"sensitivity <computeroutput>s0</computeroutput> and authorized for all " -"categories." -msgstr "" +msgid "manual page for further information. In Fedora, targeted policy enforces MCS, and in MCS, there is just one sensitivity, <computeroutput>s0</computeroutput>. MCS in Fedora supports 1024 different categories: <computeroutput>c0</computeroutput> through to <computeroutput>c1023</computeroutput>. <computeroutput>s0-s0:c0.c1023</computeroutput> is sensitivity <computeroutput>s0</computeroutput> and authorized for all categories." +msgstr "справочной страницей (man) с более подробной информацией. В Fedora целевая политика targeted назначает MCS, и в MCS, только один уровень <computeroutput>s0</computeroutput>. MCS в Fedora поддерживает 1024 различных категории: от <computeroutput>c0</computeroutput> до <computeroutput>c1023</computeroutput>. <computeroutput>s0-s0:c0.c1023</computeroutput> - это уровень <computeroutput>s0</computeroutput> и применим для всех категорий."

#. Tag: para #, no-c-format -msgid "" -"MLS enforces the <ulink url="http://en.wikipedia.org/wiki/Bell-" -"LaPadula_model">Bell-La Padula Mandatory Access Model</ulink>, and is used " -"in Labeled Security Protection Profile (LSPP) environments. To use MLS " -"restrictions, install the <package>selinux-policy-mls</package> package, and " -"configure MLS to be the default SELinux policy. The MLS policy shipped with " -"Fedora omits many program domains that were not part of the evaluated " -"configuration, and therefore, MLS on a desktop workstation is unusable (no " -"support for the X Window System); however, an MLS policy from the <ulink url=" -""http://oss.tresys.com/projects/refpolicy%5C%22%3Eupstream SELinux Reference " -"Policy</ulink> can be built that includes all program domains." -msgstr "" +msgid "MLS enforces the <ulink url="http://en.wikipedia.org/wiki/Bell-LaPadula_model%5C%22%3EBell-La Padula Mandatory Access Model</ulink>, and is used in Labeled Security Protection Profile (LSPP) environments. To use MLS restrictions, install the <package>selinux-policy-mls</package> package, and configure MLS to be the default SELinux policy. The MLS policy shipped with Fedora omits many program domains that were not part of the evaluated configuration, and therefore, MLS on a desktop workstation is unusable (no support for the X Window System); however, an MLS policy from the <ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3Eupstream SELinux Reference Policy</ulink> can be built that includes all program domains." +msgstr "MLS вводит в действие <ulink url="http://en.wikipedia.org/wiki/Bell-LaPadula_model%5C%22%3EBell-La Padula Mandatory Access Model</ulink>, и используется в средах Labeled Security Protection Profile (LSPP). Для использования механизмов MLS, необходимо установить пакет <package>selinux-policy-mls</package> и сконфигурировать MLS в качестве политики SELinux по умолчанию. Политика MLS поставляемая с Fedora не включает домены для программ, которые не являются частью протестированной конфигурации и более того, MLS не применима на десктопе или рабочей станции (так как нет поддержки для X Window System); однако политика MLS от <ulink url="http://oss.tresys.com/projects/ refpolicy"> upstream SELinux Reference Policy</ulink> может быть построена так, чтобы учитывать все программные домены."

#. Tag: title #, no-c-format msgid "Domain Transitions" -msgstr "" +msgstr "Доменные Переходы, Транзитивность (Domain Transitions)"

+# неточный #. Tag: para #, no-c-format -msgid "" -"A process in one domain transitions to another domain by executing an " -"application that has the <computeroutput>entrypoint</computeroutput> type " -"for the new domain. The <computeroutput>entrypoint</computeroutput> " -"permission is used in SELinux policy, and controls which applications can be " -"used to enter a domain. The following example demonstrates a domain " -"transition:" -msgstr "" +msgid "A process in one domain transitions to another domain by executing an application that has the <computeroutput>entrypoint</computeroutput> type for the new domain. The <computeroutput>entrypoint</computeroutput> permission is used in SELinux policy, and controls which applications can be used to enter a domain. The following example demonstrates a domain transition:" +msgstr "Процесс из одного домена переходит в другой домен, если первый процесс выполняет приложение, которое запускается из файла с типом <computeroutput>entrypoint</computeroutput> нового домена. Разрешение перехода <computeroutput>entrypoint</computeroutput> используется в политике SELinux и контролирует какие приложения используется для входа в домен. В следующем примере показаны доменные переходы (domain transitions)"

#. Tag: para #, no-c-format -msgid "" -"A user wants to change their password. To do this, they run the " -"<command>passwd</command> application. The <filename>/usr/bin/passwd</" -"filename> executable is labeled with the <computeroutput>passwd_exec_t</" -"computeroutput> type:" -msgstr "" +msgid "A user wants to change their password. To do this, they run the <command>passwd</command> application. The <filename>/usr/bin/passwd</filename> executable is labeled with the <computeroutput>passwd_exec_t</computeroutput> type:" +msgstr "Пользователь хочет изменить свой пароль. Для того, чтобы это сделать пользователь выполняет команду <command>passwd</command>. Файл <filename>/usr/bin/passwd</filename> является исполняемым и промаркирован меткой с типом <computeroutput>passwd_exec_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"The <application>passwd</application> application accesses <filename>/etc/" -"shadow</filename>, which is labeled with the <computeroutput>shadow_t</" -"computeroutput> type:" -msgstr "" +msgid "The <application>passwd</application> application accesses <filename>/etc/shadow</filename>, which is labeled with the <computeroutput>shadow_t</computeroutput> type:" +msgstr "Приложение <application>passwd</application> получает доступ <application>passwd</application>, которое помечено типом <computeroutput>shadow_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"An SELinux policy rule states that processes running in the " -"<computeroutput>passwd_t</computeroutput> domain are allowed to read and " -"write to files labeled with the <computeroutput>shadow_t</computeroutput> " -"type. The <computeroutput>shadow_t</computeroutput> type is only applied to " -"files that are required for a password change. This includes <filename>/etc/" -"gshadow</filename>, <filename>/etc/shadow</filename>, and their backup files." -msgstr "" +msgid "An SELinux policy rule states that processes running in the <computeroutput>passwd_t</computeroutput> domain are allowed to read and write to files labeled with the <computeroutput>shadow_t</computeroutput> type. The <computeroutput>shadow_t</computeroutput> type is only applied to files that are required for a password change. This includes <filename>/etc/gshadow</filename>, <filename>/etc/shadow</filename>, and their backup files." +msgstr "Правило политики SELinux определяет, что процесам, запущенным в домене <computeroutput>passwd_t</computeroutput>, разрешено читать и записать в файлы помеченные типом <computeroutput>shadow_t</computeroutput>. Тип <computeroutput>shadow_t</computeroutput> применяется только к файлам, которые необходимы для смены пароля. Это файлы <filename>/etc/gshadow</filename>, <filename>/etc/shadow</filename> и их резервные копии."

#. Tag: para #, no-c-format -msgid "" -"An SELinux policy rule states that the <computeroutput>passwd_t</" -"computeroutput> domain has <computeroutput>entrypoint</computeroutput> " -"permission to the <computeroutput>passwd_exec_t</computeroutput> type." -msgstr "" +msgid "An SELinux policy rule states that the <computeroutput>passwd_t</computeroutput> domain has <computeroutput>entrypoint</computeroutput> permission to the <computeroutput>passwd_exec_t</computeroutput> type." +msgstr "Правило политики SELinux определяет, что домен <computeroutput>passwd_t</computeroutput> имеет разрешения перехода <computeroutput>entrypoint</computeroutput> для типа <computeroutput>passwd_exec_t</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"When a user runs the <command>/usr/bin/passwd</command> application, the " -"user's shell process transitions to the <computeroutput>passwd_t</" -"computeroutput> domain. With SELinux, since the default action is to deny, " -"and a rule exists that allows (among other things) applications running in " -"the <computeroutput>passwd_t</computeroutput> domain to access files labeled " -"with the <computeroutput>shadow_t</computeroutput> type, the " -"<application>passwd</application> application is allowed to access " -"<filename>/etc/shadow</filename>, and update the user's password." -msgstr "" +msgid "When a user runs the <command>/usr/bin/passwd</command> application, the user's shell process transitions to the <computeroutput>passwd_t</computeroutput> domain. With SELinux, since the default action is to deny, and a rule exists that allows (among other things) applications running in the <computeroutput>passwd_t</computeroutput> domain to access files labeled with the <computeroutput>shadow_t</computeroutput> type, the <application>passwd</application> application is allowed to access <filename>/etc/shadow</filename>, and update the user's password." +msgstr "Когда пользователь выполняет приложение <command>/usr/bin/passwd</command>, оболочка shell пользователя переходит в домен <computeroutput>passwd_t</computeroutput>. С SELinux, где по умолчанию принимается действие блокирования и существует правило позволяющее приложениям, выполняющимся в домене <computeroutput>passwd_t</computeroutput>, получать доступ к файлам помеченным типом <computeroutput>shadow_t</computeroutput>, приложение <application>passwd</application> получает доступ к <filename>/etc/shadow</filename>, и меняет пароль ползователя."

#. Tag: para #, no-c-format -msgid "" -"This example is not exhaustive, and is used as a basic example to explain " -"domain transition. Although there is an actual rule that allows subjects " -"running in the <computeroutput>passwd_t</computeroutput> domain to access " -"objects labeled with the <computeroutput>shadow_t</computeroutput> file " -"type, other SELinux policy rules must be met before the subject can " -"transition to a new domain. In this example, Type Enforcement ensures:" -msgstr "" +msgid "This example is not exhaustive, and is used as a basic example to explain domain transition. Although there is an actual rule that allows subjects running in the <computeroutput>passwd_t</computeroutput> domain to access objects labeled with the <computeroutput>shadow_t</computeroutput> file type, other SELinux policy rules must be met before the subject can transition to a new domain. In this example, Type Enforcement ensures:" +msgstr "Данный пример не является исчерпывающим и используется как простейший пример для объяснения переходов (domain transitions). Таким образом определено работающее правило, которое позволяет субъектам выполняться в домене <computeroutput>passwd_t</computeroutput> для доступа к объектам маркированным с типом файлов <computeroutput>shadow_t</computeroutput>, другие правила политики SELinux должны быть пройденгны, перед тем как субъект сможет выполнить переход в другой домен. В этом примере Type Enforcement удостоверяет, что:"

#. Tag: para #, no-c-format -msgid "" -"the <computeroutput>passwd_t</computeroutput> domain can only be entered by " -"executing an application labeled with the <computeroutput>passwd_exec_t</" -"computeroutput> type; can only execute from authorized shared libraries, " -"such as the <computeroutput>lib_t</computeroutput> type; and can not execute " -"any other applications." -msgstr "" +msgid "the <computeroutput>passwd_t</computeroutput> domain can only be entered by executing an application labeled with the <computeroutput>passwd_exec_t</computeroutput> type; can only execute from authorized shared libraries, such as the <computeroutput>lib_t</computeroutput> type; and can not execute any other applications." +msgstr "В домен <computeroutput>passwd_t</computeroutput> можно войти, выполнением приложений, маркированных типом <computeroutput>passwd_exec_t</computeroutput>; и могут исполнять только авторизованные разделенные библиотеки, такие как тип <computeroutput>lib_t</computeroutput>; и не могут выполнять любые друие приложения"

#. Tag: para #, no-c-format -msgid "" -"only authorized domains, such as <computeroutput>passwd_t</computeroutput>, " -"can write to files labeled with the <computeroutput>shadow_t</" -"computeroutput> type. Even if other processes are running with superuser " -"privileges, those processes can not write to files labeled with the " -"<computeroutput>shadow_t</computeroutput> type, as they are not running in " -"the <computeroutput>passwd_t</computeroutput> domain." -msgstr "" +msgid "only authorized domains, such as <computeroutput>passwd_t</computeroutput>, can write to files labeled with the <computeroutput>shadow_t</computeroutput> type. Even if other processes are running with superuser privileges, those processes can not write to files labeled with the <computeroutput>shadow_t</computeroutput> type, as they are not running in the <computeroutput>passwd_t</computeroutput> domain." +msgstr "Только авторизованные домены <computeroutput>passwd_t</computeroutput>, могут записывать в файлы маркированные типом <computeroutput>shadow_t</computeroutput>. Даже если другие процессы запущены с привелегиями суперпользователя, эти процессы не могут выполнять записть в файлы с типом <computeroutput>shadow_t</computeroutput>, до тех пор, так как они не запущены в домене <computeroutput>passwd_t</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"only authorized domains can transition to the <computeroutput>passwd_t</" -"computeroutput> domain. For example, the <systemitem class="daemon" -"">sendmail</systemitem> process running in the <computeroutput>sendmail_t</" -"computeroutput> domain does not have a legitimate reason to execute " -"<command>passwd</command>; therefore, it can never transition to the " -"<computeroutput>passwd_t</computeroutput> domain." -msgstr "" +msgid "only authorized domains can transition to the <computeroutput>passwd_t</computeroutput> domain. For example, the <systemitem class="daemon">sendmail</systemitem> process running in the <computeroutput>sendmail_t</computeroutput> domain does not have a legitimate reason to execute <command>passwd</command>; therefore, it can never transition to the <computeroutput>passwd_t</computeroutput> domain." +msgstr "Только авторизованные домены могут выпоолнять переход в домен <computeroutput>passwd_t</computeroutput>. Например, процесс <systemitem class="daemon">sendmail</systemitem> запускается в домене <computeroutput>sendmail_t</computeroutput> и не имеет логичных (законных) причин для запуска <command>passwd</command>; таким образом он не может выполнить переход в домен <computeroutput>passwd_t</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"processes running in the <computeroutput>passwd_t</computeroutput> domain " -"can only read and write to authorized types, such as files labeled with the " -"<computeroutput>etc_t</computeroutput> or <computeroutput>shadow_t</" -"computeroutput> types. This prevents the <application>passwd</application> " -"application from being tricked into reading or writing arbitrary files." -msgstr "" +msgid "processes running in the <computeroutput>passwd_t</computeroutput> domain can only read and write to authorized types, such as files labeled with the <computeroutput>etc_t</computeroutput> or <computeroutput>shadow_t</computeroutput> types. This prevents the <application>passwd</application> application from being tricked into reading or writing arbitrary files." +msgstr "Процессы запущенные в домене <computeroutput>passwd_t</computeroutput> могут только читать и записывать в авторизованные файлы промаркированные типом <computeroutput>etc_t</computeroutput> или <computeroutput>shadow_t</computeroutput>. Это предотвращает приложение <application>passwd</application> от записи или чтения в другие файлы."

#. Tag: title #, no-c-format msgid "SELinux Contexts for Processes" -msgstr "" +msgstr "Контексты SELinux для процессов"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>ps -eZ</command> command to view the SELinux context for " -"processes. For example:" -msgstr "" +msgid "Use the <command>ps -eZ</command> command to view the SELinux context for processes. For example:" +msgstr "Используйте команду <command>ps -eZ</command> для просмотра контекста SELinux для процессов. Например:"

#. Tag: para #, no-c-format -msgid "" -"Open a terminal, such as <menuchoice><guimenu>Applications</" -"guimenu><guisubmenu>System Tools</guisubmenu><guimenuitem>Terminal</" -"guimenuitem></menuchoice>." -msgstr "" +msgid "Open a terminal, such as <menuchoice><guimenu>Applications</guimenu><guisubmenu>System Tools</guisubmenu><guimenuitem>Terminal</guimenuitem></menuchoice>." +msgstr "Откройте терминал, например <menuchoice><guimenu>Applications</guimenu><guisubmenu>System Tools</guisubmenu><guimenuitem>Terminal</guimenuitem></menuchoice>."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>/usr/bin/passwd</command> command. Do not enter a new " -"password." -msgstr "" +msgid "Run the <command>/usr/bin/passwd</command> command. Do not enter a new password." +msgstr "Выполните команду <command>/usr/bin/passwd</command>. Не вводите новый пароль."

#. Tag: para #, no-c-format -msgid "" -"Open a new tab, or another terminal, and run the <command>ps -eZ | grep " -"passwd</command> command. The output is similar to the following:" -msgstr "" +msgid "Open a new tab, or another terminal, and run the <command>ps -eZ | grep passwd</command> command. The output is similar to the following:" +msgstr "Откройте новую вкладку и выполните команду <command>ps -eZ | grep passwd</command>. Вывод команды будет схож с указанным ниже:"

#. Tag: para #, no-c-format -msgid "" -"In the first tab/terminal, press <userinput>Ctrl+C</userinput> to cancel the " -"<application>passwd</application> application." -msgstr "" +msgid "In the first tab/terminal, press <userinput>Ctrl+C</userinput> to cancel the <application>passwd</application> application." +msgstr "В первой вкладке\терминале нажмите <userinput>Ctrl+C</userinput> для завершения приложения <application>passwd</application>."

#. Tag: para #, no-c-format -msgid "" -"In this example, when the <filename>/usr/bin/passwd</filename> application " -"(labeled with the <computeroutput>passwd_exec_t</computeroutput> type) is " -"executed, the user's shell process transitions to the " -"<computeroutput>passwd_t</computeroutput> domain. Remember: the type defines " -"a domain for processes, and a type for files." -msgstr "" +msgid "In this example, when the <filename>/usr/bin/passwd</filename> application (labeled with the <computeroutput>passwd_exec_t</computeroutput> type) is executed, the user's shell process transitions to the <computeroutput>passwd_t</computeroutput> domain. Remember: the type defines a domain for processes, and a type for files." +msgstr "В этом примере, когда приложение <filename>/usr/bin/passwd</filename> (помеченное типом <computeroutput>passwd_exec_t</computeroutput>) выполняется, оболчка (shell) пользователя переходит в домен <computeroutput>passwd_t</computeroutput>. Важно: Тип определяет домен для процессов и тип для файлов."

#. Tag: para #, no-c-format -msgid "" -"Use the <command>ps -eZ</command> command to view the SELinux contexts for " -"running processes. The following is a limited example of the output, and may " -"differ on your system:" -msgstr "" +msgid "Use the <command>ps -eZ</command> command to view the SELinux contexts for running processes. The following is a limited example of the output, and may differ on your system:" +msgstr "Команда <command>ps -eZ</command> используется для просмотра контекстов SELinux запущенных процессов. Ниже показан ограниченный вывод команды, который может быть различных для разных операционных систем:"

+# Фраза Type Enforcement then separates each domain не имеет адекватного русского перевода, так как термин Type Enforcement не получается перевести корректно в данном контексте и этот термин не имеет русского аналога на данный момент. #. Tag: para #, no-c-format -msgid "" -"The <computeroutput>system_r</computeroutput> role is used for system " -"processes, such as daemons. Type Enforcement then separates each domain." -msgstr "" +msgid "The <computeroutput>system_r</computeroutput> role is used for system processes, such as daemons. Type Enforcement then separates each domain." +msgstr "Роль <computeroutput>system_r</computeroutput> используется для системных процессов, таких как демоны."

#. Tag: title #, no-c-format msgid "SELinux Contexts for Users" -msgstr "" +msgstr "Контексты SELinux для пользователей"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>id -Z</command> command to view the SELinux context " -"associated with your Linux user:" -msgstr "" +msgid "Use the <command>id -Z</command> command to view the SELinux context associated with your Linux user:" +msgstr "Используйте команду <command>id -Z</command> для просмотра контекста SELinux ассоциированного с пользователем Linux:"

#. Tag: para #, no-c-format -msgid "" -"In Fedora, Linux users run unconfined by default. This SELinux context shows " -"that the Linux user is mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user, running as the <computeroutput>unconfined_r</" -"computeroutput> role, and is running in the <computeroutput>unconfined_t</" -"computeroutput> domain. <computeroutput>s0-s0</computeroutput> is an MLS " -"range, which in this case, is the same as just <computeroutput>s0</" -"computeroutput>. The categories the user has access to is defined by " -"<computeroutput>c0.c1023</computeroutput>, which is all categories " -"(<computeroutput>c0</computeroutput> through to <computeroutput>c1023</" -"computeroutput>)." -msgstr "" +msgid "In Fedora, Linux users run unconfined by default. This SELinux context shows that the Linux user is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user, running as the <computeroutput>unconfined_r</computeroutput> role, and is running in the <computeroutput>unconfined_t</computeroutput> domain. <computeroutput>s0-s0</computeroutput> is an MLS range, which in this case, is the same as just <computeroutput>s0</computeroutput>. The categories the user has access to is defined by <computeroutput>c0.c1023</computeroutput>, which is all categories (<computeroutput>c0</computeroutput> through to <computeroutput>c1023</computeroutput>)." +msgstr "В Fedora, польователи Linux работают неограниченно по умолчанию. В данном случае контекст SELinux показывает, что пользователь Linux сопоставлен с пользователем SELinux <computeroutput>unconfined_u</computeroutput>, работающим с ролью <computeroutput>unconfined_r</computeroutput>, и в <computeroutput>unconfined_t</computeroutput> домене. <computeroutput>s0-s0</computeroutput> показывает диапазон уровней MLS, который в данном случае одинаковый <computeroutput>s0</computeroutput>. Категории, к которым пользователь имеет доступ определены: <computeroutput>c0.c1023</computeroutput>, это все категории (от <computeroutput>c0</computeroutput> до <computeroutput>c1023</computeroutput>)."

Modified: community/branches/f13/ru-RU/Further_Information.po =================================================================== --- community/branches/f13/ru-RU/Further_Information.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Further_Information.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,246 +1,202 @@ # SOME DESCRIPTIVE TITLE. # FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-11-20 15:06+0500\n" +"Last-Translator: Alexey Cicin daydrim@gmail.com\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n"

#. Tag: title #, no-c-format msgid "Further Information" -msgstr "" +msgstr "Дополнительная информация"

#. Tag: title #, no-c-format msgid "Contributors" -msgstr "" +msgstr "Спонсоры, ассистенты, помощники"

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://fedoraproject.org/wiki/GeertWarrink%5C%22%3EGeert Warrink</" -"ulink> (translation - Dutch)" -msgstr "" +msgid "<ulink url="http://fedoraproject.org/wiki/GeertWarrink%5C%22%3EGeert Warrink</ulink> (translation - Dutch)" +msgstr "<ulink url="http://fedoraproject.org/wiki/GeertWarrink%5C%22%3EGeert Warrink</ulink> (translation - Dutch)"

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://fedoraproject.org/wiki/User:Beckerde%5C%22%3EDomingo Becker</" -"ulink> (translation - Spanish)" -msgstr "" +msgid "<ulink url="http://fedoraproject.org/wiki/User:Beckerde%5C%22%3EDomingo Becker</ulink> (translation - Spanish)" +msgstr "<ulink url="http://fedoraproject.org/wiki/User:Beckerde%5C%22%3EDomingo Becker</ulink> (translation - Spanish)"

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://fedoraproject.org/wiki/User:Logan%5C%22%3EDaniel Cabrera</" -"ulink> (translation - Spanish)" -msgstr "" +msgid "<ulink url="http://fedoraproject.org/wiki/User:Logan%5C%22%3EDaniel Cabrera</ulink> (translation - Spanish)" +msgstr "<ulink url="http://fedoraproject.org/wiki/User:Logan%5C%22%3EDaniel Cabrera</ulink> (translation - Spanish)"

#. Tag: title #, no-c-format msgid "Other Resources" -msgstr "" +msgstr "Другие ресурсы"

#. Tag: title #, no-c-format msgid "The National Security Agency (NSA)" -msgstr "" +msgstr "Национальное агентство безопасности The National Security Agency (NSA)"

#. Tag: para #, no-c-format -msgid "" -"From the NSA <ulink url="http://www.nsa.gov/research/selinux/contrib.shtml" -"">Contributors to SELinux</ulink> page:" -msgstr "" +msgid "From the NSA <ulink url="http://www.nsa.gov/research/selinux/contrib.shtml%5C%22%3EContributors to SELinux</ulink> page:" +msgstr "Из страницы NSA <ulink url="http://www.nsa.gov/research/selinux/contrib.shtml%5C%22%3EContributors to SELinux</ulink>:"

#. Tag: para #, no-c-format -msgid "" -"<emphasis>Researchers in NSA's National Information Assurance Research " -"Laboratory (NIARL) designed and implemented flexible mandatory access " -"controls in the major subsystems of the Linux kernel and implemented the new " -"operating system components provided by the Flask architecture, namely the " -"security server and the access vector cache. The NSA researchers reworked " -"the LSM-based SELinux for inclusion in Linux 2.6. NSA has also led the " -"development of similar controls for the X Window System (XACE/XSELinux) and " -"for Xen (XSM/Flask).</emphasis>" -msgstr "" +msgid "<emphasis>Researchers in NSA's National Information Assurance Research Laboratory (NIARL) designed and implemented flexible mandatory access controls in the major subsystems of the Linux kernel and implemented the new operating system components provided by the Flask architecture, namely the security server and the access vector cache. The NSA researchers reworked the LSM-based SELinux for inclusion in Linux 2.6. NSA has also led the development of similar controls for the X Window System (XACE/XSELinux) and for Xen (XSM/Flask).</emphasis>" +msgstr "<emphasis>Научные работники в NSA's National Information Assurance Research Laboratory (NIARL) разработали и спроектировали гибкий механизм управления мандатным доступом в основных подсистемах ядра Linux и внедрили в новую операционную систему компоненты, предоставляющие архитектуру Flask, в частности сервер безопасности и кэш вектора доступа. Исследователи NSA переработали LSM SELinux для включения в Linux 2.6. NSA также ведет разработку аналогичных механизмов управления для X Window System (XACE/XSELinux) и Xen (XSM/Flask).</emphasis>"

#. Tag: para #, no-c-format -msgid "" -"Main SELinux website: <ulink url="http://www.nsa.gov/research/selinux/index." -"shtml" />." -msgstr "" +msgid "Main SELinux website: <ulink url="http://www.nsa.gov/research/selinux/index.shtml%5C" />." +msgstr "Основной веб-сайт SELinux: <ulink url="http://www.nsa.gov/research/selinux/index.shtml%5C" />."

#. Tag: para #, no-c-format -msgid "" -"SELinux documentation: <ulink url="http://www.nsa.gov/research/selinux/docs." -"shtml" />." -msgstr "" +msgid "SELinux documentation: <ulink url="http://www.nsa.gov/research/selinux/docs.shtml%5C" />." +msgstr "Документация SELinux: <ulink url="http://www.nsa.gov/research/selinux/docs.shtml%5C" />."

#. Tag: para #, no-c-format -msgid "" -"SELinux background: <ulink url="http://www.nsa.gov/research/selinux/" -"background.shtml" />." -msgstr "" +msgid "SELinux background: <ulink url="http://www.nsa.gov/research/selinux/background.shtml%5C" />." +msgstr "Предпосылки SELinux: <ulink url="http://www.nsa.gov/research/selinux/background.shtml%5C" />."

#. Tag: title #, no-c-format msgid "Tresys Technology" -msgstr "" +msgstr "Tresys Technology"

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> are the " -"upstream for:" -msgstr "" +msgid "<ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> are the upstream for:" +msgstr "<ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> в направлении к:"

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://userspace.selinuxproject.org/trac/%5C%22%3ESELinux userland " -"libraries and tools</ulink>." -msgstr "" +msgid "<ulink url="http://userspace.selinuxproject.org/trac/%5C%22%3ESELinux userland libraries and tools</ulink>." +msgstr "<ulink url="http://userspace.selinuxproject.org/trac/%5C%22%3ESELinux userland libraries and tools</ulink>."

#. Tag: para #, no-c-format -msgid "" -"<ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference " -"Policy</ulink>." -msgstr "" +msgid "<ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference Policy</ulink>." +msgstr "<ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference Policy</ulink>."

#. Tag: title #, no-c-format msgid "SELinux News" -msgstr "" +msgstr "Новости SELinux"

#. Tag: para #, no-c-format msgid "News: <ulink url="http://selinuxnews.org/wp/%5C" />." -msgstr "" +msgstr "Новости: <ulink url="http://selinuxnews.org/wp/%5C" />."

#. Tag: para #, no-c-format -msgid "" -"Planet SELinux (blogs): <ulink url="http://selinuxnews.org/planet/%5C" />." -msgstr "" +msgid "Planet SELinux (blogs): <ulink url="http://selinuxnews.org/planet/%5C" />." +msgstr "Planet SELinux (blogs): <ulink url="http://selinuxnews.org/planet/%5C" />."

#. Tag: title #, no-c-format msgid "SELinux Project Wiki" -msgstr "" +msgstr "SELinux Project Wiki"

#. Tag: para #, no-c-format msgid "Main page: <ulink url="http://selinuxproject.org/page/Main_Page%5C" />." -msgstr "" +msgstr "Основная страница: <ulink url="http://selinuxproject.org/page/Main_Page%5C" />."

#. Tag: para #, no-c-format -msgid "" -"User resources, including links to documentation, mailing lists, websites, " -"and tools: <ulink url="http://selinuxproject.org/page/User_Resources%5C" />." -msgstr "" +msgid "User resources, including links to documentation, mailing lists, websites, and tools: <ulink url="http://selinuxproject.org/page/User_Resources%5C" />." +msgstr "Пользовательские ресурсы, включаю ссылку к документации, рассылочные листы, веб-сайты и инструменты: <ulink url="http://selinuxproject.org/page/User_Resources%5C" />."

#. Tag: title #, no-c-format msgid "Red Hat Enterprise Linux" -msgstr "" +msgstr "Red Hat Enterprise Linux"

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://www.redhat.com/docs/en-US/" -"Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/index.html">Red Hat " -"Enterprise Linux Deployment Guide</ulink> contains an SELinux <ulink url=" -""http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/" -"Deployment_Guide/selg-chapter-0054.html">References</ulink> section, that " -"has links to SELinux tutorials, general information, and the technology " -"behind SELinux." -msgstr "" +msgid "The <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux Deployment Guide</ulink> contains an SELinux <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen...</ulink> section, that has links to SELinux tutorials, general information, and the technology behind SELinux." +msgstr "<ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux Deployment Guide</ulink> содержит раздел SELinux <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen...</ulink>, где есть ссылки к демонстрациям SELinux, основной информации и технологиям использующихся в SELinux."

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/" -"selinux-guide/index.html">Red Hat Enterprise Linux 4 SELinux Guide</ulink>." -msgstr "" +msgid "The <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/in... Hat Enterprise Linux 4 SELinux Guide</ulink>." +msgstr "<ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/in... Hat Enterprise Linux 4 SELinux Guide</ulink>."

#. Tag: title #, no-c-format msgid "Fedora" -msgstr "" +msgstr "Fedora"

#. Tag: para #, no-c-format msgid "Main page: <ulink url="http://fedoraproject.org/wiki/SELinux%5C" />." -msgstr "" +msgstr "Основная страница: <ulink url="http://fedoraproject.org/wiki/SELinux%5C" />."

#. Tag: para #, no-c-format -msgid "" -"Troubleshooting: <ulink url="http://fedoraproject.org/wiki/SELinux/" -"Troubleshooting" />." -msgstr "" +msgid "Troubleshooting: <ulink url="http://fedoraproject.org/wiki/SELinux/Troubleshooting%5C" />." +msgstr "Поиск и устранение неисправностей: <ulink url="http://fedoraproject.org/wiki/SELinux/Troubleshooting%5C" />."

#. Tag: para #, no-c-format -msgid "" -"Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/" -"selinux-faq-fc5/" />." -msgstr "" +msgid "Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C" />." +msgstr "Fedora Core 5 SELinux FAQ: <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C" />."

#. Tag: para #, no-c-format -msgid "" -"SELinux Managing Confined Services Guide: <ulink url="http://docs." -"fedoraproject.org/selinux-managing-confined-services-guide/" />" -msgstr "" +msgid "SELinux Managing Confined Services Guide: <ulink url="http://docs.fedoraproject.org/selinux-managing-confined-services-guide/%5C" />" +msgstr "SELinux Руководство по управлению ограниченными службами (SELinux Managing Confined Services Guide): <ulink url="http://docs.fedoraproject.org/selinux-managing-confined-services-guide/%5C" />"

#. Tag: title #, no-c-format msgid "The UnOfficial SELinux FAQ" -msgstr "" +msgstr "Неофициальный SELinux FAQ"

#. Tag: para #, no-c-format msgid "<ulink url="http://www.crypt.gen.nz/selinux/faq.html%5C" />" -msgstr "" +msgstr "<ulink url="http://www.crypt.gen.nz/selinux/faq.html%5C" />"

#. Tag: title #, no-c-format msgid "IRC" -msgstr "" +msgstr "IRC"

#. Tag: para #, no-c-format msgid "On <ulink url="http://freenode.net/%5C%22%3EFreenode</ulink>:" -msgstr "" +msgstr "На <ulink url="http://freenode.net/%5C%22%3EFreenode</ulink>:"

#. Tag: para #, no-c-format msgid "#selinux" -msgstr "" +msgstr "#selinux"

#. Tag: para #, no-c-format msgid "#fedora-selinux" -msgstr "" +msgstr "#fedora-selinux"

#. Tag: para #, no-c-format msgid "#security" -msgstr "" +msgstr "#security"

Modified: community/branches/f13/ru-RU/Introduction.po =================================================================== --- community/branches/f13/ru-RU/Introduction.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Introduction.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,424 +1,227 @@ -# SOME DESCRIPTIVE TITLE. -# FIRST AUTHOR EMAIL@ADDRESS, YEAR. -# -#, fuzzy +# SOME DESCRIPTIVE TITLE. +# FIRST AUTHOR EMAIL@ADDRESS, YEAR. +# msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-07-30 00:03+0500\n" +"Last-Translator: Alexey Cicin daydrim@gmail.com\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n"

#. Tag: title #, no-c-format msgid "Introduction" -msgstr "" +msgstr "Введение"

#. Tag: para #, no-c-format -msgid "" -"Security-Enhanced Linux (SELinux) is an implementation of a " -"<firstterm>mandatory access control</firstterm> mechanism in the Linux " -"kernel, checking for allowed operations after standard " -"<firstterm>discretionary access controls</firstterm> are checked. It was " -"created by the National Security Agency and can enforce rules on files and " -"processes in a Linux system, and on their actions, based on defined policy." -msgstr "" +msgid "Security-Enhanced Linux (SELinux) is an implementation of a <firstterm>mandatory access control</firstterm> mechanism in the Linux kernel, checking for allowed operations after standard <firstterm>discretionary access controls</firstterm> are checked. It was created by the National Security Agency and can enforce rules on files and processes in a Linux system, and on their actions, based on defined policy." +msgstr "Linux с улучшенной безопасностью (SELinux) - это реализация мандатного управления доступом <firstterm>mandatory access control</firstterm> в ядре Linux, проверяющего разрешение операций после проверки стандартного дискреционного управления доступом <firstterm>discretionary access controls</firstterm>. SELinux создан Агенством Национальной Безопасности и вводит в действие правила для файлов и процессов в системе Linux, для совершаемых над ними действий, основываясь на установленной политике."

#. Tag: para #, no-c-format -msgid "" -"When using SELinux, files, including directories and devices, are referred " -"to as objects. Processes, such as a user running a command or the <trademark " -"class="registered">Mozilla</trademark><trademark class="registered"> " -"Firefox</trademark> application, are referred to as subjects. Most operating " -"systems use a Discretionary Access Control (DAC) system that controls how " -"subjects interact with objects, and how subjects interact with each other. " -"On operating systems using DAC, users control the permissions of files " -"(objects) that they own. For example, on <trademark class="registered" -"">Linux</trademark> operating systems, users could make their home " -"directories world-readable, giving users and processes (subjects) access to " -"potentially sensitive information, with no further protection over this " -"unwanted action." -msgstr "" +msgid "When using SELinux, files, including directories and devices, are referred to as objects. Processes, such as a user running a command or the <trademark class="registered">Mozilla</trademark><trademark class="registered"> Firefox</trademark> application, are referred to as subjects. Most operating systems use a Discretionary Access Control (DAC) system that controls how subjects interact with objects, and how subjects interact with each other. On operating systems using DAC, users control the permissions of files (objects) that they own. For example, on <trademark class="registered">Linux</trademark> operating systems, users could make their home directories world-readable, giving users and processes (subjects) access to potentially sensitive information, with no further protection over this unwanted action." +msgstr "При использовании SELinux, файлы, включая директории и устройства являются объектами. Процессы, такие как, выполнение команды пользователем или приложение <trademark class="registered">Mozilla</trademark><trademark class="registered"> Firefox</trademark>, являются субъектами. Большинство операционных систем используют механизм дискретного контроля доступа (Discretionary Access Control (DAC), который контролирует каким образом субъекты взаимодействуют с объектами, и как субъекты взаимодействуют друг с другом. В операционных системах с использованием DAC, пользователи контролируют права д оступа к файлам (объектам), для которых они являются собственниками. Например, в операционных системах <trademark class="registered">Linux</trademark>, пользователи могут сделать свои домашние директории читаемыми для всех, предоставив пользователям и процессам (субъектам) доступ к потенциально конфеденциальной информации, без какой либо защиты от этого нежелательных действий."

#. Tag: para #, no-c-format -msgid "" -"Relying on DAC mechanisms alone is fundamentally inadequate for strong " -"system security. DAC access decisions are only based on user identity and " -"ownership, ignoring other security-relevant information such as the role of " -"the user, the function and trustworthiness of the program, and the " -"sensitivity and integrity of the data. Each user has complete discretion " -"over their files, making it impossible to enforce a system-wide security " -"policy. Furthermore, every program run by a user inherits all of the " -"permissions granted to the user and is free to change access to the user's " -"files, so no protection is provided against malicious software. Many system " -"services and privileged programs must run with coarse-grained privileges " -"that far exceed their requirements, so that a flaw in any one of these " -"programs could be exploited to obtain further system access.<footnote> " -"<para> "Integrating Flexible Support for Security Policies into the Linux " -"Operating System", by Peter Loscocco and Stephen Smalley. This paper was " -"originally prepared for the National Security Agency and is, consequently, " -"in the public domain. Refer to the <ulink url="http://www.nsa.gov/research/" -"_files/selinux/papers/freenix01/index.shtml">original paper</ulink> for " -"details and the document as it was first released. Any edits and changes " -"were done by Murray McAllister. </para> </footnote>" -msgstr "" +msgid "Relying on DAC mechanisms alone is fundamentally inadequate for strong system security. DAC access decisions are only based on user identity and ownership, ignoring other security-relevant information such as the role of the user, the function and trustworthiness of the program, and the sensitivity and integrity of the data. Each user has complete discretion over their files, making it impossible to enforce a system-wide security policy. Furthermore, every program run by a user inherits all of the permissions granted to the user and is free to change access to the user's files, so no protection is provided against malicious software. Many system services and privileged programs must run with coarse-grained privileges that far exceed their requirements, so that a flaw in any one of these programs could be exploited to obtain further system access.<footnote> <para> "Integrating Flexible Support for Security Policies into the Linux Operating System", by Peter Loscocco and Stephen Smalley. This paper was originally prepared for the National Security Agency and is, consequently, in the public domain. Refer to the <ulink url="http://www.nsa.gov/research/_files/selinux/papers/freenix01/index.shtml%5C%2... paper</ulink> for details and the document as it was first released. Any edits and changes were done by Murray McAllister. </para> </footnote>" +msgstr "Полагаться только на механизмы DAC - это фундаментально неверно для построения стойкой системы безопасности. Принятие решения о предоставлении доступа DAC основано только на подлинности пользователя и его правами доступа, игнорируя другую значимую информацию, такую как, роль пользователя, функцию и достоверность (надежность) программы, а также конфиденциальность и целостность данных. У каждого пользователя есть полное разделение прав для файлов, при котором невозможно назначать политику безопасности на уровне системы. Более тог о, каждая программа запускаемая пользователем наследует все права, предоставленные пользователю, и не ограничена в изменении прав доступа к пользовательским файлам, таким образом, нет никакой защиты против вредоносного программного обеспечения. Множество системных служб и привилегированных программ, должны запускаться с грубо назначенными привилегиями, права на которые превосходят требуемые права, таким образом изъян в любой из этих программ может быть использован эксплоитом для получения доступа к системе. <footnote> <para> "Integrating Flexi ble Support for Security Policies into the Linux Operating System" , Peter Loscocco и Stephen Smalley. Данный документ изначально предназначался для Агенства Национальной Безопасности и следовательно находится в публичном владении. В соответствии с <ulink url="http://www.nsa.gov/research/_files/selinux/papers/freenix01/index.shtml%5C%2... paper</ulink> деталями и документом, на основании которых он был выпущен первоначально. Все изменения и редактирования выполнил Murray McAllister. </para> </footnote>"

#. Tag: para #, no-c-format -msgid "" -"The following is an example of permissions used on Linux operating systems " -"that do not run Security-Enhanced Linux (SELinux). The permissions and " -"output in these examples may differ from your system. Use the <command>ls -" -"l</command> command to view file permissions:" -msgstr "" +msgid "The following is an example of permissions used on Linux operating systems that do not run Security-Enhanced Linux (SELinux). The permissions and output in these examples may differ from your system. Use the <command>ls -l</command> command to view file permissions:" +msgstr "Ниже показаны примеры разрешений используемые в операционных системах Linux, которые не используют Linux с улучшенной безопасностью (Security-Enhanced Linux, SELinux). Разрешения и выводы в этих примерах могут отличаться от используемых в реальных системах. Для просмотра разрешений используется команда <command>ls -l</command>:"

#. Tag: para #, no-c-format -msgid "" -"The first three permission bits, <computeroutput>rwx</computeroutput>, " -"control the access the Linux <computeroutput>user1</computeroutput> user (in " -"this case, the owner) has to <filename>file1</filename>. The next three " -"permission bits, <computeroutput>rw-</computeroutput>, control the access " -"the Linux <computeroutput>group1</computeroutput> group has to " -"<filename>file1</filename>. The last three permission bits, " -"<computeroutput>r--</computeroutput>, control the access everyone else has " -"to <filename>file1</filename>, which includes all users and processes." -msgstr "" +msgid "The first three permission bits, <computeroutput>rwx</computeroutput>, control the access the Linux <computeroutput>user1</computeroutput> user (in this case, the owner) has to <filename>file1</filename>. The next three permission bits, <computeroutput>rw-</computeroutput>, control the access the Linux <computeroutput>group1</computeroutput> group has to <filename>file1</filename>. The last three permission bits, <computeroutput>r--</computeroutput>, control the access everyone else has to <filename>file1</filename>, which includes all users and processes." +msgstr "Первые три бита доступа, <computeroutput>rwx</computeroutput>, управляют доступом пользователя Linux <computeroutput>user1</computeroutput> (в данном случае владельца) к файлу <filename>file1</filename>. Следующие три бита доступа , <computeroutput>rw-</computeroutput>, управляют доступом группы Linux <computeroutput>group1</computeroutput> к <filename>file1</filename>. Последние три бита доступа <computeroutput>r--</computeroutput>, управляют доступом для всех пользователей к <filename>file1</filename>, что включает всех пользователей и процессы."

#. Tag: para #, no-c-format -msgid "" -"Security-Enhanced Linux (SELinux) adds Mandatory Access Control (MAC) to the " -"Linux kernel, and is enabled by default in Fedora. A general purpose MAC " -"architecture needs the ability to enforce an administratively-set security " -"policy over all processes and files in the system, basing decisions on " -"labels containing a variety of security-relevant information. When properly " -"implemented, it enables a system to adequately defend itself and offers " -"critical support for application security by protecting against the " -"tampering with, and bypassing of, secured applications. MAC provides strong " -"separation of applications that permits the safe execution of untrustworthy " -"applications. Its ability to limit the privileges associated with executing " -"processes limits the scope of potential damage that can result from the " -"exploitation of vulnerabilities in applications and system services. MAC " -"enables information to be protected from legitimate users with limited " -"authorization as well as from authorized users who have unwittingly executed " -"malicious applications.<footnote> <para> "Meeting Critical Security " -"Objectives with Security-Enhanced Linux", by Peter Loscocco and Stephen " -"Smalley. This paper was originally prepared for the National Security Agency " -"and is, consequently, in the public domain. Refer to the <ulink url="http://" -"www.nsa.gov/research/_files/selinux/papers/ottawa01/index.shtml">original " -"paper</ulink> for details and the document as it was first released. Any " -"edits and changes were done by Murray McAllister. </para> </footnote>" -msgstr "" +msgid "Security-Enhanced Linux (SELinux) adds Mandatory Access Control (MAC) to the Linux kernel, and is enabled by default in Fedora. A general purpose MAC architecture needs the ability to enforce an administratively-set security policy over all processes and files in the system, basing decisions on labels containing a variety of security-relevant information. When properly implemented, it enables a system to adequately defend itself and offers critical support for application security by protecting against the tampering with, and bypassing of, secured applications. MAC provides strong separation of applications that permits the safe execution of untrustworthy applications. Its ability to limit the privileges associated with executing processes limits the scope of potential damage that can result from the exploitation of vulnerabilities in applications and system services. MAC enables information to be protected from legitimate users with limited authorization as well as f rom authorized users who have unwittingly executed malicious applications.<footnote> <para> "Meeting Critical Security Objectives with Security-Enhanced Linux", by Peter Loscocco and Stephen Smalley. This paper was originally prepared for the National Security Agency and is, consequently, in the public domain. Refer to the <ulink url="http://www.nsa.gov/research/_files/selinux/papers/ottawa01/index.shtml%5C%22... paper</ulink> for details and the document as it was first released. Any edits and changes were done by Murray McAllister. </para> </footnote>" +msgstr "Security-Enhanced Linux (SELinux) добавляет Mandatory Access Control (MAC) в ядро Linux, и включено в Fedora по-умолчанию. Основное назначение архитектуры MAC - это возможность принудительного назначения административно-установленной политики безопасности над всеми процессами и файлами системы, при этом решение основывается на метках, содержащих множество значимой информации по безопасности. Когда механизм SELinux реализован, он переводит систему в состоянии достаточной защищенности и предоставляет критичную поддержку приложениям, защищая приложения от взлома ил и обхода безопасности. MAC предоставляет строгое разделение приложений и позволяет безопасное исполнение не доверенных приложений. Обладая способностью ограничивать привелегии, связанные с исполнением процессов, MAC ограничивает рамки потенциальной угрозы, таким образом ограничивая взлом уязвимостей в приложениях и системных службах. MAC включает защиту информации от пользователей корректно авторизованных в системе с ограниченными правами также как и от авторизованных пользователей, которые неосознанно исполняют вредоносный код . <footnote> <para> "Meeting Critical Security Objectives with Security-Enhanced Linux" , Peter Loscocco и Stephen Smalley. Данный документ изначально предназначался для Агенства Национальной Безопасности и следовательно находится в публичном владении. В соответствии с <ulink url="http://www.nsa.gov/research/_files/selinux/papers/ottawa01/index.shtml%5C%22... paper</ulink> деталями и документом, на основании которых он был выпущен первоначально. Все изменения и редактирования выполнены Murray McAllister. </para> </footnote>"

#. Tag: para #, no-c-format -msgid "" -"The following is an example of the labels containing security-relevant " -"information that are used on processes, Linux users, and files, on Linux " -"operating systems that run SELinux. This information is called the SELinux " -"<emphasis>context</emphasis>, and is viewed using the <command>ls -Z</" -"command> command:" -msgstr "" +msgid "The following is an example of the labels containing security-relevant information that are used on processes, Linux users, and files, on Linux operating systems that run SELinux. This information is called the SELinux <emphasis>context</emphasis>, and is viewed using the <command>ls -Z</command> command:" +msgstr "Далее следует пример меток содержащих значимую информацию о безопасности, которая используется для процессов, пользователей Linux и файлов в операционных системах Linux, запущенных с поддержкой SELinux. Эта информация называется SELinux <emphasis>context</emphasis> и просматривается с помощью команды <command>ls -Z</command>:"

#. Tag: para #, no-c-format -msgid "" -"In this example, SELinux provides a user (<computeroutput>unconfined_u</" -"computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type " -"(<computeroutput>user_home_t</computeroutput>), and a level " -"(<computeroutput>s0</computeroutput>). This information is used to make " -"access control decisions. With DAC, access is controlled based only on Linux " -"user and group IDs. It is important to remember that SELinux policy rules " -"are checked <emphasis>after</emphasis> DAC rules. SELinux policy rules are " -"not used if DAC rules deny access first." -msgstr "" +msgid "In this example, SELinux provides a user (<computeroutput>unconfined_u</computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type (<computeroutput>user_home_t</computeroutput>), and a level (<computeroutput>s0</computeroutput>). This information is used to make access control decisions. With DAC, access is controlled based only on Linux user and group IDs. It is important to remember that SELinux policy rules are checked <emphasis>after</emphasis> DAC rules. SELinux policy rules are not used if DAC rules deny access first." +msgstr "В этом примере, SELinux предоставляет пользователю (<computeroutput>unconfined_u</computeroutput>), роль (<computeroutput>object_r</computeroutput>), тип (<computeroutput>user_home_t</computeroutput>), и уровень (<computeroutput>s0</computeroutput>). Эта информация используется для принятия решения о предоставлении доступа. Используя DAC, доступ контролируется на основе ID пользователя и группы. Важно помнить, что правила политики SELinux проверяются <emphasis>после</emphasis> правил DAC. Правила политики SELinux не используются, если правила DAC блокируют доступ."

#. Tag: title #, no-c-format msgid "Linux and SELinux Users" -msgstr "" +msgstr "Linux и пользователи SELinux"

#. Tag: para #, no-c-format -msgid "" -"On Linux operating systems that run SELinux, there are Linux users as well " -"as SELinux users. SELinux users are part of SELinux policy. Linux users are " -"mapped to SELinux users. To avoid confusion, this guide uses "Linux user" " -"and "SELinux user" to differentiate between the two." -msgstr "" +msgid "On Linux operating systems that run SELinux, there are Linux users as well as SELinux users. SELinux users are part of SELinux policy. Linux users are mapped to SELinux users. To avoid confusion, this guide uses "Linux user" and "SELinux user" to differentiate between the two." +msgstr "В операционных системах Linux с запущенным SELinux, существуют пользователи Linux и пользователи SELinux. Пользователи SELinux - это часть политики SELinux. Пользователи Linux сопоставляются (маппируются) с пользователями SELinux. Для того, чтобы избежать путаницы, в данном руководстве используются два термина "пользователь Linux" и "пользователь SELinux" для различия двух разных понятий."

#. Tag: title #, no-c-format msgid "Benefits of running SELinux" -msgstr "" +msgstr "Преимущества использования SELinux"

#. Tag: para #, no-c-format -msgid "" -"All processes and files are labeled with a type. A type defines a domain for " -"processes, and a type for files. Processes are separated from each other by " -"running in their own domains, and SELinux policy rules define how processes " -"interact with files, as well as how processes interact with each other. " -"Access is only allowed if an SELinux policy rule exists that specifically " -"allows it." -msgstr "" +msgid "All processes and files are labeled with a type. A type defines a domain for processes, and a type for files. Processes are separated from each other by running in their own domains, and SELinux policy rules define how processes interact with files, as well as how processes interact with each other. Access is only allowed if an SELinux policy rule exists that specifically allows it." +msgstr "Все процессы и файлы маркируются определённым типом. Тип определяет домен для процесса и тип для файлов. Процессы отделяются один от другого запуском в различных доменах и правила политики SELinux определяют как процесс взаимодействует с файлами, так же как и процессы взаимодействуют друг с другом. Доступ предоставляется только в том случае, если существует правило политики SELinux, разрешающее конкретное действие."

#. Tag: para #, no-c-format -msgid "" -"Fine-grained access control. Stepping beyond traditional <trademark class=" -""registered">UNIX</trademark> permissions that are controlled at user " -"discretion and based on Linux user and group IDs, SELinux access decisions " -"are based on all available information, such as an SELinux user, role, type, " -"and, optionally, a level." -msgstr "" +msgid "Fine-grained access control. Stepping beyond traditional <trademark class="registered">UNIX</trademark> permissions that are controlled at user discretion and based on Linux user and group IDs, SELinux access decisions are based on all available information, such as an SELinux user, role, type, and, optionally, a level." +msgstr "Тонко-настраиваемый контроль доступа. Выходя за рамки традиционных разрешений <trademark class="registered">UNIX</trademark> которые контролируются на уровне разделения пользователей и основываются на ID пользователей и групп Linux; решения доступа SELinux принимаются на основе всей доступной информации, такой как, пользователи SELinux, роли, тип и уровень (опционально)."

#. Tag: para #, no-c-format -msgid "" -"SELinux policy is administratively-defined, enforced system-wide, and is not " -"set at user discretion." -msgstr "" +msgid "SELinux policy is administratively-defined, enforced system-wide, and is not set at user discretion." +msgstr "Политика SELinux назначается административно, вводится в действие на уровне всей системы и не основывается на разделении пользователей."

#. Tag: para #, no-c-format -msgid "" -"Reduced vulnerability to privilege escalation attacks. One example: since " -"processes run in domains, and are therefore separated from each other, and " -"because SELinux policy rules define how processes access files and other " -"processes, if a process is compromised, the attacker only has access to the " -"normal functions of that process, and to files the process has been " -"configured to have access to. For example, if the Apache HTTP Server is " -"compromised, an attacker can not use that process to read files in user home " -"directories, unless a specific SELinux policy rule was added or configured " -"to allow such access." -msgstr "" +msgid "Reduced vulnerability to privilege escalation attacks. One example: since processes run in domains, and are therefore separated from each other, and because SELinux policy rules define how processes access files and other processes, if a process is compromised, the attacker only has access to the normal functions of that process, and to files the process has been configured to have access to. For example, if the Apache HTTP Server is compromised, an attacker can not use that process to read files in user home directories, unless a specific SELinux policy rule was added or configured to allow such access." +msgstr "Уменьшение уязвимостей свзянных с атаками по повышению привелегий. Пример. Так как процессы запускаются в доменах и, таким образом, отделены друг от друга, и так как правила политики SELinux определяют, как процессы получают доступ к файлам и другим процессами, то если процесс скомпрометирован, атакующий имеет доступ только к штатным функциям данного процесса и к файлам, доступ к которым есть у данного процесса. К примеру, если Apache HTTP Server скомпрометирован, атакующий не имеет возможности использовать данный процесс, чтобы прочитать фа йлы в домашних каталогах пользователей, до тех пор, пока специальное правило политики SELinux не будет сконфигурировано для предоставления такого доступа."

#. Tag: para #, no-c-format -msgid "" -"SELinux can be used to enforce data confidentiality and integrity, as well " -"as protecting processes from untrusted inputs." -msgstr "" +msgid "SELinux can be used to enforce data confidentiality and integrity, as well as protecting processes from untrusted inputs." +msgstr "SELinux может быть использован для усиления конфиденциальности и целостности данных, а также для защиты процессов от атак."

#. Tag: para #, no-c-format msgid "SELinux is not:" -msgstr "" +msgstr "SELinux не является:"

#. Tag: para #, no-c-format msgid "antivirus software." -msgstr "" +msgstr "антивирусным программным обеспечением."

#. Tag: para #, no-c-format msgid "a replacement for passwords, firewalls, or other security systems." -msgstr "" +msgstr "заменой паролям, межсетевым экранам или другим системам безопасности."

#. Tag: para #, no-c-format msgid "an all-in-one security solution." -msgstr "" +msgstr "решением безопасности "всё в одном"."

#. Tag: para #, no-c-format -msgid "" -"SELinux is designed to enhance existing security solutions, not replace " -"them. Even when running SELinux, continue to follow good security practices, " -"such as keeping software up-to-date, using hard-to-guess passwords, " -"firewalls, and so on." -msgstr "" +msgid "SELinux is designed to enhance existing security solutions, not replace them. Even when running SELinux, continue to follow good security practices, such as keeping software up-to-date, using hard-to-guess passwords, firewalls, and so on." +msgstr "SELinux разработан, для усовершенствования существующих решений по безопасности. Даже с запущенным SELinux, необходимо использование практик по безопасности, таких как обновление программного обеспечения последними обновлениями, использование сложных паролей, межсетевых экранов и прочего."

#. Tag: title #, no-c-format msgid "Examples" -msgstr "" +msgstr "Примеры"

#. Tag: para #, no-c-format msgid "The following examples demonstrate how SELinux increases security:" -msgstr "" +msgstr "В следующих примерах демонстрируется как SELinux повышает безопасность:"

#. Tag: para #, no-c-format -msgid "" -"The default action is deny. If an SELinux policy rule does not exist to " -"allow access, such as for a process opening a file, access is denied." -msgstr "" +msgid "The default action is deny. If an SELinux policy rule does not exist to allow access, such as for a process opening a file, access is denied." +msgstr "Действие для SELinux по-умолчанию - это блокирование доступа. Если не существует правила политики SELinux, которое предоставляет доступ, к примеру для открытия файла процессом, то доступ блокируется."

#. Tag: para #, no-c-format -msgid "" -"SELinux can confine Linux users. A number of confined SELinux users exist in " -"SELinux policy. Linux users can be mapped to confined SELinux users to take " -"advantage of the security rules and mechanisms applied to them. For example, " -"mapping a Linux user to the SELinux user_u user, results in a Linux user " -"that is not able to run (unless configured otherwise) set user ID (setuid) " -"applications, such as <command>sudo</command> and <command>su</command>, as " -"well as preventing them from executing files and applications in their home " -"directory - if configured, this prevents users from executing malicious " -"files from their home directories." -msgstr "" +msgid "SELinux can confine Linux users. A number of confined SELinux users exist in SELinux policy. Linux users can be mapped to confined SELinux users to take advantage of the security rules and mechanisms applied to them. For example, mapping a Linux user to the SELinux user_u user, results in a Linux user that is not able to run (unless configured otherwise) set user ID (setuid) applications, such as <command>sudo</command> and <command>su</command>, as well as preventing them from executing files and applications in their home directory - if configured, this prevents users from executing malicious files from their home directories." +msgstr "SELinux может ограничивать пользователей Linux. Определенное число ограниченных (confined) пользователей SELinux существует в политике SELinux. Пользователи Linux могут быть сопоставлены с ограниченными пользователями SELinux для получения преимуществ использования ролей безопасности и применяемых к ним механизмов. Например, сопоставление пользователя Linux с пользователем SELinux user_u, приводит к тому, что пользователь Linux не может выполнить (до тех пор пока не будет сконфигурировано обратное) приложение с использованием SUID бита (setuid), такие как <command>sudo</co mmand> и <command>su</command>, также предотвращает возможность записи ими в их домашние директории - и если сконфигурировано, то предотвращает запуск пользователями вредоносного программного обеспечения из их домашних директорий."

#. Tag: para #, no-c-format -msgid "" -"Process separation is used. Processes run in their own domains, preventing " -"processes from accessing files used by other processes, as well as " -"preventing processes from accessing other processes. For example, when " -"running SELinux, unless otherwise configured, an attacker can not compromise " -"a Samba server, and then use that Samba server as an attack vector to read " -"and write to files used by other processes, such as databases used by " -"<trademark class="registered">MySQL</trademark>." -msgstr "" +msgid "Process separation is used. Processes run in their own domains, preventing processes from accessing files used by other processes, as well as preventing processes from accessing other processes. For example, when running SELinux, unless otherwise configured, an attacker can not compromise a Samba server, and then use that Samba server as an attack vector to read and write to files used by other processes, such as databases used by <trademark class="registered">MySQL</trademark>." +msgstr "Использование разделения процессов. Процессы запускаются каждый в своём домене, предотвращая, доступ к файлам используемые другими процессами, а также блокируя процессам доступ к другим процессам. Например, когда SELinux включен, если не сконфигурировано обратное, то атакующий не может скомпрометироть Samba сервер, а затем использовать Samba сервер как вектор атаки для чтения и записи файлов, используемых другими процессами, такие как базы данных <trademark class="registered">MySQL</trademark>."

#. Tag: para #, no-c-format -msgid "" -"SELinux helps limit the damage made by configuration mistakes. <ulink url=" -""http://en.wikipedia.org/wiki/Domain_Name_System%5C%22%3EDomain Name System (DNS)" -"</ulink> servers often replicate information between each other in what is " -"known as a zone transfer. Attackers can use zone transfers to update DNS " -"servers with false information. When running the <ulink url="https://www." -"isc.org/software/bind">Berkeley Internet Name Domain (BIND)</ulink> as a " -"DNS server in Fedora, even if an administrator forgets to limit which " -"servers can perform a zone transfer, the default SELinux policy prevents " -"zone files <footnote> <para> Text files that include information, such as " -"hostname to IP address mappings, that are used by DNS servers. </para> </" -"footnote> from being updated via zone transfers, by the BIND <systemitem " -"class="daemon">named</systemitem> daemon itself, and by other processes." -msgstr "" +msgid "SELinux helps limit the damage made by configuration mistakes. <ulink url="http://en.wikipedia.org/wiki/Domain_Name_System%5C%22%3EDomain Name System (DNS)</ulink> servers often replicate information between each other in what is known as a zone transfer. Attackers can use zone transfers to update DNS servers with false information. When running the <ulink url="https://www.isc.org/software/bind%5C%22%3EBerkeley Internet Name Domain (BIND)</ulink> as a DNS server in Fedora, even if an administrator forgets to limit which servers can perform a zone transfer, the default SELinux policy prevents zone files <footnote> <para> Text files that include information, such as hostname to IP address mappings, that are used by DNS servers. </para> </footnote> from being updated via zone transfers, by the BIND <systemitem class="daemon">named</systemitem> daemon itself, and by other processes." +msgstr "SELinux помогает ограничить опасность создаваемую ошибку конфигурирования. <ulink url="http://en.wikipedia.org/wiki/Domain_Name_System%5C%22%3EDomain Name System (DNS)</ulink> серверы часто реплицируют информацию друг другу (данных мезанизм известен как передача зон). Атакующие могут использовать передачу зон для передачи DNS серверам ложной информации. Когда <ulink url="https://www.isc.org/software/bind%5C%22%3EBerkeley Internet Name Domain (BIND)</ulink> запущен в качестве DNS сервера в Fedora, даже если администратор забудет выставить ограничение, каким серверам разрешено выполнять передачу зон, политика SELinux по умолчанию, пре дотвратит файлы зон <footnote> <para> Текстовые файлы зон, которые содержат информацию о сопоставлениях имени хоста и IP адреса, используемых DNS серверами</para> </footnote> от обновления в процессе выполнения передачи зон демоном BIND <systemitem class="daemon">named</systemitem> или другим процессом."

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://www.redhatmagazine.com/%5C%22%3E<trademark class=" -""registered">Red Hat</trademark> Magazine</ulink> article, <ulink url=" -""http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-" -"hat-enterprise-linux-4/">Risk report: Three years of Red Hat Enterprise " -"Linux 4</ulink><footnote> <para> Cox, Mark. "Risk report: Three years of " -"Red Hat Enterprise Linux 4". Published 26 February 2008. Accessed 27 August " -"2009: <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-" -"three-years-of-red-hat-enterprise-linux-4/" />. </para> </footnote>, for " -"exploits that were restricted due to the default SELinux targeted policy in " -"<trademark class="registered">Red Hat</trademark> Enterprise <trademark " -"class="registered">Linux</trademark> 4." -msgstr "" +msgid "Refer to the <ulink url="http://www.redhatmagazine.com/%5C%22%3E<trademark class="registered">Red Hat</trademark> Magazine</ulink> article, <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-hat-... report: Three years of Red Hat Enterprise Linux 4</ulink><footnote> <para> Cox, Mark. "Risk report: Three years of Red Hat Enterprise Linux 4". Published 26 February 2008. Accessed 27 August 2009: <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-hat-..." />. </para> </footnote>, for exploits that were restricted due to the default SELinux targeted policy in <trademark class="registered">Red Hat</trademark> Enterprise <trademark class="registered">Linux</trademark> 4." +msgstr "Согласно статье <ulink url="http://www.redhatmagazine.com/%5C%22%3E<trademark class="registered">Red Hat</trademark> Magazine</ulink>, <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-hat-... report: Three years of Red Hat Enterprise Linux 4</ulink><footnote> <para> Cox, Mark. "Risk report: Three years of Red Hat Enterprise Linux 4". Published 26 February 2008. Accessed 27 August 2009: <ulink url="http://www.redhatmagazine.com/2008/02/26/risk-report-three-years-of-red-hat-..." />. </para> </footnote>, об эксплоитах, которые ограничиваются целевой политикой targeted SELinux в <trademark class="registered">Red Hat</trademark> Enterprise <trademark class="registered">Linux</trademark> 4."

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://www.linuxworld.com%5C%22%3ELinuxWorld.com</ulink> " -"article, <ulink url="http://www.linuxworld.com/news/2008/022408-selinux." -"html?page=1">A seatbelt for server software: SELinux blocks real-world " -"exploits</ulink><footnote> <para> Marti, Don. "A seatbelt for server " -"software: SELinux blocks real-world exploits". Published 24 February 2008. " -"Accessed 27 August 2009: <ulink url="http://www.linuxworld.com/" -"news/2008/022408-selinux.html?page=1" />. </para> </footnote>, for " -"background information about SELinux, and information about various exploits " -"that SELinux has prevented." -msgstr "" +msgid "Refer to the <ulink url="http://www.linuxworld.com%5C%22%3ELinuxWorld.com</ulink> article, <ulink url="http://www.linuxworld.com/news/2008/022408-selinux.html?page=1%5C%22%3EA seatbelt for server software: SELinux blocks real-world exploits</ulink><footnote> <para> Marti, Don. "A seatbelt for server software: SELinux blocks real-world exploits". Published 24 February 2008. Accessed 27 August 2009: <ulink url="http://www.linuxworld.com/news/2008/022408-selinux.html?page=1%5C" />. </para> </footnote>, for background information about SELinux, and information about various exploits that SELinux has prevented." +msgstr "Согласно статье <ulink url="http://www.linuxworld.com%5C%22%3ELinuxWorld.com</ulink> article, <ulink url="http://www.linuxworld.com/news/2008/022408-selinux.html?page=1%5C%22%3EA seatbelt for server software: SELinux blocks real-world exploits</ulink><footnote> <para> Marti, Don. "A seatbelt for server software: SELinux blocks real-world exploits". Published 24 February 2008. Accessed 27 August 2009: <ulink url="http://www.linuxworld.com/news/2008/022408-selinux.html?page=1%5C" />. </para> </footnote>, о внутренней работе SELinux и о различных эксплоитах ограниченных с помощью SELinux."

#. Tag: para #, no-c-format -msgid "" -"Refer to James Morris's <ulink url="http://james-morris.livejournal." -"com/25421.html">SELinux mitigates remote root vulnerability in OpenPegasus</" -"ulink> blog post for information about an exploit in <ulink url="http://www." -"openpegasus.org/">OpenPegasus</ulink> that was mitigated by SELinux as " -"shipped with Red Hat Enterprise Linux 4 and 5." -msgstr "" +msgid "Refer to James Morris's <ulink url="http://james-morris.livejournal.com/25421.html%5C%22%3ESELinux mitigates remote root vulnerability in OpenPegasus</ulink> blog post for information about an exploit in <ulink url="http://www.openpegasus.org/%5C%22%3EOpenPegasus</ulink> that was mitigated by SELinux as shipped with Red Hat Enterprise Linux 4 and 5." +msgstr "Согласно статье в блоге Джейса Морриса (James Morris) <ulink url="http://james-morris.livejournal.com/25421.html%5C%22%3ESELinux mitigates remote root vulnerability in OpenPegasus</ulink> об эксплоите в <ulink url="http://www.openpegasus.org/%5C%22%3EOpenPegasus</ulink> ограниченном с помощью SELinux поставляемым с Red Hat Enterprise Linux 4 и 5."

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> website " -"has an <ulink url="http://www.tresys.com/innovation.php%5C%22%3ESELinux " -"Mitigation News</ulink> section (on the right-hand side), that lists recent " -"exploits that have been mitigated or prevented by SELinux." -msgstr "" +msgid "The <ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> website has an <ulink url="http://www.tresys.com/innovation.php%5C%22%3ESELinux Mitigation News</ulink> section (on the right-hand side), that lists recent exploits that have been mitigated or prevented by SELinux." +msgstr "Вебсайт <ulink url="http://www.tresys.com/%5C%22%3ETresys Technology</ulink> опубликовал новость в разделе <ulink url="http://www.tresys.com/innovation.php%5C%22%3ESELinux Mitigation News</ulink> с правой стороны, в котором приведен список эксплоитов, ограниченных или полностью заблокированных с помощью SELinux."

#. Tag: title #, no-c-format msgid "SELinux Architecture" -msgstr "" +msgstr "Архитектура SELinux"

#. Tag: para #, no-c-format -msgid "" -"SELinux is a Linux security module that is built into the Linux kernel. " -"SELinux is driven by loadable policy rules. When security-relevant access is " -"taking place, such as when a process attempts to open a file, the operation " -"is intercepted in the kernel by SELinux. If an SELinux policy rule allows " -"the operation, it continues, otherwise, the operation is blocked and the " -"process receives an error." -msgstr "" +msgid "SELinux is a Linux security module that is built into the Linux kernel. SELinux is driven by loadable policy rules. When security-relevant access is taking place, such as when a process attempts to open a file, the operation is intercepted in the kernel by SELinux. If an SELinux policy rule allows the operation, it continues, otherwise, the operation is blocked and the process receives an error." +msgstr "SELinux - это модуль безопасности, который встроен в ядро Linux. SELinux управляется загружаемыми политиками. Когда происходит событие, имеющее значение по безопасности, такое как, открытие процессом файла, то это действие перехватывается SELinux на уровне ядра. Если правила политики SELinux позволяют выполнение данной операции, то выполнение продолжается, иначе, операция блокируется и процесс получает сообщение об ошибке."

#. Tag: para #, no-c-format -msgid "" -"SELinux decisions, such as allowing or disallowing access, are cached. This " -"cache is known as the Access Vector Cache (AVC). Caching decisions decreases " -"how often SELinux policy rules need to be checked, which increases " -"performance. Remember that SELinux policy rules have no effect if DAC rules " -"deny access first." -msgstr "" +msgid "SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). Caching decisions decreases how often SELinux policy rules need to be checked, which increases performance. Remember that SELinux policy rules have no effect if DAC rules deny access first." +msgstr "Решения SELinux, такие как разрешение или блокирование доступа кэшируются. Этот кэш известен как Access Vector Cache (AVC). Кэшированные решения уменьшают частоту обращения к правила поилитики SELinux, что увеличивает производительность. Необходимо помнить, что правила политики SELinux не используются, если правила DAC блокируют доступ."

#. Tag: title #, no-c-format msgid "SELinux on Other Operating Systems" -msgstr "" +msgstr "SELinux в разных операционных системах"

#. Tag: para #, no-c-format -msgid "" -"Refer to the following for information about running SELinux on operating " -"systems:" -msgstr "" +msgid "Refer to the following for information about running SELinux on operating systems:" +msgstr "Сслыки к ресурсам с дополнительной информацией о запуске SELinux в разных операционных системах:"

#. Tag: para #, no-c-format -msgid "" -"Hardened Gentoo: <ulink url="http://www.gentoo.org/proj/en/hardened/selinux/" -"selinux-handbook.xml" />." -msgstr "" +msgid "Hardened Gentoo: <ulink url="http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml%5C" />." +msgstr "Hardened Gentoo: <ulink url="http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml%5C" />."

#. Tag: para #, no-c-format msgid "Debian: <ulink url="http://wiki.debian.org/SELinux%5C" />." -msgstr "" +msgstr "Debian: <ulink url="http://wiki.debian.org/SELinux%5C" />."

#. Tag: para #, no-c-format -msgid "" -"Ubuntu: <ulink url="https://wiki.ubuntu.com/SELinux%5C" /> and <ulink url=" -""https://help.ubuntu.com/community/SELinux%5C" />." -msgstr "" +msgid "Ubuntu: <ulink url="https://wiki.ubuntu.com/SELinux%5C" /> and <ulink url="https://help.ubuntu.com/community/SELinux%5C" />." +msgstr "Ubuntu: <ulink url="https://wiki.ubuntu.com/SELinux%5C" /> и <ulink url="https://help.ubuntu.com/community/SELinux%5C" />."

#. Tag: para #, no-c-format -msgid "" -"Red Hat Enterprise Linux: <ulink url="http://www.redhat.com/docs/en-US/" -"Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/selg-overview.html">Red " -"Hat Enterprise Linux Deployment Guide</ulink> and <ulink url="http://www." -"redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/">Red Hat " -"Enterprise Linux 4 SELinux Guide</ulink>." -msgstr "" +msgid "Red Hat Enterprise Linux: <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux Deployment Guide</ulink> and <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/%5... Hat Enterprise Linux 4 SELinux Guide</ulink>." +msgstr "Red Hat Enterprise Linux: <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux Deployment Guide</ulink> и <ulink url="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/%5... Hat Enterprise Linux 4 SELinux Guide</ulink>."

#. Tag: para #, no-c-format -msgid "" -"Fedora: <ulink url="http://fedoraproject.org/wiki/SELinux%5C" /> and the " -"<ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3EFedora Core 5 " -"SELinux FAQ</ulink>." -msgstr "" +msgid "Fedora: <ulink url="http://fedoraproject.org/wiki/SELinux%5C" /> and the <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3EFedora Core 5 SELinux FAQ</ulink>." +msgstr "Fedora: <ulink url="http://fedoraproject.org/wiki/SELinux%5C" /> и <ulink url="http://docs.fedoraproject.org/selinux-faq-fc5/%5C%22%3EFedora Core 5 SELinux FAQ</ulink>."

Modified: community/branches/f13/ru-RU/Managing_Users.po =================================================================== --- community/branches/f13/ru-RU/Managing_Users.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Managing_Users.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,442 +1,283 @@ -# SOME DESCRIPTIVE TITLE. -# FIRST AUTHOR EMAIL@ADDRESS, YEAR. -# -#, fuzzy +# SOME DESCRIPTIVE TITLE. +# FIRST AUTHOR EMAIL@ADDRESS, YEAR. +# msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-10-04 \n" +"Last-Translator: Alexey Cicin daydrim@gmail.com\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n" +"X-Poedit-SourceCharset: utf-8\n"

#. Tag: title #, no-c-format msgid "Confining Users" -msgstr "" +msgstr "Ограничение пользователей"

#. Tag: para #, no-c-format -msgid "" -"A number of confined SELinux users are available in Fedora&nbsp;&PRODVER;. " -"Each Linux user is mapped to an SELinux user via SELinux policy, allowing " -"Linux users to inherit the restrictions placed on SELinux users, for example " -"(depending on the user), not being able to: run the X Window System; use " -"networking; run setuid applications (unless SELinux policy permits it); or " -"run the <command>su</command> and <command>sudo</command> commands. This " -"helps protect the system from the user. Refer to <xref linkend="sect-" -"Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users" /> " -"for further information about confined users." -msgstr "" +msgid "A number of confined SELinux users are available in Fedora&nbsp;&PRODVER;. Each Linux user is mapped to an SELinux user via SELinux policy, allowing Linux users to inherit the restrictions placed on SELinux users, for example (depending on the user), not being able to: run the X Window System; use networking; run setuid applications (unless SELinux policy permits it); or run the <command>su</command> and <command>sudo</command> commands. This helps protect the system from the user. Refer to <xref linkend="sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users" /> for further information about confined users." +msgstr "Множество ограниченных пользователей доступно в Fedora&nbsp;&PRODVER;. Каждый пользователь Linux сопоставлен пользователю SELinux через политику SELinux, позволяя польователям Linux наследовать ограничения установленные для пользователей SELinux, например (в зависимости от пользователя), нет возможности запускать: X Window System; использовать сетевые функции; запускать setuid приложения (до тех пор, пока политика SELinux не разрешит это); или выполнять команды <command>su</command> и <command>sudo</command>. Это помогает защитить систему от пользователя. Дополнительная информация <xref linkend="sect-Security-Enhanced_Linux-Targeted_Policy-Confined_and_Unconfined_Users" /> об ограничении пользователей доступна по ссылке."

#. Tag: title #, no-c-format msgid "Linux and SELinux User Mappings" -msgstr "" +msgstr "Сопоставление пользователей Linux и SELinux"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>semanage login -l</command> command " -"to view the mapping between Linux users and SELinux users:" -msgstr "" +msgid "As the Linux root user, run the <command>semanage login -l</command> command to view the mapping between Linux users and SELinux users:" +msgstr "От имени пользователя root, выполните команду <command>semanage login -l</command> для просмотра сопоставлений между пользователями Linux и SELinux:"

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux " -"<computeroutput>__default__</computeroutput> login by default (which is in " -"turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> " -"user). When a Linux user is created with the <command>useradd</command> " -"command, if no options are specified, they are mapped to the SELinux " -"<computeroutput>unconfined_u</computeroutput> user. The following defines " -"the default-mapping:" -msgstr "" +msgid "In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is in turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). When a Linux user is created with the <command>useradd</command> command, if no options are specified, they are mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user. The following defines the default-mapping:" +msgstr "В Fedora&nbsp;&PRODVER;, пользователи Linux по-умолчанию сопоставлены с логином <computeroutput>__default__</computeroutput> SELinux (который в свою очередь сопоставлен пользователю <computeroutput>unconfined_u</computeroutput> SELinux). Когда пользователь Linux создаётся с помощью команды <command>useradd</command>, если не указаны дополнительные опции, он сопоставляется пользователю SELinux <computeroutput>unconfined_u</computeroutput>. Ниже определяется сопоставление по-умолчанию:"

#. Tag: title #, no-c-format msgid "Confining New Linux Users: useradd" -msgstr "" +msgstr "Ограничение новых пользователей Linux: useradd"

#. Tag: para #, no-c-format -msgid "" -"Linux users mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user run in the <computeroutput>unconfined_t</" -"computeroutput> domain. This is seen by running the <command>id -Z</command> " -"command while logged-in as a Linux user mapped to " -"<computeroutput>unconfined_u</computeroutput>:" -msgstr "" +msgid "Linux users mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user run in the <computeroutput>unconfined_t</computeroutput> domain. This is seen by running the <command>id -Z</command> command while logged-in as a Linux user mapped to <computeroutput>unconfined_u</computeroutput>:" +msgstr "Пользователи Linux сопоставлены пользователю SELinux <computeroutput>unconfined_u</computeroutput>, работающем в домене <computeroutput>unconfined_t</computeroutput>. Это можно увидеть, выполнив команду <command>id -Z</command>, если войти от имени пользователя сопоставленному <computeroutput>unconfined_u</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"When Linux users run in the <computeroutput>unconfined_t</computeroutput> " -"domain, SELinux policy rules are applied, but policy rules exist that allow " -"Linux users running in the <computeroutput>unconfined_t</computeroutput> " -"domain almost all access. If unconfined Linux users execute an application " -"that SELinux policy defines can transition from the " -"<computeroutput>unconfined_t</computeroutput> domain to its own confined " -"domain, unconfined Linux users are still subject to the restrictions of that " -"confined domain. The security benefit of this is that, even though a Linux " -"user is running unconfined, the application remains confined, and therefore, " -"the exploitation of a flaw in the application can be limited by policy. " -"Note: this does not protect the system from the user. Instead, the user and " -"the system are being protected from possible damage caused by a flaw in the " -"application." -msgstr "" +msgid "When Linux users run in the <computeroutput>unconfined_t</computeroutput> domain, SELinux policy rules are applied, but policy rules exist that allow Linux users running in the <computeroutput>unconfined_t</computeroutput> domain almost all access. If unconfined Linux users execute an application that SELinux policy defines can transition from the <computeroutput>unconfined_t</computeroutput> domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy. Note: this does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application." +msgstr "Когда пользователь Linux работает в домене <computeroutput>unconfined_t</computeroutput>, применяются правила политики SELinux, но существуют правила политики SELinux, которые позволяют пользователям работать в домене <computeroutput>unconfined_t</computeroutput> с практически, полным доступом. Если неограниченные (unconfined) пользователи Linux выполняют приложение, для которого политика SELinux определяет переход (transition) из домена <computeroutput>unconfined_t</computeroutput> в свой собственный домен, то неограниченные пользователи Linux являются субъектами ограничений в этом ограниченном домене. Преимущест� �о безопасности заключается в том, что, даже учитывая, что пользователь Linux работает неограниченно, приложение остается ограниченным, кроме того, уязвимость утечки в приложении, может быть ограничено политикой. Примечание: Это не защищает систему от пользователя. Вместо этого, пользователь и система защищаются от возможного вреда, вызванного утечками в приложении."

#. Tag: para #, no-c-format -msgid "" -"When creating Linux users with <command>useradd</command>, use the <option>-" -"Z</option> option to specify which SELinux user they are mapped to. The " -"following example creates a new Linux user, useruuser, and maps that user to " -"the SELinux <computeroutput>user_u</computeroutput> user. Linux users mapped " -"to the SELinux <computeroutput>user_u</computeroutput> user run in the " -"<computeroutput>user_t</computeroutput> domain. In this domain, Linux users " -"are unable to run setuid applications unless SELinux policy permits it (such " -"as <command>passwd</command>), and can not run <command>su</command> or " -"<command>sudo</command>, preventing them from becoming the Linux root user " -"with these commands." -msgstr "" +msgid "When creating Linux users with <command>useradd</command>, use the <option>-Z</option> option to specify which SELinux user they are mapped to. The following example creates a new Linux user, useruuser, and maps that user to the SELinux <computeroutput>user_u</computeroutput> user. Linux users mapped to the SELinux <computeroutput>user_u</computeroutput> user run in the <computeroutput>user_t</computeroutput> domain. In this domain, Linux users are unable to run setuid applications unless SELinux policy permits it (such as <command>passwd</command>), and can not run <command>su</command> or <command>sudo</command>, preventing them from becoming the Linux root user with these commands." +msgstr "При создании пользователей Linux с помощью команды <command>useradd</command>, используйте опцию <option>-Z</option> для того, чтобы указать какому пользователю SELinux они сопоставляются. В следующем примере создается новый пользователь Linux, useruuser и сопоставляется пользователю SELinux <computeroutput>user_u</computeroutput>. Пользователь Linux, сопоставленный пользователю SELinux <computeroutput>user_u</computeroutput> работает в домене <computeroutput>user_t</computeroutput>. В этом домене, пользователи Linux не имеют возможности запускать setuid приложения до тех пор, пока политика SELinux не разрешит это (такие как <command>passwd </command>), и не могут выполнить <command>su</command> или <command>sudo</command>, препятствуя им повысить права до уровня root пользователя с помощью данных команд."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/useradd -Z user_u " -"useruuser</command> command to create a new Linux user (useruuser) that is " -"mapped to the SELinux <computeroutput>user_u</computeroutput> user." -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/useradd -Z user_u useruuser</command> command to create a new Linux user (useruuser) that is mapped to the SELinux <computeroutput>user_u</computeroutput> user." +msgstr "От имени пользователя root, выполните команду <command>/usr/sbin/useradd -Z user_u useruuser</command> для создания нового пользователя Linux (useruser), который сопоставлен пользователю SELinux <computeroutput>user_u</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>semanage login -l</command> command " -"to view the mapping between the Linux <computeroutput>useruuser</" -"computeroutput> user and <computeroutput>user_u</computeroutput>:" -msgstr "" +msgid "As the Linux root user, run the <command>semanage login -l</command> command to view the mapping between the Linux <computeroutput>useruuser</computeroutput> user and <computeroutput>user_u</computeroutput>:" +msgstr "От имени пользователя root, выполните команду <command>semanage login -l</command> для просмотра сопоставлений между пользователем Linux <computeroutput>useruuser</computeroutput> и <computeroutput>user_u</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>passwd useruuser</command> command " -"to assign a password to the Linux useruuser user:" -msgstr "" +msgid "As the Linux root user, run the <command>passwd useruuser</command> command to assign a password to the Linux useruuser user:" +msgstr "От имени пользователя root, выполните команду <command>passwd useruuser</command> для назначения пароля пользователю useruser:"

#. Tag: para #, no-c-format -msgid "" -"Log out of your current session, and log in as the Linux useruuser user. " -"When you log in, pam_selinux maps the Linux user to an SELinux user (in this " -"case, <computeroutput>user_u</computeroutput>), and sets up the resulting " -"SELinux context. The Linux user's shell is then launched with this context. " -"Run the <command>id -Z</command> command to view the context of a Linux user:" -msgstr "" +msgid "Log out of your current session, and log in as the Linux useruuser user. When you log in, pam_selinux maps the Linux user to an SELinux user (in this case, <computeroutput>user_u</computeroutput>), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run the <command>id -Z</command> command to view the context of a Linux user:" +msgstr "Завершите текущий сеанс, и откройте новый сеанс от имени пользователя useruuser. Когда выполняется вход, pam_selinux сопоставляет пользователя Linux, пользователю SELinux (в данном случае, <computeroutput>user_u</computeroutput>) и устанавливает результирующий SELinux контекст. Пользовательский shell запускается с этим контекстом. Выполните команду <command>id -Z</command> для просмотра контекста пользователя Linux:"

#. Tag: para #, no-c-format -msgid "" -"Log out of the Linux useruuser's session, and log back in with your account. " -"If you do not want the Linux useruuser user, run the <command>/usr/sbin/" -"userdel -r useruuser</command> command as the Linux root user to remove it, " -"along with its home directory." -msgstr "" +msgid "Log out of the Linux useruuser's session, and log back in with your account. If you do not want the Linux useruuser user, run the <command>/usr/sbin/userdel -r useruuser</command> command as the Linux root user to remove it, along with its home directory." +msgstr "Завершите сеанс пользователя useruuser и выполните вход вашей учетной записью. Если пользователь useruser больше не требуется, выполните команду <command>/usr/sbin/userdel -r useruser</command> от имени пользователя root для удаления учетной записи, вместе с его домашним каталогом."

#. Tag: title #, no-c-format msgid "Confining Existing Linux Users: semanage login" -msgstr "" +msgstr "Ограничение существующих пользователей Linux: semanage login"

#. Tag: para #, no-c-format -msgid "" -"If a Linux user is mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user (the default behavior), and you would like to change " -"which SELinux user they are mapped to, use the <command>semanage login</" -"command> command. The following example creates a new Linux user named " -"newuser, then maps that Linux user to the SELinux <computeroutput>user_u</" -"computeroutput> user:" -msgstr "" +msgid "If a Linux user is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user (the default behavior), and you would like to change which SELinux user they are mapped to, use the <command>semanage login</command> command. The following example creates a new Linux user named newuser, then maps that Linux user to the SELinux <computeroutput>user_u</computeroutput> user:" +msgstr "Если пользователь SELinux сопоставлен пользователю <computeroutput>unconfined_u</computeroutput> (в конфигурации по-умолчанию), и если вам необходимо изменить контекст сопоставляемого пользователя SELinux, с помощью команда <command>semanage login</command>. В следующем примере создаётся новый Linux называется newuser, который сопоставлен пользователю SELinux <computeroutput>user_u</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> " -"command to create a new Linux user (newuser). Since this user uses the " -"default mapping, it does not appear in the <command>/usr/sbin/semanage login " -"-l</command> output:" -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> command to create a new Linux user (newuser). Since this user uses the default mapping, it does not appear in the <command>/usr/sbin/semanage login -l</command> output:" +msgstr "От имени пользователя Linux, выполните команду <command>/usr/sbin/useradd newuser</command> для создания нового пользователя (newuser). Так как этот пользователь использует сопоставление по умолчанию, он не появляется в выводе <command>/usr/sbin/semanage login -l</command>:"

#. Tag: para #, no-c-format -msgid "" -"To map the Linux newuser user to the SELinux <computeroutput>user_u</" -"computeroutput> user, run the following command as the Linux root user:" -msgstr "" +msgid "To map the Linux newuser user to the SELinux <computeroutput>user_u</computeroutput> user, run the following command as the Linux root user:" +msgstr "Для сопоставления пользователя newuser пользователю SELinux <computeroutput>user_u</computeroutput>, выполните следующую команду от имени пользователя root:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/semanage login -a -s user_u newuser</command>" -msgstr "" +msgstr "<command>/usr/sbin/semanage login -a -s user_u newuser</command>"

#. Tag: para #, no-c-format -msgid "" -"The <option>-a</option> option adds a new record, and the <option>-s</" -"option> option specifies the SELinux user to map a Linux user to. The last " -"argument, <computeroutput>newuser</computeroutput>, is the Linux user you " -"want mapped to the specified SELinux user." -msgstr "" +msgid "The <option>-a</option> option adds a new record, and the <option>-s</option> option specifies the SELinux user to map a Linux user to. The last argument, <computeroutput>newuser</computeroutput>, is the Linux user you want mapped to the specified SELinux user." +msgstr "Опция <option>-a</option> добавляет новую запись и опция <option>-s</option> указывает пользователя SELinux для сопоставления пользователю Linux. Последний аргумент <computeroutput>newuser</computeroutput> - это пользователь Linux которому сопоставляется указанный пользователь SELinux."

#. Tag: para #, no-c-format -msgid "" -"To view the mapping between the Linux newuser user and " -"<computeroutput>user_u</computeroutput>, run the <command>semanage login -l</" -"command> command as the Linux root user:" -msgstr "" +msgid "To view the mapping between the Linux newuser user and <computeroutput>user_u</computeroutput>, run the <command>semanage login -l</command> command as the Linux root user:" +msgstr "Для просмотра сопоставлений между пользователем Linux и <computeroutput>user_u</computeroutput>, выполните команду <command>semanage login -l</command> от имени пользователя root:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>passwd newuser</command> command to " -"assign a password to the Linux newuser user:" -msgstr "" +msgid "As the Linux root user, run the <command>passwd newuser</command> command to assign a password to the Linux newuser user:" +msgstr "От имени пользователя root, выполните команду <command>passwd newuser</command> для назначения пароля пользователю newuser:"

#. Tag: para #, no-c-format -msgid "" -"Log out of your current session, and log in as the Linux newuser user. Run " -"the <command>id -Z</command> command to view the newuser's SELinux context:" -msgstr "" +msgid "Log out of your current session, and log in as the Linux newuser user. Run the <command>id -Z</command> command to view the newuser's SELinux context:" +msgstr "Завершите текущую сессию и выполните вход от имени пользователя newuser. Выполните команду <command>id -Z</command> для просмотра пользователя newuser контекста SELinux:"

#. Tag: para #, no-c-format -msgid "" -"Log out of the Linux newuser's session, and log back in with your account. " -"If you do not want the Linux newuser user, run the <command>userdel -r " -"newuser</command> command as the Linux root user to remove it, along with " -"its home directory. Also, the mapping between the Linux newuser user and " -"<computeroutput>user_u</computeroutput> is removed:" -msgstr "" +msgid "Log out of the Linux newuser's session, and log back in with your account. If you do not want the Linux newuser user, run the <command>userdel -r newuser</command> command as the Linux root user to remove it, along with its home directory. Also, the mapping between the Linux newuser user and <computeroutput>user_u</computeroutput> is removed:" +msgstr "Завершите текущую сессию newuser и выполните вход с вашей учетной записью. Если пользователь newuser больше не требуется, выполните команду <command>userdel -r newuser</command> от имени пользователя root для удаления учетной записи, вместе с его домашним каталогом. Также, сопоставлние между пользователем newuser и <computeroutput>user_u</computeroutput> удаляется:"

#. Tag: title #, no-c-format msgid "Changing the Default Mapping" -msgstr "" +msgstr "Изменение сопоставлений по-умолчанию"

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux " -"<computeroutput>__default__</computeroutput> login by default (which is in " -"turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> " -"user). If you would like new Linux users, and Linux users not specifically " -"mapped to an SELinux user to be confined by default, change the default " -"mapping with the <command>semanage login</command> command." -msgstr "" +msgid "In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is in turn mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). If you would like new Linux users, and Linux users not specifically mapped to an SELinux user to be confined by default, change the default mapping with the <command>semanage login</command> command." +msgstr "В Fedora&nbsp;&PRODVER;, пользователь Linux сопоставлен пользователю SELinux <computeroutput>__default__</computeroutput> по-умолчанию (который в свою очередь сопоставлен пользователю SELinux <computeroutput>unconfined_u</computeroutput>). Если необходимо создать новых пользователей Linux и пользователи Linux не сопоставлены пользователю SELinux ограниченному по-умолчанию, измените сопотавление по-умолчанию командой <command>semanage login</command>."

#. Tag: para #, no-c-format -msgid "" -"For example, run the following command as the Linux root user to change the " -"default mapping from <computeroutput>unconfined_u</computeroutput> to " -"<computeroutput>user_u</computeroutput>:" -msgstr "" +msgid "For example, run the following command as the Linux root user to change the default mapping from <computeroutput>unconfined_u</computeroutput> to <computeroutput>user_u</computeroutput>:" +msgstr "Например, выполните команду от имени пользователя root для изменения сопоставления по-умолчанию от <computeroutput>unconfined_u</computeroutput> на <computeroutput>user_u</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"<command>/usr/sbin/semanage login -m -S targeted -s "user_u" -r s0 " -"__default__</command>" -msgstr "" +msgid "<command>/usr/sbin/semanage login -m -S targeted -s "user_u" -r s0 __default__</command>" +msgstr "<command>/usr/sbin/semanage login -m -S targeted -s "user_u" -r s0 __default__</command>"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>semanage login -l</command> command as the Linux root user " -"to verify the <computeroutput>__default__</computeroutput> login is mapped " -"to <computeroutput>user_u</computeroutput>:" -msgstr "" +msgid "Run the <command>semanage login -l</command> command as the Linux root user to verify the <computeroutput>__default__</computeroutput> login is mapped to <computeroutput>user_u</computeroutput>:" +msgstr "Выполните команду <command>semanage login -l</command> от имени пользователя root для проверки того, что логин <computeroutput>__default__</computeroutput> сопоставлен <computeroutput>user_u</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"If a new Linux user is created and an SELinux user is not specified, or if " -"an existing Linux user logs in and does not match a specific entry from the " -"<command>semanage login -l</command> output, they are mapped to " -"<computeroutput>user_u</computeroutput>, as per the " -"<computeroutput>__default__</computeroutput> login." -msgstr "" +msgid "If a new Linux user is created and an SELinux user is not specified, or if an existing Linux user logs in and does not match a specific entry from the <command>semanage login -l</command> output, they are mapped to <computeroutput>user_u</computeroutput>, as per the <computeroutput>__default__</computeroutput> login." +msgstr "Если создается новый пользователь Linux и пользователь SELinux не указан, или если существующий пользователь Linux выполняет вход и не соответствует определенной записи из вывода <command>semanage login -l</command>, они сопоставляются <computeroutput>user_u</computeroutput>, и соответственно <computeroutput>__default__</computeroutput> логину."

#. Tag: para #, no-c-format -msgid "" -"To change back to the default behavior, run the following command as the " -"Linux root user to map the <computeroutput>__default__</computeroutput> " -"login to the SELinux <computeroutput>unconfined_u</computeroutput> user:" -msgstr "" +msgid "To change back to the default behavior, run the following command as the Linux root user to map the <computeroutput>__default__</computeroutput> login to the SELinux <computeroutput>unconfined_u</computeroutput> user:" +msgstr "Для возвращения изменений к поведению по-умолчанию, выполните следующую команду от имени пользователя root для сопоставления <computeroutput>__default__</computeroutput> логина к пользователю SELinux <computeroutput>unconfined_u</computeroutput>:"

#. Tag: title #, no-c-format msgid "xguest: Kiosk Mode" -msgstr "" +msgstr "xguest: Режим Kiosk"

#. Tag: para #, no-c-format -msgid "" -"The <package>xguest</package> package provides a kiosk user account. This " -"account is used to secure machines that people walk up to and use, such as " -"those at libraries, banks, airports, information kiosks, and coffee shops. " -"The kiosk user account is very limited: essentially, it only allows users to " -"log in and use <application>Firefox</application> to browse Internet " -"websites. Any changes made while logged in with his account, such as " -"creating files or changing settings, are lost when you log out." -msgstr "" +msgid "The <package>xguest</package> package provides a kiosk user account. This account is used to secure machines that people walk up to and use, such as those at libraries, banks, airports, information kiosks, and coffee shops. The kiosk user account is very limited: essentially, it only allows users to log in and use <application>Firefox</application> to browse Internet websites. Any changes made while logged in with his account, such as creating files or changing settings, are lost when you log out." +msgstr "Пакет <package>xguest</package> предоставляет учетную запись kiosk. Эта учетная запись использует для безопасного механизма "

#. Tag: para #, no-c-format msgid "To set up the kiosk account:" -msgstr "" +msgstr "Для настройки учетной записи kiosk:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run <command>yum install xguest</command> command to " -"install the <package>xguest</package> package. Install dependencies as " -"required." -msgstr "" +msgid "As the Linux root user, run <command>yum install xguest</command> command to install the <package>xguest</package> package. Install dependencies as required." +msgstr "От имени пользователя root, выполните команду <command>yum install xguest</command> для установки пакета <package>xguest</package>. Установите зависимости, по необходимости."

#. Tag: para #, no-c-format -msgid "" -"In order to allow the kiosk account to be used by a variety of people, the " -"account is not password-protected, and as such, the account can only be " -"protected if SELinux is running in enforcing mode. Before logging in with " -"this account, use the <command>getenforce</command> command to confirm that " -"SELinux is running in enforcing mode:" -msgstr "" +msgid "In order to allow the kiosk account to be used by a variety of people, the account is not password-protected, and as such, the account can only be protected if SELinux is running in enforcing mode. Before logging in with this account, use the <command>getenforce</command> command to confirm that SELinux is running in enforcing mode:" +msgstr "В порядке предоставления учетной записи kiosk в использование множеством людей, учетная запись не будет защищена паролем, и как следствие, учетная запись может быть защищена только, если SELinux запущен в принудительном (enforcing) режиме. Перед тем как выполнить авторизацию с данной учетной записью, используйте команду <command>getenforce</command> для того, чтобы убедиться, что SELinux запущен в принудительном (enforcing) режиме."

#. Tag: para #, no-c-format -msgid "" -"If this is not the case, refer to <xref linkend="sect-Security-" -"Enhanced_Linux-Working_with_SELinux-SELinux_Modes" /> for information about " -"changing to enforcing mode. It is not possible to log in with this account " -"if SELinux is in permissive mode or disabled." -msgstr "" +msgid "If this is not the case, refer to <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Modes" /> for information about changing to enforcing mode. It is not possible to log in with this account if SELinux is in permissive mode or disabled." +msgstr "Если это не так, руководствуйтесь <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Modes" /> об информации о смене режима в принудительный (enforcing). Невозможно выполнить авторизацию с этой учетной записью, если SELinux в разрешеительном (permissive) режиме или отключен."

#. Tag: para #, no-c-format -msgid "" -"You can only log in to this account via the GNOME Display Manager (GDM). " -"Once the <package>xguest</package> package is installed, a " -"<computeroutput>Guest</computeroutput> account is added to GDM. To log in, " -"click on the <computeroutput>Guest</computeroutput> account:" -msgstr "" +msgid "You can only log in to this account via the GNOME Display Manager (GDM). Once the <package>xguest</package> package is installed, a <computeroutput>Guest</computeroutput> account is added to GDM. To log in, click on the <computeroutput>Guest</computeroutput> account:" +msgstr "Вы можете выполнить вход с данной учетной записью через GNOME Display Manager (GDM). Так как пакет <package>xguest</package> установлен, учетная запись <computeroutput>Guest</computeroutput> добавлена в GDM. Для выполнения входа кликните по учетной записи <computeroutput>Guest</computeroutput>:"

#. Tag: title #, no-c-format msgid "Booleans for Users Executing Applications" -msgstr "" +msgstr "Булевы переключатели для пользователей, выполняющих приложения"

#. Tag: para #, no-c-format -msgid "" -"Not allowing Linux users to execute applications (which inherit users' " -"permissions) in their home directories and <filename>/tmp/</filename>, which " -"they have write access to, helps prevent flawed or malicious applications " -"from modifying files that users own. In Fedora&nbsp;&PRODVER;, by default, " -"Linux users in the <computeroutput>guest_t</computeroutput> and " -"<computeroutput>xguest_t</computeroutput> domains can not execute " -"applications in their home directories or <filename>/tmp/</filename>; " -"however, by default, Linux users in the <computeroutput>user_t</" -"computeroutput> and <computeroutput>staff_t</computeroutput> domains can." -msgstr "" +msgid "Not allowing Linux users to execute applications (which inherit users' permissions) in their home directories and <filename>/tmp/</filename>, which they have write access to, helps prevent flawed or malicious applications from modifying files that users own. In Fedora&nbsp;&PRODVER;, by default, Linux users in the <computeroutput>guest_t</computeroutput> and <computeroutput>xguest_t</computeroutput> domains can not execute applications in their home directories or <filename>/tmp/</filename>; however, by default, Linux users in the <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can." +msgstr "Не позволяют пользователям Linux выполнять приложения (которые наследуют права пользователя) в их домашних каталогах и <filename>/tmp/</filename>, в которые у них есть права на запись, помогают предотвратить утечку или выполнение вредоносных приложений от модифицирования файлов, которыми владеет пользователь. В Fedora&nbsp;&PRODVER;, по-умолчанию, пользователи Linux в доменах <computeroutput>guest_t</computeroutput> и <computeroutput>xguest_t</computeroutput> не могут выполнять приложения в своих домашних каталогах или <filename>/tmp/</filename>; однако, по-умолчанию, пользователи Linux в доменах <computeroutput>us er_t</computeroutput> и <computeroutput>staff_t</computeroutput> - могут."

#. Tag: para #, no-c-format -msgid "" -"Booleans are available to change this behavior, and are configured with the " -"<command>setsebool</command> command. The <command>setsebool</command> " -"command must be run as the Linux root user. The <command>setsebool -P</" -"command> command makes persistent changes. Do not use the <option>-P</" -"option> option if you do not want changes to persist across reboots:" -msgstr "" +msgid "Booleans are available to change this behavior, and are configured with the <command>setsebool</command> command. The <command>setsebool</command> command must be run as the Linux root user. The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots:" +msgstr "Булевы переключатели могут измененить данное поведение, и конфигурируются с помощью команды <command>setsebool</command>. Команда <command>setsebool</command> должна запускать от имени пользователя root. Команда <command>setsebool -P</command> делает изменение постоянным. Не используйте опцию <option>-P</option>, если не требутеся внесение постоянных изменений, сохраняющихся после перезагрузки системы:"

#. Tag: title #, no-c-format msgid "guest_t" -msgstr "" +msgstr "guest_t"

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>allow</emphasis> Linux users in the <computeroutput>guest_t</" -"computeroutput> domain to execute applications in their home directories and " -"<filename>/tmp/</filename>:" -msgstr "" +msgid "To <emphasis>allow</emphasis> Linux users in the <computeroutput>guest_t</computeroutput> domain to execute applications in their home directories and <filename>/tmp/</filename>:" +msgstr "Для предоставления прав <emphasis>allow</emphasis> пользователям Linux в домене <computeroutput>guest_t</computeroutput> на выполнение в их домашних каталогах и <filename>/tmp/</filename>:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/setsebool -P allow_guest_exec_content on</command>" -msgstr "" +msgstr "<command>/usr/sbin/setsebool -P allow_guest_exec_content on</command>"

#. Tag: title #, no-c-format msgid "xguest_t" -msgstr "" +msgstr "xguest_t"

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>allow</emphasis> Linux users in the <computeroutput>xguest_t</" -"computeroutput> domain to execute applications in their home directories and " -"<filename>/tmp/</filename>:" -msgstr "" +msgid "To <emphasis>allow</emphasis> Linux users in the <computeroutput>xguest_t</computeroutput> domain to execute applications in their home directories and <filename>/tmp/</filename>:" +msgstr "Для предоставления прав <emphasis>allow</emphasis> пользователям Linux в домене <computeroutput>xguest_t</computeroutput> на выполнение в их домашних каталогах и <filename>/tmp/</filename>:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/setsebool -P allow_xguest_exec_content on</command>" -msgstr "" +msgstr "<command>/usr/sbin/setsebool -P allow_xguest_exec_content on</command>"

#. Tag: title #, no-c-format msgid "user_t" -msgstr "" +msgstr "user_t"

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>prevent</emphasis> Linux users in the <computeroutput>user_t</" -"computeroutput> domain from executing applications in their home directories " -"and <filename>/tmp/</filename>:" -msgstr "" +msgid "To <emphasis>prevent</emphasis> Linux users in the <computeroutput>user_t</computeroutput> domain from executing applications in their home directories and <filename>/tmp/</filename>:" +msgstr "Для предоставления прав <emphasis>allow</emphasis> пользователям Linux в домене <computeroutput>user_t</computeroutput> на выполнение в их домашних каталогах и <filename>/tmp/</filename>:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/setsebool -P allow_user_exec_content off</command>" -msgstr "" +msgstr "<command>/usr/sbin/setsebool -P allow_user_exec_content off</command>"

#. Tag: title #, no-c-format msgid "staff_t" -msgstr "" +msgstr "staff_t"

#. Tag: para #, no-c-format -msgid "" -"To <emphasis>prevent</emphasis> Linux users in the <computeroutput>staff_t</" -"computeroutput> domain from executing applications in their home directories " -"and <filename>/tmp/</filename>:" -msgstr "" +msgid "To <emphasis>prevent</emphasis> Linux users in the <computeroutput>staff_t</computeroutput> domain from executing applications in their home directories and <filename>/tmp/</filename>:" +msgstr "Для предоставления прав <emphasis>allow</emphasis> пользователям Linux в домене <computeroutput>staff_t</computeroutput> на выполнение в их домашних каталогах и <filename>/tmp/</filename>:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/setsebool -P allow_staff_exec_content off</command>" -msgstr "" +msgstr "<command>/usr/sbin/setsebool -P allow_staff_exec_content off</command>"

Modified: community/branches/f13/ru-RU/Preface.po =================================================================== --- community/branches/f13/ru-RU/Preface.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Preface.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,67 +1,53 @@ # SOME DESCRIPTIVE TITLE. # FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-08-24 14:30+0500\n" +"Last-Translator: Alexey Cicin daydrim@gmail.com\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n" +"X-Poedit-SourceCharset: utf-8\n"

#. Tag: title #, no-c-format msgid "Preface" -msgstr "" +msgstr "Введение"

#. Tag: para #, no-c-format -msgid "" -"The Fedora&nbsp;&PRODVER; SELinux User Guide is for people with minimal or " -"no experience with SELinux. Although system administration experience is not " -"necessary, content in this guide is written for system administration tasks. " -"This guide provides an introduction to fundamental concepts and practical " -"applications of SELinux. After reading this guide you should have an " -"intermediate understanding of SELinux." -msgstr "" +msgid "The Fedora&nbsp;&PRODVER; SELinux User Guide is for people with minimal or no experience with SELinux. Although system administration experience is not necessary, content in this guide is written for system administration tasks. This guide provides an introduction to fundamental concepts and practical applications of SELinux. After reading this guide you should have an intermediate understanding of SELinux." +msgstr "Fedora&nbsp;&PRODVER; Руководство Пользователя SELinux предназначено для людей с минимальным опытом или полным отстутствуием опыта с SELinux. Несмотря на то, что опыт системного администрирования не является необходимым, содержание Руководства написано для выполнения задач системного администрирования. Это Руководство является описанием основных принципов и практического применения SELinux. После прочтения Руководства у Вас появится понимание SELinux на среднем уровне."

#. Tag: para #, no-c-format -msgid "" -"Thank you to everyone who offered encouragement, help, and testing - it is " -"most appreciated. Very special thanks to:" -msgstr "" +msgid "Thank you to everyone who offered encouragement, help, and testing - it is most appreciated. Very special thanks to:" +msgstr "Спасибо всем кто оказал содействие, помощь и тестирование - за это наибольшее признание. Особенно выражаем благодарность:"

#. Tag: para #, no-c-format -msgid "" -"Dominick Grift, Stephen Smalley, and Russell Coker for their contributions, " -"help, and patience." -msgstr "" +msgid "Dominick Grift, Stephen Smalley, and Russell Coker for their contributions, help, and patience." +msgstr "Dominick Grift, Stephen Smalley и Russell Coker за их вклад, помощь и терпение."

#. Tag: para #, no-c-format -msgid "" -"Karsten Wade for his help, adding a component for this guide to <ulink url=" -""https://bugzilla.redhat.com/%5C%22%3E Red Hat Bugzilla</ulink>, and sorting out " -"web hosting on <ulink url="http://docs.fedoraproject.org/%5C" />." -msgstr "" +msgid "Karsten Wade for his help, adding a component for this guide to <ulink url="https://bugzilla.redhat.com/%5C%22%3E Red Hat Bugzilla</ulink>, and sorting out web hosting on <ulink url="http://docs.fedoraproject.org/%5C" />." +msgstr "Karsten Wade за его помощь, добавления компонентов к Руководству в <ulink url="https://bugzilla.redhat.com/%5C%22%3E Red Hat Bugzilla</ulink>, и решение вопросов с веб-хостингом <ulink url="http://docs.fedoraproject.org/%5C" />."

#. Tag: para #, no-c-format -msgid "" -"The <ulink url="http://fedoraproject.org/wiki/Infrastructure%5C%22%3EFedora " -"Infrastructure Team</ulink> for providing hosting." -msgstr "" +msgid "The <ulink url="http://fedoraproject.org/wiki/Infrastructure%5C%22%3EFedora Infrastructure Team</ulink> for providing hosting." +msgstr "<ulink url="http://fedoraproject.org/wiki/Infrastructure%5C%22%3EFedora Infrastructure Team</ulink> за предоставление хостинга."

#. Tag: para #, no-c-format -msgid "" -"Jens-Ulrik Petersen for making sure the Red Hat Brisbane office has up-to-" -"date Fedora mirrors." -msgstr "" +msgid "Jens-Ulrik Petersen for making sure the Red Hat Brisbane office has up-to-date Fedora mirrors." +msgstr "Jens-Ulrik Petersen за поддержание офиса Red Hat Brisbane с постоянно обновленными зеркалами Fedora."

Modified: community/branches/f13/ru-RU/Revision_History.po =================================================================== --- community/branches/f13/ru-RU/Revision_History.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Revision_History.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,79 +1,77 @@ # SOME DESCRIPTIVE TITLE. # FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-11-21 18:11+0800\n" +"Last-Translator: Misha Shnurapet shnurapet@fedoraproject.org\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n"

#. Tag: title #, no-c-format msgid "Revision History" -msgstr "" +msgstr "История изменений"

#. Tag: firstname #, no-c-format msgid "Scott" -msgstr "" +msgstr "Scott"

#. Tag: surname #, no-c-format msgid "Radvan" -msgstr "" +msgstr "Radvan"

#. Tag: member #, no-c-format msgid "Update and verification for Fedora 12" -msgstr "" +msgstr "Обновление и проверка для Fedora 12"

#. Tag: member #, no-c-format msgid "Update and verification for Fedora 11" -msgstr "" +msgstr "Обновление и проверка для Fedora 11"

#. Tag: firstname #, no-c-format msgid "Murray" -msgstr "" +msgstr "Murray"

#. Tag: surname #, no-c-format msgid "McAllister" -msgstr "" +msgstr "McAllister"

#. Tag: member #, no-c-format msgid "Updating hyperlinks to NSA websites" -msgstr "" +msgstr "Обновление гиперссылок к сайтам NSA"

#. Tag: member #, no-c-format -msgid "" -"Resolving <ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=472986" -"">Red Hat Bugzilla #472986, "httpd does not write to /etc/httpd/logs/"</" -"ulink>" -msgstr "" +msgid "Resolving <ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=472986%5C%22%3ERed Hat Bugzilla #472986, "httpd does not write to /etc/httpd/logs/"</ulink>" +msgstr "Решение <ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=472986%5C%22%3ERed Hat Bugzilla #472986, «httpd does not write to /etc/httpd/logs/»</ulink>"

#. Tag: member #, no-c-format msgid "Added new section, "6.6. Booleans for Users Executing Applications"" -msgstr "" +msgstr "Добавил новый раздел, «6.6. Булевы переключатели для пользователей, выполняющих приложения»"

#. Tag: member #, no-c-format msgid "Minor text revisions" -msgstr "" +msgstr "Мелкие правки текста"

#. Tag: member #, no-c-format -msgid "" -"Initial content release on <ulink url="http://docs.fedoraproject.org/%5C" />" -msgstr "" +msgid "Initial content release on <ulink url="http://docs.fedoraproject.org/%5C" />" +msgstr "Первая публикация на <ulink url="http://docs.fedoraproject.org/%5C" />"

Modified: community/branches/f13/ru-RU/SELinux_User_Guide.po =================================================================== --- community/branches/f13/ru-RU/SELinux_User_Guide.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/SELinux_User_Guide.po 2010-11-21 23:12:12 UTC (rev 492) @@ -0,0 +1,14 @@ +# +# AUTHOR EMAIL@ADDRESS, YEAR. +# +msgid "" +msgstr "" +"Project-Id-Version: 0\n" +"POT-Creation-Date: 2010-04-15T00:19:31\n" +"PO-Revision-Date: 2010-04-15T00:19:31\n" +"Last-Translator: Automatically generated\n" +"Language-Team: None\n" +"MIME-Version: 1.0\n" +"Content-Type: application/x-publican; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +

Modified: community/branches/f13/ru-RU/Security-Enhanced_Linux.po =================================================================== --- community/branches/f13/ru-RU/Security-Enhanced_Linux.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Security-Enhanced_Linux.po 2010-11-21 23:12:12 UTC (rev 492) @@ -0,0 +1,14 @@ +# +# AUTHOR EMAIL@ADDRESS, YEAR. +# +msgid "" +msgstr "" +"Project-Id-Version: 0\n" +"POT-Creation-Date: 2010-04-15T00:19:31\n" +"PO-Revision-Date: 2010-04-15T00:19:31\n" +"Last-Translator: Automatically generated\n" +"Language-Team: None\n" +"MIME-Version: 1.0\n" +"Content-Type: application/x-publican; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +

Modified: community/branches/f13/ru-RU/Targeted_Policy.po =================================================================== --- community/branches/f13/ru-RU/Targeted_Policy.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Targeted_Policy.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,667 +1,418 @@ -# SOME DESCRIPTIVE TITLE. -# FIRST AUTHOR EMAIL@ADDRESS, YEAR. -# -#, fuzzy +# SOME DESCRIPTIVE TITLE. +# FIRST AUTHOR EMAIL@ADDRESS, YEAR. +# msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:31\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-08-24 \n" +"Last-Translator: Alexey Cicin daydrim@gmail.com\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n" +"X-Poedit-SourceCharset: utf-8\n"

#. Tag: title #, no-c-format msgid "Targeted Policy" -msgstr "" +msgstr "Целевая политика Targeted"

#. Tag: para #, no-c-format -msgid "" -"Targeted policy is the default SELinux policy used in Fedora. When using " -"targeted policy, processes that are targeted run in a confined domain, and " -"processes that are not targeted run in an unconfined domain. For example, by " -"default, logged in users run in the <computeroutput>unconfined_t</" -"computeroutput> domain, and system processes started by init run in the " -"<computeroutput>initrc_t</computeroutput> domain - both of these domains are " -"unconfined." -msgstr "" +msgid "Targeted policy is the default SELinux policy used in Fedora. When using targeted policy, processes that are targeted run in a confined domain, and processes that are not targeted run in an unconfined domain. For example, by default, logged in users run in the <computeroutput>unconfined_t</computeroutput> domain, and system processes started by init run in the <computeroutput>initrc_t</computeroutput> domain - both of these domains are unconfined." +msgstr "Целевая политика targeted - это политика, используемая в Fedora по умолчанию. Когда целевая политика targeted используется, процессы, которые являются целевыми, запускаются в ограниченном домене, остальные процессы запускаются в неограниченном домене. Например, по умолчанию пользователи, прошедшие авторизацию, работают в домене <computeroutput>unconfined_t</computeroutput> и системные процессы запущенные init-ом запускаются в домене <computeroutput>initrc_t</computeroutput> - оба домена неограниченные."

#. Tag: para #, no-c-format -msgid "" -"Unconfined domains (as well as confined domains) are subject to executable " -"and writeable memory checks. By default, subjects running in an unconfined " -"domain can not allocate writeable memory and execute it. This reduces " -"vulnerability to <ulink url="http://en.wikipedia.org/wiki/Buffer_overflow" -"">buffer overflow attacks</ulink>. These memory checks are disabled by " -"setting Booleans, which allow the SELinux policy to be modified at runtime. " -"Boolean configuration is discussed later." -msgstr "" +msgid "Unconfined domains (as well as confined domains) are subject to executable and writeable memory checks. By default, subjects running in an unconfined domain can not allocate writeable memory and execute it. This reduces vulnerability to <ulink url="http://en.wikipedia.org/wiki/Buffer_overflow%5C%22%3Ebuffer overflow attacks</ulink>. These memory checks are disabled by setting Booleans, which allow the SELinux policy to be modified at runtime. Boolean configuration is discussed later." +msgstr "Неограниченные домены (так же, как и ограниченные) - это субъекты для операций выполнения и записи в память. По умолчанию, субъекты запущенные в неограниченном домене не могут выделить память для записи и выполнить операции. Это уменьшает степень угрозы атаки переполнения буфера <ulink url="http://en.wikipedia.org/wiki/Buffer_overflow%5C%22%3Ebuffer overflow attacks</ulink>. Эти проверки памяти отключаются установкой Булевых переключателей, что позволяет изменять политику SELinux "на ходу". Настройка Булевых значений рассматривается позже."

#. Tag: title #, no-c-format msgid "Confined Processes" -msgstr "" +msgstr "Ограниченные процессы"

#. Tag: para #, no-c-format -msgid "" -"Almost every service that listens on a network is confined in Fedora. Also, " -"most processes that run as the Linux root user and perform tasks for users, " -"such as the <application>passwd</application> application, are confined. " -"When a process is confined, it runs in its own domain, such as the " -"<systemitem class="daemon">httpd</systemitem> process running in the " -"<computeroutput>httpd_t</computeroutput> domain. If a confined process is " -"compromised by an attacker, depending on SELinux policy configuration, an " -"attacker's access to resources and the possible damage they can do is " -"limited." -msgstr "" +msgid "Almost every service that listens on a network is confined in Fedora. Also, most processes that run as the Linux root user and perform tasks for users, such as the <application>passwd</application> application, are confined. When a process is confined, it runs in its own domain, such as the <systemitem class="daemon">httpd</systemitem> process running in the <computeroutput>httpd_t</computeroutput> domain. If a confined process is compromised by an attacker, depending on SELinux policy configuration, an attacker's access to resources and the possible damage they can do is limited." +msgstr "Почти каждая сетевая служба ограничена в Fedora. Также большинство процессов, которые запускаются в Linux с привелигиями пользователя root и выполняют задачи для пользователей, такие как приложение <application>passwd</application>, ограничены. Когда процесс ограничен, он запускается в своём собственном домене, например процесс <systemitem class="daemon">httpd</systemitem> запускается в домене <computeroutput>httpd_t</computeroutput>. Если ограниченный процесс скомпрометирован атакующим, в зависимости от конфигурации SELinux, доступ атакующего к ресурсам и вред, который он может нанести огр аничен."

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates how SELinux prevents the Apache HTTP " -"Server (<systemitem class="daemon">httpd</systemitem>) from reading files " -"that are not correctly labeled, such as files intended for use by Samba. " -"This is an example, and should not be used in production. It assumes that " -"the <package>httpd</package>, <package>wget</package>, " -"<package>setroubleshoot-server</package>, <package>dbus</package> and " -"<package>audit</package> packages are installed, that the SELinux targeted " -"policy is used, and that SELinux is running in enforcing mode:" -msgstr "" +msgid "The following example demonstrates how SELinux prevents the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) from reading files that are not correctly labeled, such as files intended for use by Samba. This is an example, and should not be used in production. It assumes that the <package>httpd</package>, <package>wget</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode:" +msgstr "В следующем примере демонстрируется как SELinux предотвращает Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) от чтения файлов, которые не промаркированы корректно, такие как файлы используемые Samba. Данный пример не рекомендуется использовать в продуктивных средах. Подразумевается, что пакеты <package>httpd</package>, <package>wget</package>, <package>setroubleshoot-server</package>, <package>dbus</package> и <package>audit</package> установлены, и используется целевая политика SELinux targeted, SELinux запущен в принудительном enforcing режиме:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>sestatus</command> command to confirm that SELinux is " -"enabled, is running in enforcing mode, and that targeted policy is being " -"used:" -msgstr "" +msgid "Run the <command>sestatus</command> command to confirm that SELinux is enabled, is running in enforcing mode, and that targeted policy is being used:" +msgstr "Для того, чтобы убедиться, что SELinux включен в принудительном режиме с целевой политикой, необходимо выполнить команду <command>sestatus</command>"

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>SELinux status: enabled</computeroutput> is returned when " -"SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> " -"is returned when SELinux is running in enforcing mode. " -"<computeroutput>Policy from config file: targeted</computeroutput> is " -"returned when the SELinux targeted policy is used." -msgstr "" +msgid "<computeroutput>SELinux status: enabled</computeroutput> is returned when SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> is returned when SELinux is running in enforcing mode. <computeroutput>Policy from config file: targeted</computeroutput> is returned when the SELinux targeted policy is used." +msgstr "Значение <computeroutput>SELinux status: enabled</computeroutput> возвращается, когда SELinux включен. Значение <computeroutput>Current mode: enforcing</computeroutput> возвращается, когда SELinux запущен в принудительном режиме. Значение <computeroutput>Policy from config file: targeted</computeroutput> возвращается, если используется целевая политика SELinux targeted."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /var/www/html/testfile</" -"command> command to create a file." -msgstr "" +msgid "As the Linux root user, run the <command>touch /var/www/html/testfile</command> command to create a file." +msgstr "От имени пользователя Linux root выполните команду <command>touch /var/www/html/testfile</command> для создания файла."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/testfile</command> command to view the " -"SELinux context:" -msgstr "" +msgid "Run the <command>ls -Z /var/www/html/testfile</command> command to view the SELinux context:" +msgstr "Выполните команду <command>ls -Z /var/www/html/testfile</command> для просмотра контекста SELinux:"

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users run unconfined in Fedora, which is why the " -"<filename>testfile</filename> file is labeled with the SELinux " -"<computeroutput>unconfined_u</computeroutput> user. RBAC is used for " -"processes, not files. Roles do not have a meaning for files - the " -"<computeroutput>object_r</computeroutput> role is a generic role used for " -"files (on persistent storage and network file systems). Under the <filename>/" -"proc/</filename> directory, files related to processes may use the " -"<computeroutput>system_r</computeroutput> role.<footnote> <para> When using " -"other policies, such as MLS, other roles may be used, for example, " -"<computeroutput>secadm_r</computeroutput>. </para> </footnote> The " -"<computeroutput>httpd_sys_content_t</computeroutput> type allows the " -"<systemitem class="daemon">httpd</systemitem> process to access this file." -msgstr "" +msgid "By default, Linux users run unconfined in Fedora, which is why the <filename>testfile</filename> file is labeled with the SELinux <computeroutput>unconfined_u</computeroutput> user. RBAC is used for processes, not files. Roles do not have a meaning for files - the <computeroutput>object_r</computeroutput> role is a generic role used for files (on persistent storage and network file systems). Under the <filename>/proc/</filename> directory, files related to processes may use the <computeroutput>system_r</computeroutput> role.<footnote> <para> When using other policies, such as MLS, other roles may be used, for example, <computeroutput>secadm_r</computeroutput>. </para> </footnote> The <computeroutput>httpd_sys_content_t</computeroutput> type allows the <systemitem class="daemon">httpd</systemitem> process to access this file." +msgstr "По умолчанию в Fedora пользователи Linux работают неограниченными (unconfined), поэтому файл <filename>testfile</filename> помечен пользователем SELinux <computeroutput>unconfined_u</computeroutput>. RBAC используется только для процессов, для файлов не используется. Роли не имеют значения для файлов - роль <computeroutput>object_r</computeroutput> является универсальной для файлов (на постоянно подключенных хранилищах или сетевых файловых системах). В директории <filename>/proc/</filename> файлы, относящиеся к процессам, могу использовать роль <computeroutput>system_r</computeroutput>.<footnote> <para> При использовании других политик , таких как MLS, могут использоваться другие роли, например, <computeroutput>secadm_r</computeroutput>. </para> </footnote>. Тип <computeroutput>httpd_sys_content_t</computeroutput> разрешает процессу <systemitem class="daemon">httpd</systemitem> получить доступ к этому файлу."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>service httpd start</command> " -"command to start the <systemitem class="daemon">httpd</systemitem> " -"process. The output is as follows if <systemitem class="daemon">httpd</" -"systemitem> starts successfully:" -msgstr "" +msgid "As the Linux root user, run the <command>service httpd start</command> command to start the <systemitem class="daemon">httpd</systemitem> process. The output is as follows if <systemitem class="daemon">httpd</systemitem> starts successfully:" +msgstr "От имени пользователя Lnux root выполните команду <command>service httpd start</command> для запуска процесса <systemitem class="daemon">httpd</systemitem> Вывод команды показан ниже, если <systemitem class="daemon">httpd</systemitem> запустился успешно:"

#. Tag: para #, no-c-format -msgid "" -"Change into a directory where your Linux user has write access to, and run " -"the <command>wget http://localhost/testfile</command> command. Unless there " -"are changes to the default configuration, this command succeeds:" -msgstr "" +msgid "Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/testfile</command> command. Unless there are changes to the default configuration, this command succeeds:" +msgstr "Перейдите в каталог, где у вашего Linux пользователя есть права на запись, и выполните команду <command>wget http://localhost/testfile</command>. Если в конфигурацию по умолчанию не внесены изменения, то это команда выполнится успешно:"

#. Tag: para #, no-c-format -msgid "" -"The <command>chcon</command> command relabels files; however, such label " -"changes do not survive when the file system is relabeled. For permanent " -"changes that survive a file system relabel, use the <command>semanage</" -"command> command, which is discussed later. As the Linux root user, run the " -"following command to change the type to a type used by Samba:" -msgstr "" +msgid "The <command>chcon</command> command relabels files; however, such label changes do not survive when the file system is relabeled. For permanent changes that survive a file system relabel, use the <command>semanage</command> command, which is discussed later. As the Linux root user, run the following command to change the type to a type used by Samba:" +msgstr "Команда <command>chcon</command> перемаркирует файлы; однако такие изменения не сохраняются, когда файловая система перемаркируется. Для внесения постоянных сохраняющихся изменений используется команда <command>semanage</command>, которая обсуждается позже. От имени пользователя root выполните следующую команду для изменения типа на тип, используемый Samba:"

#. Tag: para #, no-c-format msgid "<command>chcon -t samba_share_t /var/www/html/testfile</command>" -msgstr "" +msgstr "<command>chcon -t samba_share_t /var/www/html/testfile</command>"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/testfile</command> command to view the " -"changes:" -msgstr "" +msgid "Run the <command>ls -Z /var/www/html/testfile</command> command to view the changes:" +msgstr "Выполните команду <command>ls -Z /var/www/html/testfile</command> для просмотра внесенных изменений:"

#. Tag: para #, no-c-format -msgid "" -"Note: the current DAC permissions allow the <systemitem class="daemon" -"">httpd</systemitem> process access to <filename>testfile</filename>. " -"Change into a directory where your Linux user has write access to, and run " -"the <command>wget http://localhost/testfile</command> command. Unless there " -"are changes to the default configuration, this command fails:" -msgstr "" +msgid "Note: the current DAC permissions allow the <systemitem class="daemon">httpd</systemitem> process access to <filename>testfile</filename>. Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/testfile</command> command. Unless there are changes to the default configuration, this command fails:" +msgstr "Примечание: текущие разрешения DAC разрешают процессу <systemitem class="daemon">httpd</systemitem> получить доступ к файлу <filename>testfile</filename>. Перейдите в директорию, где у вашего пользователя есть права на запись и выполните команду <command>wget http://localhost/testfile</command>. Если в конфигурацию по умолчанию не внесены измнения, то команда завершится с ошибкой:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>rm -i /var/www/html/testfile</" -"command> command to remove <filename>testfile</filename>." -msgstr "" +msgid "As the Linux root user, run the <command>rm -i /var/www/html/testfile</command> command to remove <filename>testfile</filename>." +msgstr "От имени пользователя root, выполните команду <command>rm -i /var/www/html/testfile</command> для удаления <filename>testfile</filename>."

#. Tag: para #, no-c-format -msgid "" -"If you do not require <systemitem class="daemon">httpd</systemitem> to be " -"running, as the Linux root user, run the <command>service httpd stop</" -"command> command to stop <systemitem class="daemon">httpd</systemitem>:" -msgstr "" +msgid "If you do not require <systemitem class="daemon">httpd</systemitem> to be running, as the Linux root user, run the <command>service httpd stop</command> command to stop <systemitem class="daemon">httpd</systemitem>:" +msgstr "Если нет необходимости в запущенном <systemitem class="daemon">httpd</systemitem>, то от имени пользователя root выполните команду <command>service httpd stop</command> для остановки <systemitem class="daemon">httpd</systemitem>:"

#. Tag: para #, no-c-format -msgid "" -"This example demonstrates the additional security added by SELinux. Although " -"DAC rules allowed the <systemitem class="daemon">httpd</systemitem> " -"process access to <filename>testfile</filename> in step 7, because the file " -"was labeled with a type that the <systemitem class="daemon">httpd</" -"systemitem> process does not have access to, SELinux denied access. After " -"step 7, an error similar to the following is logged to <filename>/var/log/" -"messages</filename>:" -msgstr "" +msgid "This example demonstrates the additional security added by SELinux. Although DAC rules allowed the <systemitem class="daemon">httpd</systemitem> process access to <filename>testfile</filename> in step 7, because the file was labeled with a type that the <systemitem class="daemon">httpd</systemitem> process does not have access to, SELinux denied access. After step 7, an error similar to the following is logged to <filename>/var/log/messages</filename>:" +msgstr "Дополнительные настрйоки безопасности добавленные в SELinux показаны на примере. Несмотря на то, что правила DAC разрешают процессу <systemitem class="daemon">httpd</systemitem> доступ к <filename>testfile</filename> используемому в шаге 7, так как файл маркирован типо, к которому процесс <systemitem class="daemon">httpd</systemitem> не имеет доступа, то SELinux отказывает в доступе. После шага 7 ошибка журналируется в <filename>/var/log/messages</filename>:"

#. Tag: para #, no-c-format -msgid "" -"Previous log files may use a <filename>/var/log/messages." -"<replaceable>YYYYMMDD</replaceable></filename> format. When running " -"<application>syslog-ng</application>, previous log files may use a " -"<filename>/var/log/messages.<replaceable>X</replaceable></filename> format. " -"If the <systemitem class="daemon">setroubleshootd</systemitem> and " -"<systemitem class="daemon">auditd</systemitem> processes are running, " -"errors similar to the following are logged to <filename>/var/log/audit/audit." -"log</filename>:" -msgstr "" +msgid "Previous log files may use a <filename>/var/log/messages.<replaceable>YYYYMMDD</replaceable></filename> format. When running <application>syslog-ng</application>, previous log files may use a <filename>/var/log/messages.<replaceable>X</replaceable></filename> format. If the <systemitem class="daemon">setroubleshootd</systemitem> and <systemitem class="daemon">auditd</systemitem> processes are running, errors similar to the following are logged to <filename>/var/log/audit/audit.log</filename>:" +msgstr "Предыдущие журналы событий могут быть созданы в формате <filename>/var/log/messages.<replaceable>YYYYMMDD</replaceable></filename>. Если запущен <application>syslog-ng</application>, предыдущие лог файлы имеют формат <filename>/var/log/messages.<replaceable>X</replaceable></filename>. Если процессы <systemitem class="daemon">setroubleshootd</systemitem> и <systemitem class="daemon">auditd</systemitem> запущены, ошибки, показанные ниже пишутся в файл <filename>/var/log/audit/audit.log</filename>:"

#. Tag: para #, no-c-format -msgid "" -"Also, an error similar to the following is logged to <filename>/var/log/" -"httpd/error_log</filename>:" -msgstr "" +msgid "Also, an error similar to the following is logged to <filename>/var/log/httpd/error_log</filename>:" +msgstr "Также ошибки, показанные ниже, пишутся в <filename>/var/log/httpd/error_log</filename>:"

#. Tag: title #, no-c-format msgid "Unconfined Processes" -msgstr "" +msgstr "Неограниченные процессы"

#. Tag: para #, no-c-format -msgid "" -"Unconfined processes run in unconfined domains, for example, init programs " -"run in the unconfined <computeroutput>initrc_t</computeroutput> domain, " -"unconfined kernel processes run in the <computeroutput>kernel_t</" -"computeroutput> domain, and unconfined Linux users run in the " -"<computeroutput>unconfined_t</computeroutput> domain. For unconfined " -"processes, SELinux policy rules are applied, but policy rules exist that " -"allow processes running in unconfined domains almost all access. Processes " -"running in unconfined domains fall back to using DAC rules exclusively. If " -"an unconfined process is compromised, SELinux does not prevent an attacker " -"from gaining access to system resources and data, but of course, DAC rules " -"are still used. SELinux is a security enhancement on top of DAC rules - it " -"does not replace them." -msgstr "" +msgid "Unconfined processes run in unconfined domains, for example, init programs run in the unconfined <computeroutput>initrc_t</computeroutput> domain, unconfined kernel processes run in the <computeroutput>kernel_t</computeroutput> domain, and unconfined Linux users run in the <computeroutput>unconfined_t</computeroutput> domain. For unconfined processes, SELinux policy rules are applied, but policy rules exist that allow processes running in unconfined domains almost all access. Processes running in unconfined domains fall back to using DAC rules exclusively. If an unconfined process is compromised, SELinux does not prevent an attacker from gaining access to system resources and data, but of course, DAC rules are still used. SELinux is a security enhancement on top of DAC rules - it does not replace them." +msgstr "Неограниченные (unconfined) процессы выполняются в неограниченных (unconfined) доменах, программы запускаемые init выполняются в неограниченном unconfined <computeroutput>initrc_t</computeroutput> домене, неограниченные процессы ядра запускаются в домене <computeroutput>kernel_t</computeroutput>. Для неограниченных процессов правила политики SELinux также применяются, но правила политики существуют для разрешения практически всех доступов для процессов, запущенных в неограниченных доменах. Процессы запущенные в неограниченных доменах откатываются к использованию только правил DAC. Если неограниченный процесс скомпрометирован, SELinux не ограничивает атакующего от получения доступа к системным ресурсам и информации, но, конечно, правила DAC всё равно используются. SELinux это улучшение механизмов безопасности над дискретным доступом DAC - SELinux не заменяет правила дискретного доступа."

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates how the Apache HTTP Server (<systemitem " -"class="daemon">httpd</systemitem>) can access data intended for use by " -"Samba, when running unconfined. Note: in Fedora, the <systemitem class=" -""daemon">httpd</systemitem> process runs in the confined " -"<computeroutput>httpd_t</computeroutput> domain by default. This is an " -"example, and should not be used in production. It assumes that the " -"<package>httpd</package>, <package>wget</package>, <package>setroubleshoot-" -"server</package>, <package>dbus</package> and <package>audit</package> " -"packages are installed, that the SELinux targeted policy is used, and that " -"SELinux is running in enforcing mode:" -msgstr "" +msgid "The following example demonstrates how the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) can access data intended for use by Samba, when running unconfined. Note: in Fedora, the <systemitem class="daemon">httpd</systemitem> process runs in the confined <computeroutput>httpd_t</computeroutput> domain by default. This is an example, and should not be used in production. It assumes that the <package>httpd</package>, <package>wget</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, that the SELinux targeted policy is used, and that SELinux is running in enforcing mode:" +msgstr "В следующем примере показывается как Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) может получить доступ к данным, предназначенны для использования Samba, если запущен в неограиченном режиме. Примечание: по умолчанию в Fedora процесс <systemitem class="daemon">httpd</systemitem> запускается в ограниченном <computeroutput>httpd_t</computeroutput> домене. Это пример, и он не является инструкцией по использованию в продуктивных средах. Подразумевается, что пакеты <package>httpd</package>, <package>wget</package>, <package>setroubleshoot-server</package>, <package>dbus</package> и <package>audit</package> установлены, используется целевая полити� �а SELinux targeted и SELinux запущен в принудительном режиме enforcing:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /var/www/html/test2file</" -"command> command to create a file." -msgstr "" +msgid "As the Linux root user, run the <command>touch /var/www/html/test2file</command> command to create a file." +msgstr "От имени пользователя Linux root выполните команду <command>touch /var/www/html/test2file</command> для создания файла."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/test2file</command> command to view the " -"SELinux context:" -msgstr "" +msgid "Run the <command>ls -Z /var/www/html/test2file</command> command to view the SELinux context:" +msgstr "Для просмотра контекста SELinux выполните команду <command>ls -Z /var/www/html/test2file</command>:"

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users run unconfined in Fedora, which is why the " -"<filename>test2file</filename> file is labeled with the SELinux " -"<computeroutput>unconfined_u</computeroutput> user. RBAC is used for " -"processes, not files. Roles do not have a meaning for files - the " -"<computeroutput>object_r</computeroutput> role is a generic role used for " -"files (on persistent storage and network file systems). Under the <filename>/" -"proc/</filename> directory, files related to processes may use the " -"<computeroutput>system_r</computeroutput> role.<footnote> <para> When using " -"other policies, such as MLS, other roles may also be used, for example, " -"<computeroutput>secadm_r</computeroutput>. </para> </footnote> The " -"<computeroutput>httpd_sys_content_t</computeroutput> type allows the " -"<systemitem class="daemon">httpd</systemitem> process to access this file." -msgstr "" +msgid "By default, Linux users run unconfined in Fedora, which is why the <filename>test2file</filename> file is labeled with the SELinux <computeroutput>unconfined_u</computeroutput> user. RBAC is used for processes, not files. Roles do not have a meaning for files - the <computeroutput>object_r</computeroutput> role is a generic role used for files (on persistent storage and network file systems). Under the <filename>/proc/</filename> directory, files related to processes may use the <computeroutput>system_r</computeroutput> role.<footnote> <para> When using other policies, such as MLS, other roles may also be used, for example, <computeroutput>secadm_r</computeroutput>. </para> </footnote> The <computeroutput>httpd_sys_content_t</computeroutput> type allows the <systemitem class="daemon">httpd</systemitem> process to access this file." +msgstr "По умолчанию, пользователи Linux работают неограниченно в Fedora, поэтому файл <filename>test2file</filename> помечен SELinux <computeroutput>unconfined_u</computeroutput>, RBAC используется только для процессов, не для файлов. Роли не имеют значения для файлов - роль <computeroutput>object_r</computeroutput> является универсальной для файлов (на постоянно подключенных хранилищах или сетевых файловых системах). В директории <filename>/proc/</filename> файлы, относящиеся к процессам, могут использовать роль <computeroutput>system_r</computeroutput>.<footnote> <para>. При использовании других политик, таких как MLS, могут использоваться другие роли, например, <computeroutput>secadm_r</computeroutput>. </para> </footnote>. Тип <computeroutput>httpd_sys_content_t</computeroutput> разрешает процессу <systemitem class="daemon">httpd</systemitem> получить доступ к этому файлу."

#. Tag: para #, no-c-format msgid "<command>chcon -t samba_share_t /var/www/html/test2file</command>" -msgstr "" +msgstr "<command>chcon -t samba_share_t /var/www/html/test2file</command>"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /var/www/html/test2file</command> command to view the " -"changes:" -msgstr "" +msgid "Run the <command>ls -Z /var/www/html/test2file</command> command to view the changes:" +msgstr "Выполните команду <command>ls -Z /var/www/html/test2file</command> для просмотра изменений:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>service httpd status</command> command to confirm that the " -"<systemitem class="daemon">httpd</systemitem> process is not running:" -msgstr "" +msgid "Run the <command>service httpd status</command> command to confirm that the <systemitem class="daemon">httpd</systemitem> process is not running:" +msgstr "Выполните команду <command>service httpd status</command> для того убеждения в том, что процесс <systemitem class="daemon">httpd</systemitem> не запущен:"

#. Tag: para #, no-c-format -msgid "" -"If the output differs, run the <command>service httpd stop</command> command " -"as the Linux root user to stop the <systemitem class="daemon">httpd</" -"systemitem> process:" -msgstr "" +msgid "If the output differs, run the <command>service httpd stop</command> command as the Linux root user to stop the <systemitem class="daemon">httpd</systemitem> process:" +msgstr "Если вывод команды отличается, выполните команду <command>service httpd stop</command> от имени пользователя root для остановки процесса <systemitem class="daemon">httpd</systemitem>:"

#. Tag: para #, no-c-format -msgid "" -"To make the <systemitem class="daemon">httpd</systemitem> process run " -"unconfined, run the following command as the Linux root user to change the " -"type of <filename>/usr/sbin/httpd</filename>, to a type that does not " -"transition to a confined domain:" -msgstr "" +msgid "To make the <systemitem class="daemon">httpd</systemitem> process run unconfined, run the following command as the Linux root user to change the type of <filename>/usr/sbin/httpd</filename>, to a type that does not transition to a confined domain:" +msgstr "Для того, чтобы сделать работу процесса <systemitem class="daemon">httpd</systemitem> неограниченной, выполните следующую команду от имени пользователя root для изменения типа файла <filename>/usr/sbin/httpd</filename>, на тип, который не перейдёт в ограниченный домен:"

#. Tag: para #, no-c-format msgid "<command>chcon -t unconfined_exec_t /usr/sbin/httpd</command>" -msgstr "" +msgstr "<command>chcon -t unconfined_exec_t /usr/sbin/httpd</command>"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that " -"<filename>/usr/sbin/httpd</filename> is labeled with the " -"<computeroutput>unconfined_exec_t</computeroutput> type:" -msgstr "" +msgid "Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that <filename>/usr/sbin/httpd</filename> is labeled with the <computeroutput>unconfined_exec_t</computeroutput> type:" +msgstr "Выполните команду <command>ls -Z /usr/sbin/httpd</command> для подтверждения в том, что <filename>/usr/sbin/httpd</filename> помечен типом <computeroutput>unconfined_exec_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ps -eZ | grep httpd</command> command to view the " -"<systemitem class="daemon">httpd</systemitem> running in the " -"<computeroutput>unconfined_t</computeroutput> domain:" -msgstr "" +msgid "Run the <command>ps -eZ | grep httpd</command> command to view the <systemitem class="daemon">httpd</systemitem> running in the <computeroutput>unconfined_t</computeroutput> domain:" +msgstr "Выполните команду <command>ps -eZ | grep httpd</command> для того, чтобы убедиться, что <systemitem class="daemon">httpd</systemitem> выполняется в домене <computeroutput>unconfined_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"Change into a directory where your Linux user has write access to, and run " -"the <command>wget http://localhost/test2file</command> command. Unless there " -"are changes to the default configuration, this command succeeds:" -msgstr "" +msgid "Change into a directory where your Linux user has write access to, and run the <command>wget http://localhost/test2file</command> command. Unless there are changes to the default configuration, this command succeeds:" +msgstr "Перейдите в директорию, где у вашего Linux пользователя есть права на запись, для выполнения команды <command>wget http://localhost/test2file</command>. Если конфигурация по умолчанию не изменена, то команда выполнится успешно:"

#. Tag: para #, no-c-format -msgid "" -"Although the <systemitem class="daemon">httpd</systemitem> process does " -"not have access to files labeled with the <computeroutput>samba_share_t</" -"computeroutput> type, <systemitem class="daemon">httpd</systemitem> is " -"running in the unconfined <computeroutput>unconfined_t</computeroutput> " -"domain, and falls back to using DAC rules, and as such, the <command>wget</" -"command> command succeeds. Had <systemitem class="daemon">httpd</" -"systemitem> been running in the confined <computeroutput>httpd_t</" -"computeroutput> domain, the <command>wget</command> command would have " -"failed." -msgstr "" +msgid "Although the <systemitem class="daemon">httpd</systemitem> process does not have access to files labeled with the <computeroutput>samba_share_t</computeroutput> type, <systemitem class="daemon">httpd</systemitem> is running in the unconfined <computeroutput>unconfined_t</computeroutput> domain, and falls back to using DAC rules, and as such, the <command>wget</command> command succeeds. Had <systemitem class="daemon">httpd</systemitem> been running in the confined <computeroutput>httpd_t</computeroutput> domain, the <command>wget</command> command would have failed." +msgstr "Несмотря на то, что процесс <systemitem class="daemon">httpd</systemitem> не имеет доступа к файлам помеченным типом <computeroutput>samba_share_t</computeroutput>, демон <systemitem class="daemon">httpd</systemitem> запущен в неограниченном <computeroutput>unconfined_t</computeroutput> домене и отступает к использованию правил DAC, таким образом, команда <command>wget</command> выполняется успешно. Если <systemitem class="daemon">httpd</systemitem> запущен в ограниченном <computeroutput>httpd_t</computeroutput> домене, то команда <command>wget</command> завершится с ошибкой."

#. Tag: para #, no-c-format -msgid "" -"The <command>restorecon</command> command restores the default SELinux " -"context for files. As the Linux root user, run the <command>restorecon -v /" -"usr/sbin/httpd</command> command to restore the default SELinux context for " -"<filename>/usr/sbin/httpd</filename>:" -msgstr "" +msgid "The <command>restorecon</command> command restores the default SELinux context for files. As the Linux root user, run the <command>restorecon -v /usr/sbin/httpd</command> command to restore the default SELinux context for <filename>/usr/sbin/httpd</filename>:" +msgstr "Команда <command>restorecon</command> восстанавливает контекст SELinux по умолчанию для файлов. От имени пользователя root, выполните команду <command>restorecon -v /usr/sbin/httpd</command> для восстановления контекста SELinux по умолчанию для файла <filename>/usr/sbin/httpd</filename>:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that " -"<filename>/usr/sbin/httpd</filename> is labeled with the " -"<computeroutput>httpd_exec_t</computeroutput> type:" -msgstr "" +msgid "Run the <command>ls -Z /usr/sbin/httpd</command> command to confirm that <filename>/usr/sbin/httpd</filename> is labeled with the <computeroutput>httpd_exec_t</computeroutput> type:" +msgstr "Выполните команду <command>ls -Z /usr/sbin/httpd</command> для того, чтобы убедиться, что <filename>/usr/sbin/httpd</filename> помечен типом <computeroutput>httpd_exec_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/service httpd restart</" -"command> command to restart <systemitem class="daemon">httpd</systemitem>. " -"After restarting, run the <command>ps -eZ | grep httpd</command> to confirm " -"that <systemitem class="daemon">httpd</systemitem> is running in the " -"confined <computeroutput>httpd_t</computeroutput> domain:" -msgstr "" +msgid "As the Linux root user, run the <command>/sbin/service httpd restart</command> command to restart <systemitem class="daemon">httpd</systemitem>. After restarting, run the <command>ps -eZ | grep httpd</command> to confirm that <systemitem class="daemon">httpd</systemitem> is running in the confined <computeroutput>httpd_t</computeroutput> domain:" +msgstr "От имени пользователя root, выполните команду <command>/sbin/service httpd restart</command> для перезапуска <systemitem class="daemon">httpd</systemitem>. После перезапуска, выполните <command>ps -eZ | grep httpd</command> для того, чтобы убедиться в запуске <systemitem class="daemon">httpd</systemitem> в ограниченном <computeroutput>httpd_t</computeroutput> домене:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>rm -i /var/www/html/test2file</" -"command> command to remove <filename>test2file</filename>." -msgstr "" +msgid "As the Linux root user, run the <command>rm -i /var/www/html/test2file</command> command to remove <filename>test2file</filename>." +msgstr "От имени пользователя root, выполните команду <command>rm -i /var/www/html/test2file</command> для удаления <filename>test2file</filename>."

#. Tag: para #, no-c-format -msgid "" -"The examples in these sections demonstrate how data can be protected from a " -"compromised confined-process (protected by SELinux), as well as how data is " -"more accessible to an attacker from a compromised unconfined-process (not " -"protected by SELinux)." -msgstr "" +msgid "The examples in these sections demonstrate how data can be protected from a compromised confined-process (protected by SELinux), as well as how data is more accessible to an attacker from a compromised unconfined-process (not protected by SELinux)." +msgstr "Примеры в этом разделе, демонстрируют как данные могут быть защищены от уязвимых ограниченных процессов (confined-processes), защищенных с помощью SELinux, а также, как данные могут стать доступными для атакующего от уязвимых неограниченных (unconfined-processes), не защищенных с помощью SELinux."

#. Tag: title #, no-c-format msgid "Confined and Unconfined Users" -msgstr "" +msgstr "Ограниченные и Неограниченные Пользователи"

#. Tag: para #, no-c-format -msgid "" -"Each Linux user is mapped to an SELinux user via SELinux policy. This allows " -"Linux users to inherit the restrictions on SELinux users. This Linux user " -"mapping is seen by running the <command>semanage login -l</command> command " -"as the Linux root user:" -msgstr "" +msgid "Each Linux user is mapped to an SELinux user via SELinux policy. This allows Linux users to inherit the restrictions on SELinux users. This Linux user mapping is seen by running the <command>semanage login -l</command> command as the Linux root user:" +msgstr "Каждый пользователь Linux сопоставлен пользователю SELinux через политику SELinux. Это позволяет пользователям Linux наследовать ограничения пользователей SELinux. Это сопоставление пользователей Linux можно просмотреть выполнив команду <command>semanage login -l</command> от имени пользователя root:"

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux " -"<computeroutput>__default__</computeroutput> login by default (which is " -"mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). " -"The following defines the default-mapping:" -msgstr "" +msgid "In Fedora&nbsp;&PRODVER;, Linux users are mapped to the SELinux <computeroutput>__default__</computeroutput> login by default (which is mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user). The following defines the default-mapping:" +msgstr "В Fedora&nbsp;&PRODVER;, пользователи Linux сопоставлены логину SELinux <computeroutput>__default__</computeroutput>, который сопоставлен пользователю SELinux <computeroutput>unconfined_u</computeroutput> по умолчанию. Ниже определяется это сопоставление "по-умолчанию":"

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates adding a new Linux user, and that Linux " -"user being mapped to the SELinux <computeroutput>unconfined_u</" -"computeroutput> user. It assumes that the Linux root user is running " -"unconfined, as it does by default in Fedora&nbsp;&PRODVER;:" -msgstr "" +msgid "The following example demonstrates adding a new Linux user, and that Linux user being mapped to the SELinux <computeroutput>unconfined_u</computeroutput> user. It assumes that the Linux root user is running unconfined, as it does by default in Fedora&nbsp;&PRODVER;:" +msgstr "В следующем примере демонстрируется добавление нового пользователя Linux, и сопоставление пользователя Linux пользователю SELinux <computeroutput>unconfined_u</computeroutput>. Это подразумевает, что пользователь root работает неограниченно (unconfined), что установлено по умолчанию в Fedora&nbsp;&PRODVER;:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> " -"command to create a new Linux user named newuser." -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/useradd newuser</command> command to create a new Linux user named newuser." +msgstr "От имени пользователя root, выполним команду <command>/usr/sbin/useradd newuser</command> для создания нового пользователя Linux с именем newuser."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>passwd newuser</command> command to " -"assign a password to the Linux newuser user:" -msgstr "" +msgid "As the Linux root user, run the <command>passwd newuser</command> command to assign a password to the Linux newuser user:" +msgstr "От имени пользователя root, выполним команду <command>passwd newuser</command> для назначения пароля пользователю newuser:"

#. Tag: para #, no-c-format -msgid "" -"Log out of your current session, and log in as the Linux newuser user. When " -"you log in, pam_selinux maps the Linux user to an SELinux user (in this " -"case, unconfined_u), and sets up the resulting SELinux context. The Linux " -"user's shell is then launched with this context. Run the <command>id -Z</" -"command> command to view the context of a Linux user:" -msgstr "" +msgid "Log out of your current session, and log in as the Linux newuser user. When you log in, pam_selinux maps the Linux user to an SELinux user (in this case, unconfined_u), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run the <command>id -Z</command> command to view the context of a Linux user:" +msgstr "Завершите сеанс текущей сессии, и выполните логин от имени пользователя newuser. После выполнения авторизации pam_selinux сопоставит пользователя Linux пользователю SELinux (в нашем случае unconfined_u), и установит результирующий контекст SELinux. Пользовательская оболочка (shell) запущена в этом же контексте. Выполните команду <command>id -Z</command> для просмотра контекста пользователя Linux:"

#. Tag: para #, no-c-format -msgid "" -"Log out of the Linux newuser's session, and log in with your account. If you " -"do not want the Linux newuser user, run the <command>/usr/sbin/userdel -r " -"newuser</command> command as the Linux root user to remove it, along with " -"the Linux newuser's home directory." -msgstr "" +msgid "Log out of the Linux newuser's session, and log in with your account. If you do not want the Linux newuser user, run the <command>/usr/sbin/userdel -r newuser</command> command as the Linux root user to remove it, along with the Linux newuser's home directory." +msgstr "Завершите сессию пользователя newuser, и зайдите с вашей учётной записью. Если Вам не нужен пользователь newuser, его можно удалить командой <command>/usr/sbin/userdel -r newuser</command> от имени пользователя root, вместе с домашним каталогом пользователя newsuer."

#. Tag: para #, no-c-format -msgid "" -"Confined and unconfined Linux users are subject to executable and writeable " -"memory checks, and are also restricted by MCS (and MLS, if the MLS policy is " -"used). If unconfined Linux users execute an application that SELinux policy " -"defines can transition from the <computeroutput>unconfined_t</" -"computeroutput> domain to its own confined domain, unconfined Linux users " -"are still subject to the restrictions of that confined domain. The security " -"benefit of this is that, even though a Linux user is running unconfined, the " -"application remains confined, and therefore, the exploitation of a flaw in " -"the application can be limited by policy. Note: this does not protect the " -"system from the user. Instead, the user and the system are being protected " -"from possible damage caused by a flaw in the application." -msgstr "" +msgid "Confined and unconfined Linux users are subject to executable and writeable memory checks, and are also restricted by MCS (and MLS, if the MLS policy is used). If unconfined Linux users execute an application that SELinux policy defines can transition from the <computeroutput>unconfined_t</computeroutput> domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy. Note: this does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application." +msgstr "Ограниченные и неограниченные пользователи Linux - это субъекты для проверки на исполнение и запись в сегменты памяти, а также для ограничений политикой MCS (и MLS, если используется политика MLS). Если неограниченные пользователи Linux выполняют приложения, для которых SELinux определяет переход из неограниченного домена <computeroutput>unconfined_t</computeroutput> в ограниченный домен, то неограниченные польователи Linux являются субъектами для правил и ограничений в этом ограниченном домене. Преимущество безопасности в этом случае заключается в том, что хотя пользователь работает неограниченно, приложение остаётся ограниченным, и кроме того, использование утечек приложение может быть ограничено политикой. Примечание: данный механизм не защищает систему от пользователя. Вместо этого, пользователь и система защищены от возможных угроз, вызванных уязвимостями приложения."

#. Tag: para #, no-c-format -msgid "" -"The following confined SELinux users are available in Fedora&nbsp;&PRODVER;:" -msgstr "" +msgid "The following confined SELinux users are available in Fedora&nbsp;&PRODVER;:" +msgstr "Следующие ограниченнные пользователи SELinux существуют в Fedora&nbsp;&PRODVER;:"

#. Tag: title #, no-c-format msgid "SELinux User Capabilities" -msgstr "" +msgstr "Возможности пользователей SELinux"

#. Tag: entry #, no-c-format msgid "User" -msgstr "" +msgstr "Пользователь"

#. Tag: entry #, no-c-format msgid "Domain" -msgstr "" +msgstr "Домен"

#. Tag: entry #, no-c-format msgid "X Window System" -msgstr "" +msgstr "X Window System"

#. Tag: entry #, no-c-format msgid "su and sudo" -msgstr "" +msgstr "su и sudo"

#. Tag: entry #, no-c-format msgid "Execute in home directory and /tmp/" -msgstr "" +msgstr "Выполнение в домашнем каталоге и /tmp/"

#. Tag: entry #, no-c-format msgid "Networking" -msgstr "" +msgstr "Сетевые функции"

#. Tag: entry #, no-c-format msgid "guest_u" -msgstr "" +msgstr "guest_u"

#. Tag: entry #, no-c-format msgid "guest_t" -msgstr "" +msgstr "guest_t"

#. Tag: entry #, no-c-format msgid "no" -msgstr "" +msgstr "нет"

#. Tag: entry #, no-c-format msgid "optional" -msgstr "" +msgstr "опционально"

#. Tag: entry #, no-c-format msgid "xguest_u" -msgstr "" +msgstr "xguest_u"

#. Tag: entry #, no-c-format msgid "xguest_t" -msgstr "" +msgstr "xguest_t"

#. Tag: entry #, no-c-format msgid "yes" -msgstr "" +msgstr "да"

#. Tag: entry #, no-c-format msgid "only <application>Firefox</application>" -msgstr "" +msgstr "только <application>Firefox</application>"

#. Tag: entry #, no-c-format msgid "user_u" -msgstr "" +msgstr "user_u"

#. Tag: entry #, no-c-format msgid "user_t" -msgstr "" +msgstr "user_t"

#. Tag: entry #, no-c-format msgid "staff_u" -msgstr "" +msgstr "staff_u"

#. Tag: entry #, no-c-format msgid "staff_t" -msgstr "" +msgstr "staff_t"

#. Tag: entry #, no-c-format msgid "only <command>sudo</command>" -msgstr "" +msgstr "только <command>sudo</command>"

#. Tag: para #, no-c-format -msgid "" -"Linux users in the <computeroutput>guest_t</computeroutput>, " -"<computeroutput>xguest_t</computeroutput>, and <computeroutput>user_t</" -"computeroutput> domains can only run set user ID (setuid) applications if " -"SELinux policy permits it (such as <command>passwd</command>). They can not " -"run the <command>su</command> and <command>/usr/bin/sudo</command> setuid " -"applications, and therefore, can not use these applications to become the " -"Linux root user." -msgstr "" +msgid "Linux users in the <computeroutput>guest_t</computeroutput>, <computeroutput>xguest_t</computeroutput>, and <computeroutput>user_t</computeroutput> domains can only run set user ID (setuid) applications if SELinux policy permits it (such as <command>passwd</command>). They can not run the <command>su</command> and <command>/usr/bin/sudo</command> setuid applications, and therefore, can not use these applications to become the Linux root user." +msgstr "Пользователи Linux в доменах <computeroutput>guest_t</computeroutput>, <computeroutput>xguest_t</computeroutput> и <computeroutput>user_t</computeroutput> могут запускать приложения, которые устанавливают ID пользователя (setuid), только если политика SELinux позволяет это (такие как <command>passwd</command>). Они не могут выполнять setuid приложения <command>su</command> и <command>/usr/bin/sudo</command> и более того, не могут использовать данные приложения для, того чтобы повысить привелегия до пользователя root."

#. Tag: para #, no-c-format -msgid "" -"Linux users in the <computeroutput>guest_t</computeroutput> domain have no " -"network access, and can only log in via a terminal (including <systemitem " -"class="daemon">ssh</systemitem>; they can log in via <systemitem class=" -""daemon">ssh</systemitem>, but can not use <systemitem class="daemon" -"">ssh</systemitem> to connect to another system)." -msgstr "" +msgid "Linux users in the <computeroutput>guest_t</computeroutput> domain have no network access, and can only log in via a terminal (including <systemitem class="daemon">ssh</systemitem>; they can log in via <systemitem class="daemon">ssh</systemitem>, but can not use <systemitem class="daemon">ssh</systemitem> to connect to another system)." +msgstr "У пользователей Linux в домене <computeroutput>guest_t</computeroutput> нет доступа к сети, и они могут только выполнить логин через терминал (включая <systemitem class="daemon">ssh</systemitem>; они могут выполнить вход через <systemitem class="daemon">ssh</systemitem>, но они не могут использовать <systemitem class="daemon">ssh</systemitem> для подключения к удалённой системе)."

#. Tag: para #, no-c-format -msgid "" -"The only network access Linux users in the <computeroutput>xguest_t</" -"computeroutput> domain have is <application>Firefox</application> connecting " -"to web pages." -msgstr "" +msgid "The only network access Linux users in the <computeroutput>xguest_t</computeroutput> domain have is <application>Firefox</application> connecting to web pages." +msgstr "Единственный сетевой доступ, который есть у пользователей Linux в домене <computeroutput>xguest_t</computeroutput> - это подключение к веб-страницам с использованием <application>Firefox</application>."

#. Tag: para #, no-c-format -msgid "" -"Linux users in the <computeroutput>xguest_t</computeroutput>, " -"<computeroutput>user_t</computeroutput> and <computeroutput>staff_t</" -"computeroutput> domains can log in via the X Window System and a terminal." -msgstr "" +msgid "Linux users in the <computeroutput>xguest_t</computeroutput>, <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can log in via the X Window System and a terminal." +msgstr "Пользователи Linux в доменах <computeroutput>xguest_t</computeroutput>, <computeroutput>user_t</computeroutput> и <computeroutput>staff_t</computeroutput> могут выполнять вход через X Window System или терминал."

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users in the <computeroutput>staff_t</computeroutput> " -"domain do not have permissions to execute applications with <command>/usr/" -"bin/sudo</command>. These permissions must be configured by an administrator." -msgstr "" +msgid "By default, Linux users in the <computeroutput>staff_t</computeroutput> domain do not have permissions to execute applications with <command>/usr/bin/sudo</command>. These permissions must be configured by an administrator." +msgstr "По умолчанию, пользователи Linux в домене <computeroutput>staff_t</computeroutput> не имеют прав на исполнение приложений с <command>/usr/bin/sudo</command> Эти права могут быть изменены администратором."

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users in the <computeroutput>guest_t</computeroutput> and " -"<computeroutput>xguest_t</computeroutput> domains can not execute " -"applications in their home directories or <filename>/tmp/</filename>, " -"preventing them from executing applications (which inherit users' " -"permissions) in directories they have write access to. This helps prevent " -"flawed or malicious applications from modifying files users' own." -msgstr "" +msgid "By default, Linux users in the <computeroutput>guest_t</computeroutput> and <computeroutput>xguest_t</computeroutput> domains can not execute applications in their home directories or <filename>/tmp/</filename>, preventing them from executing applications (which inherit users' permissions) in directories they have write access to. This helps prevent flawed or malicious applications from modifying files users' own." +msgstr "По умолчанию, пользователи Linux в доменах <computeroutput>guest_t</computeroutput> и <computeroutput>xguest_t</computeroutput> не могут исполнять приложения в их домащних каталогах или <filename>/tmp/</filename>, предотвращая этим, запуск приложений (которые наследуют права пользователя) в директориях, на которые у них есть права записи. Это позволяет предотвратить от запуска и утечки подозрительных приложений или изменения файлов, которыми владеет пользователь."

#. Tag: para #, no-c-format -msgid "" -"By default, Linux users in the <computeroutput>user_t</computeroutput> and " -"<computeroutput>staff_t</computeroutput> domains can execute applications in " -"their home directories and <filename>/tmp/</filename>. Refer to <xref " -"linkend="sect-Security-Enhanced_Linux-Confining_Users-" -"Booleans_for_Users_Executing_Applications" /> for information about " -"allowing and preventing users from executing applications in their home " -"directories and <filename>/tmp/</filename>." -msgstr "" +msgid "By default, Linux users in the <computeroutput>user_t</computeroutput> and <computeroutput>staff_t</computeroutput> domains can execute applications in their home directories and <filename>/tmp/</filename>. Refer to <xref linkend="sect-Security-Enhanced_Linux-Confining_Users-Booleans_for_Users_Executing_Applications" /> for information about allowing and preventing users from executing applications in their home directories and <filename>/tmp/</filename>." +msgstr "По умолчанию, пользователи Linux в доменах <computeroutput>user_t</computeroutput> и <computeroutput>staff_t</computeroutput> могут выполнять приложения в их домашних каталогах и <filename>/tmp/</filename>. Дополнительная информация <xref linkend="sect-Security-Enhanced_Linux-Confining_Users-Booleans_for_Users_Executing_Applications" /> о разрешении и запрещении исполнения приложения пользователями в домашних каталогах и <filename>/tmp/</filename>."

Modified: community/branches/f13/ru-RU/Trademarks.po =================================================================== --- community/branches/f13/ru-RU/Trademarks.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Trademarks.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,7 +1,6 @@ # SOME DESCRIPTIVE TITLE. # FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" @@ -10,6 +9,7 @@ "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME EMAIL@ADDRESS\n" "Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"Language: \n" "MIME-Version: 1.0\n" "Content-Type: application/x-xml2pot; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" @@ -17,56 +17,44 @@ #. Tag: title #, no-c-format msgid "Trademark Information" -msgstr "" +msgstr "Информация о торговых марках, торговых знаках (Trademark Information)"

#. Tag: para #, no-c-format -msgid "" -"<trademark class="registered">Linux</trademark> is the registered " -"trademark of Linus Torvalds in the U.S. and other countries." -msgstr "" +msgid "<trademark class="registered">Linux</trademark> is the registered trademark of Linus Torvalds in the U.S. and other countries." +msgstr "<trademark class="registered">Linux</trademark> зарегистрированная торговая марка Linus Torvalds в США и других странах"

#. Tag: para #, no-c-format msgid "UNIX is a registered trademark of The Open Group." -msgstr "" +msgstr "UNIX - это зарегистрированная торговая марка The Open Group."

#. Tag: para #, no-c-format -msgid "" -"Type Enforcement is a trademark of Secure Computing, LLC, a wholly owned " -"subsidiary of McAfee, Inc., registered in the U.S. and in other countries. " -"Neither McAfee nor Secure Computing, LLC, has consented to the use or " -"reference to this trademark by the author outside of this guide." -msgstr "" +msgid "Type Enforcement is a trademark of Secure Computing, LLC, a wholly owned subsidiary of McAfee, Inc., registered in the U.S. and in other countries. Neither McAfee nor Secure Computing, LLC, has consented to the use or reference to this trademark by the author outside of this guide." +msgstr "Type Enforcement - это зарегистрированная торговая марка Secure Computing, LLC, подразделение, находящейся в полной собственности McAfee, Inc., зарегестрированное в США и в других странах. McAfee или Secure Computing, LLC, не согласны на использование данной торговой марки автором вне (кроме) данного руководства."

#. Tag: para #, no-c-format msgid "Apache is a trademark of The Apache Software Foundation." -msgstr "" +msgstr "Apache - это торговая марка The Apache Software Foundation."

#. Tag: para #, no-c-format -msgid "" -"MySQL is a trademark or registered trademark of MySQL AB in the U.S. and " -"other countries." -msgstr "" +msgid "MySQL is a trademark or registered trademark of MySQL AB in the U.S. and other countries." +msgstr "MySQL - это зарегистрированная торговая марка MySQL AB в США и других странах."

#. Tag: para #, no-c-format -msgid "" -"Other products mentioned may be trademarks of their respective corporations." -msgstr "" +msgid "Other products mentioned may be trademarks of their respective corporations." +msgstr "Другие продукты, упоминамые как торговые марки соответствующих компаний."

#. Tag: title #, no-c-format msgid "Source Code" -msgstr "" +msgstr "Исходный код"

#. Tag: para #, no-c-format -msgid "" -"The XML source for this guide is available at <ulink url="http://svn." -"fedorahosted.org/svn/selinuxguide/">http://svn.fedorahosted.org/svn/" -"selinuxguide/</ulink>" -msgstr "" +msgid "The XML source for this guide is available at <ulink url="http://svn.fedorahosted.org/svn/selinuxguide/%5C%22%3Ehttp://svn.fedorahoste...</ulink>" +msgstr "Исходные XML для данного руководства доступны по ссылке: <ulink url="http://svn.fedorahosted.org/svn/selinuxguide/%5C%22%3Ehttp://svn.fedorahoste...</ulink>"

Modified: community/branches/f13/ru-RU/Troubleshooting.po =================================================================== --- community/branches/f13/ru-RU/Troubleshooting.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Troubleshooting.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,1425 +1,903 @@ -# SOME DESCRIPTIVE TITLE. -# FIRST AUTHOR EMAIL@ADDRESS, YEAR. -# -#, fuzzy +# SOME DESCRIPTIVE TITLE. +# FIRST AUTHOR EMAIL@ADDRESS, YEAR. +# msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:32\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-11-20 13:29+0500\n" +"Last-Translator: Alexey Cicin daydrim@gmail.com\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n" +"X-Poedit-SourceCharset: utf-8\n"

#. Tag: title #, no-c-format msgid "Troubleshooting" -msgstr "" +msgstr "Поиск и устранение неисправностей"

#. Tag: para #, no-c-format -msgid "" -"The following chapter describes what happens when SELinux denies access; the " -"top three causes of problems; where to find information about correct " -"labeling; analyzing SELinux denials; and creating custom policy modules with " -"<command>audit2allow</command>." -msgstr "" +msgid "The following chapter describes what happens when SELinux denies access; the top three causes of problems; where to find information about correct labeling; analyzing SELinux denials; and creating custom policy modules with <command>audit2allow</command>." +msgstr "В следующей главе описывается, что происходит, когда SELinux блокирует доступ: проблемы в решении вызывают три основных причины; где найти информацию о правильных метках; анализ отказов доступа SELinux; и создание специфически настроенных модулей с помощью <command>audit2allow</command>."

#. Tag: title #, no-c-format msgid "What Happens when Access is Denied" -msgstr "" +msgstr "Что происходит, когда блокируется доступ"

#. Tag: para #, no-c-format -msgid "" -"SELinux decisions, such as allowing or disallowing access, are cached. This " -"cache is known as the Access Vector Cache (AVC). Denial messages are logged " -"when SELinux denies access. These denials are also known as "AVC denials", " -"and are logged to a different location, depending on which daemons are " -"running:" -msgstr "" +msgid "SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). Denial messages are logged when SELinux denies access. These denials are also known as "AVC denials", and are logged to a different location, depending on which daemons are running:" +msgstr "Решения SELinux, такие как предоставление или блокирование доступа, кэшируются. Этот кэш называется Access Vector Cache (AVC) или кэш вектора доступа. Сообщения о блокировании доступа, журналируются, когда SELinux блокирует доступ. Эти отказы называются "Блокировками AVC" или "AVC denials" и журналируется в различные файлы, в зависимости от того, какой демон запущен:"

#. Tag: segtitle #, no-c-format msgid "Daemon" -msgstr "" +msgstr "Демон"

#. Tag: segtitle #, no-c-format msgid "Log Location" -msgstr "" +msgstr "Расположение файлов с журналами событий"

#. Tag: seg #, no-c-format msgid "auditd on" -msgstr "" +msgstr "auditd on"

#. Tag: seg #, no-c-format msgid "<filename>/var/log/audit/audit.log</filename>" -msgstr "" +msgstr "<filename>/var/log/audit/audit.log</filename>"

#. Tag: seg #, no-c-format msgid "auditd off; rsyslogd on" -msgstr "" +msgstr "auditd off; rsyslogd on"

#. Tag: seg #, no-c-format msgid "<filename>/var/log/messages</filename>" -msgstr "" +msgstr "<filename>/var/log/messages</filename>"

#. Tag: seg #, no-c-format msgid "setroubleshootd, rsyslogd, and auditd on" -msgstr "" +msgstr "setroubleshootd, rsyslogd, and auditd on"

#. Tag: seg #, no-c-format -msgid "" -"<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial " -"messages also sent to <filename>/var/log/messages</filename>" -msgstr "" +msgid "<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial messages also sent to <filename>/var/log/messages</filename>" +msgstr "<filename>/var/log/audit/audit.log</filename>. Проще читать сообщения о блокировках, дублируемые в <filename>/var/log/messages</filename>"

#. Tag: para #, no-c-format -msgid "" -"If you are running the X Window System, have the <package>setroubleshoot</" -"package> and <package>setroubleshoot-server</package> packages installed, " -"and the <systemitem class="daemon">setroubleshootd</systemitem> and " -"<systemitem class="daemon">auditd</systemitem> daemons are running, a " -"warning is displayed when access is denied by SELinux:" -msgstr "" +msgid "If you are running the X Window System, have the <package>setroubleshoot</package> and <package>setroubleshoot-server</package> packages installed, and the <systemitem class="daemon">setroubleshootd</systemitem> and <systemitem class="daemon">auditd</systemitem> daemons are running, a warning is displayed when access is denied by SELinux:" +msgstr "Если запущена X Window System, а также установлены пакеты <package>setroubleshoot</package> и <package>setroubleshoot-server</package>, и демоны <systemitem class="daemon">setroubleshootd</systemitem> и <systemitem class="daemon">auditd</systemitem> запущены, то, когда SELinux блокирует доступ, отображается предупреждение:"

#. Tag: para #, no-c-format -msgid "" -"Clicking on 'Show' presents a detailed analysis of why SELinux denied " -"access, and a possible solution for allowing access. If you are not running " -"the X Window System, it is less obvious when access is denied by SELinux. " -"For example, users browsing your website may receive an error similar to the " -"following:" -msgstr "" +msgid "Clicking on 'Show' presents a detailed analysis of why SELinux denied access, and a possible solution for allowing access. If you are not running the X Window System, it is less obvious when access is denied by SELinux. For example, users browsing your website may receive an error similar to the following:" +msgstr "Нажатие на 'Show' показывает детальный анализ причин, почему SELinux блокировал доступ, и возможное решение для открытия доступа. Если система X Window System не запущена, событие блокировки доступа менее очевидно. Например, пользователи просматривающие веб-сайт могут получить ошибку похожую, на показанную ниже:"

#. Tag: para #, no-c-format -msgid "" -"For these situations, if DAC rules (standard Linux permissions) allow " -"access, check <filename>/var/log/messages</filename> and <filename>/var/log/" -"audit/audit.log</filename> for <computeroutput>"SELinux is preventing"</" -"computeroutput> and <computeroutput>"denied"</computeroutput> errors " -"respectively. This can be done by running the following commands as the " -"Linux root user:" -msgstr "" +msgid "For these situations, if DAC rules (standard Linux permissions) allow access, check <filename>/var/log/messages</filename> and <filename>/var/log/audit/audit.log</filename> for <computeroutput>"SELinux is preventing"</computeroutput> and <computeroutput>"denied"</computeroutput> errors respectively. This can be done by running the following commands as the Linux root user:" +msgstr "В таких ситуациях, если правила DAC (стандартные разрешения Linux) разрешают доступ, проверьте файлы <filename>/var/log/messages</filename> и <filename>/var/log/audit/audit.log</filename> на события <computeroutput>"SELinux is preventing"</computeroutput> и <computeroutput>"denied"</computeroutput>. Это можно выполнить, выполнив следующие команды от имени пользователя root:"

#. Tag: para #, no-c-format msgid "<command>grep "SELinux is preventing" /var/log/messages</command>" -msgstr "" +msgstr "<command>grep "SELinux is preventing" /var/log/messages</command>"

#. Tag: para #, no-c-format msgid "<command>grep "denied" /var/log/audit/audit.log</command>" -msgstr "" +msgstr "<command>grep "denied" /var/log/audit/audit.log</command>"

#. Tag: title #, no-c-format msgid "Top Three Causes of Problems" -msgstr "" +msgstr "Три основные причины возникновения проблем"

#. Tag: para #, no-c-format -msgid "" -"The following sections describe the top three causes of problems: labeling " -"problems, configuring Booleans and ports for services, and evolving SELinux " -"rules." -msgstr "" +msgid "The following sections describe the top three causes of problems: labeling problems, configuring Booleans and ports for services, and evolving SELinux rules." +msgstr "В следующих разделах описываются три основные причины возникновения проблем: проблема меток, конфигурирование Булевых значений и портов для служб; и отслеживание правил SELinux."

#. Tag: title #, no-c-format msgid "Labeling Problems" -msgstr "" +msgstr "Проблема Меток (проблема маркирования)"

#. Tag: para #, no-c-format -msgid "" -"On systems running SELinux, all processes and files are labeled with a label " -"that contains security-relevant information. This information is called the " -"SELinux context. If these labels are wrong, access may be denied. If an " -"application is labeled incorrectly, the process it transitions to may not " -"have the correct label, possibly causing SELinux to deny access, and the " -"process being able to create mislabeled files." -msgstr "" +msgid "On systems running SELinux, all processes and files are labeled with a label that contains security-relevant information. This information is called the SELinux context. If these labels are wrong, access may be denied. If an application is labeled incorrectly, the process it transitions to may not have the correct label, possibly causing SELinux to deny access, and the process being able to create mislabeled files." +msgstr "В системах с запущенным SELinux, все процессы и файлы маркированы метками, которые содержат информацию контекста безопасности. Эта информация называется контекстом SELinux. Если эти метки некорректны, доступ может блокироваться. Если приложение маркировано некорректно, процесс в который оно переходит может иметь некорректные метки, что возможно приведет к блокированию доступа SELinux, и такой процесс может создать некорректно маркированные файлы."

#. Tag: para #, no-c-format -msgid "" -"A common cause of labeling problems is when a non-standard directory is used " -"for a service. For example, instead of using <filename>/var/www/html/</" -"filename> for a website, an administrator wants to use <filename>/srv/myweb/" -"</filename>. On Fedora&nbsp;&PRODVER;, the <filename>/srv/</filename> " -"directory is labeled with the <computeroutput>var_t</computeroutput> type. " -"Files and directories created and <filename>/srv/</filename> inherit this " -"type. Also, newly-created top-level directories (such as <filename>/myserver/" -"</filename>) may be labeled with the <computeroutput>default_t</" -"computeroutput> type. SELinux prevents the Apache HTTP Server (<systemitem " -"class="daemon">httpd</systemitem>) from accessing both of these types. To " -"allow access, SELinux must know that the files in <filename>/srv/myweb/</" -"filename> are to be accessible to <systemitem class="daemon">httpd</" -"systemitem>:" -msgstr "" +msgid "A common cause of labeling problems is when a non-standard directory is used for a service. For example, instead of using <filename>/var/www/html/</filename> for a website, an administrator wants to use <filename>/srv/myweb/</filename>. On Fedora&nbsp;&PRODVER;, the <filename>/srv/</filename> directory is labeled with the <computeroutput>var_t</computeroutput> type. Files and directories created and <filename>/srv/</filename> inherit this type. Also, newly-created top-level directories (such as <filename>/myserver/</filename>) may be labeled with the <computeroutput>default_t</computeroutput> type. SELinux prevents the Apache HTTP Server (<systemitem class="daemon">httpd</systemitem>) from accessing both of these types. To allow access, SELinux must know that the files in <filename>/srv/myweb/</filename> are to be accessible to <systemitem class="daemon">httpd</systemitem>:" +msgstr "Основная причина проблем с маркированием - это использование нестандартных каталогов для служб. Например, вместо использования <filename>/var/www/html/</filename> для вебсайта, администратор может использовать <filename>/srv/myweb/</filename> В Fedora&nbsp;&PRODVER;, каталог <filename>/srv/</filename> помечен типом <computeroutput>var_t</computeroutput>. Файлы и каталоги создаваемые в <filename>/srv/</filename> наследуют этот тип. Также вновь созданные каталоги корневого уровня, такие как <filename>/myserver/</filename>, могут быть помечены типом <computeroutput>default_t</computeroutput>. SELinux предотвращает Apache HTTP Server (<systemitem class="daemon">httpd</systemit em>) от получения доступа к этим типам. Для предоставления доступа, SELinux должен знать о том, что файлы в <filename>/srv/myweb/</filename> доступны <systemitem class="daemon">httpd</systemitem>:"

#. Tag: para #, no-c-format -msgid "" -"This <command>semanage</command> command adds the context for the <filename>/" -"srv/myweb/</filename> directory (and all files and directories under it) to " -"the SELinux file-context configuration<footnote> <para> Files in <filename>/" -"etc/selinux/targeted/contexts/files/</filename> define contexts for files " -"and directories. Files in this directory are read by <command>restorecon</" -"command> and <command>setfiles</command> to restore files and directories to " -"their default contexts. </para> </footnote>. The <command>semanage</command> " -"command does not change the context. As the Linux root user, run the " -"<command>restorecon</command> command to apply the changes:" -msgstr "" +msgid "This <command>semanage</command> command adds the context for the <filename>/srv/myweb/</filename> directory (and all files and directories under it) to the SELinux file-context configuration<footnote> <para> Files in <filename>/etc/selinux/targeted/contexts/files/</filename> define contexts for files and directories. Files in this directory are read by <command>restorecon</command> and <command>setfiles</command> to restore files and directories to their default contexts. </para> </footnote>. The <command>semanage</command> command does not change the context. As the Linux root user, run the <command>restorecon</command> command to apply the changes:" +msgstr "Команда <command>semanage</command> добавляет контекст к каталогу <filename>/srv/myweb/</filename> (и всем файлам и каталогам в нём) к конфигурации контекста SELinux<footnote> <para> Файлы в <filename>/etc/selinux/targeted/contexts/files/</filename> определяют контексты для файлов и каталогов. Файлы в этом каталоге считываются <command>restorecon</command> и <command>setfiles</command> для восстановления контекстов к их значениям по-умочанию. </para> </footnote>. Команда <command>semanage</command> не изменяет контекста. От имени пользователя root, выполните команду <command>restorecon</command> для применения изменений:"

#. Tag: para #, no-c-format -msgid "" -"Refer to <xref linkend="sect-Security-Enhanced_Linux-" -"SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> " -"for further information about adding contexts to the file-context " -"configuration." -msgstr "" +msgid "Refer to <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> for further information about adding contexts to the file-context configuration." +msgstr "Дополнительная информаци о добавлении контекстов к конфигурации доступна в разделе <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" />."

#. Tag: title #, no-c-format msgid "What is the Correct Context?" -msgstr "" +msgstr "Как определить правильный контекст?"

#. Tag: para #, no-c-format -msgid "" -"The <command>matchpathcon</command> command checks the context of a file " -"path and compares it to the default label for that path. The following " -"example demonstrates using <command>matchpathcon</command> on a directory " -"that contains incorrectly labeled files:" -msgstr "" +msgid "The <command>matchpathcon</command> command checks the context of a file path and compares it to the default label for that path. The following example demonstrates using <command>matchpathcon</command> on a directory that contains incorrectly labeled files:" +msgstr "Команда <command>matchpathcon</command> проверяет контекст для файла и сверяет с его контекстом по умолчанию. В следующем примере демонстрируется использование <command>matchpathcon</command> для каталога, который содержит некорректно маркированные файлы:"

#. Tag: para #, no-c-format -msgid "" -"In this example, the <filename>index.html</filename> and <filename>page1." -"html</filename> files are labeled with the <computeroutput>user_home_t</" -"computeroutput> type. This type is used for files in user home directories. " -"Using the <command>mv</command> command to move files from your home " -"directory may result in files being labeled with the " -"<computeroutput>user_home_t</computeroutput> type. This type should not " -"exist outside of home directories. Use the <command>restorecon</command> " -"command to restore such files to their correct type:" -msgstr "" +msgid "In this example, the <filename>index.html</filename> and <filename>page1.html</filename> files are labeled with the <computeroutput>user_home_t</computeroutput> type. This type is used for files in user home directories. Using the <command>mv</command> command to move files from your home directory may result in files being labeled with the <computeroutput>user_home_t</computeroutput> type. This type should not exist outside of home directories. Use the <command>restorecon</command> command to restore such files to their correct type:" +msgstr "В этом примере файлы <filename>index.html</filename> и <filename>page1.html</filename> помечены типом <computeroutput>user_home_t</computeroutput>. Этот тип используется для файлов в домашних каталогах пользователей. Используя команду <command>mv</command> для перемещения файлов из вашего домашнего каталога может привести к тому, что файлы будут маркированы типом <computeroutput>user_home_t</computeroutput>. Этот тип не должен существовать вне домашних каталогов. Используйте команду <command>restorecon</command> для восстановления корректного типа таких файлов:"

#. Tag: para #, no-c-format -msgid "" -"To restore the context for all files under a directory, use the <option>-R</" -"option> option:" -msgstr "" +msgid "To restore the context for all files under a directory, use the <option>-R</option> option:" +msgstr "Для восстановления контекста всех файлов в каталоге используйте опцию <option>-R</option>:"

#. Tag: para #, no-c-format -msgid "" -"Refer to <xref linkend="sect-Security-Enhanced_Linux-" -"Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context" /> for a " -"more detailed example of <command>matchpathcon</command>." -msgstr "" +msgid "Refer to <xref linkend="sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context" /> for a more detailed example of <command>matchpathcon</command>." +msgstr "Дополнительные примеры использования <command>matchpathcon</command> доступны по ссылке: <xref linkend="sect-Security-Enhanced_Linux-Maintaining_SELinux_Labels_-Checking_the_Default_SELinux_Context" />."

#. Tag: title #, no-c-format msgid "How are Confined Services Running?" -msgstr "" +msgstr "Как работают ограниченные службы?"

#. Tag: para #, no-c-format -msgid "" -"Services can be run in a variety of ways. To cater for this, you must tell " -"SELinux how you are running services. This can be achieved via Booleans that " -"allow parts of SELinux policy to be changed at runtime, without any " -"knowledge of SELinux policy writing. This allows changes, such as allowing " -"services access to NFS file systems, without reloading or recompiling " -"SELinux policy. Also, running services on non-default port numbers requires " -"policy configuration to be updated via the <command>semanage</command> " -"command." -msgstr "" +msgid "Services can be run in a variety of ways. To cater for this, you must tell SELinux how you are running services. This can be achieved via Booleans that allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing. This allows changes, such as allowing services access to NFS file systems, without reloading or recompiling SELinux policy. Also, running services on non-default port numbers requires policy configuration to be updated via the <command>semanage</command> command." +msgstr "Службы могут работать в нескольких режимах. Для того, чтобы обеспечить режимы, необходимо сообщить SELinux как необходимо запускать службы. Это может быть достигнуто через Булевы переменные, которые позволяют частям политики SELinux изменяться в рабочем режиме, без понимания написания политики SELinux. Это позволяет вносить изменения, такие, как доступ к файловым системам NFS, без перегрузки или рекомпиляции политики SELinux. Также запуск служб на нестандартном порту требует изменения политики с помощью команды <command>semanage</command>."

#. Tag: para #, no-c-format -msgid "" -"For example, to allow the Apache HTTP Server to communicate with MySQL, turn " -"the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean on:" -msgstr "" +msgid "For example, to allow the Apache HTTP Server to communicate with MySQL, turn the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean on:" +msgstr "Например для разрешения Apache HTTP Server связываться с MySQL, переключите Булево значение <computeroutput>httpd_can_network_connect_db</computeroutput> в состояние включено (on):"

#. Tag: para #, no-c-format -msgid "" -"If access is denied for a particular service, use the <command>getsebool</" -"command> and <command>grep</command> commands to see if any Booleans are " -"available to allow access. For example, use the <command>getsebool -a | grep " -"ftp</command> command to search for FTP related Booleans:" -msgstr "" +msgid "If access is denied for a particular service, use the <command>getsebool</command> and <command>grep</command> commands to see if any Booleans are available to allow access. For example, use the <command>getsebool -a | grep ftp</command> command to search for FTP related Booleans:" +msgstr "Если доступ заблокирован для определенной службы, используйте команды <command>getsebool</command> и <command>grep</command>, для просмотра есть ли Булевы переменные для предоставления доступа. Например, используйте команду <command>getsebool -a | grep ftp</command> для поиска соответствующих Булевых значений для FTP:"

#. Tag: para #, no-c-format -msgid "" -"For a list of Booleans and whether they are on or off, run the <command>/usr/" -"sbin/getsebool -a</command> command. For a list of Booleans, an explanation " -"of what each one is, and whether they are on or off, run the <command>/usr/" -"sbin/semanage boolean -l</command> command as the Linux root user. Refer to " -"<xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans" -"" /> for information about listing and configuring Booleans." -msgstr "" +msgid "For a list of Booleans and whether they are on or off, run the <command>/usr/sbin/getsebool -a</command> command. For a list of Booleans, an explanation of what each one is, and whether they are on or off, run the <command>/usr/sbin/semanage boolean -l</command> command as the Linux root user. Refer to <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans" /> for information about listing and configuring Booleans." +msgstr "Для просмотра Булевых значений и определения включены они или выключены, выполните команду <command>/usr/sbin/getsebool -a</command>. Для просмотра списка Булевых значений и определения их назначения, а также их состояния, выполните команду <command>/usr/sbin/semanage boolean -l</command> от имени пользователя root. Дополнительная информация о списках и конфигурировании Булевых значений доступна в разделе: <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Booleans" />"

#. Tag: title #, no-c-format msgid "Port Numbers" -msgstr "" +msgstr "Номера портов"

#. Tag: para #, no-c-format -msgid "" -"Depending on policy configuration, services may only be allowed to run on " -"certain port numbers. Attempting to change the port a service runs on " -"without changing policy may result in the service failing to start. For " -"example, run the <command>semanage port -l | grep http</command> command as " -"the Linux root user to list <systemitem class="daemon">http</systemitem> " -"related ports:" -msgstr "" +msgid "Depending on policy configuration, services may only be allowed to run on certain port numbers. Attempting to change the port a service runs on without changing policy may result in the service failing to start. For example, run the <command>semanage port -l | grep http</command> command as the Linux root user to list <systemitem class="daemon">http</systemitem> related ports:" +msgstr "В зависимости от конфигурации политики, службам может быть разрешено работать только на определенном диапазоне портов. Попытка изменить порт службы без изменения политики, может привести к невозможности запуска службы. Например, выполните команду <command>semanage port -l | grep http</command> от имени пользователя root для просмотра разрешенных портов относящихся к <systemitem class="daemon">http</systemitem>:"

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>http_port_t</computeroutput> port type defines the ports " -"Apache HTTP Server can listen on, which in this case, are TCP ports 80, 443, " -"488, 8008, 8009, and 8443. If an administrator configures <filename>httpd." -"conf</filename> so that <systemitem class="daemon">httpd</systemitem> " -"listens on port 9876 (<option>Listen 9876</option>), but policy is not " -"updated to reflect this, the <command>service httpd start</command> command " -"fails:" -msgstr "" +msgid "The <computeroutput>http_port_t</computeroutput> port type defines the ports Apache HTTP Server can listen on, which in this case, are TCP ports 80, 443, 488, 8008, 8009, and 8443. If an administrator configures <filename>httpd.conf</filename> so that <systemitem class="daemon">httpd</systemitem> listens on port 9876 (<option>Listen 9876</option>), but policy is not updated to reflect this, the <command>service httpd start</command> command fails:" +msgstr "Тип порта <computeroutput>http_port_t</computeroutput> определяет порт, который Apache HTTP Server может слушать, которые, в нашем случае, TCP 80, 443,488, 8008, 8009 и 8443. Если администратор сконфигурировал <filename>httpd.conf</filename> так, что <systemitem class="daemon">httpd</systemitem> слушает порт 9876 (<option>Listen 9876</option>), но политика не обновлена в соответствии с этим изменением, то команда <command>service httpd start</command> завершится с ошибкой:"

#. Tag: para #, no-c-format -msgid "" -"An SELinux denial similar to the following is logged to <filename>/var/log/" -"audit/audit.log</filename>:" -msgstr "" +msgid "An SELinux denial similar to the following is logged to <filename>/var/log/audit/audit.log</filename>:" +msgstr "Отказ в доступе SELinux будет схож со следующим событием, записанным в <filename>/var/log/audit/audit.log</filename>:"

#. Tag: para #, no-c-format -msgid "" -"To allow <systemitem class="daemon">httpd</systemitem> to listen on a port " -"that is not listed for the <computeroutput>http_port_t</computeroutput> port " -"type, run the <command>semanage port</command> command to add a port to " -"policy configuration<footnote> <para> The <command>semanage port -a</" -"command> command adds an entry to the <filename>/etc/selinux/targeted/" -"modules/active/ports.local</filename> file. Note: by default, this file can " -"only be viewed by the Linux root user. </para> </footnote>:" -msgstr "" +msgid "To allow <systemitem class="daemon">httpd</systemitem> to listen on a port that is not listed for the <computeroutput>http_port_t</computeroutput> port type, run the <command>semanage port</command> command to add a port to policy configuration<footnote> <para> The <command>semanage port -a</command> command adds an entry to the <filename>/etc/selinux/targeted/modules/active/ports.local</filename> file. Note: by default, this file can only be viewed by the Linux root user. </para> </footnote>:" +msgstr "Для разрешения <systemitem class="daemon">httpd</systemitem> слушать порт, который не перечислен в типе <computeroutput>http_port_t</computeroutput>, выполните команду <command>semanage port</command> для добавления порта в политику<footnote> <para> Команда <command>semanage port -a</command> добавляет запись в файл <filename>/etc/selinux/targeted/modules/active/ports.local</filename>. Примечание: по умолчанию, этот файл может быть просмотрен только пользователем root. </para> </footnote>:"

#. Tag: para #, no-c-format -msgid "" -"The <option>-a</option> option adds a new record; the <option>-t</option> " -"option defines a type; and the <option>-p</option> option defines a " -"protocol. The last argument is the port number to add." -msgstr "" +msgid "The <option>-a</option> option adds a new record; the <option>-t</option> option defines a type; and the <option>-p</option> option defines a protocol. The last argument is the port number to add." +msgstr "Опция <option>-a</option> добавляет новую запись; опция <option>-t</option> определяет тип, а опция <option>-p</option> определяет протокол. Последний аргумент - это номер добавляемого порта."

#. Tag: title #, no-c-format msgid "Evolving Rules and Broken Applications" -msgstr "" +msgstr "Разбор правил и нарушенная работа приложений"

#. Tag: para #, no-c-format -msgid "" -"Applications may be broken, causing SELinux to deny access. Also, SELinux " -"rules are evolving - SELinux may not have seen an application running in a " -"certain way, possibly causing it to deny access, even though the application " -"is working as expected. For example, if a new version of PostgreSQL is " -"released, it may perform actions the current policy has not seen before, " -"causing access to be denied, even though access should be allowed." -msgstr "" +msgid "Applications may be broken, causing SELinux to deny access. Also, SELinux rules are evolving - SELinux may not have seen an application running in a certain way, possibly causing it to deny access, even though the application is working as expected. For example, if a new version of PostgreSQL is released, it may perform actions the current policy has not seen before, causing access to be denied, even though access should be allowed." +msgstr "Работа приложения может быть нарушена, по причине блокировок доступа SELinux. Такие правила SELinux необходимо разбирать детально - SELinux может не определять приложение работающее по своим правилам, даже если приложение работает в штатном режиме. Например, если выпущена новая версия PostgreSQL, она может выполнять действия, о которых текущая политика SELinux не знает, приводя к отказу в доступе, даже если доступ должен быть предоставлен."

#. Tag: para #, no-c-format -msgid "" -"For these situations, after access is denied, use <command>audit2allow</" -"command> to create a custom policy module to allow access. Refer to <xref " -"linkend="sect-Security-Enhanced_Linux-Fixing_Problems-" -"Allowing_Access_audit2allow" /> for information about using " -"<command>audit2allow</command>." -msgstr "" +msgid "For these situations, after access is denied, use <command>audit2allow</command> to create a custom policy module to allow access. Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow" /> for information about using <command>audit2allow</command>." +msgstr "Для таких ситуаций, если доступ блокирован, используйте <command>audit2allow</command> для создания специфичного модуля политики для предоставления доступа. Дополнительная информация об использовании <command>audit2allow</command> доступна в разделе <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow" />."

#. Tag: title #, no-c-format msgid "Fixing Problems" -msgstr "" +msgstr "Устранение проблем"

#. Tag: para #, no-c-format -msgid "" -"The following sections help troubleshoot issues. They go over: checking " -"Linux permissions, which are checked before SELinux rules; possible causes " -"of SELinux denying access, but no denials being logged; manual pages for " -"services, which contain information about labeling and Booleans; permissive " -"domains, for allowing one process to run permissive, rather than the whole " -"system; how to search for and view denial messages; analyzing denials; and " -"creating custom policy modules with <command>audit2allow</command>." -msgstr "" +msgid "The following sections help troubleshoot issues. They go over: checking Linux permissions, which are checked before SELinux rules; possible causes of SELinux denying access, but no denials being logged; manual pages for services, which contain information about labeling and Booleans; permissive domains, for allowing one process to run permissive, rather than the whole system; how to search for and view denial messages; analyzing denials; and creating custom policy modules with <command>audit2allow</command>." +msgstr "В следующих разделах рассматриваются вопросы поиска и устранения неисправностей и проблем. В них рассматривается: проверка разрешений Linux, что должно проверяться перед правилами SELinux; возможные причины блокировки доступа SELinux, с условием отсутствия сообщений в лог-файлах; страницы руководства (manual pages) для служб, которые содержат информацию о метках и Булевых значениях; разрешенные (permissive) домены, для разрешения одному процессу работать в разрешительном режиме, а не только всей системе телеком; способы поиска и просмотра сообщени й об отказах в доступе; анализ отказов в доступе; и создание индивидуальных модулей политики с помощью <command>audit2allow</command>."

#. Tag: title #, no-c-format msgid "Linux Permissions" -msgstr "" +msgstr "Разрешения Linux"

#. Tag: para #, no-c-format -msgid "" -"When access is denied, check standard Linux permissions. As mentioned in " -"<xref linkend="chap-Security-Enhanced_Linux-Introduction" />, most " -"operating systems use a Discretionary Access Control (DAC) system to control " -"access, allowing users to control the permissions of files that they own. " -"SELinux policy rules are checked after DAC rules. SELinux policy rules are " -"not used if DAC rules deny access first." -msgstr "" +msgid "When access is denied, check standard Linux permissions. As mentioned in <xref linkend="chap-Security-Enhanced_Linux-Introduction" />, most operating systems use a Discretionary Access Control (DAC) system to control access, allowing users to control the permissions of files that they own. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first." +msgstr "Если доступ блокируется, проверьте стандартные разрешения Linux. Как упоминается в <xref linkend="chap-Security-Enhanced_Linux-Introduction" />, большинство операционных систем использует Дискреционный Контроль Доступа Discretionary Access Control (DAC) для управления доступом, позволяя пользователям контролировать разрешения над файлами, которыми они владеют. Правила политики SELinux проверяются после правил DAC. Правила политики SELinux не используются, если правила DAC блокировали доступ первыми."

#. Tag: para #, no-c-format -msgid "" -"If access is denied and no SELinux denials are logged, use the <command>ls -" -"l</command> command to view the standard Linux permissions:" -msgstr "" +msgid "If access is denied and no SELinux denials are logged, use the <command>ls -l</command> command to view the standard Linux permissions:" +msgstr "Если доступ блокирован и нет никаких сообщений о блокировках SELinux, используйте команду <command>ls -l</command> для просмотра стандартных разрешений Linux:"

#. Tag: para #, no-c-format -msgid "" -"In this example, <filename>index.html</filename> is owned by the root user " -"and group. The root user has read and write permissions (<computeroutput>-" -"rw</computeroutput>), and members of the root group have read permissions " -"(<computeroutput>-r-</computeroutput>). Everyone else has no access " -"(<computeroutput>---</computeroutput>). By default, such permissions do not " -"allow <systemitem class="daemon">httpd</systemitem> to read this file. To " -"resolve this issue, use the <command>chown</command> command to change the " -"owner and group. This command must be run as the Linux root user:" -msgstr "" +msgid "In this example, <filename>index.html</filename> is owned by the root user and group. The root user has read and write permissions (<computeroutput>-rw</computeroutput>), and members of the root group have read permissions (<computeroutput>-r-</computeroutput>). Everyone else has no access (<computeroutput>---</computeroutput>). By default, such permissions do not allow <systemitem class="daemon">httpd</systemitem> to read this file. To resolve this issue, use the <command>chown</command> command to change the owner and group. This command must be run as the Linux root user:" +msgstr "В этом примере, владельцем файла <filename>index.html</filename> является пользователь и группа root. У пользователя root есть права на чтение и запись (<computeroutput>-rw</computeroutput>), и у членов группы root есть разрешение на чтение (<computeroutput>-r-</computeroutput>). У группы Everyone нет доступа (<computeroutput>---</computeroutput>). По умолчанию, такие разрешения не разрешают <systemitem class="daemon">httpd</systemitem> читать этот файл. Для решения этой проблемы, используйте команду <command>chown</command> для смены владельца и группы. Эта команда должна быть выполнена от имени пользователя root:"

#. Tag: para #, no-c-format -msgid "" -"This assumes the default configuration, in which <systemitem class="daemon" -"">httpd</systemitem> runs as the Linux apache user. If you run <systemitem " -"class="daemon">httpd</systemitem> with a different user, replace " -"<computeroutput>apache:apache</computeroutput> with that user." -msgstr "" +msgid "This assumes the default configuration, in which <systemitem class="daemon">httpd</systemitem> runs as the Linux apache user. If you run <systemitem class="daemon">httpd</systemitem> with a different user, replace <computeroutput>apache:apache</computeroutput> with that user." +msgstr "Данные действия подразумевают конфигурацию по умолчанию, в которой <systemitem class="daemon">httpd</systemitem> работает от имени пользователя apache. Если <systemitem class="daemon">httpd</systemitem> запускается от имени другого пользователя, замените <computeroutput>apache:apache</computeroutput> на этого пользователя."

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://fedoraproject.org/wiki/Docs/Drafts/" -"AdministrationGuide/Permissions">Fedora Documentation Project "Permissions" -""</ulink> draft for information about managing Linux permissions." -msgstr "" +msgid "Refer to the <ulink url="http://fedoraproject.org/wiki/Docs/Drafts/AdministrationGuide/Permissions%5C... Documentation Project "Permissions"</ulink> draft for information about managing Linux permissions." +msgstr "Дополнительная информация об управлении разрешениями Linux доступна по ссылке <ulink url="http://fedoraproject.org/wiki/Docs/Drafts/AdministrationGuide/Permissions%5C... Documentation Project "Permissions"</ulink>."

#. Tag: title #, no-c-format msgid "Possible Causes of Silent Denials" -msgstr "" +msgstr "Возможные причины блокировок без оповещения"

#. Tag: para #, no-c-format -msgid "" -"In certain situations, AVC denials may not be logged when SELinux denies " -"access. Applications and system library functions often probe for more " -"access than required to perform their tasks. To maintain least privilege " -"without filling audit logs with AVC denials for harmless application " -"probing, the policy can silence AVC denials without allowing a permission by " -"using <computeroutput>dontaudit</computeroutput> rules. These rules are " -"common in standard policy. The downside of <computeroutput>dontaudit</" -"computeroutput> is that, although SELinux denies access, denial messages are " -"not logged, making troubleshooting hard." -msgstr "" +msgid "In certain situations, AVC denials may not be logged when SELinux denies access. Applications and system library functions often probe for more access than required to perform their tasks. To maintain least privilege without filling audit logs with AVC denials for harmless application probing, the policy can silence AVC denials without allowing a permission by using <computeroutput>dontaudit</computeroutput> rules. These rules are common in standard policy. The downside of <computeroutput>dontaudit</computeroutput> is that, although SELinux denies access, denial messages are not logged, making troubleshooting hard." +msgstr "В некоторых ситуациях, блокировки AVC могут не журналироваться, когда SELinux блокирует доступ. Приложения и функции системных библиотек часто требуют большего доступа, чем нужно, для выполнения своих задач. Для поддержки минимальных доступов без заполнения журналов аудита, блокировками AVC о безвредных запросах приложений, политика может выполнять блокировки AVC без сообщений, не разрешая доступ, используя правила <computeroutput>dontaudit</computeroutput>. Эти правила общие в стандартной политике. Плохая сторона <computeroutput>dontaudit</computeroutput> заключается в т� �м, что, хотя SELinux блокирует доступ, сообщения о блокировке не журналируются, таким образом, делая разбор и устранение ошибок сложным."

#. Tag: para #, no-c-format -msgid "" -"To temporarily disable <computeroutput>dontaudit</computeroutput> rules, " -"allowing all denials to be logged, run the following command as the Linux " -"root user:" -msgstr "" +msgid "To temporarily disable <computeroutput>dontaudit</computeroutput> rules, allowing all denials to be logged, run the following command as the Linux root user:" +msgstr "Для временного отключения правил <computeroutput>dontaudit</computeroutput>, позволяющим всем блокировкам журналироваться, выполните следующую команду от имени пользователя root:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/semodule -DB</command>" -msgstr "" +msgstr "<command>/usr/sbin/semodule -DB</command>"

#. Tag: para #, no-c-format -msgid "" -"The <option>-D</option> option disables <computeroutput>dontaudit</" -"computeroutput> rules; the <option>-B</option> option rebuilds policy. After " -"running <command>semodule -DB</command>, try exercising the application that " -"was encountering permission problems, and see if SELinux denials &mdash; " -"relevant to the application &mdash; are now being logged. Take care in " -"deciding which denials should be allowed, as some should be ignored and " -"handled via <computeroutput>dontaudit</computeroutput> rules. If in doubt, " -"or in search of guidance, contact other SELinux users and developers on an " -"SELinux list, such as <ulink url="http://www.redhat.com/mailman/listinfo/" -"fedora-selinux-list">fedora-selinux-list</ulink>." -msgstr "" +msgid "The <option>-D</option> option disables <computeroutput>dontaudit</computeroutput> rules; the <option>-B</option> option rebuilds policy. After running <command>semodule -DB</command>, try exercising the application that was encountering permission problems, and see if SELinux denials &mdash; relevant to the application &mdash; are now being logged. Take care in deciding which denials should be allowed, as some should be ignored and handled via <computeroutput>dontaudit</computeroutput> rules. If in doubt, or in search of guidance, contact other SELinux users and developers on an SELinux list, such as <ulink url="http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-se...</ulink>." +msgstr "Опция <option>-D</option> отключает правила <computeroutput>dontaudit</computeroutput>; опция <option>-B</option> перестраивает политику. После выполнения команды <command>semodule -DB</command>, попробуйте изучить приложение, встречающее проблемы в разрешениях и просмотрите блокировки SELinux &mdash; относящиеся к приложению &mdash;, которые теперь содержатся в лог-файлах. Позаботьтесь о принятии решений, какие правила разрешить, а какие проигнорировать через правила <computeroutput>dontaudit</computeroutput>. Если есть сомнения или требуется совет, свяжитесь с пользователями и разработчиками SELinux: <ulink url=" http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-se...</ulink>."

#. Tag: para #, no-c-format -msgid "" -"To rebuild policy and enable <computeroutput>dontaudit</computeroutput> " -"rules, run the following command as the Linux root user:" -msgstr "" +msgid "To rebuild policy and enable <computeroutput>dontaudit</computeroutput> rules, run the following command as the Linux root user:" +msgstr "Для перестройки политики и включения правил <computeroutput>dontaudit</computeroutput>, выполните команду от имени пользователя root:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/semodule -B</command>" -msgstr "" +msgstr "<command>/usr/sbin/semodule -B</command>"

#. Tag: para #, no-c-format -msgid "" -"This restores the policy to its original state. For a full list of " -"<computeroutput>dontaudit</computeroutput> rules, run the <command>sesearch " -"--dontaudit</command> command. Narrow down searches using the <option>-s " -"<replaceable>domain</replaceable></option> option and the <command>grep</" -"command> command. For example:" -msgstr "" +msgid "This restores the policy to its original state. For a full list of <computeroutput>dontaudit</computeroutput> rules, run the <command>sesearch --dontaudit</command> command. Narrow down searches using the <option>-s <replaceable>domain</replaceable></option> option and the <command>grep</command> command. For example:" +msgstr "Данная команда восстанавливает политику к её исходному состоянию. Для вывода всех правил <computeroutput>dontaudit</computeroutput>, выполните команду <command>sesearch --dontaudit</command>. Сузить поиск можно с использованием опции <option>-s <replaceable>domain</replaceable></option> и команды <command>grep</command>. Например:"

#. Tag: para #, no-c-format -msgid "" -"Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-" -"Raw_Audit_Messages" /> and <xref linkend="sect-Security-Enhanced_Linux-" -"Fixing_Problems-sealert_Messages" /> for information about analyzing " -"denials." -msgstr "" +msgid "Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> and <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" /> for information about analyzing denials." +msgstr "Информация об анализе блокировок доступна в разделах: <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> and <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" />."

#. Tag: title #, no-c-format msgid "Manual Pages for Services" -msgstr "" +msgstr "Cтраницы руководства (manual pages) для служб"

#. Tag: para #, no-c-format -msgid "" -"Manual pages for services contain valuable information, such as what file " -"type to use for a given situation, and Booleans to change the access a " -"service has (such as <systemitem class="daemon">httpd</systemitem> " -"accessing NFS file systems). This information may be in the standard manual " -"page, or a manual page with <computeroutput>selinux</computeroutput> " -"prepended or appended." -msgstr "" +msgid "Manual pages for services contain valuable information, such as what file type to use for a given situation, and Booleans to change the access a service has (such as <systemitem class="daemon">httpd</systemitem> accessing NFS file systems). This information may be in the standard manual page, or a manual page with <computeroutput>selinux</computeroutput> prepended or appended." +msgstr "Страницы руководства для служб содержат важную информацию, такую как, какой тип файла используется в определенной ситуации, и какие Булевы переменные необходимо изменить для предоставления доступа службе (такой как <systemitem class="daemon">httpd</systemitem>, получающей доступ к файловым системам NFS). Информация может быть в стандартной странице руководства или странице руководства с добавленным разделом <computeroutput>selinux</computeroutput>."

#. Tag: para #, no-c-format msgid "For example, the" -msgstr "" +msgstr "Например, страница руководства"

#. Tag: refentrytitle #, no-c-format msgid "httpd_selinux" -msgstr "" +msgstr "httpd_selinux"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page has information about what file type to use for a given " -"situation, as well as Booleans to allow scripts, sharing files, accessing " -"directories inside user home directories, and so on. Other manual pages with " -"SELinux information for services include:" -msgstr "" +msgid "manual page has information about what file type to use for a given situation, as well as Booleans to allow scripts, sharing files, accessing directories inside user home directories, and so on. Other manual pages with SELinux information for services include:" +msgstr "содержит информацию о том, какой тип файла используется, какие Булевы переменные разрешают скрипты, публикацию файлов, доступ к каталогам внутри домашних каталогов и так далее. Другие страницы руководства с информацией о SELinux для служб включают:"

#. Tag: para #, no-c-format msgid "Samba: the" -msgstr "" +msgstr "Samba: страница руководства"

#. Tag: refentrytitle #, no-c-format msgid "samba_selinux" -msgstr "" +msgstr "samba_selinux"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes that files and directories to be exported via Samba " -"must be labeled with the <computeroutput>samba_share_t</computeroutput> " -"type, as well as Booleans to allow files labeled with types other than " -"<computeroutput>samba_share_t</computeroutput> to be exported via Samba." -msgstr "" +msgid "manual page describes that files and directories to be exported via Samba must be labeled with the <computeroutput>samba_share_t</computeroutput> type, as well as Booleans to allow files labeled with types other than <computeroutput>samba_share_t</computeroutput> to be exported via Samba." +msgstr "содержит информацию о файлах и каталогах, которые могут быть экспортированы через самбу, помеченные типом <computeroutput>samba_share_t</computeroutput>, а также о Булевых переменных, разрешающих экспортировать через Samba файлы помеченные типом отличным от <computeroutput>samba_share_t</computeroutput>."

#. Tag: para #, no-c-format msgid "NFS: the" -msgstr "" +msgstr "NFS: страница руководства"

#. Tag: refentrytitle #, no-c-format msgid "nfs_selinux" -msgstr "" +msgstr "nfs_selinux"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes that, by default, file systems can not be exported via " -"NFS, and that to allow file systems to be exported, Booleans such as " -"<computeroutput>nfs_export_all_ro</computeroutput> or " -"<computeroutput>nfs_export_all_rw</computeroutput> must be turned on." -msgstr "" +msgid "manual page describes that, by default, file systems can not be exported via NFS, and that to allow file systems to be exported, Booleans such as <computeroutput>nfs_export_all_ro</computeroutput> or <computeroutput>nfs_export_all_rw</computeroutput> must be turned on." +msgstr "содержит информацию о том, что по умолчанию файловые системы не могут быть экспортированы через NFS; и для разрешения экспорта файловых систем, Булевы переменные, такие как <computeroutput>nfs_export_all_ro</computeroutput> или <computeroutput>nfs_export_all_rw</computeroutput> должны быть включены."

#. Tag: para #, no-c-format msgid "Berkeley Internet Name Domain (BIND): the" -msgstr "" +msgstr "Berkeley Internet Name Domain (BIND): страница руководства"

#. Tag: refentrytitle #, no-c-format msgid "named" -msgstr "" +msgstr "named"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes what file type to use for a given situation (see the " -"<computeroutput>Red Hat SELinux BIND Security Profile</computeroutput> " -"section). The" -msgstr "" +msgid "manual page describes what file type to use for a given situation (see the <computeroutput>Red Hat SELinux BIND Security Profile</computeroutput> section). The" +msgstr "содержит информацию о том, какой тип файла используется в данной ситуации (раздел <computeroutput>Red Hat SELinux BIND Security Profile</computeroutput> section). Страница руководства"

#. Tag: refentrytitle #, no-c-format msgid "named_selinux" -msgstr "" +msgstr "named_selinux"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page describes that, by default, <systemitem class="daemon">named</" -"systemitem> can not write to master zone files, and to allow such access, " -"the <computeroutput>named_write_master_zones</computeroutput> Boolean must " -"be turned on." -msgstr "" +msgid "manual page describes that, by default, <systemitem class="daemon">named</systemitem> can not write to master zone files, and to allow such access, the <computeroutput>named_write_master_zones</computeroutput> Boolean must be turned on." +msgstr "содержит информацию о том, что по умолчанию, <systemitem class="daemon">named</systemitem> не может осуществлять запись в файлы зон, и для разрешения такого доступа Булева переменная <computeroutput>named_write_master_zones</computeroutput> должна быть включена."

#. Tag: para #, no-c-format -msgid "" -"The information in manual pages helps you configure the correct file types " -"and Booleans, helping to prevent SELinux from denying access." -msgstr "" +msgid "The information in manual pages helps you configure the correct file types and Booleans, helping to prevent SELinux from denying access." +msgstr "Информация в страницах руководства помогает настроить корректные типы файлов и Булевы переключатели, предотвращая SELinux от блокирования доступа."

#. Tag: title #, no-c-format msgid "Permissive Domains" -msgstr "" +msgstr "Разрешающие домены (Permissive Domains)"

#. Tag: para #, no-c-format -msgid "" -"When SELinux is running in permissive mode, SELinux does not deny access, " -"but denials are logged for actions that would have been denied if running in " -"enforcing mode. Previously, it was not possible to make a single domain " -"permissive (remember: processes run in domains). In certain situations, this " -"led to making the whole system permissive to troubleshoot issues." -msgstr "" +msgid "When SELinux is running in permissive mode, SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode. Previously, it was not possible to make a single domain permissive (remember: processes run in domains). In certain situations, this led to making the whole system permissive to troubleshoot issues." +msgstr "Когда SELinux запущен в разрешающем режиме, SELinux не блокирует доступ, но блокировки журналируются как действия, которые были бы блокированы, если запущен принудительный режим. Раньше, не было возможности сделать определенный домен разрешающим (помните: процессы запускаются в доменах). В некоторых ситуациях, это ведет к тому, чтобы сделать всю систему разрешающей для диагностики и исправления ошибок."

#. Tag: para #, no-c-format -msgid "" -"Fedora&nbsp;&PRODVER; includes permissive domains, where an administrator " -"can configure a single process (domain) to run permissive, rather than " -"making the whole system permissive. SELinux checks are still performed for " -"permissive domains; however, the kernel allows access and reports an AVC " -"denial for situations where SELinux would have denied access. Permissive " -"domains are also available in Fedora 9 (with the latest updates applied)." -msgstr "" +msgid "Fedora&nbsp;&PRODVER; includes permissive domains, where an administrator can configure a single process (domain) to run permissive, rather than making the whole system permissive. SELinux checks are still performed for permissive domains; however, the kernel allows access and reports an AVC denial for situations where SELinux would have denied access. Permissive domains are also available in Fedora 9 (with the latest updates applied)." +msgstr "Fedora&nbsp;&PRODVER; включает разрешающие домены, где администратор может сконфигурировать определенный процесс (домен) для запуска в разрешающем режиме, вместо того, чтобы всю систему перевести в разрешающий режим. SELinux всё равно выполняет проверки разрешающих доменов; однако, ядро предоставляет доступ и сообщает AVC об отказах в доступе, когда SELinux блокирует доступ. Разрешающие домены доступны также и в Fedora 9 (с установленными последними обновлениями)."

#. Tag: para #, no-c-format -msgid "" -"In Red Hat Enterprise Linux 4 and 5, <computeroutput><replaceable>domain</" -"replaceable>_disable_trans</computeroutput> Booleans are available to " -"prevent an application from transitioning to a confined domain, and " -"therefore, the process runs in an unconfined domain, such as " -"<computeroutput>initrc_t</computeroutput>. Turning such Booleans on can " -"cause major problems. For example, if the " -"<computeroutput>httpd_disable_trans</computeroutput> Boolean is turned on:" -msgstr "" +msgid "In Red Hat Enterprise Linux 4 and 5, <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> Booleans are available to prevent an application from transitioning to a confined domain, and therefore, the process runs in an unconfined domain, such as <computeroutput>initrc_t</computeroutput>. Turning such Booleans on can cause major problems. For example, if the <computeroutput>httpd_disable_trans</computeroutput> Boolean is turned on:" +msgstr "В Red Hat Enterprise Linux 4 and 5, доступны Булевы переключатели <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> для предотвращения приложений выполнения переходов (transitions) в ограниченный домен, кроме того, процесс, запускается в неограниченном домене, таком как <computeroutput>initrc_t</computeroutput>. Настройка подобных Булевых значений может привести к возникновению значительных проблем. Например, если Булево значение <computeroutput>httpd_disable_trans</computeroutput> включено:"

#. Tag: para #, no-c-format -msgid "" -"<systemitem class="daemon">httpd</systemitem> runs in the unconfined " -"<computeroutput>initrc_t</computeroutput> domain. Files created by processes " -"running in the <computeroutput>initrc_t</computeroutput> domain may not have " -"the same labeling rules applied as files created by a process running in the " -"<computeroutput>httpd_t</computeroutput> domain, potentially allowing " -"processes to create mislabeled files. This causes access problems later on." -msgstr "" +msgid "<systemitem class="daemon">httpd</systemitem> runs in the unconfined <computeroutput>initrc_t</computeroutput> domain. Files created by processes running in the <computeroutput>initrc_t</computeroutput> domain may not have the same labeling rules applied as files created by a process running in the <computeroutput>httpd_t</computeroutput> domain, potentially allowing processes to create mislabeled files. This causes access problems later on." +msgstr "<systemitem class="daemon">httpd</systemitem> запустится в неограниченном <computeroutput>initrc_t</computeroutput> домене. Файлы созданные таким процессом, запущенном в <computeroutput>initrc_t</computeroutput> домене, могут не получить меток безопасности, которые получат файлы, созданные в домене <computeroutput>httpd_t</computeroutput>, потенциально позволяя процессам создавать некорректно промаркированные файлы. В дальнейшем такие ситуации вызывают проблемы."

#. Tag: para #, no-c-format -msgid "" -"confined domains that are allowed to communicate with " -"<computeroutput>httpd_t</computeroutput> can not communicate with " -"<computeroutput>initrc_t</computeroutput>, possibly causing additional " -"failures." -msgstr "" +msgid "confined domains that are allowed to communicate with <computeroutput>httpd_t</computeroutput> can not communicate with <computeroutput>initrc_t</computeroutput>, possibly causing additional failures." +msgstr "ограниченный домены, которым разрешено взаимодействовать с <computeroutput>httpd_t</computeroutput>, не разрешено взаимодействовать с <computeroutput>initrc_t</computeroutput>, возможно такие ситуации приводят к дополнительным проблемам."

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput><replaceable>domain</replaceable>_disable_trans</" -"computeroutput> Booleans were removed from Fedora 7, even though there was " -"no replacement. Permissive domains solve the above issues: transition rules " -"apply, and files are created with the correct labels." -msgstr "" +msgid "The <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> Booleans were removed from Fedora 7, even though there was no replacement. Permissive domains solve the above issues: transition rules apply, and files are created with the correct labels." +msgstr "Булевы значения <computeroutput><replaceable>domain</replaceable>_disable_trans</computeroutput> были удалены из Fedora 7, и для них не подразумевается никакой замены. Разрешающие домены решают подобные ситуации: правила переходов применяются и файлы создаются с корректными метками."

#. Tag: para #, no-c-format msgid "Permissive domains can be used for:" -msgstr "" +msgstr "Разрешающие домены могут быть использованы для:"

#. Tag: para #, no-c-format -msgid "" -"making a single process (domain) run permissive to troubleshoot an issue, " -"rather than putting the entire system at risk by making the entire system " -"permissive." -msgstr "" +msgid "making a single process (domain) run permissive to troubleshoot an issue, rather than putting the entire system at risk by making the entire system permissive." +msgstr "Перевести работу определенного процесса (домена) в разрешающий режим для анализа и выявления проблем, вместо подвержения риску целой системы, засчет перевода системы в разрешающий режим."

#. Tag: para #, no-c-format -msgid "" -"creating policies for new applications. Previously, it was recommended that " -"a minimal policy be created, and then the entire machine put into permissive " -"mode, so that the application could run, but SELinux denials still logged. " -"<command>audit2allow</command> could then be used to help write the policy. " -"This put the whole system at risk. With permissive domains, only the domain " -"in the new policy can be marked permissive, without putting the whole system " -"at risk." -msgstr "" +msgid "creating policies for new applications. Previously, it was recommended that a minimal policy be created, and then the entire machine put into permissive mode, so that the application could run, but SELinux denials still logged. <command>audit2allow</command> could then be used to help write the policy. This put the whole system at risk. With permissive domains, only the domain in the new policy can be marked permissive, without putting the whole system at risk." +msgstr "создания политик для нового приложения. Раньше, рекомендовалось, создавать минимальную политику, и затем вся машина перемещалась в разрешающий режим, так, чтобы приложения могло выполниться, но блокировки SELinux всё равно логировались. Дальше команда <command>audit2allow</command> могла быть использована для создания политики. Это делает всю систему уязвимой. С использованием разрешающих доменов, только домен в новой политике помечается как разрешающий, без риска уязвимости всей системы."

#. Tag: title #, no-c-format msgid "Making a Domain Permissive" -msgstr "" +msgstr "Подготовка разрешающего домена"

#. Tag: para #, no-c-format -msgid "" -"To make a domain permissive, run the <command>semanage permissive -a " -"<replaceable>domain</replaceable></command> command, where " -"<replaceable>domain</replaceable> is the domain you want to make permissive. " -"For example, run the following command as the Linux root user to make the " -"<computeroutput>httpd_t</computeroutput> domain (the domain the Apache HTTP " -"Server runs in) permissive:" -msgstr "" +msgid "To make a domain permissive, run the <command>semanage permissive -a <replaceable>domain</replaceable></command> command, where <replaceable>domain</replaceable> is the domain you want to make permissive. For example, run the following command as the Linux root user to make the <computeroutput>httpd_t</computeroutput> domain (the domain the Apache HTTP Server runs in) permissive:" +msgstr "Для того чтобы сделать домен разрешающим, необходимо выполнить команду <command>semanage permissive -a <replaceable>domain</replaceable></command>, где <replaceable>domain</replaceable> - это домен, который нужно сделать разрешающим. Например, выполнение следующей команды от имени пользователя root, сделает домен <computeroutput>httpd_t</computeroutput> (домен, в котором запускается Apache HTTP Server) разрешающим:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/semanage permissive -a httpd_t</command>" -msgstr "" +msgstr "<command>/usr/sbin/semanage permissive -a httpd_t</command>"

#. Tag: para #, no-c-format -msgid "" -"To view a list of domains you have made permissive, run the " -"<command>semodule -l | grep permissive</command> command as the Linux root " -"user. For example:" -msgstr "" +msgid "To view a list of domains you have made permissive, run the <command>semodule -l | grep permissive</command> command as the Linux root user. For example:" +msgstr "Для просмотра доменов, работающих в разрешающем режиме, выполните команду <command>semodule -l | grep permissive</command> от имени пользователя root. Например:"

#. Tag: para #, no-c-format -msgid "" -"If you no longer want a domain to be permissive, run the <command>semanage " -"permissive -d <replaceable>domain</replaceable></command> command as the " -"Linux root user. For example:" -msgstr "" +msgid "If you no longer want a domain to be permissive, run the <command>semanage permissive -d <replaceable>domain</replaceable></command> command as the Linux root user. For example:" +msgstr "Если вам больше не требуется существование разрешающего домена, выполните команду <command>semanage permissive -d <replaceable>domain</replaceable></command> от имени пользователя root. Например:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/semanage permissive -d httpd_t</command>" -msgstr "" +msgstr "<command>/usr/sbin/semanage permissive -d httpd_t</command>"

#. Tag: title #, no-c-format msgid "Denials for Permissive Domains" -msgstr "" +msgstr "Блокировки для Разрешающих доменов"

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>SYSCALL</computeroutput> message is different for " -"permissive domains. The following is an example AVC denial (and the " -"associated system call) from the Apache HTTP Server:" -msgstr "" +msgid "The <computeroutput>SYSCALL</computeroutput> message is different for permissive domains. The following is an example AVC denial (and the associated system call) from the Apache HTTP Server:" +msgstr "Сообщение <computeroutput>SYSCALL</computeroutput> отличается для разрешающих доменов. Ниже показан пример блокировки AVC (и соответствующего системного вызова) от Apache HTTP Server:"

#. Tag: para #, no-c-format -msgid "" -"By default, the <computeroutput>httpd_t</computeroutput> domain is not " -"permissive, and as such, the action is denied, and the " -"<computeroutput>SYSCALL</computeroutput> message contains " -"<computeroutput>success=no</computeroutput>. The following is an example AVC " -"denial for the same situation, except the <command>semanage permissive -a " -"httpd_t</command> command has been run to make the <computeroutput>httpd_t</" -"computeroutput> domain permissive:" -msgstr "" +msgid "By default, the <computeroutput>httpd_t</computeroutput> domain is not permissive, and as such, the action is denied, and the <computeroutput>SYSCALL</computeroutput> message contains <computeroutput>success=no</computeroutput>. The following is an example AVC denial for the same situation, except the <command>semanage permissive -a httpd_t</command> command has been run to make the <computeroutput>httpd_t</computeroutput> domain permissive:" +msgstr "По умолчанию, домен <computeroutput>httpd_t</computeroutput> не разрешающий и, как следствие, действие блокируется и сообщение <computeroutput>SYSCALL</computeroutput> содержит <computeroutput>success=no</computeroutput>. Ниже показан пример блокировки AVC для такой же ситуации, за исключением выполненной команды <command>semanage permissive -a httpd_t</command> для запуска домена <computeroutput>httpd_t</computeroutput> в разрешающем режиме:"

#. Tag: para #, no-c-format -msgid "" -"In this case, although an AVC denial was logged, access was not denied, as " -"shown by <computeroutput>success=yes</computeroutput> in the " -"<computeroutput>SYSCALL</computeroutput> message." -msgstr "" +msgid "In this case, although an AVC denial was logged, access was not denied, as shown by <computeroutput>success=yes</computeroutput> in the <computeroutput>SYSCALL</computeroutput> message." +msgstr "В этом случае, несмотря на то, что блокировка AVC записана, доступ не блокирован, как показано в сообщении <computeroutput>SYSCALL</computeroutput> <computeroutput>success=yes</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24537.html" -"">"Permissive Domains"</ulink> blog entry for further information about " -"permissive domains." -msgstr "" +msgid "Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24537.html%5C%22%3E%5C%22Permissive Domains"</ulink> blog entry for further information about permissive domains." +msgstr "Дополнительная информация в блоге Dan Walsh <ulink url="http://danwalsh.livejournal.com/24537.html%5C%22%3E%5C%22Permissive Domains"</ulink> о разрешающих доменах."

#. Tag: title #, no-c-format msgid "Searching For and Viewing Denials" -msgstr "" +msgstr "Поиск и просмотр блокировок"

#. Tag: para #, no-c-format -msgid "" -"This section assumes the <package>setroubleshoot</package>, " -"<package>setroubleshoot-server</package>, <package>dbus</package> and " -"<package>audit</package> packages are installed, and that the <systemitem " -"class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</" -"systemitem>, and <systemitem class="daemon">setroubleshootd</systemitem> " -"daemons are running. Refer to <xref linkend="sect-Security-Enhanced_Linux-" -"Working_with_SELinux-Which_Log_File_is_Used" /> for information about " -"starting these daemons. A number of tools are available for searching for " -"and viewing SELinux denials, such as <command>ausearch</command>, " -"<command>aureport</command>, and <command>sealert</command>." -msgstr "" +msgid "This section assumes the <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>dbus</package> and <package>audit</package> packages are installed, and that the <systemitem class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</systemitem>, and <systemitem class="daemon">setroubleshootd</systemitem> daemons are running. Refer to <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Which_Log_File_is_Used" /> for information about starting these daemons. A number of tools are available for searching for and viewing SELinux denials, such as <command>ausearch</command>, <command>aureport</command>, and <command>sealert</command>." +msgstr "В этом разделе предполагается, что пакеты <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>dbus</package> и <package>audit</package> установлены, и демоны <systemitem class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</systemitem> и <systemitem class="daemon">setroubleshootd</systemitem> запущены. В соответствии с разделом <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Which_Log_File_is_Used" /> об информации о запуске этих демонов. Часть этих утилит используется для поиска и просмотра блокировок SELinux, такие как <command>ausearch</command>, <command>aureport</command> и <command>sealert</command>."

#. Tag: title #, no-c-format msgid "ausearch" -msgstr "" +msgstr "ausearch"

#. Tag: para #, no-c-format -msgid "" -"The <package>audit</package> package provides <command>ausearch</command>. " -"From the" -msgstr "" +msgid "The <package>audit</package> package provides <command>ausearch</command>. From the" +msgstr "Пакет <package>audit</package> предоставляет <command>ausearch</command>. Из"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>ausearch</command> is a tool that can query the " -"audit daemon logs based for events based on different search criteria" -""<footnote> <para> From the <citerefentry><refentrytitle>ausearch</" -"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as " -"shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. " -"</para> </footnote>. The <command>ausearch</command> tool accesses " -"<filename>/var/log/audit/audit.log</filename>, and as such, must be run as " -"the Linux root user:" -msgstr "" +msgid "manual page: "<command>ausearch</command> is a tool that can query the audit daemon logs based for events based on different search criteria"<footnote> <para> From the <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. The <command>ausearch</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user:" +msgstr "страницы руководства : "<command>ausearch</command> - это инструмент который запрашивает логи демона аудита, построенных на событиях, основанных на различных критериях поиска"<footnote> <para> Из <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry> страницы руководства, поставляемой с пакетом <package>audit</package> в Fedora&nbsp;&PRODVER;. </para> </footnote>. Инструмент <command>ausearch</command> запрашивает <filename>/var/log/audit/audit.log</filename> и, как следствие, должен быть запущен от имени пользователя root:"

#. Tag: segtitle #, no-c-format msgid "Searching For" -msgstr "" +msgstr "Поиск"

#. Tag: segtitle #, no-c-format msgid "Command" -msgstr "" +msgstr "Команда"

#. Tag: seg #, no-c-format msgid "all denials" -msgstr "" +msgstr "все блокировки"

#. Tag: seg #, no-c-format msgid "<command>/sbin/ausearch -m avc</command>" -msgstr "" +msgstr "<command>/sbin/ausearch -m avc</command>"

#. Tag: seg #, no-c-format msgid "denials for that today" -msgstr "" +msgstr "блокировки за сегодняшний день"

#. Tag: seg #, no-c-format msgid "<command>/sbin/ausearch -m avc -ts today</command>" -msgstr "" +msgstr "<command>/sbin/ausearch -m avc -ts today</command>"

#. Tag: seg #, no-c-format msgid "denials from the last 10 minutes" -msgstr "" +msgstr "блокировки за последние 10 минут"

#. Tag: seg #, no-c-format msgid "<command>/sbin/ausearch -m avc -ts recent</command>" -msgstr "" +msgstr "<command>/sbin/ausearch -m avc -ts recent</command>"

#. Tag: para #, no-c-format -msgid "" -"To search for SELinux denials for a particular service, use the <option>-c " -"<replaceable>comm-name</replaceable></option> option, where " -"<replaceable>comm-name</replaceable> "is the executable’s name"<footnote> " -"<para> From the <citerefentry><refentrytitle>ausearch</" -"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as " -"shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. " -"</para> </footnote>, for example, <systemitem class="daemon">httpd</" -"systemitem> for the Apache HTTP Server, and <systemitem class="daemon" -"">smbd</systemitem> for Samba:" -msgstr "" +msgid "To search for SELinux denials for a particular service, use the <option>-c <replaceable>comm-name</replaceable></option> option, where <replaceable>comm-name</replaceable> "is the executable’s name"<footnote> <para> From the <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>, for example, <systemitem class="daemon">httpd</systemitem> for the Apache HTTP Server, and <systemitem class="daemon">smbd</systemitem> for Samba:" +msgstr "Для поиска блокировок SELinux для определенной службы, используется опция <option>-c <replaceable>comm-name</replaceable></option>, где <replaceable>comm-name</replaceable> "исполняемое имя файла"<footnote> <para> из страницы руководства <citerefentry><refentrytitle>ausearch</refentrytitle><manvolnum>8</manvolnum></citerefentry>, поставляемой с пакетом <package>audit</package> в Fedora&nbsp;&PRODVER;. </para> </footnote>, например, <systemitem class="daemon">httpd</systemitem> для Apache HTTP Server и <systemitem class="daemon">smbd</systemitem> для Samba:"

#. Tag: para #, no-c-format msgid "<command>/sbin/ausearch -m avc -c httpd</command>" -msgstr "" +msgstr "<command>/sbin/ausearch -m avc -c httpd</command>"

#. Tag: para #, no-c-format msgid "<command>/sbin/ausearch -m avc -c smbd</command>" -msgstr "" +msgstr "<command>/sbin/ausearch -m avc -c smbd</command>"

#. Tag: para #, no-c-format msgid "Refer to the" -msgstr "" +msgstr "В соответствии со"

#. Tag: citerefentry #, no-c-format msgid "manual page for further <command>ausearch</command> options." -msgstr "" +msgstr "страницей руководства <command>ausearch</command>."

#. Tag: title #, no-c-format msgid "aureport" -msgstr "" +msgstr "aureport"

#. Tag: para #, no-c-format -msgid "" -"The <package>audit</package> package provides <command>aureport</command>. " -"From the" -msgstr "" +msgid "The <package>audit</package> package provides <command>aureport</command>. From the" +msgstr "Пакет <package>audit</package> предоставляет <command>aureport</command>. Из"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>aureport</command> is a tool that produces summary " -"reports of the audit system logs"<footnote> <para> From the " -"<citerefentry><refentrytitle>aureport</refentrytitle><manvolnum>8</" -"manvolnum></citerefentry> manual page, as shipped with the <package>audit</" -"package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. The " -"<command>aureport</command> tool accesses <filename>/var/log/audit/audit." -"log</filename>, and as such, must be run as the Linux root user. To view a " -"list of SELinux denials and how often each one occurred, run the " -"<command>aureport -a</command> command. The following is example output that " -"includes two denials:" -msgstr "" +msgid "manual page: "<command>aureport</command> is a tool that produces summary reports of the audit system logs"<footnote> <para> From the <citerefentry><refentrytitle>aureport</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>audit</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. The <command>aureport</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user. To view a list of SELinux denials and how often each one occurred, run the <command>aureport -a</command> command. The following is example output that includes two denials:" +msgstr "страницы руководства : "<command>aureport</command> - это утилита, формирующая отчеты системных журналов аудита"<footnote> <para> Из страницы руководства <citerefentry><refentrytitle>aureport</refentrytitle><manvolnum>8</manvolnum></citerefentry>, поставляемой с пакетом <package>audit</package> в Fedora&nbsp;&PRODVER;. </para> </footnote>. Утилита <command>aureport</command> запрашивает <filename>/var/log/audit/audit.log</filename>, а также должны быть запущена от имени пользователя root. Для просмотра списка блокировок SELinux, а также как часто каждая из них возникает, выполните команду <command>aureport -a</command>. В следующем примере, показан вывод с двумя блокировкам� �:"

#. Tag: citerefentry #, no-c-format msgid "manual page for further <command>aureport</command> options." -msgstr "" +msgstr "страница руководства <command>aureport</command> с дополнительными опциями."

#. Tag: title #, no-c-format msgid "sealert" -msgstr "" +msgstr "sealert"

#. Tag: para #, no-c-format -msgid "" -"The <package>setroubleshoot-server</package> package provides " -"<command>sealert</command>, which reads denial messages translated by " -"<package>setroubleshoot-server</package>. Denials are assigned IDs, as seen " -"in <filename>/var/log/messages</filename>. The following is an example " -"denial from <filename>messages</filename>:" -msgstr "" +msgid "The <package>setroubleshoot-server</package> package provides <command>sealert</command>, which reads denial messages translated by <package>setroubleshoot-server</package>. Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. The following is an example denial from <filename>messages</filename>:" +msgstr "Пакет <package>setroubleshoot-server</package> предоставляет <command>sealert</command>, которая читает сообщения о блокировках, транслированные <package>setroubleshoot-server</package>. Блокировкам назначаются ID, как показано в <filename>/var/log/messages</filename>. Ниже показан пример блокировки из <filename>messages</filename>:"

#. Tag: para #, no-c-format -msgid "" -"In this example, the denial ID is <computeroutput>84e0b04d-d0ad-4347-8317-" -"22e74f6cd020</computeroutput>. The <option>-l</option> option takes an ID as " -"an argument. Running the <command>sealert -l 84e0b04d-d0ad-4347-8317-" -"22e74f6cd020</command> command presents a detailed analysis of why SELinux " -"denied access, and a possible solution for allowing access." -msgstr "" +msgid "In this example, the denial ID is <computeroutput>84e0b04d-d0ad-4347-8317-22e74f6cd020</computeroutput>. The <option>-l</option> option takes an ID as an argument. Running the <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> command presents a detailed analysis of why SELinux denied access, and a possible solution for allowing access." +msgstr "В этом примере, ID блокировки <computeroutput>84e0b04d-d0ad-4347-8317-22e74f6cd020</computeroutput>. Опция <option>-l</option> берет ID в качестве аргумента. Запуск команды <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> покажет детальный анализ причины, почему SELinux блокировал доступ и возможное решение предоставления доступа."

#. Tag: para #, no-c-format -msgid "" -"If you are running the X Window System, have the <package>setroubleshoot</" -"package> and <package>setroubleshoot-server</package> packages installed, " -"and the <systemitem class="daemon">setroubleshootd</systemitem>, " -"<systemitem class="daemon">dbus</systemitem> and <systemitem class="daemon" -"">auditd</systemitem> daemons are running, a warning is displayed when " -"access is denied by SELinux. Clicking on 'Show' launches the " -"<command>sealert</command> GUI, and displays denials in HTML output:" -msgstr "" +msgid "If you are running the X Window System, have the <package>setroubleshoot</package> and <package>setroubleshoot-server</package> packages installed, and the <systemitem class="daemon">setroubleshootd</systemitem>, <systemitem class="daemon">dbus</systemitem> and <systemitem class="daemon">auditd</systemitem> daemons are running, a warning is displayed when access is denied by SELinux. Clicking on 'Show' launches the <command>sealert</command> GUI, and displays denials in HTML output:" +msgstr "Если запущена X Window System, и установлены пакеты <package>setroubleshoot</package> и <package>setroubleshoot-server</package>, а также демоны <systemitem class="daemon">setroubleshootd</systemitem>, <systemitem class="daemon">dbus</systemitem> и <systemitem class="daemon">auditd</systemitem> запущены, то при блокировке доступа SELinux будет показано предупреждение. Нажмите 'Show', это запустит GUI <command>sealert</command> и покажет блокировку в HTML формате:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>sealert -b</command> command to launch the " -"<command>sealert</command> GUI." -msgstr "" +msgid "Run the <command>sealert -b</command> command to launch the <command>sealert</command> GUI." +msgstr "Выполните команду <command>sealert -b</command> для запуска GUI <command>sealert</command>."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>sealert -l \*</command> command to view a detailed " -"analysis of all denials." -msgstr "" +msgid "Run the <command>sealert -l \*</command> command to view a detailed analysis of all denials." +msgstr "Выполните команду <command>sealert -l \*</command> для просмотра детального анализа всех блокировок."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>sealert -a /var/log/audit/audit.log " -"-H &gt; audit.html</command> command to create a HTML version of the " -"<command>sealert</command> analysis, as seen with the <command>sealert</" -"command> GUI." -msgstr "" +msgid "As the Linux root user, run the <command>sealert -a /var/log/audit/audit.log -H &gt; audit.html</command> command to create a HTML version of the <command>sealert</command> analysis, as seen with the <command>sealert</command> GUI." +msgstr "От имени пользователя root, выполните команду <command>sealert -a /var/log/audit/audit.log -H &gt; audit.html</command> для создания HTML версии анализа <command>sealert</command>, как показано в GUI <command>sealert</command>."

#. Tag: citerefentry #, no-c-format msgid "manual page for further <command>sealert</command> options." -msgstr "" +msgstr "страница руководства <command>sealert</command> с дополнительными опциями."

#. Tag: title #, no-c-format msgid "Raw Audit Messages" -msgstr "" +msgstr "Необработанные сообщения аудита"

#. Tag: para #, no-c-format -msgid "" -"Raw audit messages are logged to <filename>/var/log/audit/audit.log</" -"filename>. The following is an example AVC denial (and the associated system " -"call) that occurred when the Apache HTTP Server (running in the " -"<computeroutput>httpd_t</computeroutput> domain) attempted to access the " -"<filename>/var/www/html/file1</filename> file (labeled with the " -"<computeroutput>samba_share_t</computeroutput> type):" -msgstr "" +msgid "Raw audit messages are logged to <filename>/var/log/audit/audit.log</filename>. The following is an example AVC denial (and the associated system call) that occurred when the Apache HTTP Server (running in the <computeroutput>httpd_t</computeroutput> domain) attempted to access the <filename>/var/www/html/file1</filename> file (labeled with the <computeroutput>samba_share_t</computeroutput> type):" +msgstr "Необработанные сообщения аудита записываются в <filename>/var/log/audit/audit.log</filename>. Ниже показан пример блокировки AVC (и связанный с этим системный вызов), которые появляются, когда Apache HTTP Server (запущенный в домене <computeroutput>httpd_t</computeroutput>) запрашивает доступ к файлу <filename>/var/www/html/file1</filename> (маркированный типом <computeroutput>samba_share_t</computeroutput>):"

#. Tag: term #, no-c-format msgid "<replaceable>{ getattr }</replaceable>" -msgstr "" +msgstr "<replaceable>{ getattr }</replaceable>"

#. Tag: para #, no-c-format -msgid "" -"The item in braces indicates the permission that was denied. " -"<computeroutput>getattr</computeroutput> indicates the source process was " -"trying to read the target file's status information. This occurs before " -"reading files. This action is denied due to the file being accessed having " -"the wrong label. Commonly seen permissions include <computeroutput>getattr</" -"computeroutput>, <computeroutput>read</computeroutput>, and " -"<computeroutput>write</computeroutput>." -msgstr "" +msgid "The item in braces indicates the permission that was denied. <computeroutput>getattr</computeroutput> indicates the source process was trying to read the target file's status information. This occurs before reading files. This action is denied due to the file being accessed having the wrong label. Commonly seen permissions include <computeroutput>getattr</computeroutput>, <computeroutput>read</computeroutput>, and <computeroutput>write</computeroutput>." +msgstr "Элемент в скобках показывает информацию о том, что доступ был блокирован. <computeroutput>getattr</computeroutput> показывает информацию о том, что процесс-источник пытался прочесть информацию о статусе файла. Это происходит перед чтением файла. Это действие было блокировано, так как файл, к которому запрашивался доступ, был промаркирован неправильной меткой. Обычно разрешения на просмотр включают: <computeroutput>getattr</computeroutput>, <computeroutput>read</computeroutput> и <computeroutput>write</computeroutput>."

#. Tag: term #, no-c-format msgid "comm="<replaceable>httpd</replaceable>"" -msgstr "" +msgstr "comm="<replaceable>httpd</replaceable>""

#. Tag: para #, no-c-format -msgid "" -"The executable that launched the process. The full path of the executable is " -"found in the <computeroutput>exe=</computeroutput> section of the system " -"call (<computeroutput>SYSCALL</computeroutput>) message, which in this case, " -"is <computeroutput>exe="/usr/sbin/httpd"</computeroutput>." -msgstr "" +msgid "The executable that launched the process. The full path of the executable is found in the <computeroutput>exe=</computeroutput> section of the system call (<computeroutput>SYSCALL</computeroutput>) message, which in this case, is <computeroutput>exe="/usr/sbin/httpd"</computeroutput>." +msgstr "Исполняемый файл, который запускает процесс. Полный путь к исполняемому файлу находится в разделе <computeroutput>exe=</computeroutput> сообщения системного вызова (<computeroutput>SYSCALL</computeroutput>), который в этом случае <computeroutput>exe="/usr/sbin/httpd"</computeroutput>."

#. Tag: term #, no-c-format msgid "path="<replaceable>/var/www/html/file1</replaceable>"" -msgstr "" +msgstr "path="<replaceable>/var/www/html/file1</replaceable>""

#. Tag: para #, no-c-format msgid "The path to the object (target) the process attempted to access." -msgstr "" +msgstr "Путь к объекту (target) процесс запрашивающий доступ."

#. Tag: term #, no-c-format -msgid "" -"scontext="<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>"" -msgstr "" +msgid "scontext="<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>"" +msgstr "scontext="<replaceable>unconfined_u:system_r:httpd_t:s0</replaceable>""

#. Tag: para #, no-c-format -msgid "" -"The SELinux context of the process that attempted the denied action. In this " -"case, it is the SELinux context of the Apache HTTP Server, which is running " -"in the <computeroutput>httpd_t</computeroutput> domain." -msgstr "" +msgid "The SELinux context of the process that attempted the denied action. In this case, it is the SELinux context of the Apache HTTP Server, which is running in the <computeroutput>httpd_t</computeroutput> domain." +msgstr "контекст SELinux процесса, который выполняет блокированное действие. В данном случае, это контекст SELinux процесса Apache HTTP Server, запущенный в домене <computeroutput>httpd_t</computeroutput>."

#. Tag: term #, no-c-format -msgid "" -"tcontext="<replaceable>unconfined_u:object_r:samba_share_t:s0</replaceable>" -""" -msgstr "" +msgid "tcontext="<replaceable>unconfined_u:object_r:samba_share_t:s0</replaceable>"" +msgstr "context="<replaceable>unconfined_u:object_r:samba_share_t:s0</replaceable>""

#. Tag: para #, no-c-format -msgid "" -"The SELinux context of the object (target) the process attempted to access. " -"In this case, it is the SELinux context of <filename>file1</filename>. Note: " -"the <computeroutput>samba_share_t</computeroutput> type is not accessible to " -"processes running in the <computeroutput>httpd_t</computeroutput> domain." -msgstr "" +msgid "The SELinux context of the object (target) the process attempted to access. In this case, it is the SELinux context of <filename>file1</filename>. Note: the <computeroutput>samba_share_t</computeroutput> type is not accessible to processes running in the <computeroutput>httpd_t</computeroutput> domain." +msgstr "Контекст SELinux объекта (цели, target) процесса, запрашивающего доступ. В данном случае - это контекст SELinux файла <filename>file1</filename>. Примечание: тип <computeroutput>samba_share_t</computeroutput> не доступен процессам, запущенным в <computeroutput>httpd_t</computeroutput> домене."

#. Tag: para #, no-c-format -msgid "" -"In certain situations, the <computeroutput>tcontext</computeroutput> may " -"match the <computeroutput>scontext</computeroutput>, for example, when a " -"process attempts to execute a system service that will change " -"characteristics of that running process, such as the user ID. Also, the " -"<computeroutput>tcontext</computeroutput> may match the " -"<computeroutput>scontext</computeroutput> when a process tries to use more " -"resources (such as memory) than normal limits allow, resulting in a security " -"check to see if that process is allowed to break those limits." -msgstr "" +msgid "In certain situations, the <computeroutput>tcontext</computeroutput> may match the <computeroutput>scontext</computeroutput>, for example, when a process attempts to execute a system service that will change characteristics of that running process, such as the user ID. Also, the <computeroutput>tcontext</computeroutput> may match the <computeroutput>scontext</computeroutput> when a process tries to use more resources (such as memory) than normal limits allow, resulting in a security check to see if that process is allowed to break those limits." +msgstr "В определенных ситуациях, <computeroutput>tcontext</computeroutput> может совпадать с <computeroutput>scontext</computeroutput>, например, если процесс пытается выполнить системную службу, которая изменяет характеристики этого, запущенного процесса, такого как ID пользователя. Также <computeroutput>tcontext</computeroutput> может совпадать с <computeroutput>scontext</computeroutput>, когда процесс пытается использовать больше ресурсов (например, памяти) чем позволяет лимит, что приводит к проверке безопасности, может ли такой процесс преодолеть данное ограничение."

#. Tag: para #, no-c-format -msgid "" -"From the system call (<computeroutput>SYSCALL</computeroutput>) message, two " -"items are of interest:" -msgstr "" +msgid "From the system call (<computeroutput>SYSCALL</computeroutput>) message, two items are of interest:" +msgstr "Из сообщения системного вызова (<computeroutput>SYSCALL</computeroutput>), интересны два пункта:"

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>success=<replaceable>no</replaceable></computeroutput>: " -"indicates whether the denial (AVC) was enforced or not. " -"<computeroutput>success=no</computeroutput> indicates the system call was " -"not successful (SELinux denied access). <computeroutput>success=yes</" -"computeroutput> indicates the system call was successful - this can be seen " -"for permissive domains or unconfined domains, such as " -"<computeroutput>initrc_t</computeroutput> and <computeroutput>kernel_t</" -"computeroutput>." -msgstr "" +msgid "<computeroutput>success=<replaceable>no</replaceable></computeroutput>: indicates whether the denial (AVC) was enforced or not. <computeroutput>success=no</computeroutput> indicates the system call was not successful (SELinux denied access). <computeroutput>success=yes</computeroutput> indicates the system call was successful - this can be seen for permissive domains or unconfined domains, such as <computeroutput>initrc_t</computeroutput> and <computeroutput>kernel_t</computeroutput>." +msgstr "<computeroutput>success=<replaceable>no</replaceable></computeroutput>: показывает была ли блокировка (AVC) принудительна или нет. <computeroutput>success=no</computeroutput> показывает, что системный вызов не был выполнен успешно (SELinux блокировал доступ). <computeroutput>success=yes</computeroutput> показывает, что системный вызов был выполнен успешно - такое событие можно увидеть для разрешающих доменов или неограниченных доменов, таких как <computeroutput>initrc_t</computeroutput> и <computeroutput>kernel_t</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>exe="<replaceable>/usr/sbin/httpd</replaceable>"</" -"computeroutput>: the full path to the executable that launched the process, " -"which in this case, is <computeroutput>exe="/usr/sbin/httpd"</" -"computeroutput>." -msgstr "" +msgid "<computeroutput>exe="<replaceable>/usr/sbin/httpd</replaceable>"</computeroutput>: the full path to the executable that launched the process, which in this case, is <computeroutput>exe="/usr/sbin/httpd"</computeroutput>." +msgstr "<computeroutput>exe="<replaceable>/usr/sbin/httpd</replaceable>"</computeroutput>: полный путь к исполняемому файлу, который запускает процесс, который в данном случае <computeroutput>exe="/usr/sbin/httpd"</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"An incorrect file type is a common cause for SELinux denying access. To " -"start troubleshooting, compare the source context (<computeroutput>scontext</" -"computeroutput>) with the target context (<computeroutput>tcontext</" -"computeroutput>). Should the process (<computeroutput>scontext</" -"computeroutput>) be accessing such an object (<computeroutput>tcontext</" -"computeroutput>)? For example, the Apache HTTP Server " -"(<computeroutput>httpd_t</computeroutput>) should only be accessing types " -"specified in the" -msgstr "" +msgid "An incorrect file type is a common cause for SELinux denying access. To start troubleshooting, compare the source context (<computeroutput>scontext</computeroutput>) with the target context (<computeroutput>tcontext</computeroutput>). Should the process (<computeroutput>scontext</computeroutput>) be accessing such an object (<computeroutput>tcontext</computeroutput>)? For example, the Apache HTTP Server (<computeroutput>httpd_t</computeroutput>) should only be accessing types specified in the" +msgstr "Некорректный тип файла - это основная причина, для блокировок доступа SELinux. Для начала анализа и устранения проблем, сравните исходных контекст (<computeroutput>scontext</computeroutput>) с целевым контекстом (<computeroutput>tcontext</computeroutput>). Должен ли процесс (<computeroutput>scontext</computeroutput>) получать доступ к объекту (<computeroutput>tcontext</computeroutput>)? Например, Apache HTTP Server (<computeroutput>httpd_t</computeroutput>) должен получать доступ только к файлам указанным в"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page, such as <computeroutput>httpd_sys_content_t</computeroutput>, " -"<computeroutput>public_content_t</computeroutput>, and so on, unless " -"configured otherwise." -msgstr "" +msgid "manual page, such as <computeroutput>httpd_sys_content_t</computeroutput>, <computeroutput>public_content_t</computeroutput>, and so on, unless configured otherwise." +msgstr "странице руководства, таким как <computeroutput>httpd_sys_content_t</computeroutput>, <computeroutput>public_content_t</computeroutput> и так далее, если не сконфигурировано иное."

#. Tag: title #, no-c-format msgid "sealert Messages" -msgstr "" +msgstr "Сообщения sealert"

#. Tag: para #, no-c-format -msgid "" -"Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. " -"The following is an example AVC denial (logged to <filename>messages</" -"filename>) that occurred when the Apache HTTP Server (running in the " -"<computeroutput>httpd_t</computeroutput> domain) attempted to access the " -"<filename>/var/www/html/file1</filename> file (labeled with the " -"<computeroutput>samba_share_t</computeroutput> type):" -msgstr "" +msgid "Denials are assigned IDs, as seen in <filename>/var/log/messages</filename>. The following is an example AVC denial (logged to <filename>messages</filename>) that occurred when the Apache HTTP Server (running in the <computeroutput>httpd_t</computeroutput> domain) attempted to access the <filename>/var/www/html/file1</filename> file (labeled with the <computeroutput>samba_share_t</computeroutput> type):" +msgstr "Блокировкам присваиваются ID, как видно в <filename>/var/log/messages</filename>. Ниже показан пример блокировки AVC (журналированной в <filename>messages</filename>), которая возникает когда Apache HTTP Server (запущенный в домене <computeroutput>httpd_t</computeroutput>) пытается получить доступ к файлу <filename>/var/www/html/file1</filename> (маркированный типом <computeroutput>samba_share_t</computeroutput>):"

#. Tag: para #, no-c-format -msgid "" -"As suggested, run the <command>sealert -l 84e0b04d-d0ad-4347-8317-" -"22e74f6cd020</command> command to view the complete message. This command " -"only works on the local machine, and presents the same information as the " -"<command>sealert</command> GUI:" -msgstr "" +msgid "As suggested, run the <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> command to view the complete message. This command only works on the local machine, and presents the same information as the <command>sealert</command> GUI:" +msgstr "Подразумевается, что выполнение команды <command>sealert -l 84e0b04d-d0ad-4347-8317-22e74f6cd020</command> покажет сообщение целиком. Эта команда работает только на локальной машине и показывает аналогичную информацию с <command>sealert</command> GUI:"

#. Tag: term #, no-c-format msgid "Summary" -msgstr "" +msgstr "Краткая сводка"

#. Tag: para #, no-c-format -msgid "" -"A brief summary of the denied action. This is the same as the denial in " -"<filename>/var/log/messages</filename>. In this example, the <systemitem " -"class="daemon">httpd</systemitem> process was denied access to a file " -"(<filename>file1</filename>), which is labeled with the " -"<computeroutput>samba_share_t</computeroutput> type." -msgstr "" +msgid "A brief summary of the denied action. This is the same as the denial in <filename>/var/log/messages</filename>. In this example, the <systemitem class="daemon">httpd</systemitem> process was denied access to a file (<filename>file1</filename>), which is labeled with the <computeroutput>samba_share_t</computeroutput> type." +msgstr "Краткая сводка действия блокировки. Это та же самая блокировка, что и в <filename>/var/log/messages</filename>. В этом примере процесс <systemitem class="daemon">httpd</systemitem> блокирует доступ к файлу (<filename>file1</filename>), который помечен типом <computeroutput>samba_share_t</computeroutput>."

#. Tag: term #, no-c-format msgid "Detailed Description" -msgstr "" +msgstr "Детальное описание"

#. Tag: para #, no-c-format -msgid "" -"A more verbose description. In this example, <filename>file1</filename> is " -"labeled with the <computeroutput>samba_share_t</computeroutput> type. This " -"type is used for files and directories that you want to export via Samba. " -"The description suggests changing the type to a type that can be accessed by " -"the Apache HTTP Server and Samba, if such access is desired." -msgstr "" +msgid "A more verbose description. In this example, <filename>file1</filename> is labeled with the <computeroutput>samba_share_t</computeroutput> type. This type is used for files and directories that you want to export via Samba. The description suggests changing the type to a type that can be accessed by the Apache HTTP Server and Samba, if such access is desired." +msgstr "Более полное описание. В этом примере <filename>file1</filename> помечен типом <computeroutput>samba_share_t</computeroutput>. Этот тип используется для файлов и каталогов, которые необходимо экспортировать через Samba. Описание подразумевает изменение типа на тип, который может быть доступен для Apache HTTP Server и Samba, если доступ блокируется."

#. Tag: term #, no-c-format msgid "Allowing Access" -msgstr "" +msgstr "Предоставление доступа"

#. Tag: para #, no-c-format -msgid "" -"A suggestion for how to allow access. This may be relabeling files, turning " -"a Boolean on, or making a local policy module. In this case, the suggestion " -"is to label the file with a type accessible to both the Apache HTTP Server " -"and Samba." -msgstr "" +msgid "A suggestion for how to allow access. This may be relabeling files, turning a Boolean on, or making a local policy module. In this case, the suggestion is to label the file with a type accessible to both the Apache HTTP Server and Samba." +msgstr "Предположения как можно разрешить доступ. Это можно сделать с помощью перемаркировки файлов, включения Булевых переменных или создания локального модуля политики. В данном случае предполагается изменения типа файла, на тип доступный Apache HTTP Server и Samba."

#. Tag: term #, no-c-format msgid "Fix Command" -msgstr "" +msgstr "Команда исправления"

#. Tag: para #, no-c-format -msgid "" -"A suggested command to allow access and resolve the denial. In this example, " -"it gives the command to change the <filename>file1</filename> type to " -"<computeroutput>public_content_t</computeroutput>, which is accessible to " -"the Apache HTTP Server and Samba." -msgstr "" +msgid "A suggested command to allow access and resolve the denial. In this example, it gives the command to change the <filename>file1</filename> type to <computeroutput>public_content_t</computeroutput>, which is accessible to the Apache HTTP Server and Samba." +msgstr "Предполагаемая команда для предоставления доступ и разрешения блокировки. В данном примере, даётся команда, изменяющая тип <filename>file1</filename> на <computeroutput>public_content_t</computeroutput>, который доступен Apache HTTP Server и Samba."

#. Tag: term #, no-c-format msgid "Additional Information" -msgstr "" +msgstr "Дополнительная информация"

#. Tag: para #, no-c-format -msgid "" -"Information that is useful in bug reports, such as the policy package name " -"and version (<computeroutput>selinux-policy-3.5.13-11.fc12</" -"computeroutput>), but may not help towards solving why the denial occurred." -msgstr "" +msgid "Information that is useful in bug reports, such as the policy package name and version (<computeroutput>selinux-policy-3.5.13-11.fc12</computeroutput>), but may not help towards solving why the denial occurred." +msgstr "Информация полезная в отчетах об ошибках, таких как такая как имя пакета политики и версия (<computeroutput>selinux-policy-3.5.13-11.fc12</computeroutput>), но не помогающая в направлении решения и устранения причин появления блокировки."

#. Tag: para #, no-c-format -msgid "" -"The raw audit messages from <filename>/var/log/audit/audit.log</filename> " -"that are associated with the denial. Refer to <xref linkend="sect-Security-" -"Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> for information about " -"each item in the AVC denial." -msgstr "" +msgid "The raw audit messages from <filename>/var/log/audit/audit.log</filename> that are associated with the denial. Refer to <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> for information about each item in the AVC denial." +msgstr "Необработанные сообщения аудита из <filename>/var/log/audit/audit.log</filename>, связанные с блокировкой. Дополнительная информация <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages" /> о каждом пункте в блокировке AVC."

#. Tag: title #, no-c-format msgid "Allowing Access: audit2allow" -msgstr "" +msgstr "Предоставление доступа: audit2allow"

#. Tag: para #, no-c-format -msgid "" -"Do not use the example in this section in production. It is used only to " -"demonstrate the use of <command>audit2allow</command>." -msgstr "" +msgid "Do not use the example in this section in production. It is used only to demonstrate the use of <command>audit2allow</command>." +msgstr "Не используйте данный пример в продуктивной системе. Он используется только для демонстрации использования <command>audit2allow</command>."

#. Tag: para #, no-c-format msgid "From the" -msgstr "" +msgstr "Из"

#. Tag: refentrytitle #, no-c-format msgid "audit2allow" -msgstr "" +msgstr "audit2allow"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>audit2allow</command> - generate SELinux policy " -"allow rules from logs of denied operations"<footnote> <para> From the " -"<citerefentry><refentrytitle>audit2allow</refentrytitle><manvolnum>1</" -"manvolnum></citerefentry> manual page, as shipped with the " -"<package>policycoreutils</package> package in Fedora&nbsp;&PRODVER;. </para> " -"</footnote>. After analyzing denials as per <xref linkend="sect-Security-" -"Enhanced_Linux-Fixing_Problems-sealert_Messages" />, and if no label " -"changes or Booleans allowed access, use <command>audit2allow</command> to " -"create a local policy module. After access is denied by SELinux, running the " -"<command>audit2allow</command> command presents Type Enforcement rules that " -"allow the previously denied access." -msgstr "" +msgid "manual page: "<command>audit2allow</command> - generate SELinux policy allow rules from logs of denied operations"<footnote> <para> From the <citerefentry><refentrytitle>audit2allow</refentrytitle><manvolnum>1</manvolnum></citerefentry> manual page, as shipped with the <package>policycoreutils</package> package in Fedora&nbsp;&PRODVER;. </para> </footnote>. After analyzing denials as per <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" />, and if no label changes or Booleans allowed access, use <command>audit2allow</command> to create a local policy module. After access is denied by SELinux, running the <command>audit2allow</command> command presents Type Enforcement rules that allow the previously denied access." +msgstr "страницы руководства: "<command>audit2allow</command> - генерирует разрешающие правила политики SELinux из логов (журналаов) блокированных операций"<footnote> <para> Из страницы руководства <citerefentry><refentrytitle>audit2allow</refentrytitle><manvolnum>1</manvolnum></citerefentry>, поставляемой с пакетом <package>policycoreutils</package> в Fedora&nbsp;&PRODVER;. </para> </footnote>. После анализа блокировок как в <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" />, и если метки не изменяются и нет Булевых переменных, предоставляющих доступ, используйте команду <command>audit2allow</command> для создания локального модуля политики. После того, как SELinux блокировал доступ, выполнение команды <command>audit2allow</command> покажет правила Type Enforcement, которые разрешат блокированный доступ."

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates using <command>audit2allow</command> to " -"create a policy module:" -msgstr "" +msgid "The following example demonstrates using <command>audit2allow</command> to create a policy module:" +msgstr "В следующем примере демонстрируется использование <command>audit2allow</command> для создания модуля политики:"

#. Tag: para #, no-c-format -msgid "" -"A denial and the associated system call are logged to <filename>/var/log/" -"audit/audit.log</filename>:" -msgstr "" +msgid "A denial and the associated system call are logged to <filename>/var/log/audit/audit.log</filename>:" +msgstr "Блокировка и соответствующий системный вызов записаны в <filename>/var/log/audit/audit.log</filename>:"

#. Tag: para #, no-c-format -msgid "" -"In this example, <application>certwatch</application> (<computeroutput>comm=" -""certwatch"</computeroutput>) was denied write access (<computeroutput>" -"{ write }</computeroutput>) to a directory labeled with the " -"<computeroutput>var_t</computeroutput> type " -"(<computeroutput>tcontext=system_u:object_r:var_t:s0</computeroutput>). " -"Analyze the denial as per <xref linkend="sect-Security-Enhanced_Linux-" -"Fixing_Problems-sealert_Messages" />. If no label changes or Booleans " -"allowed access, use <command>audit2allow</command> to create a local policy " -"module." -msgstr "" +msgid "In this example, <application>certwatch</application> (<computeroutput>comm="certwatch"</computeroutput>) was denied write access (<computeroutput>{ write }</computeroutput>) to a directory labeled with the <computeroutput>var_t</computeroutput> type (<computeroutput>tcontext=system_u:object_r:var_t:s0</computeroutput>). Analyze the denial as per <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" />. If no label changes or Booleans allowed access, use <command>audit2allow</command> to create a local policy module." +msgstr "В этом примере <application>certwatch</application> (<computeroutput>comm="certwatch"</computeroutput>) блокирует доступ на запись (<computeroutput>{ write }</computeroutput>) в каталог помеченный типом <computeroutput>var_t</computeroutput> (<computeroutput>tcontext=system_u:object_r:var_t:s0</computeroutput>). Проанализируйте блокировку в соответствии с <xref linkend="sect-Security-Enhanced_Linux-Fixing_Problems-sealert_Messages" />. Если метки не изменены или нет Булевых переменных, предоставляющих доступ, используйте <command>audit2allow</command> для создания локальной политики."

#. Tag: para #, no-c-format -msgid "" -"With a denial logged, such as the <computeroutput>certwatch</computeroutput> " -"denial in step 1, run the <command>audit2allow -w -a</command> command to " -"produce a human-readable description of why access was denied. The <option>-" -"a</option> option causes all audit logs to be read. The <option>-w</option> " -"option produces the human-readable description. The <command>audit2allow</" -"command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as " -"such, must be run as the Linux root user:" -msgstr "" +msgid "With a denial logged, such as the <computeroutput>certwatch</computeroutput> denial in step 1, run the <command>audit2allow -w -a</command> command to produce a human-readable description of why access was denied. The <option>-a</option> option causes all audit logs to be read. The <option>-w</option> option produces the human-readable description. The <command>audit2allow</command> tool accesses <filename>/var/log/audit/audit.log</filename>, and as such, must be run as the Linux root user:" +msgstr "С записанным сообщением о блокировке, таким как <computeroutput>certwatch</computeroutput> в шаге 1, выполните команду <command>audit2allow -w -a</command> для создания удобно-читаемого описания, почему доступ был блокирован. Опция <option>-a</option> является основанием для чтения всех логов. Опция <option>-w</option> создает удобо-читаемое описание. Инструмент <command>audit2allow</command> запрашивает <filename>/var/log/audit/audit.log</filename> и, как следствие, должен быть запущен от имени пользователя root."

#. Tag: para #, no-c-format msgid "As shown, access was denied due to a missing Type Enforcement rule." -msgstr "" +msgstr "Как показано, доступ блокирован, в соответствии с отсутствием правила Type Enforcement."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>audit2allow -a</command> command to view the Type " -"Enforcement rule that allows the denied access:" -msgstr "" +msgid "Run the <command>audit2allow -a</command> command to view the Type Enforcement rule that allows the denied access:" +msgstr "Выполните команду <command>audit2allow -a</command> для просмотра правил Type Enforcement. которые разрешают блокированный доступ:"

#. Tag: para #, no-c-format -msgid "" -"Missing Type Enforcement rules are usually caused by bugs in SELinux policy, " -"and should be reported in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed " -"Hat Bugzilla</ulink>. For Fedora, create bugs against the " -"<computeroutput>Fedora</computeroutput> product, and select the " -"<computeroutput>selinux-policy</computeroutput> component. Include the " -"output of the <command>audit2allow -w -a</command> and <command>audit2allow -" -"a</command> commands in such bug reports." -msgstr "" +msgid "Missing Type Enforcement rules are usually caused by bugs in SELinux policy, and should be reported in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat Bugzilla</ulink>. For Fedora, create bugs against the <computeroutput>Fedora</computeroutput> product, and select the <computeroutput>selinux-policy</computeroutput> component. Include the output of the <command>audit2allow -w -a</command> and <command>audit2allow -a</command> commands in such bug reports." +msgstr "Недостающие правила Type Enforcement обычно вызвана ошибками в политике SELinux, и о них необходимо сообщать в <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat Bugzilla</ulink>. Для Fedora, создайте bug напротив продукта <computeroutput>Fedora</computeroutput> и выберите компоненту <computeroutput>selinux-policy</computeroutput>. Включите вывод команд <command>audit2allow -w -a</command> и <command>audit2allow -a</command> в bug report."

#. Tag: para #, no-c-format -msgid "" -"To use the rule displayed by <command>audit2allow -a</command>, run the " -"<command>audit2allow -a -M <replaceable>mycertwatch</replaceable></command> " -"command as the Linux root user to create custom module. The <option>-M</" -"option> option creates a Type Enforcement file (<filename>.te</filename>) " -"with the name specified with <option>-M</option>, in your current working " -"directory:" -msgstr "" +msgid "To use the rule displayed by <command>audit2allow -a</command>, run the <command>audit2allow -a -M <replaceable>mycertwatch</replaceable></command> command as the Linux root user to create custom module. The <option>-M</option> option creates a Type Enforcement file (<filename>.te</filename>) with the name specified with <option>-M</option>, in your current working directory:" +msgstr "Для использования правила, показанного <command>audit2allow -a</command>, выполните команду <command>audit2allow -a -M <replaceable>mycertwatch</replaceable></command> от имени пользователя root для создания индивидуального модуля. Опция <option>-M</option> создает файл Type Enforcement (<filename>.te</filename>), с именем. указанным опцией <option>-M</option>, в текущем каталоге:"

#. Tag: para #, no-c-format -msgid "" -"Also, <command>audit2allow</command> compiles the Type Enforcement rule into " -"a policy package (<filename>.pp</filename>). To install the module, run the " -"<command>/usr/sbin/semodule -i <replaceable>mycertwatch.pp</replaceable></" -"command> command as the Linux root user." -msgstr "" +msgid "Also, <command>audit2allow</command> compiles the Type Enforcement rule into a policy package (<filename>.pp</filename>). To install the module, run the <command>/usr/sbin/semodule -i <replaceable>mycertwatch.pp</replaceable></command> command as the Linux root user." +msgstr "Также, <command>audit2allow</command> компилирует правила Type Enforcement в пакет политики (<filename>.pp</filename>). Для инсталляции модуля, используется команда <command>/usr/sbin/semodule -i <replaceable>mycertwatch.pp</replaceable></command> от имени пользователя root."

#. Tag: para #, no-c-format -msgid "" -"Modules created with <command>audit2allow</command> may allow more access " -"than required. It is recommended that policy created with " -"<command>audit2allow</command> be posted to an SELinux list, such as <ulink " -"url="http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-" -"selinux-list</ulink>, for review. If you believe their is a bug in policy, " -"create a bug in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat " -"Bugzilla</ulink>." -msgstr "" +msgid "Modules created with <command>audit2allow</command> may allow more access than required. It is recommended that policy created with <command>audit2allow</command> be posted to an SELinux list, such as <ulink url="http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-se...</ulink>, for review. If you believe their is a bug in policy, create a bug in <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat Bugzilla</ulink>." +msgstr "Модули, созданные с помощью <command>audit2allow</command> могут предоставить больше доступа чем требуется. Рекомендуется публиковать политики, созданные с помощью <command>audit2allow</command> в лист SELinux. такой как <ulink url="http://www.redhat.com/mailman/listinfo/fedora-selinux-list%5C%22%3Efedora-se...</ulink>, для обзора. Если Вы считаете, что это ошибка (bug) в политике, создайте bug в <ulink url="https://bugzilla.redhat.com/%5C%22%3ERed Hat Bugzilla</ulink>."

#. Tag: para #, no-c-format -msgid "" -"If you have multiple denials from multiple processes, but only want to " -"create a custom policy for a single process, use the <command>grep</command> " -"command to narrow down the input for <command>audit2allow</command>. The " -"following example demonstrates using <command>grep</command> to only send " -"denials related to <command>certwatch</command> through " -"<command>audit2allow</command>:" -msgstr "" +msgid "If you have multiple denials from multiple processes, but only want to create a custom policy for a single process, use the <command>grep</command> command to narrow down the input for <command>audit2allow</command>. The following example demonstrates using <command>grep</command> to only send denials related to <command>certwatch</command> through <command>audit2allow</command>:" +msgstr "Если есть множество блокировок от множества процессов, но необходимо создать индивидуальную политику для одного определенного процесса, используйте команду <command>grep</command> для сужения ввода команде <command>audit2allow</command>. В следующем примере демонстрируется использование команды <command>grep</command> для отправки блокировок. относящихся только к <command>certwatch</command> для <command>audit2allow</command>:"

#. Tag: para #, no-c-format -msgid "" -"Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24750.html" -"">"Using audit2allow to build policy modules. Revisited."</ulink> blog " -"entry for further information about using <command>audit2allow</command> to " -"build policy modules." -msgstr "" +msgid "Refer to Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24750.html%5C%22%3E%5C%22Using audit2allow to build policy modules. Revisited."</ulink> blog entry for further information about using <command>audit2allow</command> to build policy modules." +msgstr "В соответствии с блогом Dan Walsh's <ulink url="http://danwalsh.livejournal.com/24750.html%5C%22%3E%5C%22Using audit2allow to build policy modules. Revisited."</ulink> дополнительная информация об использовании <command>audit2allow</command> для создания модулей политик."

Modified: community/branches/f13/ru-RU/Working_With_SELinux.po =================================================================== --- community/branches/f13/ru-RU/Working_With_SELinux.po 2010-11-21 10:12:49 UTC (rev 491) +++ community/branches/f13/ru-RU/Working_With_SELinux.po 2010-11-21 23:12:12 UTC (rev 492) @@ -1,2232 +1,1363 @@ # SOME DESCRIPTIVE TITLE. # FIRST AUTHOR EMAIL@ADDRESS, YEAR. # -#, fuzzy msgid "" msgstr "" -"Project-Id-Version: PACKAGE VERSION\n" +"Project-Id-Version: SELinux User Guide\n" "Report-Msgid-Bugs-To: http://bugs.kde.org%5Cn" "POT-Creation-Date: 2010-04-15T00:19:32\n" -"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: FULL NAME EMAIL@ADDRESS\n" -"Language-Team: LANGUAGE kde-i18n-doc@kde.org\n" +"PO-Revision-Date: 2010-10-04 09:28+0500\n" +"Last-Translator: Alexey Cicin daydrim@gmail.com\n" +"Language-Team: trans-ru trans-ru@lists.fedoraproject.org\n" +"Language: \n" "MIME-Version: 1.0\n" -"Content-Type: application/x-xml2pot; charset=UTF-8\n" +"Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" +"X-Poedit-Language: Russian\n" +"X-Poedit-Country: RUSSIAN FEDERATION\n" +"X-Poedit-SourceCharset: utf-8\n"

#. Tag: title #, no-c-format msgid "Working with SELinux" -msgstr "" +msgstr "Работа с SELinux"

#. Tag: para #, no-c-format -msgid "" -"The following sections give a brief overview of the main SELinux packages in " -"Fedora; installing and updating packages; which log files are used; the main " -"SELinux configuration file; enabling and disabling SELinux; SELinux modes; " -"configuring Booleans; temporarily and persistently changing file and " -"directory labels; overriding file system labels with the <command>mount</" -"command> command; mounting NFS file systems; and how to preserve SELinux " -"contexts when copying and archiving files and directories." -msgstr "" +msgid "The following sections give a brief overview of the main SELinux packages in Fedora; installing and updating packages; which log files are used; the main SELinux configuration file; enabling and disabling SELinux; SELinux modes; configuring Booleans; temporarily and persistently changing file and directory labels; overriding file system labels with the <command>mount</command> command; mounting NFS file systems; and how to preserve SELinux contexts when copying and archiving files and directories." +msgstr "В следующих разделах приведен краткий обзор главных пакетов SELinux в Fedora; установка и обновление пакетов; показано какие файлы журналов используются; рассмотрен основной конфигурационный файл SELinux; включение и отключение SELinux; режимы SELinux; конфигурирование Булевых значений; временное или перманентное изменение меток файлов и директорий; перекрытие меток файловой системы с помощью команды <command>mount</command>; монтирование файловых систем NFS; а также, как сохранение контекстов SELinux при копировании и архивировании файлов и каталогов."

#. Tag: title #, no-c-format msgid "SELinux Packages" -msgstr "" +msgstr "Пакеты SELinux"

#. Tag: para #, no-c-format -msgid "" -"In Fedora, the SELinux packages are installed by default, unless they are " -"manually excluded during installation. By default, SELinux targeted policy " -"is used, and SELinux runs in enforcing mode. The following is a brief " -"description of the main SELinux packages:" -msgstr "" +msgid "In Fedora, the SELinux packages are installed by default, unless they are manually excluded during installation. By default, SELinux targeted policy is used, and SELinux runs in enforcing mode. The following is a brief description of the main SELinux packages:" +msgstr "В Fedora пакеты SELinux установлены по умолчанию, если они не были вручную исключены из списка инсталляции при установке операционной системы. По умолчанию используется целевая политика targeted, SELinux запущен в принудительном режиме enforcing. Ниже приведено краткое описание основных пакетов SELinux:"

#. Tag: para #, no-c-format -msgid "" -"<package>policycoreutils</package>: provides utilities, such as " -"<command>semanage</command>, <command>restorecon</command>, " -"<command>audit2allow</command>, <command>semodule</command>, " -"<command>load_policy</command>, and <command>setsebool</command>, for " -"operating and managing SELinux." -msgstr "" +msgid "<package>policycoreutils</package>: provides utilities, such as <command>semanage</command>, <command>restorecon</command>, <command>audit2allow</command>, <command>semodule</command>, <command>load_policy</command>, and <command>setsebool</command>, for operating and managing SELinux." +msgstr "<package>policycoreutils</package>: предоставляет утилиты, такие как <command>semanage</command>, <command>restorecon</command>, <command>audit2allow</command>, <command>semodule</command>, <command>load_policy</command> и <command>setsebool</command>, для работы и управления SELinux."

#. Tag: para #, no-c-format -msgid "" -"<package>policycoreutils-gui</package>: provides <command>system-config-" -"selinux</command>, a graphical tool for managing SELinux." -msgstr "" +msgid "<package>policycoreutils-gui</package>: provides <command>system-config-selinux</command>, a graphical tool for managing SELinux." +msgstr "<package>policycoreutils-gui</package>: предоставляет <command>system-config-selinux</command>, графический инструмент для управления SELinux."

#. Tag: para #, no-c-format -msgid "" -"<package>selinux-policy</package>: provides the SELinux Reference Policy. " -"The SELinux Reference Policy is a complete SELinux policy, and is used as a " -"basis for other policies, such as the SELinux targeted policy. Refer to the " -"Tresys Technology <ulink url="http://oss.tresys.com/projects/refpolicy" -"">SELinux Reference Policy</ulink> page for further information. The " -"<package>selinux-policy-devel</package> package provides development tools, " -"such as <command>/usr/share/selinux/devel/policygentool</command> and " -"<command>/usr/share/selinux/devel/policyhelp</command>, as well as example " -"policy files. This package was merged into the <package>selinux-policy</" -"package> package." -msgstr "" +msgid "<package>selinux-policy</package>: provides the SELinux Reference Policy. The SELinux Reference Policy is a complete SELinux policy, and is used as a basis for other policies, such as the SELinux targeted policy. Refer to the Tresys Technology <ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference Policy</ulink> page for further information. The <package>selinux-policy-devel</package> package provides development tools, such as <command>/usr/share/selinux/devel/policygentool</command> and <command>/usr/share/selinux/devel/policyhelp</command>, as well as example policy files. This package was merged into the <package>selinux-policy</package> package." +msgstr "<package>selinux-policy</package>: предоставляет SELinux Refence Policy (Базовую Политику SELinux). SELinux Reference Policy это полная политика SELinux, которая используется как основа для других политик, таких как целевая SELinux targeted. За более подробной информацией можно обратиться к <ulink url="http://oss.tresys.com/projects/refpolicy%5C%22%3ESELinux Reference Policy</ulink> Tresys Technology. Пакет <package>selinux-policy-devel</package> предоставляет средства разработки, такие как <command>/usr/share/selinux/devel/policygentool</command> и <command>/usr/share/selinux/devel/policyhelp</command>, а также примеры политик. Этот пакет входит в состав пакета <package>selinux-policy</package>."

#. Tag: para #, no-c-format -msgid "" -"<package>selinux-policy-<replaceable>policy</replaceable></package>: " -"provides SELinux policies. For targeted policy, install <package>selinux-" -"policy-targeted</package>. For MLS, install <package>selinux-policy-mls</" -"package>. In Fedora 8, the strict policy was merged into targeted policy, " -"allowing confined and unconfined users to co-exist on the same system." -msgstr "" +msgid "<package>selinux-policy-<replaceable>policy</replaceable></package>: provides SELinux policies. For targeted policy, install <package>selinux-policy-targeted</package>. For MLS, install <package>selinux-policy-mls</package>. In Fedora 8, the strict policy was merged into targeted policy, allowing confined and unconfined users to co-exist on the same system." +msgstr "<package>selinux-policy-<replaceable>policy</replaceable></package>: предоставляет политики SELinux. Для политики целевая (targeted), установите <package>selinux-policy-targeted</package>. Для MLS установите <package>selinux-policy-mls</package>. В Fedora 8, политика strict включена в политику targeted, позволяя ограниченным и неограниченным пользователям, сосуществовать в пределах одной системы."

#. Tag: para #, no-c-format -msgid "" -"<package>setroubleshoot-server</package>: translates denial messages, " -"produced when access is denied by SELinux, into detailed descriptions that " -"are viewed with <command>sealert</command> (which is provided by this " -"package)." -msgstr "" +msgid "<package>setroubleshoot-server</package>: translates denial messages, produced when access is denied by SELinux, into detailed descriptions that are viewed with <command>sealert</command> (which is provided by this package)." +msgstr "<package>setroubleshoot-server</package>: расшифровывает сообщения о запретах, вызванных при запретах доступа SELinux, в детальные описания, которые можно просмотреть командой <command>sealert</command> (предоставляемой в этом же пакете)."

#. Tag: para #, no-c-format -msgid "" -"<package>setools</package>, <package>setools-gui</package>, and " -"<package>setools-console</package>: these packages provide the <ulink url=" -""http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools " -"distribution</ulink>, a number of tools and libraries for analyzing and " -"querying policy, audit log monitoring and reporting, and file context " -"management<footnote> <para> Brindle, Joshua. "Re: blurb for fedora setools " -"packages" Email to Murray McAllister. 1 November 2008. Any edits or changes " -"in this version were done by Murray McAllister. </para> </footnote>. The " -"<package>setools</package> package is a meta-package for SETools. The " -"<package>setools-gui</package> package provides the <command>apol</command>, " -"<command>seaudit</command>, and <command>sediffx</command> tools. The " -"<package>setools-console</package> package provides the <command>seaudit-" -"report</command>, <command>sechecker</command>, <command>sediff</command>, " -"<command>seinfo</command>, <command>sesearch</command>, <command>findcon</" -"command>, <command>replcon</command>, and <command>indexcon</command> " -"command line tools. Refer to the <ulink url="http://oss.tresys.com/projects/" -"setools">Tresys Technology SETools</ulink> page for information about these " -"tools." -msgstr "" +msgid "<package>setools</package>, <package>setools-gui</package>, and <package>setools-console</package>: these packages provide the <ulink url="http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools distribution</ulink>, a number of tools and libraries for analyzing and querying policy, audit log monitoring and reporting, and file context management<footnote> <para> Brindle, Joshua. "Re: blurb for fedora setools packages" Email to Murray McAllister. 1 November 2008. Any edits or changes in this version were done by Murray McAllister. </para> </footnote>. The <package>setools</package> package is a meta-package for SETools. The <package>setools-gui</package> package provides the <command>apol</command>, <command>seaudit</command>, and <command>sediffx</command> tools. The <package>setools-console</package> package provides the <command>seaudit-report</command>, <command>sechecker</command>, <command>sediff</command>, <command>seinfo</command>, <command>sesear ch</command>, <command>findcon</command>, <command>replcon</command>, and <command>indexcon</command> command line tools. Refer to the <ulink url="http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools</ulink> page for information about these tools." +msgstr "<package>setools</package>, <package>setools-gui</package>, и <package>setools-console</package>: эти пакеты от <ulink url="http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools distribution</ulink>, предоставляют набор инструментов и библиотек для анализа и просмотра политик, мониторинга журнала аудита и отчетности, а также управления контекстами файлов <footnote> <para> Brindle, Joshua. "Re: blurb for fedora setools packages" Email to Murray McAllister. 1 November 2008. Any edits or changes in this version were done by Murray McAllister. </para> </footnote>. Пакет <package>setools</package> - это мета-пакет инструментария SETools. Пакет <package>setools-gui</package> предоставляет набор инструментов <command>apol</command>, <command>seaudit </command> и <command>sediffx</command>. Пакет <package>setools-console</package> предоставляет утилиты командной строки: <command>seaudit-report</command>, <command>sechecker</command>, <command>sediff</command>, <command>seinfo</command>, <command>sesearch</command>, <command>findcon</command>, <command>replcon</command>, и <command>indexcon</command>. Дополнительная информация по данным утилитам доступна по ссылке: <ulink url="http://oss.tresys.com/projects/setools%5C%22%3ETresys Technology SETools</ulink>."

#. Tag: para #, no-c-format -msgid "" -"<package>libselinux-utils</package>: provides the <command>avcstat</" -"command>, <command>getenforce</command>, <command>getsebool</command>, " -"<command>matchpathcon</command>, <command>selinuxconlist</command>, " -"<command>selinuxdefcon</command>, <command>selinuxenabled</command>, " -"<command>setenforce</command>, <command>togglesebool</command> tools." -msgstr "" +msgid "<package>libselinux-utils</package>: provides the <command>avcstat</command>, <command>getenforce</command>, <command>getsebool</command>, <command>matchpathcon</command>, <command>selinuxconlist</command>, <command>selinuxdefcon</command>, <command>selinuxenabled</command>, <command>setenforce</command>, <command>togglesebool</command> tools." +msgstr "<package>libselinux-utils</package>: предоставляет инструменты <command>avcstat</command>, <command>getenforce</command>, <command>getsebool</command>, <command>matchpathcon</command>, <command>selinuxconlist</command>, <command>selinuxdefcon</command>, <command>selinuxenabled</command>, <command>setenforce</command>, <command>togglesebool</command>."

#. Tag: para #, no-c-format -msgid "" -"<package>mcstrans</package>: translates levels, such as <computeroutput>s0-" -"s0:c0.c1023</computeroutput>, to an easier to read form, such as " -"<computeroutput>SystemLow-SystemHigh</computeroutput>. This package is not " -"installed by default." -msgstr "" +msgid "<package>mcstrans</package>: translates levels, such as <computeroutput>s0-s0:c0.c1023</computeroutput>, to an easier to read form, such as <computeroutput>SystemLow-SystemHigh</computeroutput>. This package is not installed by default." +msgstr "<package>mcstrans</package>: транслирует (переводит) значения уровней, такие как <computeroutput>s0-s0:c0.c1023</computeroutput>, в доступную и легковоспринимаю форму, как <computeroutput>SystemLow-SystemHigh</computeroutput>. Этот пакет не установлен по умолчанию."

#. Tag: para #, no-c-format -msgid "" -"To install packages in Fedora, as the Linux root user, run the <command>yum " -"install <replaceable>package-name</replaceable></command> command. For " -"example, to install the <package>mcstrans</package> package, run the " -"<command>yum install mcstrans</command> command. To upgrade all installed " -"packages in Fedora, run the <command>yum update</command> command." -msgstr "" +msgid "To install packages in Fedora, as the Linux root user, run the <command>yum install <replaceable>package-name</replaceable></command> command. For example, to install the <package>mcstrans</package> package, run the <command>yum install mcstrans</command> command. To upgrade all installed packages in Fedora, run the <command>yum update</command> command." +msgstr "Для установки пакетов в Fedora, от имени root пользователя выполните команду <command>yum install <replaceable>package-name</replaceable></command>. Например для инсталляции пакета <package>mcstrans</package>, выполните команду <command>yum install mcstrans</command>. Для обновления уже установленных пакетов в Fedora, выполните команду <command>yum update</command>."

#. Tag: para #, no-c-format -msgid "" -"Refer to <ulink url="http://docs.fedoraproject.org/yum/en/%5C%22%3EManaging " -"Software with yum</ulink><footnote> <para> Managing Software with yum, " -"written by Stuart Ellis, edited by Paul W. Frields, Rodrigo Menezes, and " -"Hugo Cisneiros. </para> </footnote> for further information about using " -"<command>yum</command> to manage packages." -msgstr "" +msgid "Refer to <ulink url="http://docs.fedoraproject.org/yum/en/%5C%22%3EManaging Software with yum</ulink><footnote> <para> Managing Software with yum, written by Stuart Ellis, edited by Paul W. Frields, Rodrigo Menezes, and Hugo Cisneiros. </para> </footnote> for further information about using <command>yum</command> to manage packages." +msgstr "За полной информацией об использовании менеджера пакетов <command>yum</command> можно обратиться к <ulink url="http://docs.fedoraproject.org/yum/en/%5C%22%3EManaging Software with yum</ulink><footnote> <para> Managing Software with yum, written by Stuart Ellis, edited by Paul W. Frields, Rodrigo Menezes, and Hugo Cisneiros. </para> </footnote>"

#. Tag: para #, no-c-format -msgid "" -"In previous versions of Fedora, the <package>selinux-policy-devel</package> " -"package is required when making a local policy module with " -"<command>audit2allow -M</command>." -msgstr "" +msgid "In previous versions of Fedora, the <package>selinux-policy-devel</package> package is required when making a local policy module with <command>audit2allow -M</command>." +msgstr "В предыдущих версиях Fedora, пакет <package>selinux-policy-devel</package> требовался при сборке модуля локальной политики с помощью команды <command>audit2allow -M</command>."

#. Tag: title #, no-c-format msgid "Which Log File is Used" -msgstr "" +msgstr "Используемые Log-файлы"

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, the <package>dbus</package>, " -"<package>setroubleshoot-server</package> and <package>audit</package> " -"packages are installed if packages are not removed from the default package " -"selection." -msgstr "" +msgid "In Fedora&nbsp;&PRODVER;, the <package>dbus</package>, <package>setroubleshoot-server</package> and <package>audit</package> packages are installed if packages are not removed from the default package selection." +msgstr "В Fedora&nbsp;&PRODVER;, пакеты <package>dbus</package>, <package>setroubleshoot-server</package> и <package>audit</package> устанавливаются по умолчанию, если они не были исключены из списка инсталляции при установке."

#. Tag: para #, no-c-format -msgid "" -"SELinux denial messages, such as the following, are written to <filename>/" -"var/log/audit/audit.log</filename> by default:" -msgstr "" +msgid "SELinux denial messages, such as the following, are written to <filename>/var/log/audit/audit.log</filename> by default:" +msgstr "Сообщения о запретах доступа SELinux, приведенные ниже, записываются в <filename>/var/log/audit/audit.log</filename> по умолчанию:"

#. Tag: para #, no-c-format -msgid "" -"Also, if <systemitem class="daemon">setroubleshootd</systemitem> is " -"running, denial messages from <filename>/var/log/audit/audit.log</filename> " -"are translated to an easier-to-read form and sent to <filename>/var/log/" -"messages</filename>:" -msgstr "" +msgid "Also, if <systemitem class="daemon">setroubleshootd</systemitem> is running, denial messages from <filename>/var/log/audit/audit.log</filename> are translated to an easier-to-read form and sent to <filename>/var/log/messages</filename>:" +msgstr "Также, если <systemitem class="daemon">setroubleshootd</systemitem> запущен, а он запускается по умолчанию, то сообщения об отказах в доступе из <filename>/var/log/audit/audit.log</filename> переводятся в свободно-читаемую доступную форму и направляются в <filename>/var/log/messages</filename>:"

#. Tag: para #, no-c-format -msgid "" -"In Fedora&nbsp;&PRODVER;, <systemitem class="daemon">setroubleshootd</" -"systemitem> no longer constantly runs as a service, however it is still used " -"to analyze the AVC messages. Two new programs act as a method to start " -"setroubleshoot when needed: <systemitem class="daemon">sedispatch</" -"systemitem> and <systemitem class="daemon">seapplet</systemitem>. " -"<systemitem class="daemon">sedispatch</systemitem> runs as part of the " -"audit subsystem, and via <systemitem class="daemon">dbus</systemitem>, " -"sends a message when an AVC denial occurs, which will go straight to " -"<systemitem class="daemon">setroubleshootd</systemitem> if it is already " -"running, or it will start <systemitem class="daemon">setroubleshootd</" -"systemitem> if it is not running. <systemitem class="daemon">seapplet</" -"systemitem> is a tool which runs in the system's toolbar, waiting for dbus " -"messages in <systemitem class="daemon">setroubleshootd</systemitem>, and " -"will launch the notification bubble, allowing the user to review the denial." -msgstr "" +msgid "In Fedora&nbsp;&PRODVER;, <systemitem class="daemon">setroubleshootd</systemitem> no longer constantly runs as a service, however it is still used to analyze the AVC messages. Two new programs act as a method to start setroubleshoot when needed: <systemitem class="daemon">sedispatch</systemitem> and <systemitem class="daemon">seapplet</systemitem>. <systemitem class="daemon">sedispatch</systemitem> runs as part of the audit subsystem, and via <systemitem class="daemon">dbus</systemitem>, sends a message when an AVC denial occurs, which will go straight to <systemitem class="daemon">setroubleshootd</systemitem> if it is already running, or it will start <systemitem class="daemon">setroubleshootd</systemitem> if it is not running. <systemitem class="daemon">seapplet</systemitem> is a tool which runs in the system's toolbar, waiting for dbus messages in <systemitem class="daemon">setroubleshootd</systemitem>, and will launch the notification bubble, all owing the user to review the denial." +msgstr "В Fedora&nbsp;&PRODVER;, <systemitem class="daemon">setroubleshootd</systemitem> больше не запущен в постоянном режиме в качестве службы, однако он до сих пор исользуется для анализа AVC сообщений. Две новых программ используются как метод запуска setroubleshoot при необходимости: <systemitem class="daemon">sedispatch</systemitem> и <systemitem class="daemon">seapplet</systemitem>. <systemitem class="daemon">sedispatch</systemitem> работает как часть подсистемы аудита и через <systemitem class="daemon">dbus</systemitem>, посылает сообщение, когда отказ AVC обнаружен, который передаётся напрямую в <systemitem class="daemon">setroubleshootd</systemitem>, если последний запущен или за пускает <systemitem class="daemon">setroubleshootd</systemitem> если он не запущен. <systemitem class="daemon">seapplet</systemitem> - это инструмент. который работает в системной панели, ждёт сообщений от dbus к <systemitem class="daemon">setroubleshootd</systemitem>, и вызывает иконку оповещение, позволяющую пользователю просмотреть сообщение с отказом."

#. Tag: para #, no-c-format -msgid "" -"Denial messages are sent to a different location, depending on which daemons " -"are running:" -msgstr "" +msgid "Denial messages are sent to a different location, depending on which daemons are running:" +msgstr "Сообщения о запретах отправляются в различные расположения файлов, в зависимости от того, какие демоны запущены:"

#. Tag: segtitle #, no-c-format msgid "Daemon" -msgstr "" +msgstr "Демон"

#. Tag: segtitle #, no-c-format msgid "Log Location" -msgstr "" +msgstr "Расположение журналов"

#. Tag: seg #, no-c-format msgid "auditd on" -msgstr "" +msgstr "auditd on"

#. Tag: seg #, no-c-format msgid "<filename>/var/log/audit/audit.log</filename>" -msgstr "" +msgstr "<filename>/var/log/audit/audit.log</filename>"

#. Tag: seg #, no-c-format msgid "auditd off; rsyslogd on" -msgstr "" +msgstr "auditd off; rsyslogd on"

#. Tag: seg #, no-c-format msgid "<filename>/var/log/messages</filename>" -msgstr "" +msgstr "<filename>/var/log/messages</filename>"

#. Tag: seg #, no-c-format msgid "rsyslogd and auditd on" -msgstr "" +msgstr "rsyslogd and auditd on"

#. Tag: seg #, no-c-format -msgid "" -"<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial " -"messages also sent to <filename>/var/log/messages</filename>" -msgstr "" +msgid "<filename>/var/log/audit/audit.log</filename>. Easier-to-read denial messages also sent to <filename>/var/log/messages</filename>" +msgstr "<filename>/var/log/audit/audit.log</filename>. Сообщения о запретах в свободно-читаемой и доступной форме направляются в <filename>/var/log/messages</filename>"

#. Tag: title #, no-c-format msgid "Starting Daemons Automatically" -msgstr "" +msgstr "Автоматический запуск демонов"

#. Tag: para #, no-c-format -msgid "" -"To configure the <systemitem class="daemon">auditd</systemitem>, " -"<systemitem class="daemon">rsyslogd</systemitem>, and <systemitem class=" -""daemon">setroubleshootd</systemitem> daemons to automatically start at " -"boot, run the following commands as the Linux root user:" -msgstr "" +msgid "To configure the <systemitem class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</systemitem>, and <systemitem class="daemon">setroubleshootd</systemitem> daemons to automatically start at boot, run the following commands as the Linux root user:" +msgstr "Для конфигурирования автоматического запуска демонов <systemitem class="daemon">auditd</systemitem>, <systemitem class="daemon">rsyslogd</systemitem>, и <systemitem class="daemon">setroubleshootd</systemitem> при загрузке системы, необходимо выполнить следующие команды от пользователя root:"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>service <replaceable>service-name</replaceable> status</" -"command> command to check if these services are running, for example:" -msgstr "" +msgid "Use the <command>service <replaceable>service-name</replaceable> status</command> command to check if these services are running, for example:" +msgstr "Используйте команду <command>service <replaceable>service-name</replaceable> status</command> для проверки запущены ли данные службы, например:"

#. Tag: para #, no-c-format -msgid "" -"If the above services are not running (<computeroutput><replaceable>service-" -"name</replaceable> is stopped</computeroutput>), use the <command>service " -"<replaceable>service-name</replaceable> start</command> command as the Linux " -"root user to start them. For example:" -msgstr "" +msgid "If the above services are not running (<computeroutput><replaceable>service-name</replaceable> is stopped</computeroutput>), use the <command>service <replaceable>service-name</replaceable> start</command> command as the Linux root user to start them. For example:" +msgstr "Если службы не запущены (<computeroutput><replaceable>service-name</replaceable> is stopped</computeroutput>), используйте команду <command>service <replaceable>service-name</replaceable> start</command> от имени пользователя root для того, чтобы запустить их. Например:"

#. Tag: title #, no-c-format msgid "Main Configuration File" -msgstr "" +msgstr "Основной конфигурационный файл"

#. Tag: para #, no-c-format -msgid "" -"The <filename>/etc/selinux/config</filename> file is the main SELinux " -"configuration file. It controls the SELinux mode and the SELinux policy to " -"use:" -msgstr "" +msgid "The <filename>/etc/selinux/config</filename> file is the main SELinux configuration file. It controls the SELinux mode and the SELinux policy to use:" +msgstr "Файл <filename>/etc/selinux/config</filename> - это основной главный конфигурационный файл SELinux. Он определяет режим SELinux и используемую политику SELinux:"

#. Tag: term #, no-c-format msgid "<computeroutput>SELINUX=enforcing</computeroutput>" -msgstr "" +msgstr "<computeroutput>SELINUX=enforcing</computeroutput>"

#. Tag: para #, no-c-format -msgid "" -"The <option>SELINUX</option> option sets the mode SELinux runs in. SELinux " -"has three modes: enforcing, permissive, and disabled. When using enforcing " -"mode, SELinux policy is enforced, and SELinux denies access based on SELinux " -"policy rules. Denial messages are logged. When using permissive mode, " -"SELinux policy is not enforced. SELinux does not deny access, but denials " -"are logged for actions that would have been denied if running SELinux in " -"enforcing mode. When using disabled mode, SELinux is disabled (the SELinux " -"module is not registered with the Linux kernel), and only DAC rules are used." -msgstr "" +msgid "The <option>SELINUX</option> option sets the mode SELinux runs in. SELinux has three modes: enforcing, permissive, and disabled. When using enforcing mode, SELinux policy is enforced, and SELinux denies access based on SELinux policy rules. Denial messages are logged. When using permissive mode, SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running SELinux in enforcing mode. When using disabled mode, SELinux is disabled (the SELinux module is not registered with the Linux kernel), and only DAC rules are used." +msgstr "Опция <option>SELINUX</option> устанавливает режим, в котором запущен SELinux. SELinux запускается в трех режимах: enforcing, permissive, и disabled. Когда используется режим enforcing, политика SELinux включена принудительно и SELinux запрещает доступ, основываясь на правилах политики SELinux. Сообщения о запретах доступа журналируются. Когда используется режим permissive, политика SELinux в разрешитиельном режиме. SELinux не отказывает в доступе, но отказы журналируются как действия, которые были бы заблокированы, если SELinux запустить в режиме enforcing. Когда используется режим disabled, SELinux от� �лючен (модуль SELinux не загружается с ядром Linux), и используются только DAC правила контроля доступа."

#. Tag: term #, no-c-format msgid "<computeroutput>SELINUXTYPE=targeted</computeroutput>" -msgstr "" +msgstr "<computeroutput>SELINUXTYPE=targeted</computeroutput>"

#. Tag: para #, no-c-format -msgid "" -"The <option>SELINUXTYPE</option> option sets the SELinux policy to use. " -"Targeted policy is the default policy. Only change this option if you want " -"to use the MLS policy. To use the MLS policy, install the <package>selinux-" -"policy-mls</package> package; configure <option>SELINUXTYPE=mls</option> in " -"<filename>/etc/selinux/config</filename>; and reboot your system." -msgstr "" +msgid "The <option>SELINUXTYPE</option> option sets the SELinux policy to use. Targeted policy is the default policy. Only change this option if you want to use the MLS policy. To use the MLS policy, install the <package>selinux-policy-mls</package> package; configure <option>SELINUXTYPE=mls</option> in <filename>/etc/selinux/config</filename>; and reboot your system." +msgstr "Опция <option>SELINUXTYPE</option> устанавливает политику используемую SELinux. Политика targeted используется по умолчанию. Эта опция изменяется только в том случае, если необходимо использовать политику MLS. Для того, чтобы использовать политику MLS, установите пакет <package>selinux-policy-mls</package>; установите опцию <option>SELINUXTYPE=mls</option> в файле <filename>/etc/selinux/config</filename>; и перезагрузите операционную систему."

#. Tag: para #, no-c-format -msgid "" -"When systems run with SELinux in permissive or disabled mode, users have " -"permission to label files incorrectly. Also, files created while SELinux is " -"disabled are not labeled. This causes problems when changing to enforcing " -"mode. To prevent incorrectly labeled and unlabeled files from causing " -"problems, file systems are automatically relabeled when changing from " -"disabled mode to permissive or enforcing mode." -msgstr "" +msgid "When systems run with SELinux in permissive or disabled mode, users have permission to label files incorrectly. Also, files created while SELinux is disabled are not labeled. This causes problems when changing to enforcing mode. To prevent incorrectly labeled and unlabeled files from causing problems, file systems are automatically relabeled when changing from disabled mode to permissive or enforcing mode." +msgstr "Когда система запущена с SELinux в режиме permissive или disabled, у пользователей есть права некорректно маркировать файлы. Также, файлы созданные во время того, как SELinux отключен, не маркируются. Это вызывает проблемы, когда режим переводится в состояние enforcing. Для того, чтобы предотвратить некорректную маркировку или появление немаркированных файлов, файловые системы автоматически перемаркируются при изменению с disabled на permissive или enforcing режим."

#. Tag: title #, no-c-format msgid "Enabling and Disabling SELinux" -msgstr "" +msgstr "Включение и Отключение SELinux"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/usr/sbin/getenforce</command> or <command>/usr/sbin/" -"sestatus</command> commands to check the status of SELinux. The " -"<command>getenforce</command> command returns <computeroutput>Enforcing</" -"computeroutput>, <computeroutput>Permissive</computeroutput>, or " -"<computeroutput>Disabled</computeroutput>. The <command>getenforce</command> " -"command returns <computeroutput>Enforcing</computeroutput> when SELinux is " -"enabled (SELinux policy rules are enforced):" -msgstr "" +msgid "Use the <command>/usr/sbin/getenforce</command> or <command>/usr/sbin/sestatus</command> commands to check the status of SELinux. The <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput>, <computeroutput>Permissive</computeroutput>, or <computeroutput>Disabled</computeroutput>. The <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput> when SELinux is enabled (SELinux policy rules are enforced):" +msgstr "Команды <command>/usr/sbin/getenforce</command> или <command>/usr/sbin/sestatus</command> используются для проверки статуса SELinux. Команда <command>getenforce</command> возвращает значение <computeroutput>Enforcing</computeroutput>, <computeroutput>Permissive</computeroutput>, или <computeroutput>Disabled</computeroutput>. Команда <command>getenforce</command> возвращает <computeroutput>Enforcing</computeroutput> когда SELinux активирован (правила политики SELinux принудительные):"

#. Tag: para #, no-c-format -msgid "" -"The <command>getenforce</command> command returns " -"<computeroutput>Permissive</computeroutput> when SELinux is enabled, but " -"SELinux policy rules are not enforced, and only DAC rules are used. The " -"<command>getenforce</command> command returns <computeroutput>Disabled</" -"computeroutput> if SELinux is disabled." -msgstr "" +msgid "The <command>getenforce</command> command returns <computeroutput>Permissive</computeroutput> when SELinux is enabled, but SELinux policy rules are not enforced, and only DAC rules are used. The <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput> if SELinux is disabled." +msgstr "Команда <command>getenforce</command> возвращает <computeroutput>Permissive</computeroutput> когда SELinux активирован, но правила политики SELinux не принудительные enforced, и используются только правила DAC. Команда <command>getenforce</command> возвращает <computeroutput>Disabled</computeroutput>, если SELinux отключен."

#. Tag: para #, no-c-format -msgid "" -"The <command>sestatus</command> command returns the SELinux status and the " -"SELinux policy being used:" -msgstr "" +msgid "The <command>sestatus</command> command returns the SELinux status and the SELinux policy being used:" +msgstr "Команда <command>sestatus</command> возвращает статус SELinux и используемой политики SELinux:"

#. Tag: para #, no-c-format -msgid "" -"<computeroutput>SELinux status: enabled</computeroutput> is returned when " -"SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> " -"is returned when SELinux is running in enforcing mode. " -"<computeroutput>Policy from config file: targeted</computeroutput> is " -"returned when the SELinux targeted policy is used." -msgstr "" +msgid "<computeroutput>SELinux status: enabled</computeroutput> is returned when SELinux is enabled. <computeroutput>Current mode: enforcing</computeroutput> is returned when SELinux is running in enforcing mode. <computeroutput>Policy from config file: targeted</computeroutput> is returned when the SELinux targeted policy is used." +msgstr "Значение <computeroutput>SELinux status: enabled</computeroutput> возвращается, когда SELinux включен. <computeroutput>Current mode: enforcing</computeroutput> возвращается, когда SELinux включен в принудительном enforced режиме. <computeroutput>Policy from config file: targeted</computeroutput> возвраещается, когда используется политика SELinux targeted."

#. Tag: title #, no-c-format msgid "Enabling SELinux" -msgstr "" +msgstr "Включение SELinux"

#. Tag: para #, no-c-format -msgid "" -"On systems with SELinux disabled, the <computeroutput>SELINUX=disabled</" -"computeroutput> option is configured in <filename>/etc/selinux/config</" -"filename>:" -msgstr "" +msgid "On systems with SELinux disabled, the <computeroutput>SELINUX=disabled</computeroutput> option is configured in <filename>/etc/selinux/config</filename>:" +msgstr "В операционных системах с отключенным SELinux, сконфигурирована опция <computeroutput>SELINUX=disabled</computeroutput> в <filename>/etc/selinux/config</filename>:"

#. Tag: para #, no-c-format -msgid "" -"Also, the <command>getenforce</command> command returns " -"<computeroutput>Disabled</computeroutput>:" -msgstr "" +msgid "Also, the <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput>:" +msgstr "Также, команда <command>getenforce</command> возвращает значение <computeroutput>Disabled</computeroutput>:"

#. Tag: para #, no-c-format msgid "To enable SELinux:" -msgstr "" +msgstr "Для включения SELinux:"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>rpm -qa | grep selinux</command>, <command>rpm -q " -"policycoreutils</command>, and <command>rpm -qa | grep setroubleshoot</" -"command> commands to confirm that the SELinux packages are installed. This " -"guide assumes the following packages are installed: <package>selinux-policy-" -"targeted</package>, <package>selinux-policy</package>, <package>libselinux</" -"package>, <package>libselinux-python</package>, <package>libselinux-utils</" -"package>, <package>policycoreutils</package>, <package>setroubleshoot</" -"package>, <package>setroubleshoot-server</package>, <package>setroubleshoot-" -"plugins</package>. If these packages are not installed, as the Linux root " -"user, install them via the <command>yum install <replaceable>package-name</" -"replaceable></command> command. The following packages are optional: " -"<package>policycoreutils-gui</package>, <package>setroubleshoot</package>, " -"<package>selinux-policy-devel</package>, and <package>mcstrans</package>." -msgstr "" +msgid "Use the <command>rpm -qa | grep selinux</command>, <command>rpm -q policycoreutils</command>, and <command>rpm -qa | grep setroubleshoot</command> commands to confirm that the SELinux packages are installed. This guide assumes the following packages are installed: <package>selinux-policy-targeted</package>, <package>selinux-policy</package>, <package>libselinux</package>, <package>libselinux-python</package>, <package>libselinux-utils</package>, <package>policycoreutils</package>, <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>setroubleshoot-plugins</package>. If these packages are not installed, as the Linux root user, install them via the <command>yum install <replaceable>package-name</replaceable></command> command. The following packages are optional: <package>policycoreutils-gui</package>, <package>setroubleshoot</package>, <package>selinux-policy-devel</package>, and <package>mcstrans</package>." +msgstr "Используйте команду <command>rpm -qa | grep selinux</command>, <command>rpm -q policycoreutils</command>, и <command>rpm -qa | grep setroubleshoot</command> для проверки инсталляции пакетов SELinux. Это руководство предполагает, что инсталлированы следующие пакеты: <package>selinux-policy-targeted</package>, <package>selinux-policy</package>, <package>libselinux</package>, <package>libselinux-python</package>, <package>libselinux-utils</package>, <package>policycoreutils</package>, <package>setroubleshoot</package>, <package>setroubleshoot-server</package>, <package>setroubleshoot-plugins</package>. Если эти пакеты не установлены, установите их от имени пользователя root с помощью команды <command>yum install <replaceable>package-name</replaceable></command>. Следующие пакеты опциональны: <package>policycoreutils-gui</package>, <package>setroubleshoot</package>, <package>selinux-policy-devel</package>, и <package>mcstrans</package>."

#. Tag: para #, no-c-format -msgid "" -"Before SELinux is enabled, each file on the file system must be labeled with " -"an SELinux context. Before this happens, confined domains may be denied " -"access, preventing your system from booting correctly. To prevent this, " -"configure <computeroutput>SELINUX=permissive</computeroutput> in <filename>/" -"etc/selinux/config</filename>:" -msgstr "" +msgid "Before SELinux is enabled, each file on the file system must be labeled with an SELinux context. Before this happens, confined domains may be denied access, preventing your system from booting correctly. To prevent this, configure <computeroutput>SELINUX=permissive</computeroutput> in <filename>/etc/selinux/config</filename>:" +msgstr "Перед тем, как SELinux включится, каждый файл файловой системы должен быть промаркирован контекстом SELinux. До того, как это произойдёт, ограниченным доменам может быть отказано в доступе, что приведёт к некорректной загрузке операционной системы. Для того , чтобы не допустить этого, сконфигурируйте <computeroutput>SELINUX=permissive</computeroutput> в файле <filename>/etc/selinux/config</filename>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>reboot</command> command to restart " -"the system. During the next boot, file systems are labeled. The label " -"process labels all files with an SELinux context:" -msgstr "" +msgid "As the Linux root user, run the <command>reboot</command> command to restart the system. During the next boot, file systems are labeled. The label process labels all files with an SELinux context:" +msgstr "От имени пользователя root, выполните команду <command>reboot</command> для перезагрузки операционной системы. Во время следующей загрузки файловые системы будут промаркированы. Процесс маркирования расставляет метки для всех файлов в контексте SELinux:"

#. Tag: para #, no-c-format -msgid "" -"Each <computeroutput>*</computeroutput> character on the bottom line " -"represents 1000 files that have been labeled. In the above example, four " -"<computeroutput>*</computeroutput> characters represent 4000 files have been " -"labeled. The time it takes to label all files depends upon the number of " -"files on the system, and the speed of the hard disk drives. On modern " -"systems, this process can take as little as 10 minutes." -msgstr "" +msgid "Each <computeroutput>*</computeroutput> character on the bottom line represents 1000 files that have been labeled. In the above example, four <computeroutput>*</computeroutput> characters represent 4000 files have been labeled. The time it takes to label all files depends upon the number of files on the system, and the speed of the hard disk drives. On modern systems, this process can take as little as 10 minutes." +msgstr "Каждый символ <computeroutput>*</computeroutput> в последней строке обозначает 1000 файлов, которые были промаркированы. В примере, приведенном выше, четыре символа <computeroutput>*</computeroutput> означают, что 4000 файлов были промаркированы. Общее время маркирования всех файлов зависит от общего количества файлов и скорости жёстких дисков. На современных системах, этот процесс занимает чуть меньше 10 минут."

#. Tag: para #, no-c-format -msgid "" -"In permissive mode, SELinux policy is not enforced, but denials are still " -"logged for actions that would have been denied if running in enforcing mode. " -"Before changing to enforcing mode, as the Linux root user, run the " -"<command>grep "SELinux is preventing" /var/log/messages</command> command " -"as the Linux root user to confirm that SELinux did not deny actions during " -"the last boot. If SELinux did not deny actions during the last boot, this " -"command does not return any output. Refer to <xref linkend="chap-Security-" -"Enhanced_Linux-Troubleshooting" /> for troubleshooting information if " -"SELinux denied access during boot." -msgstr "" +msgid "In permissive mode, SELinux policy is not enforced, but denials are still logged for actions that would have been denied if running in enforcing mode. Before changing to enforcing mode, as the Linux root user, run the <command>grep "SELinux is preventing" /var/log/messages</command> command as the Linux root user to confirm that SELinux did not deny actions during the last boot. If SELinux did not deny actions during the last boot, this command does not return any output. Refer to <xref linkend="chap-Security-Enhanced_Linux-Troubleshooting" /> for troubleshooting information if SELinux denied access during boot." +msgstr "В разрешительном режиме, политика SELinux принудительно не назначена, но запреты журналируются как действия, которые были бы запрещены в принудительном режиме. Перед тем как перейти в принудительный режим, от имени пользователя root выполните команду <command>grep "SELinux is preventing" /var/log/messages</command>, для того, чтобы убедиться, что SELinux не запрещает действия во время последний загрузки. Если SELinux не запреащает действия во время последней загрузки, то данная команда не вернёт никакого вывода. В соотвстетствии с <xref linkend="chap-Security-Enhanced_Linux-Troubleshooting"/> инф� �рмацией о поиске и устранении проблем, в случае, если SELinux запрещает доступ в процессе загрузки."

#. Tag: para #, no-c-format -msgid "" -"If there were no denial messages in <filename>/var/log/messages</filename>, " -"configure <computeroutput>SELINUX=enforcing</computeroutput> in <filename>/" -"etc/selinux/config</filename>:" -msgstr "" +msgid "If there were no denial messages in <filename>/var/log/messages</filename>, configure <computeroutput>SELINUX=enforcing</computeroutput> in <filename>/etc/selinux/config</filename>:" +msgstr "Если не обнаружено сообщений о запретах в <filename>/var/log/messages</filename>, то сконфигурируйте <computeroutput>SELINUX=enforcing</computeroutput> в <filename>/etc/selinux/config</filename>:"

#. Tag: para #, no-c-format -msgid "" -"Reboot your system. After reboot, confirm that the <command>getenforce</" -"command> command returns <computeroutput>Enforcing</computeroutput>:" -msgstr "" +msgid "Reboot your system. After reboot, confirm that the <command>getenforce</command> command returns <computeroutput>Enforcing</computeroutput>:" +msgstr "Перезагрузите операционную систему. После перезагрузки, удостоверьтесь, что команда <command>getenforce</command> возвращает значение <computeroutput>Enforcing</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage login -l</" -"command> command to view the mapping between SELinux and Linux users. The " -"output should be as follows:" -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage login -l</command> command to view the mapping between SELinux and Linux users. The output should be as follows:" +msgstr "От имени пользователя root, выполните команду <command>/usr/sbin/semanage login -l</command> для просмотра отображений между SELinux и пользователями Linux. Вывод команды должен быть такой, как показано ниже:"

#. Tag: para #, no-c-format -msgid "" -"If this is not the case, run the following commands as the Linux root user " -"to fix the user mappings. It is safe to ignore the <computeroutput>SELinux-" -"user<replaceable> username</replaceable> is already defined</computeroutput> " -"warnings if they occur, where <replaceable>username</replaceable> can be " -"<computeroutput>unconfined_u</computeroutput>, <computeroutput>guest_u</" -"computeroutput>, or <computeroutput>xguest_u</computeroutput>:" -msgstr "" +msgid "If this is not the case, run the following commands as the Linux root user to fix the user mappings. It is safe to ignore the <computeroutput>SELinux-user<replaceable> username</replaceable> is already defined</computeroutput> warnings if they occur, where <replaceable>username</replaceable> can be <computeroutput>unconfined_u</computeroutput>, <computeroutput>guest_u</computeroutput>, or <computeroutput>xguest_u</computeroutput>:" +msgstr "Если это не так, то выполните команду от root пользователя для исправления ошибок в отображениях пользователей. Безопаснее проигнорировать предупреждения <computeroutput>SELinux-user<replaceable> username</replaceable> is already defined</computeroutput>, если они появляются, где <replaceable>username</replaceable> может быть <computeroutput>unconfined_u</computeroutput>, <computeroutput>guest_u</computeroutput>, или <computeroutput>xguest_u</computeroutput>:"

#. Tag: title #, no-c-format msgid "Disabling SELinux" -msgstr "" +msgstr "Отключение SELinux"

#. Tag: para #, no-c-format -msgid "" -"To disable SELinux, configure <option>SELINUX=disabled</option> in " -"<filename>/etc/selinux/config</filename>:" -msgstr "" +msgid "To disable SELinux, configure <option>SELINUX=disabled</option> in <filename>/etc/selinux/config</filename>:" +msgstr "Для отключения SELinux, сконфигурируйте <option>SELINUX=disabled</option> в <filename>/etc/selinux/config</filename>:"

#. Tag: para #, no-c-format -msgid "" -"Reboot your system. After reboot, confirm that the <command>getenforce</" -"command> command returns <computeroutput>Disabled</computeroutput>:" -msgstr "" +msgid "Reboot your system. After reboot, confirm that the <command>getenforce</command> command returns <computeroutput>Disabled</computeroutput>:" +msgstr "Перезагрузите операционную систему. После перезагрузки убедитесь, что команда <command>getenforce</command> возвращает значение <computeroutput>Disabled</computeroutput>:"

#. Tag: title #, no-c-format msgid "SELinux Modes" -msgstr "" +msgstr "Режимы SELinux"

#. Tag: para #, no-c-format msgid "SELinux has three modes:" -msgstr "" +msgstr "Существует три режима SELinux:"

#. Tag: para #, no-c-format -msgid "" -"Enforcing: SELinux policy is enforced. SELinux denies access based on " -"SELinux policy rules." -msgstr "" +msgid "Enforcing: SELinux policy is enforced. SELinux denies access based on SELinux policy rules." +msgstr "Принудительный (Enforcing): политика SELinux включена принудительно. SELinux запрещает доступ, основываясь на правилах политики SELinux."

#. Tag: para #, no-c-format -msgid "" -"Permissive: SELinux policy is not enforced. SELinux does not deny access, " -"but denials are logged for actions that would have been denied if running in " -"enforcing mode." -msgstr "" +msgid "Permissive: SELinux policy is not enforced. SELinux does not deny access, but denials are logged for actions that would have been denied if running in enforcing mode." +msgstr "Разрешающий: политика SELinux не принудительна. SELinux не запрещает доступ, но запреты журнлируются как действия, которые были бы запрещены, если переключить политику в принудительный режим."

#. Tag: para #, no-c-format msgid "Disabled: SELinux is disabled. Only DAC rules are used." -msgstr "" +msgstr "Disabled: SELinux отключен. Используются только дискретные правила DAC."

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/usr/sbin/setenforce</command> command to change between " -"enforcing and permissive mode. Changes made with <command>/usr/sbin/" -"setenforce</command> do not persist across reboots. To change to enforcing " -"mode, as the Linux root user, run the <command>/usr/sbin/setenforce 1</" -"command> command. To change to permissive mode, run the <command>/usr/sbin/" -"setenforce 0</command> command. Use the <command>/usr/sbin/getenforce</" -"command> command to view the current SELinux mode." -msgstr "" +msgid "Use the <command>/usr/sbin/setenforce</command> command to change between enforcing and permissive mode. Changes made with <command>/usr/sbin/setenforce</command> do not persist across reboots. To change to enforcing mode, as the Linux root user, run the <command>/usr/sbin/setenforce 1</command> command. To change to permissive mode, run the <command>/usr/sbin/setenforce 0</command> command. Use the <command>/usr/sbin/getenforce</command> command to view the current SELinux mode." +msgstr "Команда <command>/usr/sbin/setenforce</command> используется для перехода между принудительным (enforcing) и разрешающим (permissive) режимами. Изменения внесённые командой <command>/usr/sbin/setenforce</command> не сохраняются после перезагрузки. Для перехода в принудительным режим выполните от имени root пользователя команду <command>/usr/sbin/setenforce 1</command>. Для перехода в резрешающий режим выполните команду <command>/usr/sbin/setenforce 0</command>. Команда <command>/usr/sbin/getenforce</command> используется для просмотра текущего режима SELinux."

#. Tag: para #, no-c-format -msgid "" -"Persistent mode changes are covered in <xref linkend="sect-Security-" -"Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux" />." -msgstr "" +msgid "Persistent mode changes are covered in <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux" />." +msgstr "Постоянные значения режимов перечислены в <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux"/>."

#. Tag: title #, no-c-format msgid "Booleans" -msgstr "" +msgstr "Булевые значения (Переключатели)"

#. Tag: para #, no-c-format -msgid "" -"Booleans allow parts of SELinux policy to be changed at runtime, without any " -"knowledge of SELinux policy writing. This allows changes, such as allowing " -"services access to NFS file systems, without reloading or recompiling " -"SELinux policy." -msgstr "" +msgid "Booleans allow parts of SELinux policy to be changed at runtime, without any knowledge of SELinux policy writing. This allows changes, such as allowing services access to NFS file systems, without reloading or recompiling SELinux policy." +msgstr "Переключатели позволяют изменять части политики SELinux во время работы (без перезапуска и остановки), не обладая глубоким пониманием создания политики SELinux. Это позволяет вносить изменения, такие как: разрешение доступа службам к файловым системам NFS, без перезагрузки или рекомпиляции политики SELinux."

#. Tag: title #, no-c-format msgid "Listing Booleans" -msgstr "" +msgstr "Список Переключателей"

#. Tag: para #, no-c-format -msgid "" -"For a list of Booleans, an explanation of what each one is, and whether they " -"are on or off, run the <command>semanage boolean -l</command> command as the " -"Linux root user. The following example does not list all Booleans:" -msgstr "" +msgid "For a list of Booleans, an explanation of what each one is, and whether they are on or off, run the <command>semanage boolean -l</command> command as the Linux root user. The following example does not list all Booleans:" +msgstr "Для получения списка переключателей, объяснения, за что отвечает каждый переключатель, включен или выключен, необходимо выполнить команду <command>semanage boolean -l</command> от имени пользователя root. В примере, показанном ниже, показаны не все переключатели:"

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>SELinux boolean</computeroutput> column lists Boolean " -"names. The <computeroutput>Description</computeroutput> column lists whether " -"the Booleans are on or off, and what they do." -msgstr "" +msgid "The <computeroutput>SELinux boolean</computeroutput> column lists Boolean names. The <computeroutput>Description</computeroutput> column lists whether the Booleans are on or off, and what they do." +msgstr "Столбец <computeroutput>SELinux boolean</computeroutput> содержит названия Булевых переключателей. Столбец <computeroutput>Description</computeroutput> содержит статус выключено или выключено (on или off) и действие, за которое отвечает переключатель."

#. Tag: para #, no-c-format -msgid "" -"In the following example, the <computeroutput>ftp_home_dir</computeroutput> " -"Boolean is off, preventing the FTP daemon (<systemitem class="daemon" -"">vsftpd</systemitem>) from reading and writing to files in user home " -"directories:" -msgstr "" +msgid "In the following example, the <computeroutput>ftp_home_dir</computeroutput> Boolean is off, preventing the FTP daemon (<systemitem class="daemon">vsftpd</systemitem>) from reading and writing to files in user home directories:" +msgstr "В следующем примере переключатель <computeroutput>ftp_home_dir</computeroutput> отключен, блокирует демона FTP (<systemitem class="daemon">vsftpd</systemitem>) на чтение и запись в файлы в домашних каталогах пользователей:"

#. Tag: para #, no-c-format -msgid "" -"The <command>getsebool -a</command> command lists Booleans, whether they are " -"on or off, but does not give a description of each one. The following " -"example does not list all Booleans:" -msgstr "" +msgid "The <command>getsebool -a</command> command lists Booleans, whether they are on or off, but does not give a description of each one. The following example does not list all Booleans:" +msgstr "Команда <command>getsebool -a</command> выводит список переключателей, показывает выключены они или нет, но не даёт описания, за что они отвечают. В следующем примере перечислены не все переключатели:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>getsebool <replaceable>boolean-name</replaceable></command> " -"command to only list the status of the <replaceable>boolean-name</" -"replaceable> Boolean:" -msgstr "" +msgid "Run the <command>getsebool <replaceable>boolean-name</replaceable></command> command to only list the status of the <replaceable>boolean-name</replaceable> Boolean:" +msgstr "Для получения статуса одного конкретного Булева значения (переключателя) <replaceable>boolean-name</replaceable> используется команда <command>getsebool <replaceable>boolean-name</replaceable></command> "

#. Tag: para #, no-c-format msgid "Use a space-separated list to list multiple Booleans:" -msgstr "" +msgstr "Для вывода значения множества Булевых значений используется список разделенный пробелами:"

#. Tag: title #, no-c-format msgid "Configuring Booleans" -msgstr "" +msgstr "Конфигурирование Переключателей"

#. Tag: para #, no-c-format -msgid "" -"The <command>setsebool <replaceable>boolean-name</replaceable> " -"<replaceable>x</replaceable></command> command turns Booleans on or off, " -"where <replaceable>boolean-name</replaceable> is a Boolean name, and " -"<replaceable>x</replaceable> is either <option>on</option> to turn the " -"Boolean on, or <option>off</option> to turn it off." -msgstr "" +msgid "The <command>setsebool <replaceable>boolean-name</replaceable> <replaceable>x</replaceable></command> command turns Booleans on or off, where <replaceable>boolean-name</replaceable> is a Boolean name, and <replaceable>x</replaceable> is either <option>on</option> to turn the Boolean on, or <option>off</option> to turn it off." +msgstr "Команда <command>setsebool <replaceable>boolean-name</replaceable> <replaceable>x</replaceable></command> переводит переключатели в состояние включено или выключено, где <replaceable>boolean-name</replaceable> - название переключателя, а <replaceable>x</replaceable> - <option>on</option> для включения или <option>off</option> для выключения."

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates configuring the " -"<computeroutput>httpd_can_network_connect_db</computeroutput> Boolean:" -msgstr "" +msgid "The following example demonstrates configuring the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean:" +msgstr "В следующем примере, показана процедура конфигурирования переключателя <computeroutput>httpd_can_network_connect_db</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"By default, the <computeroutput>httpd_can_network_connect_db</" -"computeroutput> Boolean is off, preventing Apache HTTP Server scripts and " -"modules from connecting to database servers:" -msgstr "" +msgid "By default, the <computeroutput>httpd_can_network_connect_db</computeroutput> Boolean is off, preventing Apache HTTP Server scripts and modules from connecting to database servers:" +msgstr "По умолчанию <computeroutput>httpd_can_network_connect_db</computeroutput> выключен, блокируя доступ скриптам и модулям Apache HTTP Server к серверам баз данных."

#. Tag: para #, no-c-format -msgid "" -"To temporarily enable Apache HTTP Server scripts and modules to connect to " -"database servers, run the <command>setsebool httpd_can_network_connect_db " -"on</command> command as the Linux root user." -msgstr "" +msgid "To temporarily enable Apache HTTP Server scripts and modules to connect to database servers, run the <command>setsebool httpd_can_network_connect_db on</command> command as the Linux root user." +msgstr "Для временного предоставления скриптам и модулям Apache HTTP Server доступа при подключении к серверам баз данных, необходимо выполнить команду <command>setsebool httpd_can_network_connect_db on</command> от имени пользователя root."

#. Tag: para #, no-c-format -msgid "" -"Use the <command>getsebool httpd_can_network_connect_db</command> command to " -"verify the Boolean is turned on:" -msgstr "" +msgid "Use the <command>getsebool httpd_can_network_connect_db</command> command to verify the Boolean is turned on:" +msgstr "Для проверки корректности включения Булевого переключателя используется команда <command>getsebool httpd_can_network_connect_db</command>:"

#. Tag: para #, no-c-format -msgid "" -"This allows Apache HTTP Server scripts and modules to connect to database " -"servers." -msgstr "" +msgid "This allows Apache HTTP Server scripts and modules to connect to database servers." +msgstr "Это позволяет сценариям и модулям Apache HTTP Server подключаться к серверам баз данных"

#. Tag: para #, no-c-format -msgid "" -"This change is not persistent across reboots. To make changes persistent " -"across reboots, run the <command>setsebool -P <replaceable>boolean-name</" -"replaceable> on</command> command as the Linux root user:" -msgstr "" +msgid "This change is not persistent across reboots. To make changes persistent across reboots, run the <command>setsebool -P <replaceable>boolean-name</replaceable> on</command> command as the Linux root user:" +msgstr "Данное изменение не сохраняется при перезагрузках системы. Для внесения изменений на постоянной основе (после перезагрузки системы) необходимо использовать команду <command>setsebool -P <replaceable>boolean-name</replaceable> on</command> от имени пользователя root:"

#. Tag: para #, no-c-format -msgid "" -"To temporarily revert to the default behavior, as the Linux root user, run " -"the <command>setsebool httpd_can_network_connect_db off</command> command. " -"For changes that persist across reboots, run the <command>setsebool -P " -"httpd_can_network_connect_db off</command> command." -msgstr "" +msgid "To temporarily revert to the default behavior, as the Linux root user, run the <command>setsebool httpd_can_network_connect_db off</command> command. For changes that persist across reboots, run the <command>setsebool -P httpd_can_network_connect_db off</command> command." +msgstr "Для временной отмены данного действия, от имени пользователя root выполните команду <command>setsebool httpd_can_network_connect_db off</command>. Для изменений, сохраняющихся после перезагрузки, необходимо выполнить команду <command>setsebool -P httpd_can_network_connect_db off</command>."

#. Tag: title #, no-c-format msgid "Booleans for NFS and CIFS" -msgstr "" +msgstr "Булевы переключатели для NFS и CIFS"

#. Tag: para #, no-c-format -msgid "" -"By default, NFS mounts on the client side are labeled with a default context " -"defined by policy for NFS file systems. In common policies, this default " -"context uses the <computeroutput>nfs_t</computeroutput> type. Also, by " -"default, Samba shares mounted on the client side are labeled with a default " -"context defined by policy. In common policies, this default context uses the " -"<computeroutput>cifs_t</computeroutput> type." -msgstr "" +msgid "By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Also, by default, Samba shares mounted on the client side are labeled with a default context defined by policy. In common policies, this default context uses the <computeroutput>cifs_t</computeroutput> type." +msgstr "По умолчанию, NFS монтируемый на стороне клиента, выставляет контекст по умолчанию для файловых систем NFS. В большинстве политик, по умолчанию используется контекст <computeroutput>nfs_t</computeroutput>. Также, по умолчанию, общие папки Samba монтируемые на клиентской стороне, маркируются контекстом по умолчанию, используемым в политике. В большинстве политик, по умолчанию используется контекст <computeroutput>cifs_t</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"Depending on policy configuration, services may not be able to read files " -"labeled with the <computeroutput>nfs_t</computeroutput> or " -"<computeroutput>cifs_t</computeroutput> types. This may prevent file systems " -"labeled with these types from being mounted and then read or exported by " -"other services. Booleans can be turned on or off to control which services " -"are allowed to access the <computeroutput>nfs_t</computeroutput> and " -"<computeroutput>cifs_t</computeroutput> types." -msgstr "" +msgid "Depending on policy configuration, services may not be able to read files labeled with the <computeroutput>nfs_t</computeroutput> or <computeroutput>cifs_t</computeroutput> types. This may prevent file systems labeled with these types from being mounted and then read or exported by other services. Booleans can be turned on or off to control which services are allowed to access the <computeroutput>nfs_t</computeroutput> and <computeroutput>cifs_t</computeroutput> types." +msgstr "В зависимости от конфигурации политики, службы могут не иметь прав на чтение файлов маркированных типом <computeroutput>nfs_t</computeroutput> или <computeroutput>cifs_t</computeroutput>. Это может блокировать доступ на чтение или экспорт монтированных файловых систем с этими типами другими службами. Переключатели могут быть включены или выключены для управления тем, каким службами разрешен доступ к типам <computeroutput>nfs_t</computeroutput> и <computeroutput>cifs_t</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"The <command>setsebool</command> and <command>semanage</command> commands " -"must be run as the Linux root user. The <command>setsebool -P</command> " -"command makes persistent changes. Do not use the <option>-P</option> option " -"if you do not want changes to persist across reboots:" -msgstr "" +msgid "The <command>setsebool</command> and <command>semanage</command> commands must be run as the Linux root user. The <command>setsebool -P</command> command makes persistent changes. Do not use the <option>-P</option> option if you do not want changes to persist across reboots:" +msgstr "Команды <command>setsebool</command> и <command>semanage</command> должны запускаться от имени пользователя root. Команда <command>setsebool -P</command> вносит постоянные изменения. Не используйте опцию <option>-P</option>, если вы не хотите, чтобы изменения были постоянными:"

#. Tag: title #, no-c-format msgid "Apache HTTP Server" -msgstr "" +msgstr "Apache HTTP Server"

#. Tag: para #, no-c-format -msgid "" -"To allow access to NFS file systems (files labeled with the " -"<computeroutput>nfs_t</computeroutput> type):" -msgstr "" +msgid "To allow access to NFS file systems (files labeled with the <computeroutput>nfs_t</computeroutput> type):" +msgstr "Для предоставления доступа к файловым системам NFS (файлам помеченным типом <computeroutput>nfs_t</computeroutput>):"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/setsebool -P httpd_use_nfs on</command>" -msgstr "" +msgstr "<command>/usr/sbin/setsebool -P httpd_use_nfs on</command>"

#. Tag: para #, no-c-format -msgid "" -"To allow access to Samba file systems (files labeled with the " -"<computeroutput>cifs_t</computeroutput> type):" -msgstr "" +msgid "To allow access to Samba file systems (files labeled with the <computeroutput>cifs_t</computeroutput> type):" +msgstr "Для предоставления доступа к файловым системам Samba (файлам, помеченным типом <computeroutput>cifs_t</computeroutput> type):"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/setsebool -P httpd_use_cifs on</command>" -msgstr "" +msgstr "<command>/usr/sbin/setsebool -P httpd_use_cifs on</command>"

#. Tag: title #, no-c-format msgid "Samba" -msgstr "" +msgstr "Samba"

#. Tag: para #, no-c-format msgid "To export NFS file systems:" -msgstr "" +msgstr "Для экспорта файловых систем NFS:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/setsebool -P samba_share_nfs on</command>" -msgstr "" +msgstr "<command>/usr/sbin/setsebool -P samba_share_nfs on</command>"

#. Tag: title #, no-c-format msgid "FTP (<systemitem class="daemon">vsftpd</systemitem>)" -msgstr "" +msgstr "FTP (<systemitem class="daemon">vsftpd</systemitem>)"

#. Tag: para #, no-c-format msgid "To allow access to NFS file systems:" -msgstr "" +msgstr "Для предоставления доступа к файловым системам NFS:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/setsebool -P allow_ftpd_use_nfs on</command>" -msgstr "" +msgstr "<command>/usr/sbin/setsebool -P allow_ftpd_use_nfs on</command>"

#. Tag: para #, no-c-format msgid "To allow access to Samba file systems:" -msgstr "" +msgstr "Для предоставления доступа к файловым системам Samba:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/setsebool -P allow_ftpd_use_cifs on</command>" -msgstr "" +msgstr "<command>/usr/sbin/setsebool -P allow_ftpd_use_cifs on</command>"

#. Tag: title #, no-c-format msgid "Other Services" -msgstr "" +msgstr "Другие службы"

#. Tag: para #, no-c-format msgid "For a list of NFS related Booleans for other services:" -msgstr "" +msgstr "Для получения перечня всех Булевых переключателей NFS, относящихся к другим службам:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/semanage boolean -l | grep nfs</command>" -msgstr "" +msgstr "<command>/usr/sbin/semanage boolean -l | grep nfs</command>"

#. Tag: para #, no-c-format msgid "For a list of Samba related Booleans for other services:" -msgstr "" +msgstr "Для получения перечения Булевых переключателей Samba, относящихся к другим службам:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/semanage boolean -l | grep cifs</command>" -msgstr "" +msgstr "<command>/usr/sbin/semanage boolean -l | grep cifs</command>"

#. Tag: para #, no-c-format -msgid "" -"These Booleans exist in SELinux policy as shipped with Fedora&nbsp;" -"&PRODVER;. They may not exist in policy shipped with other versions of " -"Fedora or other operating systems." -msgstr "" +msgid "These Booleans exist in SELinux policy as shipped with Fedora&nbsp;&PRODVER;. They may not exist in policy shipped with other versions of Fedora or other operating systems." +msgstr "Данные Булевы переключатели существует в политике SELinux, поставляемых с Fedora&nbsp;&PRODVER;. Они могут отсутствовать в политиках поставляемых с другими версиями Fedora или другими операционными системами."

#. Tag: para #, no-c-format -msgid "" -"Refer to the SELinux Managing Confined Services Guide:<ulink url="http://" -"docs.fedoraproject.org/selinux-managing-confined-services-guide" /> for " -"more information relating to SELinux Booleans." -msgstr "" +msgid "Refer to the SELinux Managing Confined Services Guide:<ulink url="http://docs.fedoraproject.org/selinux-managing-confined-services-guide%5C" /> for more information relating to SELinux Booleans." +msgstr "Дополнительная информация, относящаяся к Булевым значениям (переключателям) SELinux: SELinux Managing Confined Services Guide <ulink url="http://docs.fedoraproject.org/selinux-managing-confined-services-guide%5C" />."

#. Tag: title #, no-c-format msgid "SELinux Contexts - Labeling Files" -msgstr "" +msgstr "Контексты SELinux - Маркирование файлов"

#. Tag: para #, no-c-format -msgid "" -"On systems running SELinux, all processes and files are labeled in a way " -"that represents security-relevant information. This information is called " -"the SELinux context. For files, this is viewed using the <command>ls -Z</" -"command> command:" -msgstr "" +msgid "On systems running SELinux, all processes and files are labeled in a way that represents security-relevant information. This information is called the SELinux context. For files, this is viewed using the <command>ls -Z</command> command:" +msgstr "В системах с запущенным SELinux, все процессы и файлы маркированы (помечены) так, чтобы представлять информацию в контексте безопасности. Эта информация называется контекстом SELinux, и просматривается с использованием команды <command>ls -Z</command>:"

#. Tag: para #, no-c-format -msgid "" -"In this example, SELinux provides a user (<computeroutput>unconfined_u</" -"computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type " -"(<computeroutput>user_home_t</computeroutput>), and a level " -"(<computeroutput>s0</computeroutput>). This information is used to make " -"access control decisions. On DAC systems, access is controlled based on " -"Linux user and group IDs. SELinux policy rules are checked after DAC rules. " -"SELinux policy rules are not used if DAC rules deny access first." -msgstr "" +msgid "In this example, SELinux provides a user (<computeroutput>unconfined_u</computeroutput>), a role (<computeroutput>object_r</computeroutput>), a type (<computeroutput>user_home_t</computeroutput>), and a level (<computeroutput>s0</computeroutput>). This information is used to make access control decisions. On DAC systems, access is controlled based on Linux user and group IDs. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first." +msgstr "В этом примере, SELinux приводит пользователя (<computeroutput>unconfined_u</computeroutput>), роль (<computeroutput>object_r</computeroutput>), тип (<computeroutput>user_home_t</computeroutput>) и уровень (<computeroutput>s0</computeroutput>). Эта информация используется для принятия решений контроля доступа. В системах DAC, контроль доступа осуществляется с использованием ID пользователя и группы. Правила политики SELinux проверяются после правил DAC. Правила политики SELinux не используются, если DAC блокировал доступ первым."

#. Tag: para #, no-c-format -msgid "" -"There are multiple commands for managing the SELinux context for files, such " -"as <command>chcon</command>, <command>semanage fcontext</command>, and " -"<command>restorecon</command>." -msgstr "" +msgid "There are multiple commands for managing the SELinux context for files, such as <command>chcon</command>, <command>semanage fcontext</command>, and <command>restorecon</command>." +msgstr "Существует множество команд для управления контекстом SELinux для файлов, такие как <command>chcon</command>, <command>semanage fcontext</command> и <command>restorecon</command>."

#. Tag: title #, no-c-format msgid "Temporary Changes: chcon" -msgstr "" +msgstr "Временные изменения: chcon"

#. Tag: para #, no-c-format -msgid "" -"The <command>chcon</command> command changes the SELinux context for files. " -"However, changes made with the <command>chcon</command> command do not " -"survive a file system relabel, or the execution of the <command>/sbin/" -"restorecon</command> command. SELinux policy controls whether users are able " -"to modify the SELinux context for any given file. When using <command>chcon</" -"command>, users provide all or part of the SELinux context to change. An " -"incorrect file type is a common cause of SELinux denying access." -msgstr "" +msgid "The <command>chcon</command> command changes the SELinux context for files. However, changes made with the <command>chcon</command> command do not survive a file system relabel, or the execution of the <command>/sbin/restorecon</command> command. SELinux policy controls whether users are able to modify the SELinux context for any given file. When using <command>chcon</command>, users provide all or part of the SELinux context to change. An incorrect file type is a common cause of SELinux denying access." +msgstr "Команда <command>chcon</command> вносит изменения в контекст SELinux для файлов. Однако, изменения, вносимые с помощью команды <command>chcon</command> не сохраняются после перемаркирования файловой системы или выполнения команды <command>/sbin/restorecon</command>. Политика SELinux контролирует может ли пользователь изменять контекст для файлов. При использовании команды <command>chcon</command>, пользователи предоставляют всю информацию или часть об изменении контекста SELinux. Некорректный тип файла обычно является причиной блокирования доступа SELinux."

#. Tag: title #, no-c-format msgid "Quick Reference" -msgstr "" +msgstr "Быстрое ознакомление"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>chcon -t <replaceable>type</replaceable> <replaceable>file-" -"name</replaceable></command> command to change the file type, where " -"<replaceable>type</replaceable> is a type, such as " -"<computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>file-" -"name</replaceable> is a file or directory name." -msgstr "" +msgid "Run the <command>chcon -t <replaceable>type</replaceable> <replaceable>file-name</replaceable></command> command to change the file type, where <replaceable>type</replaceable> is a type, such as <computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>file-name</replaceable> is a file or directory name." +msgstr "Выполните команду <command>chcon -t <replaceable>type</replaceable> <replaceable>file-name</replaceable></command> для изменения типа файла, где <replaceable>type</replaceable> - это тип, такой как <computeroutput>httpd_sys_content_t</computeroutput>, а <replaceable>file-name</replaceable> имя файла или каталога."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>chcon -R -t <replaceable>type</replaceable> " -"<replaceable>directory-name</replaceable></command> command to change the " -"type of the directory and its contents, where <replaceable>type</" -"replaceable> is a type, such as <computeroutput>httpd_sys_content_t</" -"computeroutput>, and <replaceable>directory-name</replaceable> is a " -"directory name." -msgstr "" +msgid "Run the <command>chcon -R -t <replaceable>type</replaceable> <replaceable>directory-name</replaceable></command> command to change the type of the directory and its contents, where <replaceable>type</replaceable> is a type, such as <computeroutput>httpd_sys_content_t</computeroutput>, and <replaceable>directory-name</replaceable> is a directory name." +msgstr "Выполните команду <command>chcon -R -t <replaceable>type</replaceable> <replaceable>directory-name</replaceable></command> для изменения типа каталога и его содержимого, где <replaceable>type</replaceable> - это тип, такой как <computeroutput>httpd_sys_content_t</computeroutput>, а <replaceable>directory-name</replaceable> имя каталога."

#. Tag: title #, no-c-format msgid "Changing a File's or Directory's Type" -msgstr "" +msgstr "Изменение типа файла или каталога"

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates changing the type, and no other " -"attributes of the SELinux context:" -msgstr "" +msgid "The following example demonstrates changing the type, and no other attributes of the SELinux context:" +msgstr "В следующих примерах показывается изменение атрибута тип контекста SELinux:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd</command> command without arguments to change into your " -"home directory." -msgstr "" +msgid "Run the <command>cd</command> command without arguments to change into your home directory." +msgstr "Выполните команду <command>cd</command> без аргументов для перехода в домашний каталог."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>touch file1</command> command to create a new file. Use the " -"<command>ls -Z file1</command> command to view the SELinux context for " -"<filename>file1</filename>:" -msgstr "" +msgid "Run the <command>touch file1</command> command to create a new file. Use the <command>ls -Z file1</command> command to view the SELinux context for <filename>file1</filename>:" +msgstr "Выполните команду <command>touch file1</command> для создания нового файла. Используя команду <command>ls -Z file1</command> просмотрите контекст SELinux для <filename>file1</filename>:"

#. Tag: para #, no-c-format -msgid "" -"In this example, the SELinux context for <filename>file1</filename> includes " -"the SELinux <computeroutput>unconfined_u</computeroutput> user, " -"<computeroutput>object_r</computeroutput> role, <computeroutput>user_home_t</" -"computeroutput> type, and the <computeroutput>s0</computeroutput> level. For " -"a description of each part of the SELinux context, refer to <xref linkend=" -""chap-Security-Enhanced_Linux-SELinux_Contexts" />." -msgstr "" +msgid "In this example, the SELinux context for <filename>file1</filename> includes the SELinux <computeroutput>unconfined_u</computeroutput> user, <computeroutput>object_r</computeroutput> role, <computeroutput>user_home_t</computeroutput> type, and the <computeroutput>s0</computeroutput> level. For a description of each part of the SELinux context, refer to <xref linkend="chap-Security-Enhanced_Linux-SELinux_Contexts" />." +msgstr "В этом примере контекст SELinux для <filename>file1</filename> включает пользователя SELinux <computeroutput>unconfined_u</computeroutput>, роль <computeroutput>object_r</computeroutput>, тип <computeroutput>user_home_t</computeroutput> и уровень <computeroutput>s0</computeroutput>. Расширенное описание каждой части контекста SELinux доступно согласно <xref linkend="chap-Security-Enhanced_Linux-SELinux_Contexts" />."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>chcon -t samba_share_t file1</command> command to change " -"the type to <computeroutput>samba_share_t</computeroutput>. The <option>-t</" -"option> option only changes the type. View the change with <command>ls -Z " -"file1</command>:" -msgstr "" +msgid "Run the <command>chcon -t samba_share_t file1</command> command to change the type to <computeroutput>samba_share_t</computeroutput>. The <option>-t</option> option only changes the type. View the change with <command>ls -Z file1</command>:" +msgstr "Выполните команду <command>chcon -t samba_share_t file1</command> для изменения типа на <computeroutput>samba_share_t</computeroutput>. Опция <option>-t</option> отвечает за изменение типа. Просмотрите изменения с помощью <command>ls -Z file1</command>:"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/sbin/restorecon -v file1</command> command to restore the " -"SELinux context for the <filename>file1</filename> file. Use the <option>-v</" -"option> option to view what changes:" -msgstr "" +msgid "Use the <command>/sbin/restorecon -v file1</command> command to restore the SELinux context for the <filename>file1</filename> file. Use the <option>-v</option> option to view what changes:" +msgstr "Используйте команду <command>/sbin/restorecon -v file1</command> для восстановления контекста SELinux для файла <filename>file1</filename>. Используйте <option>-v</option> опцию для просмотра изменений, вносимых командой:"

#. Tag: para #, no-c-format -msgid "" -"In this example, the previous type, <computeroutput>samba_share_t</" -"computeroutput>, is restored to the correct, <computeroutput>user_home_t</" -"computeroutput> type. When using targeted policy (the default SELinux policy " -"in Fedora 11), the <command>/sbin/restorecon</command> command reads the " -"files in the <filename>/etc/selinux/targeted/contexts/files/</filename> " -"directory, to see which SELinux context files should have." -msgstr "" +msgid "In this example, the previous type, <computeroutput>samba_share_t</computeroutput>, is restored to the correct, <computeroutput>user_home_t</computeroutput> type. When using targeted policy (the default SELinux policy in Fedora 11), the <command>/sbin/restorecon</command> command reads the files in the <filename>/etc/selinux/targeted/contexts/files/</filename> directory, to see which SELinux context files should have." +msgstr "В этом примере, предыдущий тип <computeroutput>samba_share_t</computeroutput> восстанавливается на корректное значение, <computeroutput>user_home_t</computeroutput>. Когда используется целевая политика targeted (Политика SELinux по умолчанию в Fedora 11), команда <command>/sbin/restorecon</command> читает файлы в каталоге <filename>/etc/selinux/targeted/contexts/files/</filename>, для того, чтобы узнать какие контексты SELinux должны присваиваться файлам."

#. Tag: para #, no-c-format -msgid "" -"The example in this section works the same for directories, for example, if " -"<filename>file1</filename> was a directory." -msgstr "" +msgid "The example in this section works the same for directories, for example, if <filename>file1</filename> was a directory." +msgstr "Данный пример работает также и для каталогов, то есть, применим, если <filename>file1</filename> является каталогом."

#. Tag: title #, no-c-format msgid "Changing a Directory and its Contents Types" -msgstr "" +msgstr "Изменение типа каталога и его содержимого"

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a new directory, and changing " -"the directory's file type (along with its contents) to a type used by the " -"Apache HTTP Server. The configuration in this example is used if you want " -"Apache HTTP Server to use a different document root (instead of <filename>/" -"var/www/html/</filename>):" -msgstr "" +msgid "The following example demonstrates creating a new directory, and changing the directory's file type (along with its contents) to a type used by the Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of <filename>/var/www/html/</filename>):" +msgstr "Следующий пример демонстрирует создание нового каталога и изменение типа каталога (вместе с его контекстом) на тип, используемый Apache HTTP Server. Конфигурация в этом примере используется если вы хотите назначить Apache HTTP Server другой корневой каталог document root (вместо <filename>/var/www/html/</filename>):"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mkdir /web</command> command to " -"create a new directory, and then the <command>touch /web/file{1,2,3}</" -"command> command to create 3 empty files (<filename>file1</filename>, " -"<filename>file2</filename>, and <filename>file3</filename>). The <filename>/" -"web/</filename> directory and files in it are labeled with the " -"<computeroutput>default_t</computeroutput> type:" -msgstr "" +msgid "As the Linux root user, run the <command>mkdir /web</command> command to create a new directory, and then the <command>touch /web/file{1,2,3}</command> command to create 3 empty files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). The <filename>/web/</filename> directory and files in it are labeled with the <computeroutput>default_t</computeroutput> type:" +msgstr "От имени пользователя root, выполните команду <command>mkdir /web</command> для создания нового каталога и команду <command>touch /web/file{1,2,3}</command> для создания трёх пустых файлов (<filename>file1</filename>, <filename>file2</filename> и <filename>file3</filename>). Каталог <filename>/web/</filename> и файлы в внутри каталога помечены как тип <computeroutput>default_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>chcon -R -t httpd_sys_content_t /" -"web/</command> command to change the type of the <filename>/web/</filename> " -"directory (and its contents) to <computeroutput>httpd_sys_content_t</" -"computeroutput>:" -msgstr "" +msgid "As the Linux root user, run the <command>chcon -R -t httpd_sys_content_t /web/</command> command to change the type of the <filename>/web/</filename> directory (and its contents) to <computeroutput>httpd_sys_content_t</computeroutput>:" +msgstr "От имени пользователя root, выполните команду <command>chcon -R -t httpd_sys_content_t /web/</command> для изменения типа каталога <filename>/web/</filename> (и его содержимого) на <computeroutput>httpd_sys_content_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -R -v /web/</" -"command> command to restore the default SELinux contexts:" -msgstr "" +msgid "As the Linux root user, run the <command>/sbin/restorecon -R -v /web/</command> command to restore the default SELinux contexts:" +msgstr "От имени пользователя root выполните команду <command>/sbin/restorecon -R -v /web/</command> для восстановления контекста SELinux по умолчанию:"

#. Tag: para #, no-c-format msgid "Refer to the" -msgstr "" +msgstr "Дополнительная информация о"

#. Tag: refentrytitle #, no-c-format msgid "chcon" -msgstr "" +msgstr "chcon"

#. Tag: citerefentry #, no-c-format msgid "manual page for further information about <command>chcon</command>." -msgstr "" +msgstr "в справочном руководстве (manual page) команды <command>chcon</command>."

#. Tag: para #, no-c-format -msgid "" -"Type Enforcement is the main permission control used in SELinux targeted " -"policy. For the most part, SELinux users and roles can be ignored." -msgstr "" +msgid "Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored." +msgstr "Type Enforcement - это основной контроль доступа, используемый в целевой политике SELinux. В большинстве случаев, пользователи SELinux и роли могут быть проигнорированы."

#. Tag: title #, no-c-format msgid "Persistent Changes: semanage fcontext" -msgstr "" +msgstr "Постоянные изменения: semanage fcontext"

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext</command> command changes the " -"SELinux context for files. When using targeted policy, changes made with " -"this command are added to the <filename>/etc/selinux/targeted/contexts/files/" -"file_contexts</filename> file if the changes are to files that exists in " -"<filename>file_contexts</filename>, or are added to <filename>file_contexts." -"local</filename> for new files and directories, such as creating a " -"<filename>/web/</filename> directory. <command>setfiles</command>, which is " -"used when a file system is relabeled, and <command>/sbin/restorecon</" -"command>, which restores the default SELinux contexts, read these files. " -"This means that changes made by <command>/usr/sbin/semanage fcontext</" -"command> are persistent, even if the file system is relabeled. SELinux " -"policy controls whether users are able to modify the SELinux context for any " -"given file." -msgstr "" +msgid "The <command>/usr/sbin/semanage fcontext</command> command changes the SELinux context for files. When using targeted policy, changes made with this command are added to the <filename>/etc/selinux/targeted/contexts/files/file_contexts</filename> file if the changes are to files that exists in <filename>file_contexts</filename>, or are added to <filename>file_contexts.local</filename> for new files and directories, such as creating a <filename>/web/</filename> directory. <command>setfiles</command>, which is used when a file system is relabeled, and <command>/sbin/restorecon</command>, which restores the default SELinux contexts, read these files. This means that changes made by <command>/usr/sbin/semanage fcontext</command> are persistent, even if the file system is relabeled. SELinux policy controls whether users are able to modify the SELinux context for any given file." +msgstr "Команда <command>/usr/sbin/semanage fcontext</command> изменяет контекст SELinux для файлов. При использовании целевой политики targeted, изменение вносимые данной командой, добавляются в файл <filename>/etc/selinux/targeted/contexts/files/file_contexts</filename>, если изменения вносятся для существующих файлов, то они добавляются в файл <filename>file_contexts</filename>, или добавляютсяв файл <filename>file_contexts.local</filename> для новых файлов и каталогов, например при создании каталога <filename>/web/</filename>. <command>setfiles</command>, использующаяся при маркирование файловой системы и <command>/sbin/restorecon</command>, использующаяся для восст� �новления контекста SELinux по умолчанию, читают эти файлы. Это значит, что изменения вносимые командой <command>/usr/sbin/semanage fcontext</command> постоянно, даже если файловая система будет перемаркирована. Политика SELinux контролирует возможность пользователей изменять контекст файлов."

#. Tag: para #, no-c-format msgid "To make SELinux context changes that survive a file system relabel:" -msgstr "" +msgstr "Для внесения изменений в контекст SELinux изменений, которые сохранятся при перемаркировании файловой системы:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>/usr/sbin/semanage fcontext -a <replaceable>options</" -"replaceable> <replaceable>file-name</replaceable>|<replaceable>directory-" -"name</replaceable></command> command, remembering to use the full path to " -"the file or directory." -msgstr "" +msgid "Run the <command>/usr/sbin/semanage fcontext -a <replaceable>options</replaceable> <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command, remembering to use the full path to the file or directory." +msgstr "Выполните команду <command>/usr/sbin/semanage fcontext -a <replaceable>options</replaceable> <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command>, помня, что необходимо использовать полные пути к файлам и каталогам."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>/sbin/restorecon -v <replaceable>file-name</replaceable>|" -"<replaceable>directory-name</replaceable></command> command to apply the " -"context changes." -msgstr "" +msgid "Run the <command>/sbin/restorecon -v <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command to apply the context changes." +msgstr "Выполните команду <command>/sbin/restorecon -v <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> для применения изменений контекста."

#. Tag: title #, no-c-format msgid "Changing a File's Type" -msgstr "" +msgstr "Изменение типа файла"

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates changing a file's type, and no other " -"attributes of the SELinux context:" -msgstr "" +msgid "The following example demonstrates changing a file's type, and no other attributes of the SELinux context:" +msgstr "В следующем примере демонстрируется как изменить тип файла в контексте SELinux:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /etc/file1</command> command " -"to create a new file. By default, newly-created files in the <filename>/etc/" -"</filename> directory are labeled with the <computeroutput>etc_t</" -"computeroutput> type:" -msgstr "" +msgid "As the Linux root user, run the <command>touch /etc/file1</command> command to create a new file. By default, newly-created files in the <filename>/etc/</filename> directory are labeled with the <computeroutput>etc_t</computeroutput> type:" +msgstr "От имени пользователя root, выполните команду <command>touch /etc/file1</command> для создания нового файла. По умолчанию, вновь созданные файлы в каталоге <filename>/etc/</filename> помечаются типом <computeroutput>etc_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"samba_share_t /etc/file1</command> command to change the <filename>file1</" -"filename> type to <computeroutput>samba_share_t</computeroutput>. The " -"<option>-a</option> option adds a new record, and the <option>-t</option> " -"option defines a type (<computeroutput>samba_share_t</computeroutput>). " -"Note: running this command does not directly change the type - " -"<filename>file1</filename> is still labeled with the <computeroutput>etc_t</" -"computeroutput> type:" -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</command> command to change the <filename>file1</filename> type to <computeroutput>samba_share_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (<computeroutput>samba_share_t</computeroutput>). Note: running this command does not directly change the type - <filename>file1</filename> is still labeled with the <computeroutput>etc_t</computeroutput> type:" +msgstr "От имени пользователя root, выполните команду <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</command> для изменения типа файла <filename>file1</filename> на <computeroutput>samba_share_t</computeroutput>. Опция <option>-a</option> добавляет новую запись, а опция <option>-t</option> определяет тип (<computeroutput>samba_share_t</computeroutput>). Примечание: выполнение данной командой не изменяет тип напрямую - <filename>file1</filename> до сих пор помечен типом <computeroutput>etc_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</" -"command> command adds the following entry to <filename>/etc/selinux/targeted/" -"contexts/files/file_contexts.local</filename>:" -msgstr "" +msgid "The <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</command> command adds the following entry to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:" +msgstr "Команда <command>/usr/sbin/semanage fcontext -a -t samba_share_t /etc/file1</command> добавляет следующую запись в <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -v /etc/file1</" -"command> command to change the type. Since the <command>semanage</command> " -"command added an entry to <filename>file.contexts.local</filename> for " -"<filename>/etc/file1</filename>, the <command>/sbin/restorecon</command> " -"command changes the type to <computeroutput>samba_share_t</computeroutput>:" -msgstr "" +msgid "As the Linux root user, run the <command>/sbin/restorecon -v /etc/file1</command> command to change the type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <filename>/etc/file1</filename>, the <command>/sbin/restorecon</command> command changes the type to <computeroutput>samba_share_t</computeroutput>:" +msgstr "От имени пользователя root выполните команду <command>/sbin/restorecon -v /etc/file1</command> для изменения типа. Так как команда <command>semanage</command> добавила запись в <filename>file.contexts.local</filename> для <filename>/etc/file1</filename>, команда <command>/sbin/restorecon</command> изменяет тип на <computeroutput>samba_share_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>rm -i /etc/file1</command> command " -"to remove <filename>file1</filename>." -msgstr "" +msgid "As the Linux root user, run the <command>rm -i /etc/file1</command> command to remove <filename>file1</filename>." +msgstr "От имени пользователя root выполните команду <command>rm -i /etc/file1</command> для удаления <filename>file1</filename>."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /etc/" -"file1</command> command to remove the context added for <filename>/etc/" -"file1</filename>. When the context is removed, running <command>restorecon</" -"command> changes the type to <computeroutput>etc_t</computeroutput>, rather " -"than <computeroutput>samba_share_t</computeroutput>." -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /etc/file1</command> command to remove the context added for <filename>/etc/file1</filename>. When the context is removed, running <command>restorecon</command> changes the type to <computeroutput>etc_t</computeroutput>, rather than <computeroutput>samba_share_t</computeroutput>." +msgstr "От имени пользователя root, выполните команду <command>/usr/sbin/semanage fcontext -d /etc/file1</command> для удаления контекста добавленного для <filename>/etc/file1</filename>. Когда контекст удален, выполнение команды <command>restorecon</command> изменяет тип на <computeroutput>etc_t</computeroutput>, вместо <computeroutput>samba_share_t</computeroutput>."

#. Tag: title #, no-c-format msgid "Changing a Directory's Type" -msgstr "" +msgstr "Изменение типа каталога"

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a new directory and changing " -"that directory's file type, to a type used by Apache HTTP Server:" -msgstr "" +msgid "The following example demonstrates creating a new directory and changing that directory's file type, to a type used by Apache HTTP Server:" +msgstr "В следующем примере демонстрируется создание нового каталога и изменение типа каталога на тип, используемый Apache HTTP Server:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mkdir /web</command> command to " -"create a new directory. This directory is labeled with the " -"<computeroutput>default_t</computeroutput> type:" -msgstr "" +msgid "As the Linux root user, run the <command>mkdir /web</command> command to create a new directory. This directory is labeled with the <computeroutput>default_t</computeroutput> type:" +msgstr "От имени пользователя root, выполните команду <command>mkdir /web</command> для создания нового каталога. Этот каталог помечен типом <computeroutput>default_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"The <command>ls</command> <option>-d</option> option makes <command>ls</" -"command> list information about a directory, rather than its contents, and " -"the <option>-Z</option> option makes <command>ls</command> display the " -"SELinux context (in this example, <computeroutput>unconfined_u:object_r:" -"default_t:s0</computeroutput>)." -msgstr "" +msgid "The <command>ls</command> <option>-d</option> option makes <command>ls</command> list information about a directory, rather than its contents, and the <option>-Z</option> option makes <command>ls</command> display the SELinux context (in this example, <computeroutput>unconfined_u:object_r:default_t:s0</computeroutput>)." +msgstr "Команда <command>ls</command> <option>-d</option> с опцией выводит информацию о каталоге, а не о его содержимом, а опция <option>-Z</option> показывает контекст SELinux (в нашем примере, <computeroutput>unconfined_u:object_r:default_t:s0</computeroutput>)."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"httpd_sys_content_t /web</command> command to change the <filename>/web/</" -"filename> type to <computeroutput>httpd_sys_content_t</computeroutput>. The " -"<option>-a</option> option adds a new record, and the <option>-t</option> " -"option defines a type (<computeroutput>httpd_sys_content_t</" -"computeroutput>). Note: running this command does not directly change the " -"type - <filename>/web/</filename> is still labeled with the " -"<computeroutput>default_t</computeroutput> type:" -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</command> command to change the <filename>/web/</filename> type to <computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (<computeroutput>httpd_sys_content_t</computeroutput>). Note: running this command does not directly change the type - <filename>/web/</filename> is still labeled with the <computeroutput>default_t</computeroutput> type:" +msgstr "От имени пользователя root, выполните команду <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</command> для изменения типа каталога <filename>/web/</filename> на <computeroutput>httpd_sys_content_t</computeroutput>. Опция <option>-a</option> добавляет новую запись, а опция <option>-t</option> определяет тип (<computeroutput>httpd_sys_content_t</computeroutput>). Примечание: выполнение этой команды не изменяет тип напрямую - <filename>/web/</filename> до сих пор помечен типом <computeroutput>default_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</" -"command> command adds the following entry to <command>/etc/selinux/targeted/" -"contexts/files/file_contexts.local</command>:" -msgstr "" +msgid "The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</command> command adds the following entry to <command>/etc/selinux/targeted/contexts/files/file_contexts.local</command>:" +msgstr "Команда <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /web</command> добавляет следующую запись в <command>/etc/selinux/targeted/contexts/files/file_contexts.local</command>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -v /web</command> " -"command to change the type. Since the <command>semanage</command> command " -"added an entry to <filename>file.contexts.local</filename> for <filename>/" -"web</filename>, the <command>/sbin/restorecon</command> command changes the " -"type to <computeroutput>httpd_sys_content_t</computeroutput>:" -msgstr "" +msgid "As the Linux root user, run the <command>/sbin/restorecon -v /web</command> command to change the type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <filename>/web</filename>, the <command>/sbin/restorecon</command> command changes the type to <computeroutput>httpd_sys_content_t</computeroutput>:" +msgstr "От имени пользователя root, выполните команду <command>/sbin/restorecon -v /web</command> для изменения типа. Так как с помощью команды <command>semanage</command> добавлена запись в <filename>file.contexts.local</filename> для <filename>/web</filename>, то команда <command>/sbin/restorecon</command> изменяет тип на <computeroutput>httpd_sys_content_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"By default, newly-created files and directories inherit the SELinux type of " -"their parent folders. When using this example, and before removing the " -"SELinux context added for <filename>/web/</filename>, files and directories " -"created in the <filename>/web/</filename> directory are labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> type." -msgstr "" +msgid "By default, newly-created files and directories inherit the SELinux type of their parent folders. When using this example, and before removing the SELinux context added for <filename>/web/</filename>, files and directories created in the <filename>/web/</filename> directory are labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type." +msgstr "По умолчанию, вновь созданные файлы и каталоги наследуют тип SELinux от своих родительских каталогов. При использовании данного примера и перед удалением контекста SELinux, добавленного для <filename>/web/</filename>, файлы и каталоги созданные в каталоге <filename>/web/</filename> помечены типом <computeroutput>httpd_sys_content_t</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /" -"web</command> command to remove the context added for <filename>/web/</" -"filename>." -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d /web</command> command to remove the context added for <filename>/web/</filename>." +msgstr "От имени пользователя root, выполните команду <command>/usr/sbin/semanage fcontext -d /web</command> для удаления контекста, добавленного для <filename>/web/</filename>."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -v /web</command> " -"command to restore the default SELinux context." -msgstr "" +msgid "As the Linux root user, run the <command>/sbin/restorecon -v /web</command> command to restore the default SELinux context." +msgstr "От имени пользователя root, выполните команду <command>/sbin/restorecon -v /web</command> для восстановления контекста SELinux по умолчанию."

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a new directory, and changing " -"the directory's file type (along with its contents) to a type used by Apache " -"HTTP Server. The configuration in this example is used if you want Apache " -"HTTP Server to use a different document root (instead of <filename>/var/www/" -"html/</filename>):" -msgstr "" +msgid "The following example demonstrates creating a new directory, and changing the directory's file type (along with its contents) to a type used by Apache HTTP Server. The configuration in this example is used if you want Apache HTTP Server to use a different document root (instead of <filename>/var/www/html/</filename>):" +msgstr "В следующем примере демонстрируется создание нового каталога и изменение типа каталога (вместе с его содержимым) на тип, используемым Apache HTTP Server. Конфигурация в этом примере, может быть использована, если Apache HTTP Server использует другой корневой каталог (вместо <filename>/var/www/html/</filename>):"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"httpd_sys_content_t "/web(/.*)?"</command> command to change the type of " -"the <filename>/web/</filename> directory and the files in it, to " -"<computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</" -"option> option adds a new record, and the <option>-t</option> option defines " -"a type (httpd_sys_content_t). The <computeroutput>"/web(/.*)?"</" -"computeroutput> regular expression causes the <command>semanage</command> " -"command to apply changes to the <filename>/web/</filename> directory, as " -"well as the files in it. Note: running this command does not directly change " -"the type - <filename>/web/</filename> and files in it are still labeled with " -"the <computeroutput>default_t</computeroutput> type:" -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> command to change the type of the <filename>/web/</filename> directory and the files in it, to <computeroutput>httpd_sys_content_t</computeroutput>. The <option>-a</option> option adds a new record, and the <option>-t</option> option defines a type (httpd_sys_content_t). The <computeroutput>"/web(/.*)?"</computeroutput> regular expression causes the <command>semanage</command> command to apply changes to the <filename>/web/</filename> directory, as well as the files in it. Note: running this command does not directly change the type - <filename>/web/</filename> and files in it are still labeled with the <computeroutput>default_t</computeroutput> type:" +msgstr "От имени пользователя root, выполните команду <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> для изменения типа каталога <filename>/web/</filename> и файла в нем, на <computeroutput>httpd_sys_content_t</computeroutput>. Опция <option>-a</option> добавляет новую запись, а опция <option>-t</option> определяет тип (httpd_sys_content_t). Регулярное выражение <computeroutput>"/web(/.*)?"</computeroutput> при выполнении команды <command>semanage</command> применяет изменения к каталогу <filename>/web/</filename>, а также файлам внутри него. Примечание: выполнение этой команды не изменяет тип напрямую - <filename>/web/</filename> до сих пор помечен типом <compu teroutput>default_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/." -"*)?"</command> command adds the following entry to <filename>/etc/selinux/" -"targeted/contexts/files/file_contexts.local</filename>:" -msgstr "" +msgid "The <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> command adds the following entry to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:" +msgstr "Команда <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"</command> добавляет следующую запись в <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -R -v /web</" -"command> command to change the type of the <filename>/web/</filename> " -"directory, as well as all files in it. The <option>-R</option> is for " -"recursive, which means all files and directories under the <filename>/web/</" -"filename> directory are labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> type. Since the " -"<command>semanage</command> command added an entry to <filename>file." -"contexts.local</filename> for <computeroutput>/web(/.*)?</computeroutput>, " -"the <command>/sbin/restorecon</command> command changes the types to " -"<computeroutput>httpd_sys_content_t</computeroutput>:" -msgstr "" +msgid "As the Linux root user, run the <command>/sbin/restorecon -R -v /web</command> command to change the type of the <filename>/web/</filename> directory, as well as all files in it. The <option>-R</option> is for recursive, which means all files and directories under the <filename>/web/</filename> directory are labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type. Since the <command>semanage</command> command added an entry to <filename>file.contexts.local</filename> for <computeroutput>/web(/.*)?</computeroutput>, the <command>/sbin/restorecon</command> command changes the types to <computeroutput>httpd_sys_content_t</computeroutput>:" +msgstr "От имени пользователя root, выполните команду <command>/sbin/restorecon -R -v /web</command> для изменения типа каталога <filename>/web/</filename>, а также файлам внутри него. Опция <option>-R</option> определяет рекурсию, а это означает, что все файлы и каталоги внутри <filename>/web/</filename> помечены типом <computeroutput>httpd_sys_content_t</computeroutput>. Так как с помощью команды <command>semanage</command> добавлены записи в <filename>file.contexts.local</filename> для <computeroutput>/web(/.*)?</computeroutput>, то команда <command>/sbin/restorecon</command> изменяет тип на <computeroutput>httpd_sys_content_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"By default, newly-created files and directories inherit the SELinux type of " -"their parents. In this example, files and directories created in the " -"<filename>/web/</filename> directory will be labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> type." -msgstr "" +msgid "By default, newly-created files and directories inherit the SELinux type of their parents. In this example, files and directories created in the <filename>/web/</filename> directory will be labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type." +msgstr "По умолчанию вновь созданные файлы и каталоги наследуют тип SELinux от родительских каталогов. В данном примере, файлы и каталоги созданные в каталоге <filename>/web/</filename> будут помечены типом <computeroutput>httpd_sys_content_t</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d "/" -"web(/.*)?"</command> command to remove the context added for " -"<computeroutput>"/web(/.*)?"</computeroutput>." -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -d "/web(/.*)?"</command> command to remove the context added for <computeroutput>"/web(/.*)?"</computeroutput>." +msgstr "От имени пользователя root выполните команду <command>/usr/sbin/semanage fcontext -d "/web(/.*)?"</command> для удаления контекста добавленного для <computeroutput>"/web(/.*)?"</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/sbin/restorecon -R -v /web</" -"command> command to restore the default SELinux contexts." -msgstr "" +msgid "As the Linux root user, run the <command>/sbin/restorecon -R -v /web</command> command to restore the default SELinux contexts." +msgstr "От имени пользователя root выполните команду <command>/sbin/restorecon -R -v /web</command> для восстановления контекста SELinux по умолчанию."

#. Tag: title #, no-c-format msgid "Deleting an added Context" -msgstr "" +msgstr "Удаление добавленного контекста"

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates adding and removing an SELinux context:" -msgstr "" +msgid "The following example demonstrates adding and removing an SELinux context:" +msgstr "В следующем примере демонстрируется добавление и удаление контекста SELinux:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t " -"httpd_sys_content_t /test</command> command. The <filename>/test/</filename> " -"directory does not have to exist. This command adds the following context to " -"<filename>/etc/selinux/targeted/contexts/files/file_contexts.local</" -"filename>:" -msgstr "" +msgid "As the Linux root user, run the <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /test</command> command. The <filename>/test/</filename> directory does not have to exist. This command adds the following context to <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:" +msgstr "От имени пользователя root выполните команду <command>/usr/sbin/semanage fcontext -a -t httpd_sys_content_t /test</command>. Каталога <filename>/test/</filename> не должно существовать. Эта команда добавляет следующих контекст в <filename>/etc/selinux/targeted/contexts/files/file_contexts.local</filename>:"

#. Tag: para #, no-c-format -msgid "" -"To remove the context, as the Linux root user, run the <command>/usr/sbin/" -"semanage fcontext -d <replaceable>file-name</replaceable>|" -"<replaceable>directory-name</replaceable></command> command, where " -"<replaceable>file-name</replaceable>|<replaceable>directory-name</" -"replaceable> is the first part in <filename>file_contexts.local</filename>. " -"The following is an example of a context in <filename>file_contexts.local</" -"filename>:" -msgstr "" +msgid "To remove the context, as the Linux root user, run the <command>/usr/sbin/semanage fcontext -d <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command> command, where <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable> is the first part in <filename>file_contexts.local</filename>. The following is an example of a context in <filename>file_contexts.local</filename>:" +msgstr "Для удаления контекста, выполните от имени пользователя root команду <command>/usr/sbin/semanage fcontext -d <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable></command>, где <replaceable>file-name</replaceable>|<replaceable>directory-name</replaceable> является первой частью в <filename>file_contexts.local</filename>. Ниже показан пример контекста в <filename>file_contexts.local</filename>:"

#. Tag: para #, no-c-format -msgid "" -"With the first part being <computeroutput>/test</computeroutput>. To prevent " -"the <filename>/test/</filename> directory from being labeled with the " -"<computeroutput>httpd_sys_content_t</computeroutput> after running <command>/" -"sbin/restorecon</command>, or after a file system relabel, run the following " -"command as the Linux root user to delete the context from " -"<filename>file_contexts.local</filename>:" -msgstr "" +msgid "With the first part being <computeroutput>/test</computeroutput>. To prevent the <filename>/test/</filename> directory from being labeled with the <computeroutput>httpd_sys_content_t</computeroutput> after running <command>/sbin/restorecon</command>, or after a file system relabel, run the following command as the Linux root user to delete the context from <filename>file_contexts.local</filename>:" +msgstr "В начале указан <computeroutput>/test</computeroutput>. Для предотвращения маркирования каталога <filename>/test/</filename> контекстом <computeroutput>httpd_sys_content_t</computeroutput> после запуска <command>/sbin/restorecon</command>, или после перемаркирования файловой системы, выполните следующую команду от имени пользователя root для удаления контекста из <filename>file_contexts.local</filename>:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/semanage fcontext -d /test</command>" -msgstr "" +msgstr "<command>/usr/sbin/semanage fcontext -d /test</command>"

#. Tag: para #, no-c-format -msgid "" -"If the context is part of a regular expression, for example, " -"<computeroutput>/web(/.*)?</computeroutput>, use quotation marks around the " -"regular expression:" -msgstr "" +msgid "If the context is part of a regular expression, for example, <computeroutput>/web(/.*)?</computeroutput>, use quotation marks around the regular expression:" +msgstr "Если контекст является частью регулярного выражения, например <computeroutput>/web(/.*)?</computeroutput>, заключите регулярное выражение в кавычки:"

#. Tag: para #, no-c-format msgid "<command>/usr/sbin/semanage fcontext -d "/web(/.*)?"</command>" -msgstr "" +msgstr "<command>/usr/sbin/semanage fcontext -d "/web(/.*)?"</command>"

#. Tag: refentrytitle #, no-c-format msgid "semanage" -msgstr "" +msgstr "semanage"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page for further information about <command>/usr/sbin/semanage</" -"command>." -msgstr "" +msgid "manual page for further information about <command>/usr/sbin/semanage</command>." +msgstr "справочное руководство (manual page) для большей информации о <command>/usr/sbin/semanage</command>."

#. Tag: para #, no-c-format -msgid "" -"When changing the SELinux context with <command>/usr/sbin/semanage fcontext -" -"a</command>, use the full path to the file or directory to avoid files being " -"mislabeled after a file system relabel, or after the <command>/sbin/" -"restorecon</command> command is run." -msgstr "" +msgid "When changing the SELinux context with <command>/usr/sbin/semanage fcontext -a</command>, use the full path to the file or directory to avoid files being mislabeled after a file system relabel, or after the <command>/sbin/restorecon</command> command is run." +msgstr "При изменении контекста SELinux с помощью <command>/usr/sbin/semanage fcontext -a</command>, используйте полные пути к файлам или каталога для избежания ошибок после маркирования файловой системы, или после выполнения команды <command>/sbin/restorecon</command>."

#. Tag: title #, no-c-format msgid "The file_t and default_t Types" -msgstr "" +msgstr "Типы file_t и default_t"

#. Tag: para #, no-c-format -msgid "" -"For file systems that support extended attributes, when a file that lacks an " -"SELinux context on disk is accessed, it is treated as if it had a default " -"context as defined by SELinux policy. In common policies, this default " -"context uses the <computeroutput>file_t</computeroutput> type. This should " -"be the only use of this type, so that files without a context on disk can be " -"distinguished in policy, and generally kept inaccessible to confined " -"domains. The <computeroutput>file_t</computeroutput> type should not exist " -"on correctly-labeled file systems, because all files on a system running " -"SELinux should have an SELinux context, and the <computeroutput>file_t</" -"computeroutput> type is never used in file-context configuration<footnote> " -"<para> Files in <filename>/etc/selinux/targeted/contexts/files/</filename> " -"define contexts for files and directories. Files in this directory are read " -"by <command>restorecon</command> and <command>setfiles</command> to restore " -"files and directories to their default contexts. </para> </footnote>." -msgstr "" +msgid "For file systems that support extended attributes, when a file that lacks an SELinux context on disk is accessed, it is treated as if it had a default context as defined by SELinux policy. In common policies, this default context uses the <computeroutput>file_t</computeroutput> type. This should be the only use of this type, so that files without a context on disk can be distinguished in policy, and generally kept inaccessible to confined domains. The <computeroutput>file_t</computeroutput> type should not exist on correctly-labeled file systems, because all files on a system running SELinux should have an SELinux context, and the <computeroutput>file_t</computeroutput> type is never used in file-context configuration<footnote> <para> Files in <filename>/etc/selinux/targeted/contexts/files/</filename> define contexts for files and directories. Files in this directory are read by <command>restorecon</command> and <command>setfiles</command> to restore files and directo ries to their default contexts. </para> </footnote>." +msgstr "Для файловых систем, поддерживающих расширенные атрибуты, при запрос на доступ к файлу, у которого нет метки с контекстом SELinux, такой файл трактуется, таким образом, как если ему назначен контекст SELinux по умолчанию. В большинстве политик, такой контекст по умолчанию использует тип <computeroutput>file_t</computeroutput>. Это должно быть единственным способом использования такого типа, таким образом файлы без контекста могут быть определены для политики и стать недоступными для ограниченных (confined) доменов. Тип <computeroutput>file_t</computeroutput> не должен существ� �вать на корректно маркированных файловых системах, потому что все файлы в операционных системах с включенным SELinux должны иметь контекст SELinux и тип <computeroutput>file_t</computeroutput> никогда не должен использоваться в конфигурации контекстов файлов<footnote> <para> Файлы в <filename>/etc/selinux/targeted/contexts/files/</filename> определяют контексты для файлов и каталогов. К файлам в этом каталоге обращаются <command>restorecon</command> и <command>setfiles</command> для восстановления файлов и каталогов к контекстам по умолчанию. </para> </footnote>."

#. Tag: para #, no-c-format -msgid "" -"The <computeroutput>default_t</computeroutput> type is used on files that do " -"not match any other pattern in file-context configuration, so that such " -"files can be distinguished from files that do not have a context on disk, " -"and generally kept inaccessible to confined domains. If you create a new top-" -"level directory, such as <filename>/mydirectory/</filename>, this directory " -"may be labeled with the <computeroutput>default_t</computeroutput> type. If " -"services need access to such a directory, update the file-contexts " -"configuration for this location. Refer to <xref linkend="sect-Security-" -"Enhanced_Linux-SELinux_Contexts_Labeling_Files-" -"Persistent_Changes_semanage_fcontext" /> for details on adding a context to " -"the file-context configuration." -msgstr "" +msgid "The <computeroutput>default_t</computeroutput> type is used on files that do not match any other pattern in file-context configuration, so that such files can be distinguished from files that do not have a context on disk, and generally kept inaccessible to confined domains. If you create a new top-level directory, such as <filename>/mydirectory/</filename>, this directory may be labeled with the <computeroutput>default_t</computeroutput> type. If services need access to such a directory, update the file-contexts configuration for this location. Refer to <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" /> for details on adding a context to the file-context configuration." +msgstr "Тип <computeroutput>default_t</computeroutput> используется для файлов, которые не принадлежат ни к одному шаблону конфигурации контекста, таким образом, файлы могут быть отделены от файлов, у которых нет контекста, и быть недоступными для ограниченных доменов, если вы создаете новый каталог на уровне корня, такой как <filename>/mydirectory/</filename>, то этот каталог будет помечен типом <computeroutput>default_t</computeroutput>. Если к этому каталогу необходим доступ службам, измените файловый контекст для этого каталога. Дополнительная информация о добавлении файлового контекста доступна по ссылке <xref linkend="sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext" />."

#. Tag: title #, no-c-format msgid "Mounting File Systems" -msgstr "" +msgstr "Монтирование файловых систем"

#. Tag: para #, no-c-format -msgid "" -"By default, when a file system that supports extended attributes is mounted, " -"the security context for each file is obtained from the <emphasis>security." -"selinux</emphasis> extended attribute of the file. Files in file systems " -"that do not support extended attributes are assigned a single, default " -"security context from the policy configuration, based on file system type." -msgstr "" +msgid "By default, when a file system that supports extended attributes is mounted, the security context for each file is obtained from the <emphasis>security.selinux</emphasis> extended attribute of the file. Files in file systems that do not support extended attributes are assigned a single, default security context from the policy configuration, based on file system type." +msgstr "По умолчанию, когда монтируется файловая система, поддерживающая расширенные атрибуты, контекст безопасности для каждого файла получается из расширенного атрибута <emphasis>security.selinux</emphasis> файла. Файлам в файловой системе, не имеющих расширенных атрибутов, присваивается контекст безопасности по умолчанию, в соотвествтии с политикой безопасности, в зависмости от типа файловой системы."

#. Tag: para #, no-c-format -msgid "" -"Use the <command>mount -o context</command> command to override existing " -"extended attributes, or to specify a different, default context for file " -"systems that do not support extended attributes. This is useful if you do " -"not trust a file system to supply the correct attributes, for example, " -"removable media used in multiple systems. The <command>mount -o context</" -"command> command can also be used to support labeling for file systems that " -"do not support extended attributes, such as File Allocation Table (FAT) or " -"NFS file systems. The context specified with the <option>context</option> is " -"not written to disk: the original contexts are preserved, and are seen when " -"mounting without a <option>context</option> option (if the file system had " -"extended attributes in the first place)." -msgstr "" +msgid "Use the <command>mount -o context</command> command to override existing extended attributes, or to specify a different, default context for file systems that do not support extended attributes. This is useful if you do not trust a file system to supply the correct attributes, for example, removable media used in multiple systems. The <command>mount -o context</command> command can also be used to support labeling for file systems that do not support extended attributes, such as File Allocation Table (FAT) or NFS file systems. The context specified with the <option>context</option> is not written to disk: the original contexts are preserved, and are seen when mounting without a <option>context</option> option (if the file system had extended attributes in the first place)." +msgstr "Используйте команду <command>mount -o context</command> для переопределения существующих атрибутов, или укажите другой контекст по умолчанию для файловых систем, не поддерживающих расширенные атрибуты. Это полезно, если используются не доверенные файловые системы для получения расширенных атрибутов, например, сменных носителей, используемых в различных системах. Команда <command>mount -o context</command> может также использоваться для установки меток для файловых систем, которые не поддерживают расширенные атрибуты, такие как File Allocation Table (FAT) или NFS. Контек ст указанный опцией <option>context</option> не записывается на диск: исходный контекст сохраняется и виден, если файловая система подключена без опции <option>context</option> (если у файловой системы есть расширенные атрибуты, в корректном порядке)."

#. Tag: para #, no-c-format -msgid "" -"For further information about file system labeling, refer to James Morris's " -""Filesystem Labeling in SELinux" article: <ulink url="http://www." -"linuxjournal.com/article/7426" />." -msgstr "" +msgid "For further information about file system labeling, refer to James Morris's "Filesystem Labeling in SELinux" article: <ulink url="http://www.linuxjournal.com/article/7426%5C" />." +msgstr "Дополнительная информации о метках файловых систем, доступна по ссылке James Morris's "Filesystem Labeling in SELinux" article: <ulink url="http://www.linuxjournal.com/article/7426%5C" />."

#. Tag: title #, no-c-format msgid "Context Mounts" -msgstr "" +msgstr "Монтирование контекста"

#. Tag: para #, no-c-format -msgid "" -"To mount a file system with the specified context, overriding existing " -"contexts if they exist, or to specify a different, default context for a " -"file system that does not support extended attributes, as the Linux root " -"user, use the <command>mount -o context=<replaceable>SELinux_user:role:type:" -"level</replaceable></command> command when mounting the desired file system. " -"Context changes are not written to disk. By default, NFS mounts on the " -"client side are labeled with a default context defined by policy for NFS " -"file systems. In common policies, this default context uses the " -"<computeroutput>nfs_t</computeroutput> type. Without additional mount " -"options, this may prevent sharing NFS file systems via other services, such " -"as the Apache HTTP Server. The following example mounts an NFS file system " -"so that it can be shared via the Apache HTTP Server:" -msgstr "" +msgid "To mount a file system with the specified context, overriding existing contexts if they exist, or to specify a different, default context for a file system that does not support extended attributes, as the Linux root user, use the <command>mount -o context=<replaceable>SELinux_user:role:type:level</replaceable></command> command when mounting the desired file system. Context changes are not written to disk. By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Without additional mount options, this may prevent sharing NFS file systems via other services, such as the Apache HTTP Server. The following example mounts an NFS file system so that it can be shared via the Apache HTTP Server:" +msgstr "Для монтирования файловой системы с определенным контекстом, переопределяющим уже существующий контекст или указывающий другой контекст по умолчанию для файловой системы, не использующей расширенные атрибуты, от имени пользователя root используется команда <command>mount -o context=<replaceable>SELinux_user:role:type:level</replaceable></command> для подключения нужной файловой системы. Изменения контекста не записываются на диск. По умолчанию, при монтировании NFS на стороне клиента, файловой системе присваивается контекст, назначенный политикой для файловых систем NFS. В большинстве политик, этот контекст использует тип <computeroutput>nfs_t</computeroutput>. Без дополнительных опций монтирования, такой тип, может привести к отказам в доступе к файловым системам NFS для других служб, таких как Apache HTTP Server. В следующем примере, показывается как монтировать файловую систему NFS так, чтобы предоставлялся доступ для Apache HTTP Server:"

#. Tag: para #, no-c-format -msgid "" -"Newly-created files and directories on this file system appear to have the " -"SELinux context specified with <option>-o context</option>; however, since " -"context changes are not written to disk for these situations, the context " -"specified with the <option>context</option> option is only retained if the " -"<option>context</option> option is used on the next mount, and if the same " -"context is specified." -msgstr "" +msgid "Newly-created files and directories on this file system appear to have the SELinux context specified with <option>-o context</option>; however, since context changes are not written to disk for these situations, the context specified with the <option>context</option> option is only retained if the <option>context</option> option is used on the next mount, and if the same context is specified." +msgstr "Вновь созданные файлы и директории в этих файловых системах появляются с контекстом, указанным опцией <option>-o context</option>: однако, так как изменения контекста не записываются на диск, то для таких ситуаций, контекст указанный опцией <option>context</option> сохраняется, только если опция <option>context</option> используется при следующем монтировании и с указанием того же самого контекста."

#. Tag: para #, no-c-format -msgid "" -"Type Enforcement is the main permission control used in SELinux targeted " -"policy. For the most part, SELinux users and roles can be ignored, so, when " -"overriding the SELinux context with <option>-o context</option>, use the " -"SELinux <computeroutput>system_u</computeroutput> user and " -"<computeroutput>object_r</computeroutput> role, and concentrate on the type. " -"If you are not using the MLS policy or multi-category security, use the " -"<computeroutput>s0</computeroutput> level." -msgstr "" +msgid "Type Enforcement is the main permission control used in SELinux targeted policy. For the most part, SELinux users and roles can be ignored, so, when overriding the SELinux context with <option>-o context</option>, use the SELinux <computeroutput>system_u</computeroutput> user and <computeroutput>object_r</computeroutput> role, and concentrate on the type. If you are not using the MLS policy or multi-category security, use the <computeroutput>s0</computeroutput> level." +msgstr "Type Enforcement - это основное средство управления используемое в целевой политике targeted SELinux. В большинстве ситуаций, роли и пользователи SELinux игнорируются, таким образом при переназначении контекста опцией <option>-o context</option>, используйте пользователя SELinux <computeroutput>system_u</computeroutput> и роль <computeroutput>object_r</computeroutput>, и сконцентрируйтесь на типе. Если не используется политика MLS или мульти-категорийная политика безопасности, используйте уровень <computeroutput>s0</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"When a file system is mounted with a <option>context</option> option, " -"context changes (by users and processes) are prohibited. For example, " -"running <command>chcon</command> on a file system mounted with a " -"<option>context</option> option results in a <computeroutput>Operation not " -"supported</computeroutput> error." -msgstr "" +msgid "When a file system is mounted with a <option>context</option> option, context changes (by users and processes) are prohibited. For example, running <command>chcon</command> on a file system mounted with a <option>context</option> option results in a <computeroutput>Operation not supported</computeroutput> error." +msgstr "Когда файловая система монтирована с опцией <option>context</option>, изменения контекста (пользователями и процессами) запрещаются. Например, выполнение <command>chcon</command> на файловой системе, монтированной с опцией <option>context</option> завершится с ошибкой <computeroutput>Operation not supported</computeroutput>."

#. Tag: title #, no-c-format msgid "Changing the Default Context" -msgstr "" +msgstr "Изменение контекста по умолчанию"

#. Tag: para #, no-c-format -msgid "" -"As mentioned in <xref linkend="sect-Security-Enhanced_Linux-" -"Working_with_SELinux-The_file_t_and_default_t_Types" />, on file systems " -"that support extended attributes, when a file that lacks an SELinux context " -"on disk is accessed, it is treated as if it had a default context as defined " -"by SELinux policy. In common policies, this default context uses the " -"<computeroutput>file_t</computeroutput> type. If it is desirable to use a " -"different default context, mount the file system with the " -"<option>defcontext</option> option." -msgstr "" +msgid "As mentioned in <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-The_file_t_and_default_t_Types" />, on file systems that support extended attributes, when a file that lacks an SELinux context on disk is accessed, it is treated as if it had a default context as defined by SELinux policy. In common policies, this default context uses the <computeroutput>file_t</computeroutput> type. If it is desirable to use a different default context, mount the file system with the <option>defcontext</option> option." +msgstr "Как упоминается в <xref linkend="sect-Security-Enhanced_Linux-Working_with_SELinux-The_file_t_and_default_t_Types" />, в файловых системах, поддерживающих расширенные атрибуты, где при обращении к файлу, у которого нет контекста SELinux, к такому файлу обращаются как к файлу с контекстом SELinux по-умолчанию, установленному в политике SELinux. В большинстве политик, контекст по умолчанию использует тип <computeroutput>file_t</computeroutput>. Если желательно использовать другой контекст по-умолчанию, монтируйте файловую систему с опцией <option>defcontext</option>."

#. Tag: para #, no-c-format -msgid "" -"The following example mounts a newly-created file system (on <filename>/dev/" -"sda2</filename>) to the newly-created <filename>/test/</filename> directory. " -"It assumes that there are no rules in <filename>/etc/selinux/targeted/" -"contexts/files/</filename> that define a context for the <filename>/test/</" -"filename> directory:" -msgstr "" +msgid "The following example mounts a newly-created file system (on <filename>/dev/sda2</filename>) to the newly-created <filename>/test/</filename> directory. It assumes that there are no rules in <filename>/etc/selinux/targeted/contexts/files/</filename> that define a context for the <filename>/test/</filename> directory:" +msgstr "В следующем примере монтируется вновь созданная файловая система (на <filename>/dev/sda2</filename>) к вновь созданному каталогу <filename>/test/</filename>. Подразумевается что не создано правил в <filename>/etc/selinux/targeted/contexts/files/</filename>, определяющих контекст для каталога <filename>/test/</filename>:"

#. Tag: para #, no-c-format msgid "In this example:" -msgstr "" +msgstr "В этом примере:"

#. Tag: para #, no-c-format -msgid "" -"the <option>defcontext</option> option defines that <computeroutput>system_u:" -"object_r:samba_share_t:s0</computeroutput> is "the default security context " -"for unlabeled files"<footnote> <para> Morris, James. "Filesystem Labeling " -"in SELinux". Published 1 October 2004. Accessed 14 October 2008: <ulink url=" -""http://www.linuxjournal.com/article/7426%5C" />. </para> </footnote>." -msgstr "" +msgid "the <option>defcontext</option> option defines that <computeroutput>system_u:object_r:samba_share_t:s0</computeroutput> is "the default security context for unlabeled files"<footnote> <para> Morris, James. "Filesystem Labeling in SELinux". Published 1 October 2004. Accessed 14 October 2008: <ulink url="http://www.linuxjournal.com/article/7426%5C" />. </para> </footnote>." +msgstr "опция "

#. Tag: para #, no-c-format -msgid "" -"when mounted, the root directory (<filename>/test/</filename>) of the file " -"system is treated as if it is labeled with the context specified by " -"<option>defcontext</option> (this label is not stored on disk). This affects " -"the labeling for files created under <filename>/test/</filename>: new files " -"inherit the <computeroutput>samba_share_t</computeroutput> type, and these " -"labels are stored on disk." -msgstr "" +msgid "when mounted, the root directory (<filename>/test/</filename>) of the file system is treated as if it is labeled with the context specified by <option>defcontext</option> (this label is not stored on disk). This affects the labeling for files created under <filename>/test/</filename>: new files inherit the <computeroutput>samba_share_t</computeroutput> type, and these labels are stored on disk." +msgstr "когда монтирован, корневой каталог (<filename>/test/</filename>) файловой системы, ведет себя, как если бы он был помечен контекстом, указанным <option>defcontext</option> (эта метка не хранится на диске). Это действует на метки для файлов, созданных под <filename>/test/</filename>: новые файлы наследуют тип <computeroutput>samba_share_t</computeroutput>, и эти метки хранятся на диске."

#. Tag: para #, no-c-format -msgid "" -"files created under <filename>/test/</filename> while the file system was " -"mounted with a <option>defcontext</option> option retain their labels." -msgstr "" +msgid "files created under <filename>/test/</filename> while the file system was mounted with a <option>defcontext</option> option retain their labels." +msgstr "файлы, созданные под <filename>/test/</filename>, в то время, как файловая система монтирована с опцией <option>defcontext</option> сохраняют свои метки."

#. Tag: title #, no-c-format msgid "Mounting an NFS File System" -msgstr "" +msgstr "Монтирование файловой системы NFS"

#. Tag: para #, no-c-format -msgid "" -"By default, NFS mounts on the client side are labeled with a default context " -"defined by policy for NFS file systems. In common policies, this default " -"context uses the <computeroutput>nfs_t</computeroutput> type. Depending on " -"policy configuration, services, such as Apache HTTP Server and MySQL, may " -"not be able to read files labeled with the <computeroutput>nfs_t</" -"computeroutput> type. This may prevent file systems labeled with this type " -"from being mounted and then read or exported by other services." -msgstr "" +msgid "By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS file systems. In common policies, this default context uses the <computeroutput>nfs_t</computeroutput> type. Depending on policy configuration, services, such as Apache HTTP Server and MySQL, may not be able to read files labeled with the <computeroutput>nfs_t</computeroutput> type. This may prevent file systems labeled with this type from being mounted and then read or exported by other services." +msgstr "По умолчанию, монтирование NFS на стороне клиента маркируется контекстом по умолчанию, определенным для файловых систем NFS. В большинстве политик этот контекст по-умолчанию использует тип <computeroutput>nfs_t</computeroutput>. В зависимости от конфигурации политики, службы, такие как Apache HTTP Server и MySQL, могут не иметь возможности читать файлы помеченные типом <computeroutput>nfs_t</computeroutput>. Это может препятствовать монтированию, а затем чтению или экспортированию файловых систем с этим типом другими службами."

#. Tag: para #, no-c-format -msgid "" -"If you would like to mount an NFS file system and read or export that file " -"system with another service, use the <option>context</option> option when " -"mounting to override the <computeroutput>nfs_t</computeroutput> type. Use " -"the following context option to mount NFS file systems so that they can be " -"shared via the Apache HTTP Server:" -msgstr "" +msgid "If you would like to mount an NFS file system and read or export that file system with another service, use the <option>context</option> option when mounting to override the <computeroutput>nfs_t</computeroutput> type. Use the following context option to mount NFS file systems so that they can be shared via the Apache HTTP Server:" +msgstr "Если вы хотите монтировать файловую систему NFS, а затем предоставить возможность чтения или экспортирования файловой системы другой службе, используйте опцию <option>context</option>, когда монтирование перекрывает тип <computeroutput>nfs_t</computeroutput>. Используйте следующую опцию контекста для монтирования файловой системы NFS, так чтобы к ним мог быть предоставлен доступ через Apache HTTP Server:"

#. Tag: para #, no-c-format -msgid "" -"Since context changes are not written to disk for these situations, the " -"context specified with the <option>context</option> option is only retained " -"if the <option>context</option> option is used on the next mount, and if the " -"same context is specified." -msgstr "" +msgid "Since context changes are not written to disk for these situations, the context specified with the <option>context</option> option is only retained if the <option>context</option> option is used on the next mount, and if the same context is specified." +msgstr "Так как изменения контекста не записываются на диск в таких случаях, то контекст указанный опцией <option>context</option> сохранится, только в случае, если опция <option>context</option> используется при следующем монтировании и если указан тот же самый контекст."

#. Tag: para #, no-c-format -msgid "" -"As an alternative to mounting file systems with <option>context</option> " -"options, Booleans can be turned on to allow services access to file systems " -"labeled with the <computeroutput>nfs_t</computeroutput> type. Refer to <xref " -"linkend="sect-Security-Enhanced_Linux-Booleans-Booleans_for_NFS_and_CIFS" /" -"> for instructions on configuring Booleans to allow services access to the " -"<computeroutput>nfs_t</computeroutput> type." -msgstr "" +msgid "As an alternative to mounting file systems with <option>context</option> options, Booleans can be turned on to allow services access to file systems labeled with the <computeroutput>nfs_t</computeroutput> type. Refer to <xref linkend="sect-Security-Enhanced_Linux-Booleans-Booleans_for_NFS_and_CIFS" /> for instructions on configuring Booleans to allow services access to the <computeroutput>nfs_t</computeroutput> type." +msgstr "Как альтернатива опции монтирования файловых систем с опцией <option>context</option> , Булевы переключатели могут разрешать службам доступ к файловым система с типом <computeroutput>nfs_t</computeroutput>. Подробная информация в <xref linkend="sect-Security-Enhanced_Linux-Booleans-Booleans_for_NFS_and_CIFS" /> инструкции по конфигурировании Булевых переключателей для предоставления доступа службам к типу <computeroutput>nfs_t</computeroutput>."

#. Tag: title #, no-c-format msgid "Multiple NFS Mounts" -msgstr "" +msgstr "Многократное монтирование NFS"

#. Tag: para #, no-c-format -msgid "" -"When mounting multiple mounts from the same NFS export, attempting to " -"override the SELinux context of each mount with a different context, results " -"in subsequent mount commands failing. In the following example, the NFS " -"server has a single export, <filename>/export</filename>, which has two " -"subdirectories, <filename>web/</filename> and <filename>database/</" -"filename>. The following commands attempt two mounts from a single NFS " -"export, and try to override the context for each one:" -msgstr "" +msgid "When mounting multiple mounts from the same NFS export, attempting to override the SELinux context of each mount with a different context, results in subsequent mount commands failing. In the following example, the NFS server has a single export, <filename>/export</filename>, which has two subdirectories, <filename>web/</filename> and <filename>database/</filename>. The following commands attempt two mounts from a single NFS export, and try to override the context for each one:" +msgstr "При многократном монтировании NFS от одного и того же источника эскортирования NFS, попытка перекрывания контекста SELinux для каждого экземпляра монтирования, результат следующих монтирований будет ошибкой. В следующем примере, представлен один источник экспорта NFS, <filename>/export</filename>, у которого два подкатолога, <filename>web/</filename> и <filename>database/</filename>. Следующие команды пытаются выполнить два монтирования от одного NFS экспорта и переназначают контекст для каждого из них:"

#. Tag: para #, no-c-format -msgid "" -"The second mount command fails, and the following is logged to <filename>/" -"var/log/messages</filename>:" -msgstr "" +msgid "The second mount command fails, and the following is logged to <filename>/var/log/messages</filename>:" +msgstr "Вторая команда монтирования завершается с ошибкой и следующая запись журналируется в <filename>/var/log/messages</filename>:"

#. Tag: para #, no-c-format -msgid "" -"To mount multiple mounts from a single NFS export, with each mount having a " -"different context, use the <option>-o nosharecache,context</option> options. " -"The following example mounts multiple mounts from a single NFS export, with " -"a different context for each mount (allowing a single service access to each " -"one):" -msgstr "" +msgid "To mount multiple mounts from a single NFS export, with each mount having a different context, use the <option>-o nosharecache,context</option> options. The following example mounts multiple mounts from a single NFS export, with a different context for each mount (allowing a single service access to each one):" +msgstr "Для подключения нескольких монтирований одного NFS экспорта, с указанием разных контекстов для разных монтирований, используются опции <option>-o nosharecache,context</option>. В следующем примере множество монтирований одного NFS экспорта, с различными контекстами для каждого экземпляра монтирования (позволяющему доступ для одной службы к одному экземпляру монтирования):"

#. Tag: para #, no-c-format -msgid "" -"In this example, <computeroutput>server:/export/web</computeroutput> is " -"mounted locally to <filename>/local/web/</filename>, with all files being " -"labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"allowing Apache HTTP Server access. <computeroutput>server:/export/database</" -"computeroutput> is mounted locally to <filename>/local/database</filename>, " -"with all files being labeled with the <computeroutput>mysqld_db_t</" -"computeroutput> type, allowing MySQL access. These type changes are not " -"written to disk." -msgstr "" +msgid "In this example, <computeroutput>server:/export/web</computeroutput> is mounted locally to <filename>/local/web/</filename>, with all files being labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, allowing Apache HTTP Server access. <computeroutput>server:/export/database</computeroutput> is mounted locally to <filename>/local/database</filename>, with all files being labeled with the <computeroutput>mysqld_db_t</computeroutput> type, allowing MySQL access. These type changes are not written to disk." +msgstr "В этом примере, <computeroutput>server:/export/web</computeroutput> монтируется локально к <filename>/local/web/</filename>, со всеми файлами помеченными типом <computeroutput>httpd_sys_content_t</computeroutput>, позволяющему получать доступ Apache HTTP Server. <computeroutput>server:/export/database</computeroutput> монтирован локально к <filename>/local/database</filename>, со всеми файлами помеченными типом <computeroutput>mysqld_db_t</computeroutput>, позволяющим получать доступ MySQL. Эти изменения типов не записываются на диск."

#. Tag: para #, no-c-format -msgid "" -"The <option>nosharecache</option> options allows you to mount the same " -"subdirectory of an export multiple times with different contexts (for " -"example, mounting <filename>/export/web</filename> multiple times). Do not " -"mount the same subdirectory from an export multiple times with different " -"contexts, as this creates an overlapping mount, where files are accessible " -"under two different contexts." -msgstr "" +msgid "The <option>nosharecache</option> options allows you to mount the same subdirectory of an export multiple times with different contexts (for example, mounting <filename>/export/web</filename> multiple times). Do not mount the same subdirectory from an export multiple times with different contexts, as this creates an overlapping mount, where files are accessible under two different contexts." +msgstr "Опция <option>nosharecache</option> позволяет монтировать один и тот же подкатолог экспорта несколько раз с различными контекстами (например, монтировать <filename>/export/web</filename> несколько раз). Не монтируйте один и тот же подкаталог несколько раз с различными контекстами, так как это создаёт совмещение монтирований, где файлы доступны под двумя разными контекстами."

#. Tag: title #, no-c-format msgid "Making Context Mounts Persistent" -msgstr "" +msgstr "Создание постоянных контекстных монтирований"

#. Tag: para #, no-c-format -msgid "" -"To make context mounts persistent across remounting and reboots, add entries " -"for the file systems in <filename>/etc/fstab</filename> or an automounter " -"map, and use the desired context as a mount option. The following example " -"adds an entry to <filename>/etc/fstab</filename> for an NFS context mount:" -msgstr "" +msgid "To make context mounts persistent across remounting and reboots, add entries for the file systems in <filename>/etc/fstab</filename> or an automounter map, and use the desired context as a mount option. The following example adds an entry to <filename>/etc/fstab</filename> for an NFS context mount:" +msgstr "Для сохранения контекста постоянным при перемонтированиях и перезагрузках, необходимо добавить запись для файловых систем в <filename>/etc/fstab</filename> или в карту автомонтирования, и использовать нужные контекст как опцию монтирования. В следующем примере добавлена запись в <filename>/etc/fstab</filename> для монтирования NFS с нужным контекстом:"

#. Tag: para #, no-c-format -msgid "" -"Refer to the <ulink url="http://www.redhat.com/docs/en-US/" -"Red_Hat_Enterprise_Linux/5.2/html/Deployment_Guide/s1-nfs-client-config.html" -"">Red Hat Enterprise Linux 5 Deployment Guide, Section 19.2. "NFS Client " -"Configuration"</ulink> for information about mounting NFS file systems." -msgstr "" +msgid "Refer to the <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux 5 Deployment Guide, Section 19.2. "NFS Client Configuration"</ulink> for information about mounting NFS file systems." +msgstr "Дополнительная информация о монтировании файловых систем NFS <ulink url="http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.2/html/Deploymen... Hat Enterprise Linux 5 Deployment Guide, Section 19.2. "NFS Client Configuration"</ulink>."

#. Tag: title #, no-c-format msgid "Maintaining SELinux Labels" -msgstr "" +msgstr "Поддержка Меток SELinux"

#. Tag: para #, no-c-format -msgid "" -"These sections describe what happens to SELinux contexts when copying, " -"moving, and archiving files and directories. Also, it explains how to " -"preserve contexts when copying and archiving." -msgstr "" +msgid "These sections describe what happens to SELinux contexts when copying, moving, and archiving files and directories. Also, it explains how to preserve contexts when copying and archiving." +msgstr "В данном разделе описывается, что происходит с контекстами SELinux при копировании, перемещении и архивировании файлов и каталогов. Также, объясняется как предохранить контексты при копировании и архивировании."

#. Tag: title #, no-c-format msgid "Copying Files and Directories" -msgstr "" +msgstr "Копирование файлов и каталогов"

#. Tag: para #, no-c-format -msgid "" -"When a file or directory is copied, a new file or directory is created if it " -"does not exist. That new file or directory's context is based on default-" -"labeling rules, not the original file or directory's context (unless options " -"were used to preserve the original context). For example, files created in " -"user home directories are labeled with the <computeroutput>user_home_t</" -"computeroutput> type:" -msgstr "" +msgid "When a file or directory is copied, a new file or directory is created if it does not exist. That new file or directory's context is based on default-labeling rules, not the original file or directory's context (unless options were used to preserve the original context). For example, files created in user home directories are labeled with the <computeroutput>user_home_t</computeroutput> type:" +msgstr "Когда файл или каталог копируются, то создаётся новый файл или каталог, если он не существует. Контекст нового файла или каталога основан на правилах создания контекста по-умолчанию, а не на контексте исходного файла или каталога (если не используется опция для сохранения исходного контекста). Например, файлы созданные в домашнем каталоге пользователя маркируются типом <computeroutput>user_home_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"If such a file is copied to another directory, such as <filename>/etc/</" -"filename>, the new file is created in accordance to default-labeling rules " -"for the <filename>/etc/</filename> directory. Copying a file (without " -"additional options) may not preserve the original context:" -msgstr "" +msgid "If such a file is copied to another directory, such as <filename>/etc/</filename>, the new file is created in accordance to default-labeling rules for the <filename>/etc/</filename> directory. Copying a file (without additional options) may not preserve the original context:" +msgstr "Если такой файл копируется в другой каталог, такой как <filename>/etc/</filename>, новый файл создаётся в соответствии с правилами контекста по умолчанию для каталога <filename>/etc/</filename>. Копирование файла (без дополнительных опций), может не сохранить исходный контекст:"

#. Tag: para #, no-c-format -msgid "" -"When <filename>file1</filename> is copied to <filename>/etc/</filename>, if " -"<filename>/etc/file1</filename> does not exist, <filename>/etc/file1</" -"filename> is created as a new file. As shown in the example above, " -"<filename>/etc/file1</filename> is labeled with the <computeroutput>etc_t</" -"computeroutput> type, in accordance to default-labeling rules." -msgstr "" +msgid "When <filename>file1</filename> is copied to <filename>/etc/</filename>, if <filename>/etc/file1</filename> does not exist, <filename>/etc/file1</filename> is created as a new file. As shown in the example above, <filename>/etc/file1</filename> is labeled with the <computeroutput>etc_t</computeroutput> type, in accordance to default-labeling rules." +msgstr "Когда <filename>file1</filename> копируется в <filename>/etc/</filename>, если <filename>/etc/file1</filename> не существует, то <filename>/etc/file1</filename> создается как новый файл"

#. Tag: para #, no-c-format -msgid "" -"When a file is copied over an existing file, the existing file's context is " -"preserved, unless the user specified <command>cp</command> options to " -"preserve the context of the original file, such as <option>--" -"preserve=context</option>. SELinux policy may prevent contexts from being " -"preserved during copies." -msgstr "" +msgid "When a file is copied over an existing file, the existing file's context is preserved, unless the user specified <command>cp</command> options to preserve the context of the original file, such as <option>--preserve=context</option>. SELinux policy may prevent contexts from being preserved during copies." +msgstr "Когда файл копируется поверх существующего файла, существующий контекст файла сохраняется, если пользователь не укажет опции <command>cp</command> для сохранения контекста указанного файла, такую как <option>--preserve=context</option>. Политика SELinux может ограничивать контекст, от сохранения при копировании."

#. Tag: title #, no-c-format msgid "Copying Without Preserving SELinux Contexts" -msgstr "" +msgstr "Копирование без сохранения контекста SELinux"

#. Tag: para #, no-c-format -msgid "" -"When copying a file with the <command>cp</command> command, if no options " -"are given, the type is inherited from the targeted, parent directory:" -msgstr "" +msgid "When copying a file with the <command>cp</command> command, if no options are given, the type is inherited from the targeted, parent directory:" +msgstr "При копировании файла с помощью команды <command>cp</command>, если не указывается никаких опций, тип наследуется от целевого родительского каталога:"

#. Tag: para #, no-c-format -msgid "" -"In this example, <filename>file1</filename> is created in a user's home " -"directory, and is labeled with the <computeroutput>user_home_t</" -"computeroutput> type. The <filename>/var/www/html/</filename> directory is " -"labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"as shown with the <command>ls -dZ /var/www/html/</command> command. When " -"<filename>file1</filename> is copied to <filename>/var/www/html/</filename>, " -"it inherits the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"as shown with the <command>ls -Z /var/www/html/file1</command> command." -msgstr "" +msgid "In this example, <filename>file1</filename> is created in a user's home directory, and is labeled with the <computeroutput>user_home_t</computeroutput> type. The <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -dZ /var/www/html/</command> command. When <filename>file1</filename> is copied to <filename>/var/www/html/</filename>, it inherits the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -Z /var/www/html/file1</command> command." +msgstr "В этом примере, <filename>file1</filename> создается в домашнем каталоге пользователя и помечен типом <computeroutput>user_home_t</computeroutput>. Каталог <filename>/var/www/html/</filename> помечен типом <computeroutput>httpd_sys_content_t</computeroutput>, как показывается в выводе команды <command>ls -dZ /var/www/html/</command>. Когда <filename>file1</filename> копируется в <filename>/var/www/html/</filename> он наследует тип <computeroutput>httpd_sys_content_t</computeroutput>, как показано в выводе команды <command>ls -Z /var/www/html/file1</command>."

#. Tag: title #, no-c-format msgid "Preserving SELinux Contexts When Copying" -msgstr "" +msgstr "Сохранение контекстов SELinux при копировании"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>cp --preserve=context</command> command to preserve " -"contexts when copying:" -msgstr "" +msgid "Use the <command>cp --preserve=context</command> command to preserve contexts when copying:" +msgstr "Используйте команду <command>cp --preserve=context</command> для сохранения контекста при копировании:"

#. Tag: para #, no-c-format -msgid "" -"In this example, <filename>file1</filename> is created in a user's home " -"directory, and is labeled with the <computeroutput>user_home_t</" -"computeroutput> type. The <filename>/var/www/html/</filename> directory is " -"labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, " -"as shown with the <command>ls -dZ /var/www/html/</command> command. Using " -"the <option>--preserve=context</option> option preserves SELinux contexts " -"during copy operations. As shown with the <command>ls -Z /var/www/html/" -"file1</command> command, the <filename>file1</filename> " -"<computeroutput>user_home_t</computeroutput> type was preserved when the " -"file was copied to <filename>/var/www/html/</filename>." -msgstr "" +msgid "In this example, <filename>file1</filename> is created in a user's home directory, and is labeled with the <computeroutput>user_home_t</computeroutput> type. The <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type, as shown with the <command>ls -dZ /var/www/html/</command> command. Using the <option>--preserve=context</option> option preserves SELinux contexts during copy operations. As shown with the <command>ls -Z /var/www/html/file1</command> command, the <filename>file1</filename> <computeroutput>user_home_t</computeroutput> type was preserved when the file was copied to <filename>/var/www/html/</filename>." +msgstr "В этом примере, <filename>file1</filename> создаётся в домашнем каталоге пользователя, и помечен типом <computeroutput>user_home_t</computeroutput>. Каталог <filename>/var/www/html/</filename> помечен типом <computeroutput>httpd_sys_content_t</computeroutput>, как показано в выводе команды <command>ls -dZ /var/www/html/</command>. Используя опцию <option>--preserve=context</option> сохраняется контекст SELinux во время операции копирования. Как показано в выводе команды <command>ls -Z /var/www/html/file1</command>, тип файла <filename>file1</filename> <computeroutput>user_home_t</computeroutput>, сохранен после копирования в <filename>/var/www/html/</filename>."

#. Tag: title #, no-c-format msgid "Copying and Changing the Context" -msgstr "" +msgstr "Копирование с изменением контекста"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>cp -Z</command> command to change the destination copy's " -"context. The following example was performed in the user's home directory:" -msgstr "" +msgid "Use the <command>cp -Z</command> command to change the destination copy's context. The following example was performed in the user's home directory:" +msgstr "Используйте команду <command>cp -Z</command> для изменения целевого контекста при копировании. В следующем примере выполнено копирование в домашний каталог пользователя:"

#. Tag: para #, no-c-format -msgid "" -"In this example, the context is defined with the <option>-Z</option> option. " -"Without the <option>-Z</option> option, <filename>file2</filename> would be " -"labeled with the <computeroutput>unconfined_u:object_r:user_home_t</" -"computeroutput> context." -msgstr "" +msgid "In this example, the context is defined with the <option>-Z</option> option. Without the <option>-Z</option> option, <filename>file2</filename> would be labeled with the <computeroutput>unconfined_u:object_r:user_home_t</computeroutput> context." +msgstr "В этом примере, контекст определен опцией <option>-Z</option>. Без опции <option>-Z</option> файл <filename>file2</filename> будет помечен контекстом <computeroutput>unconfined_u:object_r:user_home_t</computeroutput>."

#. Tag: title #, no-c-format msgid "Copying a File Over an Existing File" -msgstr "" +msgstr "Копирования файла поверх существующего файла"

#. Tag: para #, no-c-format -msgid "" -"When a file is copied over an existing file, the existing file's context is " -"preserved (unless an option is used to preserve contexts). For example:" -msgstr "" +msgid "When a file is copied over an existing file, the existing file's context is preserved (unless an option is used to preserve contexts). For example:" +msgstr "Когда файл копируется поверх существующего файла, контекст существующего файла сохраняется (если не указывается опция preserve context). Например:"

#. Tag: para #, no-c-format -msgid "" -"In this example, two files are created: <filename>/etc/file1</filename>, " -"labeled with the <computeroutput>etc_t</computeroutput> type, and <filename>/" -"tmp/file2</filename>, labeled with the <computeroutput>user_tmp_t</" -"computeroutput> type. The <command>cp /tmp/file2 /etc/file1</command> " -"command overwrites <filename>file1</filename> with <filename>file2</" -"filename>. After copying, the <command>ls -Z /etc/file1</command> command " -"shows <filename>file1</filename> labeled with the <computeroutput>etc_t</" -"computeroutput> type, not the <computeroutput>user_tmp_t</computeroutput> " -"type from <filename>/tmp/file2</filename> that replaced <filename>/etc/" -"file1</filename>." -msgstr "" +msgid "In this example, two files are created: <filename>/etc/file1</filename>, labeled with the <computeroutput>etc_t</computeroutput> type, and <filename>/tmp/file2</filename>, labeled with the <computeroutput>user_tmp_t</computeroutput> type. The <command>cp /tmp/file2 /etc/file1</command> command overwrites <filename>file1</filename> with <filename>file2</filename>. After copying, the <command>ls -Z /etc/file1</command> command shows <filename>file1</filename> labeled with the <computeroutput>etc_t</computeroutput> type, not the <computeroutput>user_tmp_t</computeroutput> type from <filename>/tmp/file2</filename> that replaced <filename>/etc/file1</filename>." +msgstr "В этом примере создаются два файла: <filename>/etc/file1</filename>, помеченный типом <computeroutput>etc_t</computeroutput> и <filename>/tmp/file2</filename>, помеченный типом <computeroutput>user_tmp_t</computeroutput>. Команда <command>cp /tmp/file2 /etc/file1</command> перезаписывает файл <filename>file1</filename> файлом <filename>file2</filename>. После копирования команда <command>ls -Z /etc/file1</command> показывает, что <filename>file1</filename> помечен типом <computeroutput>etc_t</computeroutput>, а не <computeroutput>user_tmp_t</computeroutput> от <filename>/tmp/file2</filename>, который заменил <filename>/etc/file1</filename>."

#. Tag: para #, no-c-format -msgid "" -"Copy files and directories, rather than moving them. This helps ensure they " -"are labeled with the correct SELinux contexts. Incorrect SELinux contexts " -"can prevent processes from accessing such files and directories." -msgstr "" +msgid "Copy files and directories, rather than moving them. This helps ensure they are labeled with the correct SELinux contexts. Incorrect SELinux contexts can prevent processes from accessing such files and directories." +msgstr "Копируйте файлы и каталоги, вместо того. чтобы перемещать (moving) их. Это поможет удостовериться, что они помечены корректным контекстом SELinux. Некорректный контекст SELinux может ограничить доступ к таким файлам и каталогам."

#. Tag: title #, no-c-format msgid "Moving Files and Directories" -msgstr "" +msgstr "Перемещение (Moving) файлов и каталогов"

#. Tag: para #, no-c-format -msgid "" -"File and directories keep their current SELinux context when they are moved. " -"In many cases, this is incorrect for the location they are being moved to. " -"The following example demonstrates moving a file from a user's home " -"directory to <filename>/var/www/html/</filename>, which is used by the " -"Apache HTTP Server. Since the file is moved, it does not inherit the correct " -"SELinux context:" -msgstr "" +msgid "File and directories keep their current SELinux context when they are moved. In many cases, this is incorrect for the location they are being moved to. The following example demonstrates moving a file from a user's home directory to <filename>/var/www/html/</filename>, which is used by the Apache HTTP Server. Since the file is moved, it does not inherit the correct SELinux context:" +msgstr "Файлы и каталоги сохраняют свой текущий контекст SELinux при перемещении. В большинстве случаев, это некорректно к расположению куда они перемещаются. В следующем примере демонстрируется перемещение файла и домашнего каталога пользователя в каталог <filename>/var/www/html/</filename>, который использует Apache HTTP Server. Так как файл перемещается он не наследует корректный контекст SELinux:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd</command> command without any arguments to change into " -"your home directory. Once in your home directory, run the <command>touch " -"file1</command> command to create a file. This file is labeled with the " -"<computeroutput>user_home_t</computeroutput> type:" -msgstr "" +msgid "Run the <command>cd</command> command without any arguments to change into your home directory. Once in your home directory, run the <command>touch file1</command> command to create a file. This file is labeled with the <computeroutput>user_home_t</computeroutput> type:" +msgstr "Выполните команду <command>cd</command> без аргументов для перехода в домашний каталог. После того, как вы перешли в домашний каталог, выполните команду <command>touch file1</command> для создания файла. Этот файл помечен типом <computeroutput>user_home_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -dZ /var/www/html/</command> command to view the SELinux " -"context of the <filename>/var/www/html/</filename> directory:" -msgstr "" +msgid "Run the <command>ls -dZ /var/www/html/</command> command to view the SELinux context of the <filename>/var/www/html/</filename> directory:" +msgstr "Выполните команду <command>ls -dZ /var/www/html/</command> для просмотра контекста SELinux каталога <filename>/var/www/html/</filename>:"

#. Tag: para #, no-c-format -msgid "" -"By default, the <filename>/var/www/html/</filename> directory is labeled " -"with the <computeroutput>httpd_sys_content_t</computeroutput> type. Files " -"and directories created under the <filename>/var/www/html/</filename> " -"directory inherit this type, and as such, they are labeled with this type." -msgstr "" +msgid "By default, the <filename>/var/www/html/</filename> directory is labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type. Files and directories created under the <filename>/var/www/html/</filename> directory inherit this type, and as such, they are labeled with this type." +msgstr "По умолчанию каталог <filename>/var/www/html/</filename> помечен типом <computeroutput>httpd_sys_content_t</computeroutput>. Файлы и каталоги созданные в каталоге <filename>/var/www/html/</filename> наследуют этот тип, и как следствие, перемаркируются этим типом."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mv file1 /var/www/html/</command> " -"command to move <filename>file1</filename> to the <filename>/var/www/html/</" -"filename> directory. Since this file is moved, it keeps its current " -"<computeroutput>user_home_t</computeroutput> type:" -msgstr "" +msgid "As the Linux root user, run the <command>mv file1 /var/www/html/</command> command to move <filename>file1</filename> to the <filename>/var/www/html/</filename> directory. Since this file is moved, it keeps its current <computeroutput>user_home_t</computeroutput> type:" +msgstr "От имени пользователя root, выполните команду <command>mv file1 /var/www/html/</command> для перемещения <filename>file1</filename> в каталог <filename>/var/www/html/</filename>. Так как файл перемещается, то он сохраняет тип <computeroutput>user_home_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"By default, the Apache HTTP Server can not read files that are labeled with " -"the <computeroutput>user_home_t</computeroutput> type. If all files " -"comprising a web page are labeled with the <computeroutput>user_home_t</" -"computeroutput> type, or another type that the Apache HTTP Server can not " -"read, permission is denied when attempting to access them via Firefox or " -"text-based Web browsers." -msgstr "" +msgid "By default, the Apache HTTP Server can not read files that are labeled with the <computeroutput>user_home_t</computeroutput> type. If all files comprising a web page are labeled with the <computeroutput>user_home_t</computeroutput> type, or another type that the Apache HTTP Server can not read, permission is denied when attempting to access them via Firefox or text-based Web browsers." +msgstr "По умолчанию Apache HTTP Server не может читать файлы помеченные типом <computeroutput>user_home_t</computeroutput>. Если все файлы относящиеся к веб странице помечены типом <computeroutput>user_home_t</computeroutput> или другим типом, который Apache HTTP Server не имеет права читать, разрешение запрещает доступ к ним через Firefox или другие браузеры."

#. Tag: para #, no-c-format -msgid "" -"Moving files and directories with the <command>mv</command> command may " -"result in the wrong SELinux context, preventing processes, such as the " -"Apache HTTP Server and Samba, from accessing such files and directories." -msgstr "" +msgid "Moving files and directories with the <command>mv</command> command may result in the wrong SELinux context, preventing processes, such as the Apache HTTP Server and Samba, from accessing such files and directories." +msgstr "Перемещение файлов и каталогов с помощью команды <command>mv</command> может привести к некорректному контексту SELinux, ограничивая доступ процессам, таким как Apache HTTP Server и Samba, к файлам и каталогам "

#. Tag: title #, no-c-format msgid "Checking the Default SELinux Context" -msgstr "" +msgstr "Изменение контекста SELinux по умолчанию"

#. Tag: para #, no-c-format -msgid "" -"Use the <command>/usr/sbin/matchpathcon</command> command to check if files " -"and directories have the correct SELinux context. From the" -msgstr "" +msgid "Use the <command>/usr/sbin/matchpathcon</command> command to check if files and directories have the correct SELinux context. From the" +msgstr "Используйте команду <command>/usr/sbin/matchpathcon</command> для проверки имеют ли файлы и каталоги корректный контекст SELinux. Из:"

#. Tag: refentrytitle #, no-c-format msgid "matchpathcon" -msgstr "" +msgstr "matchpathcon"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page: "<command>matchpathcon</command> queries the system policy and " -"outputs the default security context associated with the file path." -""<footnote> <para> The <citerefentry><refentrytitle>matchpathcon</" -"refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as " -"shipped with the <package>libselinux-utils</package> package in Fedora, is " -"written by Daniel Walsh. Any edits or changes in this version were done by " -"Murray McAllister. </para> </footnote>. The following example demonstrates " -"using the <command>/usr/sbin/matchpathcon</command> command to verify that " -"files in <filename>/var/www/html/</filename> directory are labeled correctly:" -msgstr "" +msgid "manual page: "<command>matchpathcon</command> queries the system policy and outputs the default security context associated with the file path."<footnote> <para> The <citerefentry><refentrytitle>matchpathcon</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, as shipped with the <package>libselinux-utils</package> package in Fedora, is written by Daniel Walsh. Any edits or changes in this version were done by Murray McAllister. </para> </footnote>. The following example demonstrates using the <command>/usr/sbin/matchpathcon</command> command to verify that files in <filename>/var/www/html/</filename> directory are labeled correctly:" +msgstr "manual page: "<command>matchpathcon</command> queries the system policy and outputs the default security context associated with the file path."<footnote> <para> <citerefentry><refentrytitle>matchpathcon</refentrytitle><manvolnum>8</manvolnum></citerefentry> manual page, поставляемая с пакетом <package>libselinux-utils</package> в Fedora, написанная Daniel Walsh. Любые изменения или поправки в этой версии выполнены Murray McAllister. </para> </footnote>. Следующий пример демонстрирует использование команды <command>/usr/sbin/matchpathcon</command> для проверки файлов в каталоге <filename>/var/www/html/</filename> на корректные метки:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>touch /var/www/html/file{1,2,3}</" -"command> command to create three files (<filename>file1</filename>, " -"<filename>file2</filename>, and <filename>file3</filename>). These files " -"inherit the <computeroutput>httpd_sys_content_t</computeroutput> type from " -"the <filename>/var/www/html/</filename> directory:" -msgstr "" +msgid "As the Linux root user, run the <command>touch /var/www/html/file{1,2,3}</command> command to create three files (<filename>file1</filename>, <filename>file2</filename>, and <filename>file3</filename>). These files inherit the <computeroutput>httpd_sys_content_t</computeroutput> type from the <filename>/var/www/html/</filename> directory:" +msgstr "От имени пользователя root, выполните команду <command>touch /var/www/html/file{1,2,3}</command> для создания трёх файлов (<filename>file1</filename>, <filename>file2</filename>, и <filename>file3</filename>). Эти файлы наследуют тип <computeroutput>httpd_sys_content_t</computeroutput> от каталога <filename>/var/www/html/</filename>:"

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>chcon -t samba_share_t /var/www/" -"html/file1</command> command to change the <filename>file1</filename> type " -"to <computeroutput>samba_share_t</computeroutput>. Note: the Apache HTTP " -"Server can not read files or directories labeled with the " -"<computeroutput>samba_share_t</computeroutput> type." -msgstr "" +msgid "As the Linux root user, run the <command>chcon -t samba_share_t /var/www/html/file1</command> command to change the <filename>file1</filename> type to <computeroutput>samba_share_t</computeroutput>. Note: the Apache HTTP Server can not read files or directories labeled with the <computeroutput>samba_share_t</computeroutput> type." +msgstr "От имени пользователя root, выполните команду <command>chcon -t samba_share_t /var/www/html/file1</command> для изменения типа файла <filename>file1</filename> на <computeroutput>samba_share_t</computeroutput>. Примечание: Apache HTTP Server не может читать файлы и каталоги помеченные типом <computeroutput>samba_share_t</computeroutput>."

#. Tag: para #, no-c-format -msgid "" -"The <command>/usr/sbin/matchpathcon</command> <option>-V</option> option " -"compares the current SELinux context to the correct, default context in " -"SELinux policy. Run the <command>/usr/sbin/matchpathcon -V /var/www/html/*</" -"command> command to check all files in the <filename>/var/www/html/</" -"filename> directory:" -msgstr "" +msgid "The <command>/usr/sbin/matchpathcon</command> <option>-V</option> option compares the current SELinux context to the correct, default context in SELinux policy. Run the <command>/usr/sbin/matchpathcon -V /var/www/html/*</command> command to check all files in the <filename>/var/www/html/</filename> directory:" +msgstr "Опция <command>/usr/sbin/matchpathcon</command> <option>-V</option> сверяет текущий контекст SELinux с корректным, контекстом по-умолчанию в политике SELinux. Выполните команду <command>/usr/sbin/matchpathcon -V /var/www/html/*</command> для проверки всех файлов в каталоге <filename>/var/www/html/</filename>:"

#. Tag: para #, no-c-format -msgid "" -"The following output from the <command>/usr/sbin/matchpathcon</command> " -"command explains that <filename>file1</filename> is labeled with the " -"<computeroutput>samba_share_t</computeroutput> type, but should be labeled " -"with the <computeroutput>httpd_sys_content_t</computeroutput> type:" -msgstr "" +msgid "The following output from the <command>/usr/sbin/matchpathcon</command> command explains that <filename>file1</filename> is labeled with the <computeroutput>samba_share_t</computeroutput> type, but should be labeled with the <computeroutput>httpd_sys_content_t</computeroutput> type:" +msgstr "Ниже показан вывод команды <command>/usr/sbin/matchpathcon</command>. объясняющий, что <filename>file1</filename> помечен типом <computeroutput>samba_share_t</computeroutput>, а должен быть помечен типом <computeroutput>httpd_sys_content_t</computeroutput>:"

#. Tag: para #, no-c-format -msgid "" -"To resolve the label problem and allow the Apache HTTP Server access to " -"<filename>file1</filename>, as the Linux root user, run the <command>/sbin/" -"restorecon -v /var/www/html/file1</command> command:" -msgstr "" +msgid "To resolve the label problem and allow the Apache HTTP Server access to <filename>file1</filename>, as the Linux root user, run the <command>/sbin/restorecon -v /var/www/html/file1</command> command:" +msgstr "Для решения проблемы и предоставления доступа Apache HTTP Server к <filename>file1</filename>, от имени пользователя root, выполните команду <command>/sbin/restorecon -v /var/www/html/file1</command>:"

#. Tag: title #, no-c-format msgid "Archiving Files with tar" -msgstr "" +msgstr "Архивирование файлов с помощью tar"

#. Tag: para #, no-c-format -msgid "" -"<command>tar</command> does not retain extended attributes by default. Since " -"SELinux contexts are stored in extended attributes, contexts can be lost " -"when archiving files. Use <command>tar --selinux</command> to create " -"archives that retain contexts. If a Tar archive contains files without " -"extended attributes, or if you want the extended attributes to match the " -"system defaults, run the archive through <command>/sbin/restorecon</command>:" -msgstr "" +msgid "<command>tar</command> does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use <command>tar --selinux</command> to create archives that retain contexts. If a Tar archive contains files without extended attributes, or if you want the extended attributes to match the system defaults, run the archive through <command>/sbin/restorecon</command>:" +msgstr "<command>tar</command> не сохраняет расширенные атрибуты по умолчанию. Так как контексты SELinux хранятся в расширенных атрибутах, контексты могут быть потеряны при архивировании файлов. Используйте <command>tar --selinux</command> для создания архивов с сохранением контекстов. Если Tar архив содержит файлы без расширенных атрибутов, или если вам нужно, чтобы расширенные атрибуты соответствовали системным настройкам по-умолчанию, пропустите архив через <command>/sbin/restorecon</command>:"

#. Tag: para #, no-c-format -msgid "" -"Note: depending on the directory, you may need to be the Linux root user to " -"run the <command>/sbin/restorecon</command> command." -msgstr "" +msgid "Note: depending on the directory, you may need to be the Linux root user to run the <command>/sbin/restorecon</command> command." +msgstr "Примечание: в зависимости от каталога, вам могут быть необходимы права пользователя root для выполнения команды <command>/sbin/restorecon</command>."

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a Tar archive that retains " -"SELinux contexts:" -msgstr "" +msgid "The following example demonstrates creating a Tar archive that retains SELinux contexts:" +msgstr "В следующем примере демонстрируется создание архива Tar с сохранением контекста SELinux:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /var/www/html/</command> command to change into the " -"<filename>/var/www/html/</filename> directory. Once in this directory, as " -"the Linux root user, run the <command>tar --selinux -cf test.tar file{1,2,3}" -"</command> command to create a Tar archive named <filename>test.tar</" -"filename>." -msgstr "" +msgid "Run the <command>cd /var/www/html/</command> command to change into the <filename>/var/www/html/</filename> directory. Once in this directory, as the Linux root user, run the <command>tar --selinux -cf test.tar file{1,2,3}</command> command to create a Tar archive named <filename>test.tar</filename>." +msgstr "Выполните команду <command>cd /var/www/html/</command> для перехода в каталог <filename>/var/www/html/</filename>. Из этого каталога от имени пользователя root выполните команду <command>tar --selinux -cf test.tar file{1,2,3}</command> для создания Tar архива с именем <filename>test.tar</filename>."

#. Tag: para #, no-c-format -msgid "" -"As the Linux root user, run the <command>mkdir /test</command> command to " -"create a new directory, and then, run the <command>chmod 777 /test/</" -"command> command to allow all users full-access to the <filename>/test/</" -"filename> directory." -msgstr "" +msgid "As the Linux root user, run the <command>mkdir /test</command> command to create a new directory, and then, run the <command>chmod 777 /test/</command> command to allow all users full-access to the <filename>/test/</filename> directory." +msgstr "От имени пользователя root, выполните команду <command>mkdir /test</command> для создания нового каталога, и затем, выполните команду <command>chmod 777 /test/</command> для предоставления всем пользователям полного доступа к каталогу <filename>/test/</filename>."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cp /var/www/html/test.tar /test/</command> command to copy " -"the <filename>test.tar</filename> file in to the <filename>/test/</filename> " -"directory." -msgstr "" +msgid "Run the <command>cp /var/www/html/test.tar /test/</command> command to copy the <filename>test.tar</filename> file in to the <filename>/test/</filename> directory." +msgstr "Выполните команду <command>cp /var/www/html/test.tar /test/</command> для копирования файла <filename>test.tar</filename> в каталог <filename>/test/</filename>."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /test/</command> command to change into the <filename>/" -"test/</filename> directory. Once in this directory, run the <command>tar -" -"xvf test.tar</command> command to extract the Tar archive." -msgstr "" +msgid "Run the <command>cd /test/</command> command to change into the <filename>/test/</filename> directory. Once in this directory, run the <command>tar -xvf test.tar</command> command to extract the Tar archive." +msgstr "Выполните команду <command>cd /test/</command> для перехода в каталог <filename>/test/</filename>. Из этого каталога, выполните команду <command>tar -xvf test.tar</command> для распаковки Tar архива."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>ls -lZ /test/</command> command to view the SELinux " -"contexts. The <computeroutput>httpd_sys_content_t</computeroutput> type has " -"been retained, rather than being changed to <computeroutput>default_t</" -"computeroutput>, which would have happened had the <option>--selinux</" -"option> not been used:" -msgstr "" +msgid "Run the <command>ls -lZ /test/</command> command to view the SELinux contexts. The <computeroutput>httpd_sys_content_t</computeroutput> type has been retained, rather than being changed to <computeroutput>default_t</computeroutput>, which would have happened had the <option>--selinux</option> not been used:" +msgstr "Выполните команду <command>ls -lZ /test/</command> для просмотра контекста SELinux. Тип The <computeroutput>httpd_sys_content_t</computeroutput> сохранился, вместо <computeroutput>default_t</computeroutput>, что произошло бы, если опция <option>--selinux</option> не использовалась:"

#. Tag: para #, no-c-format -msgid "" -"If the <filename>/test/</filename> directory is no longer required, as the " -"Linux root user, run the <command> rm -ri /test/</command> command to remove " -"it, as well as all files in it." -msgstr "" +msgid "If the <filename>/test/</filename> directory is no longer required, as the Linux root user, run the <command> rm -ri /test/</command> command to remove it, as well as all files in it." +msgstr "Если каталог <filename>/test/</filename> больше не нужен, от имени пользователя root, выполните команду <command> rm -ri /test/</command> для его удаления, а также всех файлов в нём."

#. Tag: refentrytitle #, no-c-format msgid "tar" -msgstr "" +msgstr "tar"

#. Tag: citerefentry #, no-c-format -msgid "" -"manual page for further information about <command>tar</command>, such as " -"the <option>--xattrs</option> option that retains all extended attributes." -msgstr "" +msgid "manual page for further information about <command>tar</command>, such as the <option>--xattrs</option> option that retains all extended attributes." +msgstr "страница информации (manual page) для дополнительной информации о <command>tar</command>, такой как опции <option>--xattrs</option>, сохраняющей все расширенные атрибуты."

#. Tag: title #, no-c-format msgid "Archiving Files with star" -msgstr "" +msgstr "Архивирование файлов с помощью star"

#. Tag: para #, no-c-format -msgid "" -"<command>star</command> does not retain extended attributes by default. " -"Since SELinux contexts are stored in extended attributes, contexts can be " -"lost when archiving files. Use <command>star -xattr -H=exustar</command> to " -"create archives that retain contexts. The <package>star</package> package is " -"not installed by default. To install <command>star</command>, run the " -"<command>yum install star</command> command as the Linux root user." -msgstr "" +msgid "<command>star</command> does not retain extended attributes by default. Since SELinux contexts are stored in extended attributes, contexts can be lost when archiving files. Use <command>star -xattr -H=exustar</command> to create archives that retain contexts. The <package>star</package> package is not installed by default. To install <command>star</command>, run the <command>yum install star</command> command as the Linux root user." +msgstr "<command>star</command> не сохраняет расширенные атрибуты по умолчанию. Так как контексты SELinux хранятся в расширенных атрибутах, контексты могут быть потеряны при архивировании файлов. Используйте <command><star -xattr -H=exustar/command> для создания архивов с сохранением котекстов. Пакет <package>star</package> не установлен по-умолчанию. Для установки <command>star</command>, необходимо выполнить команду <command>yum install star</command> от имени пользователя root."

#. Tag: para #, no-c-format -msgid "" -"The following example demonstrates creating a Star archive that retains " -"SELinux contexts:" -msgstr "" +msgid "The following example demonstrates creating a Star archive that retains SELinux contexts:" +msgstr "В следующем примере демонстрируется создание архива Star с сохранением контекста SELinux:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /var/www/html/</command> command to change into the " -"<filename>/var/www/html/</filename> directory. Once in this directory, as " -"the Linux root user, run the <command>star -xattr -H=exustar -c -f=test.star " -"file{1,2,3}</command> command to create a Star archive named <filename>test." -"star</filename>:" -msgstr "" +msgid "Run the <command>cd /var/www/html/</command> command to change into the <filename>/var/www/html/</filename> directory. Once in this directory, as the Linux root user, run the <command>star -xattr -H=exustar -c -f=test.star file{1,2,3}</command> command to create a Star archive named <filename>test.star</filename>:" +msgstr "Выполните команду <command>cd /var/www/html/</command> для перехода в каталог <filename>/var/www/html/</filename>. Из этого каталога от имени пользователя root, выполните команду <command>star -xattr -H=exustar -c -f=test.star file{1,2,3}</command> для создания архива Star с именем <filename>test.star</filename>:"

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cp /var/www/html/test.star /test/</command> command to copy " -"the <filename>test.star</filename> file in to the <filename>/test/</" -"filename> directory." -msgstr "" +msgid "Run the <command>cp /var/www/html/test.star /test/</command> command to copy the <filename>test.star</filename> file in to the <filename>/test/</filename> directory." +msgstr "Выполните команду <command>cp /var/www/html/test.star /test/</command> для копирования файла <filename>test.star</filename> в каталог <filename>/test/</filename>."

#. Tag: para #, no-c-format -msgid "" -"Run the <command>cd /test/</command> command to change into the <filename>/" -"test/</filename> directory. Once in this directory, run the <command>star -x " -"-f=test.star</command> command to extract the Star archive:" -msgstr "" +msgid "Run the <command>cd /test/</command> command to change into the <filename>/test/</filename> directory. Once in this directory, run the <command>star -x -f=test.star</command> command to extract the Star archive:" +msgstr "Выполните команду <command>cd /test/</command> для перехода в каталог <filename>/test/</filename>. В этом каталоге выполните команду <command>star -x -f=test.star</command> для распаковки архива Star:"

#. Tag: para #, no-c-format -msgid "" -"If <command>star</command> is no longer required, as the Linux root user, " -"run the <command>yum remove star</command> command to remove the package." -msgstr "" +msgid "If <command>star</command> is no longer required, as the Linux root user, run the <command>yum remove star</command> command to remove the package." +msgstr "Если <command>star</command> больше не нужен от имение пользователя root, выполните команду <command>yum remove star</command> для удаления пакета."

#. Tag: refentrytitle #, no-c-format msgid "star" -msgstr "" +msgstr "star"

#. Tag: citerefentry #, no-c-format msgid "manual page for further information about <command>star</command>." -msgstr "" +msgstr "страница информации (manual page) для дополнительной информации о <command>star</command>"