[root@www ~]# cp file1 file2 &

[root@www ~]# tar -zpcf /tmp/etc.tar.gz /etc &
[1] 8400  <== [job number] PID 
[root@www ~]# tar: Removing leading `/' from member names 
# bAXu@X (job number)AӸXP bash C
#  8400 hOoӤu@btΤ PIDCܩX{ƬO tar 檺ƬyA
# ѩڭ̨S[WƬyɦVAҥH|vTeIL|vTeާ@I

[1]+  Done                    tar -zpcf /tmp/etc.tar.gz /etc

[root@www ~]# tar -zpcvf /tmp/etc.tar.gz /etc &

[root@www ~]# tar -zpcvf /tmp/etc.tar.gz /etc > /tmp/log.txt 2>&1 &
[1] 8429
[root@www ~]# 

[root@www ~]# vi ~/.bashrc
# b vi @ҦUAU [ctrl]-z oӫ
[1]+  Stopped                 vim ~/.bashrc
[root@www ~]#   <==QoFeޱvI
[root@www ~]# find / -print
....(Xٲ)....
# ɿù|D`LI]ùW|ܩҦɦWCЫU [ctrl]-z Ȱ
[2]+  Stopped                 find / -print

[root@www ~]# jobs [-lrs]
ﶵPѼơG
-l  GFCX job number POꤧ~APɦCX PID XF
-r  GȦCXbI run u@F
-s  GȦCXbIȰ (stop) u@C

dҤ@G[ثe bash AҦu@AP PID
[root@www ~]# jobs -l
[1]- 10314 Stopped                 vim ~/.bashrc
[2]+ 10833 Stopped                 find / -print

[root@www ~]# fg %jobnumber
ﶵPѼơG
%jobnumber Gjobnumber u@X(Ʀr)C`NA % OiiLI

dҤ@GH jobs [u@AANu@XG
[root@www ~]# jobs
[1]- 10314 Stopped                 vim ~/.bashrc
[2]+ 10833 Stopped                 find / -print
[root@www ~]# fg      <==w]X + u@AY [2]CߧYU[ctrl]-z
[root@www ~]# fg %1   <==WwXӤu@XIAU[ctrl]-z
[root@www ~]# jobs
[1]+  Stopped                 vim ~/.bashrc
[2]-  Stopped                 find / -print

dҤ@G@ find / -perm +7000 > /tmp/text.txt AߨIhȰI
[root@www ~]# find / -perm +7000 > /tmp/text.txt
# ɡAХߨU [ctrl]-z ȰI
[3]+  Stopped                 find / -perm +7000 > /tmp/text.txt

dҤGGӤu@bIUiAåB[LII
[root@www ~]# jobs ; bg %3 ; jobs
[1]-  Stopped                 vim ~/.bashrc
[2]   Stopped                 find / -print
[3]+  Stopped                 find / -perm +7000 > /tmp/text.txt
[3]+ find / -perm +7000 > /tmp/text.txt &  <== bg%3 pI
[1]+  Stopped                 vim ~/.bashrc
[2]   Stopped                 find / -print
[3]-  Running                 find / -perm +7000 > /tmp/text.txt &

[root@www ~]# kill -signal %jobnumber
[root@www ~]# kill -l
ﶵPѼơG
-l  GoӬO L pgACXثe kill ϥΪT (signal) ǡH
signal GN᭱Ӥu@˪oI man 7 signal iG
  -1 GsŪ@Ѽƪ]w ( reload)F
  -2 GNPLJ [ctrl]-c P˪ʧ@F
  -9 GߨjR@Ӥu@F
  -15GH`{Ǥ觋פ@u@CP -9 O@˪C

dҤ@GXثe bash ҤUIu@AñNӤu@yjRzC
[root@www ~]# jobs
[1]+  Stopped                 vim ~/.bashrc
[2]   Stopped                 find / -print
[root@www ~]# kill -9 %2; jobs
[1]+  Stopped                 vim ~/.bashrc
[2]   Killed                  find / -print
# ALXAAUF jobs @AN|o{ 2 u@FI]QFI

dҡGXثe bash ҤUIu@AñNӤu@y`פzC
[root@www ~]# jobs
[1]+  Stopped                 vim ~/.bashrc
[root@www ~]# kill -SIGTERM %1
# -SIGTERM P -15 O@˪IziHϥ kill -l Ӭd\I

[root@www ~]# nohup [OPѼ]   <==b׺ݾeu@
[root@www ~]# nohup [OPѼ] & <==b׺ݾIu@

# 1. s@|yε 500 z{G
[root@www ~]# vim sleep500.sh
#!/bin/bash
/bin/sleep 500s
/bin/echo "I have slept 500 seconds."

# 2. IhAåBߨnXtΡG
[root@www ~]# chmod a+x sleep500.sh
[root@www ~]# nohup ./sleep500.sh &
[1] 5074
[root@www ~]# nohup: appending output to nohup.out <==|ioӰTI
[root@www ~]# exit

[root@www ~]# ps aux  <==[tΩҦ{Ǹ
[root@www ~]# ps -lA  <==]O[ҦtΪ
[root@www ~]# ps axjf <==sP{Ǿ𪬺A
ﶵPѼơG
-A  GҦ process ܥXӡAP -e 㦳P˪ĥΡF
-a  GP terminal Ҧ process F
-u  GĨϥΪ (effective user)  process F
x   Gq`P a oӰѼƤ@_ϥΡAiCXTC
X榡WG
l   GBԲӪN PID TCXF
j   Gu@榡 (jobs format)
-f  G@ӧ󬰧㪺XC

dҤ@GNثeݩzۤvonJ PID PTCܥX(uPۤv bash )
[root@www ~]# ps -l
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S     0 13639 13637  0  75   0 -  1287 wait   pts/1    00:00:00 bash
4 R     0 13700 13639  0  77   0 -  1101 -      pts/1    00:00:00 ps

dҤGGCXثeҦbO{ǡG
[root@www ~]# ps aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0   2064   616 ?        Ss   Mar11   0:01 init [5]
root         2  0.0  0.0      0     0 ?        S<   Mar11   0:00 [migration/0]
root         3  0.0  0.0      0     0 ?        SN   Mar11   0:00 [ksoftirqd/0]
.....(ٲ).....
root     13639  0.0  0.2   5148  1508 pts/1    Ss   11:44   0:00 -bash
root     14232  0.0  0.1   4452   876 pts/1    R+   15:52   0:00 ps aux
root     18593  0.0  0.0   2240   476 ?        Ss   Mar14   0:00 /usr/sbin/atd

dҤTGHdҤ@ܤeAܥXҦ{ǡG
[root@www ~]# ps -lA
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S     0     1     0  0  76   0 -   435 -      ?        00:00:01 init
1 S     0     2     1  0  94  19 -     0 ksofti ?        00:00:00 ksoftirqd/0
1 S     0     3     1  0  70  -5 -     0 worker ?        00:00:00 events/0
....(HUٲ)....
# A|o{CP ps -l XpۦPAܪ{ǫh]AtΩҦ{ǡC

dҥ|GCX{Ǿ𪺵{ܡG
[root@www ~]# ps axjf
 PPID   PID  PGID   SID TTY      TPGID STAT   UID   TIME COMMAND
    0     1     1     1 ?           -1 Ss       0   0:01 init [5]
.....(ٲ).....
    1  4586  4586  4586 ?           -1 Ss       0   0:00 /usr/sbin/sshd
 4586 13637 13637 13637 ?           -1 Ss       0   0:00  \_ sshd: root@pts/1
13637 13639 13639 13639 pts/1    14266 Ss       0   0:00      \_ -bash
13639 14266 14266 13639 pts/1    14266 R+       0   0:00          \_ ps axjf
.....(᭱ٲ).....

dҤGXP cron P syslog oӪAȦ PID XH
[root@www ~]# ps aux | egrep '(cron|syslog)'
root   4286  0.0  0.0  1720   572 ?      Ss  Mar11   0:00 syslogd -m 0
root   4661  0.0  0.1  5500  1192 ?      Ss  Mar11   0:00 crond
root  14286  0.0  0.0  4116   592 pts/1  R+  16:15   0:00 egrep (cron|syslog)
# ҥHXO 4286  4661 ooINOo˧䪺աI

apache  8683  0.0  0.9 83384 9992 ?   Z  14:33   0:00 /usr/sbin/httpd <defunct>

[root@www ~]# top [-d Ʀr] | top [-bnp]
ﶵPѼơG
-d  G᭱iHơANOӵ{ǵesơCw]O 5 F
-b  GH妸觋 top A٦hѼƥiHϥγI
      q`|ftƬyɦVӱN妸GXɮסC
-n  GP -b ftANqOAݭniX top XGC
-p  GwYǭ PID Ӷi[ʴӤwC
b top L{iHϥΪOG
	? Gܦb top iHJOF
	P GH CPU ϥθ귽ƧܡF
	M GH Memory ϥθ귽ƧܡF
	N GH PID ӱƧdzI
	T GѸ Process ϥΪ CPU ɶֿn (TIME+) ƧǡC
	k GY PID @ӰT  (signal)
	r GY PID sq@ nice ȡC
	q G} top n骺C

dҤ@GCs@ top A[TG
[root@www ~]# top -d 2
top - 17:03:09 up 7 days, 16:16,  1 user,  load average: 0.00, 0.00, 0.00
Tasks:  80 total,   1 running,  79 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.5%us,  0.5%sy,  0.0%ni, 99.0%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:    742664k total,   681672k used,    60992k free,   125336k buffers
Swap:  1020088k total,       28k used,  1020060k free,   311156k cached
    <==pG[J k  r ɡAN|r˥X{bo̳I
  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND     
14398 root      15   0  2188 1012  816 R  0.5  0.1   0:00.05 top
    1 root      15   0  2064  616  528 S  0.0  0.1   0:01.38 init
    2 root      RT  -5     0    0    0 S  0.0  0.0   0:00.00 migration/0
    3 root      34  19     0    0    0 S  0.0  0.0   0:00.00 ksoftirqd/0

dҤGGN top Ti 2 AMNGX /tmp/top.txt
[root@www ~]# top -b -n 2 > /tmp/top.txt
# oˤ@ӡAKKINiHN top Ts /tmp/top.txt ɮפFC

dҤTGڭ̦ۤv bash PID i $$ ܼƨoAШϥ top [ PID
[root@www ~]# echo $$
13639  <==NOoӼƦrILOڭ bash  PID
[root@www ~]# top -d 2 -p 13639
top - 17:31:56 up 7 days, 16:45,  1 user,  load average: 0.00, 0.00, 0.00
Tasks:   1 total,   0 running,   1 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.0%us,  0.0%sy,  0.0%ni,100.0%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:    742664k total,   682540k used,    60124k free,   126548k buffers
Swap:  1020088k total,       28k used,  1020060k free,   311276k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
13639 root      15   0  5148 1508 1220 S  0.0  0.2   0:00.18 bash

dҥ|GӤWDAW NI ȬO 0 AQn令 10 ܡH
# bdҤT top eU r A|X{pUϼˡI
top - 17:34:24 up 7 days, 16:47,  1 user,  load average: 0.00, 0.00, 0.00
Tasks:   1 total,   0 running,   1 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.0%us,  0.0%sy,  0.0%ni, 99.5%id,  0.0%wa,  0.0%hi,  0.5%si,  0.0%st
Mem:    742664k total,   682540k used,    60124k free,   126636k buffers
Swap:  1020088k total,       28k used,  1020060k free,   311276k cached
PID to renice: 13639  <==U r MJo PID X
  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
13639 root      15   0  5148 1508 1220 S  0.0  0.2   0:00.18 bash

Renice PID 13639 to value: 10   <==oO nice 
  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND

top - 17:38:58 up 7 days, 16:52,  1 user,  load average: 0.00, 0.00, 0.00
Tasks:   1 total,   0 running,   1 sleeping,   0 stopped,   0 zombie
Cpu(s):  0.0%us,  0.0%sy,  0.0%ni,100.0%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:    742664k total,   682540k used,    60124k free,   126648k buffers
Swap:  1020088k total,       28k used,  1020060k free,   311276k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
13639 root      26  10  5148 1508 1220 S  0.0  0.2   0:00.18 bash

[root@www ~]# pstree [-A|U] [-up]
ﶵPѼơG
-A  GU{Ǿ𤧶sH ASCII rӳsF
-U  GU{Ǿ𤧶sHUXrӳsCbYDz׺ݤUi|~F
-p  GæPɦCXC process  PIDF
-u  GæPɦCXC process ݱbW١C

dҤ@GCXثetΤWҦ{Ǿ𪺬ʡG
[root@www ~]# pstree -A
init-+-acpid
     |-atd
     |-auditd-+-audispd---{audispd}  <==oPU@欰 auditd XӪl{
     |        `-{auditd}
     |-automount---4*[{automount}]   <==w]pUAۦ{Ƿ|HƦr
....(ٲ)....
     |-sshd---sshd---bash---pstree   <==NOڭ̫O檺Ӭ̩ۨʡI
....(Uٲ)....
# `N@UAF`٪AҥHwgRhܦh{ǤFI

dҤGGӤWDAPɨqX PID P users 
[root@www ~]# pstree -Aup
init(1)-+-acpid(4555)
        |-atd(18593)
        |-auditd(4256)-+-audispd(4258)---{audispd}(4261)
        |              `-{auditd}(4257)
        |-automount(4536)-+-{automount}(4537) <=={Ǭۦ PID PI
        |                 |-{automount}(4538)
        |                 |-{automount}(4541)
        |                 `-{automount}(4544)
....(ٲ)....
        |-sshd(4586)---sshd(16903)---bash(16905)---pstree(16967)
....(ٲ)....
        |-xfs(4692,xfs)   <==]{Ǿ̨֦ëD pstree ̡IҥHCXb
....(Uٲ)....
# bA () YO PID Hθӵ{Ǫ owner ILAѩڬOϥ 
# root 榹@OAҥHݩ root {ǴN|ܥXӰաI

[root@www ~]# killall [-iIe] [command name]
ﶵPѼơG
-i  Ginteractive NAʦAYݭnRɡA|X{ܦrϥΪ̡F
-e  Gexact NAܡy᭱ command name n@PzAӧ㪺O
      WL 15 ӦrC
-I  GOW(itѼ)jpgC

dҤ@G syslogd oӫOҰʪ PID @ SIGHUP T
[root@www ~]# killall -1 syslogd
# pG ps aux JӬݤ@UAsyslogd ~O㪺OW١CY]tӰѼơA
# h syslogd -m 0 ~O㪺OI

dҤGGjפҦH httpd Ұʪ{
[root@www ~]# killall -9 httpd

dҤTG̦߰ݨC bash {O_ݭnQפB@I
[root@www ~]# killall -i -9 bash
Kill bash(16905) ? (y/N) n <==oӤI
Kill bash(17351) ? (y/N) y <==oӱI
# 㦳ʪ\IiH߰ݧAO_nR bash oӵ{Cn`NAYS -i ѼơA
# Ҧ bash |Qo root I]A root ۤv bash I ^_^

[root@www ~]# ps -l
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S     0 18625 18623  2  75   0 -  1514 wait   pts/1    00:00:00 bash
4 R     0 18653 18625  0  77   0 -  1102 -      pts/1    00:00:00 ps

[root@www ~]# nice [-n Ʀr] command
ﶵPѼơG
-n  G᭱@ӼƭȡAƭȪd -20 ~ 19C

dҤ@G root @ nice Ȭ -5 AΩ vi A[ӵ{ǡI
[root@www ~]# nice -n -5 vi &
[1] 18676
[root@www ~]# ps -l
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S     0 18625 18623  0  75   0 -  1514 wait   pts/1    00:00:00 bash
4 T     0 18676 18625  0  72  -5 -  1242 finish pts/1    00:00:00 vi
4 R     0 18678 18625  0  77   0 -  1101 -      pts/1    00:00:00 ps
# 쥻 bash PRI  75  AҥH vi w] 75CLѩ󵹤 nice   -5 A
# ] vi  PRI CFIëDC 70 A]֤ٷ|ʺAվI

[root@www ~]# kill -9 %1 <==էN vi 

[root@www ~]# renice [number] PID
ﶵPѼơG
PID GYӵ{Ǫ ID ڡI

dҤ@GXۤv bash PID AñN PID  nice վ 10
[root@www ~]# ps -l
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S     0 18625 18623  0  75   0 -  1514 wait   pts/1    00:00:00 bash
4 R     0 18712 18625  0  77   0 -  1102 -      pts/1    00:00:00 ps

[root@www ~]# renice 10 18625
18625: old priority 0, new priority 10

[root@www ~]# ps -l
F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY          TIME CMD
4 S     0 18625 18623  0  85  10 -  1514 wait   pts/1    00:00:00 bash
4 R     0 18715 18625  0  87  10 -  1102 -      pts/1    00:00:00 ps

[root@www ~]# free [-b|-k|-m|-g] [-t]
ﶵPѼơG
-b  GJ free ɡAܪO KbytesAڭ̥iHϥ b(bytes), m(Mbytes)
      k(Kbytes),  g(Gbytes) ܳI
-t  GbX̲׵GAܹOP swap `qC

dҤ@GܥثetΪOeq
[root@www ~]# free -m
          total       used    free   shared   buffers    cached
Mem:        725        666      59        0       132       287
-/+ buffers/cache:     245     479
Swap:       996          0     996

[root@www ~]# uname [-asrmpi]
ﶵPѼơG
-a  GҦtάTA]AUƳ|QCXӡF
-s  Gtή֤ߦW
-r  G֤ߪ
-m  GtΪwW١AҦp i686  x86_64 F
-p  GCPU AP -m AuOܪO CPU I
-i  Gw骺x (ix86)

dҤ@GXtΪ򥻸T
[root@www ~]# uname -a
Linux www.vbird.tsai 2.6.18-92.el5 #1 SMP Tue Jun 10 18:49:47 EDT 2008 i686
i686 i386 GNU/Linux

[root@www ~]# uptime
 15:39:13 up 8 days, 14:52,  1 user,  load average: 0.00, 0.00, 0.00
# top oӫOwg͹LTAAI

[root@www ~]# netstat -[atunlp]
ﶵPѼơG
-a  GNثetΤWҦsuBťBSocket ƳCX
-t  GCX tcp ʥ]
-u  GCX udp ʥ]
-n  GH{ǪAȦW١AH (port number) ܡF
-l  GCXثebť (listen) AȡF
-p  GCXӺAȪ{ PID 

dҤ@GCXثetΤwgإߪsuP unix socket A
[root@www ~]# netstat
Active Internet connections (w/o servers) <==P
Proto Recv-Q Send-Q Local Address        Foreign Address      State
tcp        0    132 192.168.201.110:ssh  192.168.:vrtl-vmf-sa ESTABLISHED
Active UNIX domain sockets (w/o servers)  <==P{Ǧۤv(D)
Proto RefCnt Flags       Type       State         I-Node Path
unix  20     [ ]         DGRAM                    9153   /dev/log
unix  3      [ ]         STREAM     CONNECTED     13317  /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     13233  /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     13208  /tmp/.font-unix/fs7100
....(ٲ)....

dҤGGXثetΤWwbťsuΨ PID
[root@www ~]# netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address    Foreign Address  State   PID/Program name
tcp        0      0 127.0.0.1:2208   0.0.0.0:*        LISTEN  4566/hpiod
tcp        0      0 0.0.0.0:111      0.0.0.0:*        LISTEN  4328/portmap
tcp        0      0 127.0.0.1:631    0.0.0.0:*        LISTEN  4597/cupsd
tcp        0      0 0.0.0.0:728      0.0.0.0:*        LISTEN  4362/rpc.statd
tcp        0      0 127.0.0.1:25     0.0.0.0:*        LISTEN  4629/sendmail: 
tcp        0      0 127.0.0.1:2207   0.0.0.0:*        LISTEN  4571/python
tcp        0      0 :::22            :::*             LISTEN  4586/sshd
# FiHCXťPA~A̫@ٯܦAȪ
# PID XHε{ǪOWٳIҦp̫@檺 4586 NO PID

dҤTGNWza 127.0.0.1:631 ӺAܡH
[root@www ~]# kill -9 4597
[root@www ~]# killall -9 cupsd

dҤ@GXҦ֤߶}ɪT
[root@www ~]# dmesg | more

dҤGGjM}ɭԡAwЪTH
[root@www ~]# dmesg | grep -i hd
    ide0: BM-DMA at 0xd800-0xd807, BIOS settings: hda:DMA, hdb:DMA
    ide1: BM-DMA at 0xd808-0xd80f, BIOS settings: hdc:pio, hdd:pio
hda: IC35L040AVER07-0, ATA DISK drive
hdb: ASUS DRW-2014S1, ATAPI CD/DVD-ROM drive
hda: max request size: 128KiB
....(Uٲ)....

[root@www ~]# vmstat [-a] [ [`p]] <==CPU/O鵥T
[root@www ~]# vmstat [-fs]                      <==O
[root@www ~]# vmstat [-S ]                  <==]wܼƾڪ
[root@www ~]# vmstat [-d]                       <==PϺЦ
[root@www ~]# vmstat [-p μ]                <==PϺЦ
ﶵPѼơG
-a  Gϥ inactive/active(DP_) N buffer/cache OXTF
-f  G}ثeAtνƻs (fork) {ǼơF
-s  GN@Ǩƥ (}ܥثe) ɭPOܤƱpCF
-S  G᭱iHAܪƦCҦp K/M N bytes eqF
-d  GCXϺЪŪg`qέp
-p  G᭱CXμѡAiܸӤμѪŪg`qέp

dҤ@GέpثeD CPU AAC@A@pTI
[root@www ~]# vmstat 1 3
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 0  0     28  61540 137000 291960    0    0     4     5   38   55  0  0 100  0  0
 0  0     28  61540 137000 291960    0    0     0     0 1004   50  0  0 100  0  0
 0  0     28  61540 137000 291964    0    0     0     0 1022   65  0  0 100  0  0

dҤGGtΤWҦϺЪŪgA
[root@www ~]# vmstat -d
disk- ------------reads------------ ------------writes----------- -----IO------
       total merged sectors      ms  total merged sectors      ms    cur    sec
ram0       0      0       0       0      0      0       0       0      0      0
....(ٲ)....
hda   144188 182874 6667154 7916979 151341 510244 8027088 15244705      0    848
hdb        0      0       0       0      0      0       0       0      0      0

[dmtsai@www ~]$ passwd
Changing password for user dmtsai.
Changing password for dmtsai
(current) UNIX password: <==o̫U [ctrl]-z åBU [enter]
[1]+  Stopped                 passwd

[dmtsai@www ~]$ pstree -u
init-+-acpid
....(ٲ)....
     |-sshd---sshd---sshd(dmtsai)---bash-+-more
     |                                   |-passwd(root)
     |                                   `-pstree
....(Uٲ)....

[root@www ~]# ll /proc
dr-xr-xr-x  5 root      root              0 Mar 11 08:46 1
dr-xr-xr-x  5 root      root              0 Mar 11 00:46 10
dr-xr-xr-x  5 root      root              0 Mar 11 00:46 11
....(ٲ)....
-r--r--r--  1 root      root              0 Mar 20 12:11 uptime
-r--r--r--  1 root      root              0 Mar 20 12:11 version
-r--r--r--  1 root      root              0 Mar 20 12:11 vmstat
-r--r--r--  1 root      root              0 Mar 20 12:11 zoneinfo

[root@www ~]# ll /proc/1
dr-xr-xr-x 2 root root 0 Mar 12 11:04 attr
-r-------- 1 root root 0 Mar 17 14:32 auxv
-r--r--r-- 1 root root 0 Mar 17 14:32 cmdline  <==NOO
-rw-r--r-- 1 root root 0 Mar 17 14:32 coredump_filter
-r--r--r-- 1 root root 0 Mar 17 14:32 cpuset
lrwxrwxrwx 1 root root 0 Mar 17 14:32 cwd -> /
-r-------- 1 root root 0 Mar 17 14:32 environ  <==@ܼ
lrwxrwxrwx 1 root root 0 Mar 17 14:32 exe -> /sbin/init  <==ڰ檺O
....(HUٲ)....

[root@www ~]# cat /proc/1/cmdline
init [5]

[root@www ~]# fuser [-umv] [-k [i] [-signal]] file/dir
ﶵPѼơG
-u  GF{Ǫ PID ~APɦCXӵ{Ǫ̡֦F
-m  G᭱ɦW|DʪWɮרtΪ̳hA umount \ܦġI
-v  GiHCXCɮ׻P{٦OʡI
-k  GXϥθɮ/ؿ PID AøչϥH SIGKILL oӰT PIDF
-i  GP -k tXAbR PID e|߰ݨϥΪ̷N@I
-signalGҦp -1 -15 AY[ܡAw]O SIGKILL (-9) oI

dҤ@GXثeҦbؿϥ PID/ݱb/v H
[root@www ~]# fuser -uv .
                     USER        PID ACCESS COMMAND
.:                   root      20639 ..c.. (root)bash

dҤGGҦϥΨ /proc oɮרtΪ{ǧaI
[root@www ~]# fuser -uv /proc
# |ܥơA]S{Ƿ|hϥ /proc oӥؿڡI
# |QΨ쪺O /proc UɮװաIҥHAӭno˰G

[root@www ~]# fuser -mvu /proc
                     USER        PID ACCESS COMMAND
/proc:               root       4289 f.... (root)klogd
                     root       4555 f.... (root)acpid
                     haldaemon  4758 f.... (haldaemon)hald
                     root       4977 F.... (root)Xorg
# oX{Ǧbi /proc ɮרtΪsIo˲MFܡH

dҤTG /var Uݩ FIFO ɮסAåBXsɮת{
[root@www ~]# find /var -type p
/var/gdm/.gdmfifo     <==ڭ̰woNYiI
/var/run/autofs.fifo-misc
/var/run/autofs.fifo-net

[root@www ~]# fuser -uv /var/gdm/.gdmfifo
                     USER        PID ACCESS COMMAND
/var/gdm/.gdmfifo:   root       4892 F.... (root)gdm-binary

dҥ|GPdҤTAչϧR PIDHBynzRI
[root@www ~]# fuser -ki /var/gdm/.gdmfifo
/var/gdm/.gdmfifo:    4892
Kill process 4892 ? (y/N) n

[root@www ~]# lsof [-aUu] [+d]
ﶵPѼơG
-a  GhƻݭnyPɦߡz~ܥXGɡI
-U  GȦCX Unix like tΪ socket ɮF
-u  G᭱ usernameACXӨϥΪ̬{ǩҶ}ҪɮסF
+d  G᭱ؿAYXYӥؿUwgQ}ҪɮסI

dҤ@GCXثetΤWҦwgQ}Ҫɮ׻P˸mG
[root@www ~]# lsof
COMMAND PID  USER   FD  TYPE  DEVICE   SIZE     NODE NAME
init      1  root  cwd   DIR     3,2   4096        2 /
init      1  root  rtd   DIR     3,2   4096        2 /
init      1  root  txt   REG     3,2  38620  1426405 /sbin/init
....(Uٲ)....
# `NFܡHOAbw]pUA lsof |NثetΤWwg}Ҫ
# ɮץCXӡҥHAeh~HڡIziH`NAĤ@ɮ init 檺
# aNbڥؿAӮڥؿAKKIҦb inode ]ܥXӳI

dҤGGȦCX root Ҧ{Ƕ}Ҫ socket ɮ
[root@www ~]# lsof -u root -a -U
COMMAND     PID USER   FD   TYPE     DEVICE SIZE   NODE NAME
udevd       400 root    3u  unix 0xedd4cd40        1445 socket
auditd     4256 root    7u  unix 0xedd4c380        9081 socket
audispd    4258 root    0u  unix 0xedd4c1e0        9080 socket
# `N쨺 -a aIpGAOJ lsof -u root  lsof -U A|ԣTH
# ϥ lsof -u root -U  lsof -u root -a -U AIPաI
# -a γ~NObѨMPɻݭnӶس߮ɰڡI ^_^

dҤTGЦCXثetΤWҦQҰʪP˸m
[root@www ~]# lsof +d /dev
COMMAND     PID      USER   FD   TYPE     DEVICE SIZE  NODE NAME
init          1      root   10u  FIFO       0,16       1147 /dev/initctl
udevd       400      root    0u   CHR        1,3       1420 /dev/null
udevd       400      root    1u   CHR        1,3       1420 /dev/null
udevd       400      root    2u   CHR        1,3       1420 /dev/null
# ݧaI]˸mb /dev ̭IҥHoAϥηjMؿYiڡI

dҥ|GqXݩ root  bash o{Ҷ}Ҫɮ
[root@www ~]# lsof -u root | grep bash
bash   20639 root  cwd    DIR    3,2    4096    648321 /root
bash   20639 root  rtd    DIR    3,2    4096         2 /
bash   20639 root  txt    REG    3,2  735004   1199424 /bin/bash
bash   20639 root  mem    REG    3,2   46680     64873 /lib/libnss_files-2.5.so
....(Uٲ)....

[root@www ~]# pidof [-sx] program_name
ﶵPѼơG
-s  GȦCX@ PID ӤCXҦ PID
-x  GPɦCX program name i઺ PPID ӵ{Ǫ PID

dҤ@GCXثetΤW init H syslogd oӵ{ PID
[root@www ~]# pidof init syslogd
1 4286
# zפWAӷ| PID ~CWܤ]OX{F PID C
# OO init  syslogd o{ PID աC

[root@www ~]# ls -Z
drwxr-xr-x  root root root:object_r:user_home_t   Desktop
-rw-r--r--  root root root:object_r:user_home_t   install.log
-rw-r--r--  root root root:object_r:user_home_t   install.log.syslog
# WzSr骺ANOwʥ媺eI

Identify:role:type
ѧO::

[root@www ~]# ll -Zd /usr/sbin/httpd /var/www/html
-rwxr-xr-x  root root system_u:object_r:httpd_exec_t   /usr/sbin/httpd
drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t /var/www/html
# ̪쳣O object_r ANOɮסI httpd ݩ httpd_exec_t A
# /var/www/html hݩ httpd_sys_content_t oI

[root@www ~]# getenforce
Enforcing  <==աINܥXثeҦ Enforcing oI

[root@www ~]# sestatus [-vb]
ﶵPѼơG
-v  GˬdC /etc/sestatus.conf ɮ׻P{Ǫwʥ夺eF
-b  GNثeFWhLȦCXAYYdzWh (rule) O_nҰ (0/1) NF

dҤ@GCXثe SELinux ϥέӬF (Policy)H
[root@www ~]# sestatus
SELinux status:                 enabled    <==O_Ұ SELinux
SELinuxfs mount:                /selinux   <==SELinux ɮ׸ƱI
Current mode:                   enforcing  <==ثeҦ
Mode from config file:          enforcing  <==]wɫwҦ
Policy version:                 21
Policy from config file:        targeted   <==ثeFH

[root@www ~]# vi /etc/selinux/config
SELINUX=enforcing     <==վ enforcing|disabled|permissive
SELINUXTYPE=targeted  <==ثeȦ targeted P strict

[root@www ~]# vi /boot/grub/menu.lst
default=0
timeout=5
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title CentOS (2.6.18-92.el5)
        root (hd0,0)
        kernel /vmlinuz-2.6.18-92.el5 ro root=LABEL=/1 rhgb quiet selinux=0
        initrd /initrd-2.6.18-92.el5.img
# pGnҰ SELinux AhiHX{ selinux=0 r˦b kernel ᭱I

[root@www ~]# setenforce [0|1]
ﶵPѼơG
0 Gন permissive eeҦF
1 Gন Enforcing jҦ

dҤ@GN SELinux b Enforcing P permissive P[
[root@www ~]# setenforce 0
[root@www ~]# getenforce
Permissive
[root@www ~]# setenforce 1
[root@www ~]# getenforce
Enforcing

# 1. ҰʳoӺAȧaI
[root@www ~]# /etc/init.d/httpd start
bҰ httpd:          [  Tw  ]

# 2. [L{ǡAåB[{Ǫ SELinux wʥ
[root@www ~]# pstree | grep httpd
     |-httpd---8*[httpd]   <==httpd |ͫܦhl{ǨӭtdAȳI

[root@www ~]# ps aux -Z |grep http
root:system_r:httpd_t root   24089 0.2 1.2 22896 9256 ? Ss 16:06 0:00 /usr/sbin/httpd
root:system_r:httpd_t apache 24092 0.0 0.6 22896 4752 ? S  16:06 0:00 /usr/sbin/httpd
root:system_r:httpd_t apache 24093 0.0 0.6 22896 4752 ? S  16:06 0:00 /usr/sbin/httpd
....(᭱ٲ)....

[root@www ~]# echo "This is my first web page." > /var/www/html/index.html

[root@www ~]# ll -Z /var/www/html/index.html
-rw-r--r-- root root root:object_r:httpd_sys_content_t /var/www/html/index.html

# 1. b root aؿظmһݪG
[root@www ~]# echo "My 2nd web page..." > index.html

# 2. N index.html yhz /var/www/html ؿhG
[root@www ~]# rm /var/www/html/index.html
[root@www ~]# mv index.html /var/www/html
# oӴժIb mv oӫOBzWIȥϥ mv I

[root@www ~]# ll -Z /var/www/html/index.html
-rw-r--r-- root root root:object_r:user_home_t /var/www/html/index.html

[root@www ~]# chcon [-R] [-t type] [-u user] [-r role] ɮ
[root@www ~]# chcon [-R] --reference=d ɮ
ﶵPѼơG
-R  GsPӥؿUؿ]PɭקF
-t  G᭱wʥ媺IҦp httpd_sys_content_t F
-u  G᭱ѧOAҦp system_uF
-r  G᭱󨤦AҦp system_rF
--reference=dɡGYɮ׷dҨӭק򱵪ɮתI

dҤ@GN𫍧 index.html אּ httpd_sys_content_t 
[root@www ~]# chcon -t httpd_sys_content_t /var/www/html/index.html
[root@www ~]# ll -Z /var/www/html/index.html
-rw-r--r--  root root root:object_r:httpd_sys_content_t /var/www/html/index.html
# @Io˴N^ӰաI

dҤGGH /etc/passwd ̾ڡAN index.html ק令
[root@www ~]# ll -Z /etc/passwd
-rw-r--r--  root root system_u:object_r:etc_t          /etc/passwd

[root@www ~]# chcon --reference=/etc/passwd /var/www/html/index.html
[root@www ~]# ll -Z /var/www/html/index.html
-rw-r--r--  root root root:object_r:etc_t /var/www/html/index.html
# ݬݡIO_PW /etc/passwd ۦPFILAoSO~wʥI
# nۭקIڭ̨Ӷi橳Ut~@ӫOBmݬݡI

[root@www ~]# restorecon [-Rv] ɮשΥؿ
ﶵPѼơG
-R  GsPؿ@_קF
-v  GNL{ܨùW

dҤ@GN~ index.html Hw]wʥ勵L
[root@www ~]# restorecon -Rv /var/www/html/index.html
restorecon reset /var/www/html/index.html context system_u:object_r:etc_t:s0->
system_u:object_r:httpd_sys_content_t:s0
# WoOP@IܱN index.html  etc_t אּ httpd_sys_content_t

[root@www ~]# chkconfig --list setroubleshoot
setroubleshoot  0:off  1:off  2:off 3:on  4:on  5:on  6:off
# ڭ̪ Linux B@ҦOb 3  5 A]oӭn on YiC

[root@www ~]# chkconfig setroubleshoot on
#  chkconfig ڭ̷|b᭱`СA --list OCXثe浥ŬO_ҰʡA
# pG[W on AhOb}ɱҰʡAY off h}ɤҰʡC

[root@www ~]# cat /var/log/messages | grep setroubleshoot
Mar 23 17:18:44 www setroubleshoot: SELinux is preventing the httpd from using 
potentially mislabeled files (/var/www/html/index.html). For complete SELinux 
messages. run sealert -l 6c028f77-ddb6-4515-91f4-4e3e719994d4

[root@www ~]# sealert -l 6c028f77-ddb6-4515-91f4-4e3e719994d4
Summary:

SELinux is preventing the httpd from using potentially mislabeled files
(/var/www/html/index.html). <==NO /var/log/messages T

Detailed Description:       <==UO󧹾㪺yzInݡI

SELinux has denied httpd access to potentially mislabeled file(s)
(/var/www/html/index.html). This means that SELinux will not allow httpd to use
these files. It is common for users to edit files in their home directory or tmp
directories and then move (mv) them to system directories. The problem is that
the files end up with the wrong file context which confined applications are not
allowed to access.

Allowing Access:            <==Yn\sAAݭni檺ʧ@I

If you want httpd to access this files, you need to relabel them using
restorecon -v '/var/www/html/index.html'. You might want to relabel the entire
directory using restorecon -R -v '/var/www/html'.
....(Uٲ)....

[root@www ~]# chkconfig --list auditd
auditd      0:off  1:off  2:on   3:on   4:on   5:on   6:off

[root@www ~]# chkconfig auditd on
# Y 3:off  5:off ɡA~ݭniI

[root@www ~]# audit2why < /var/log/audit/audit.log
# NOANnɪeŪiӤRAÿXRGIGIoˡG
type=AVC msg=audit(1237799959.349:355): avc:  denied  { getattr } for  pid=24094 
comm="httpd" path="/var/www/html/index.html" dev=hda2 ino=654685 scontext=root:s
ystem_r:httpd_t:s0 tcontext=root:object_r:user_home_t:s0 tclass=file
    Was caused by:
       Missing or disabled TE allow rule.
       Allow rules may exist but be disabled by boolean settings; check boolean
settings.
       You can see the necessary allow rules by running audit2allow with this
audit message as input.

[root@www ~]# seinfo [-Atrub]
ﶵPѼơG
-A  GCX SELinux ABWhLȡBѧOBBOҦT
-t  GCX SELinux ҦO (type) 
-r  GCX SELinux Ҧ (role) 
-u  GCX SELinux ҦѧO (user) 
-b  GCXҦWh (L)

dҤ@GCX SELinux bFUέpA
[root@www ~]# seinfo
Statistics for policy file: /etc/selinux/targeted/policy/policy.21
Policy Version & Type: v.21 (binary, MLS) <==CXFҦbɻP

   Classes:            61    Permissions:       220
   Types:            1521    Attributes:        155
   Users:               3    Roles:               6
   Booleans:          213    Cond. Expr.:       190
   Sensitivities:       1    Categories:       1024
   Allow:           86561    Neverallow:          0
   Auditallow:         34    Dontaudit:        5460
   Role allow:          5    Role trans:          0
....(Uٲ)....
# qWڭ̥iHݨoӬFO targeted AFwʥO 1521 ӡF
# ӰwAȪWh (Booleans) @qF 213 WhI

dҤGGCXP httpd Wh (booleans) ǡH
[root@www ~]# seinfo -b | grep httpd
Rule loading disabled
   allow_httpd_mod_auth_pam
   allow_httpd_bugzilla_script_anon_write
   httpd_enable_ftp_server
....(Uٲ)....
# AiHݨAD`hP httpd WhqwOI

[root@www ~]# sesearch [-a] [-s DO] [-t ؼO] [-b L]
ﶵPѼơG
-a  GCXOΥLȪҦT
-t  G᭱٭nOAҦp -t httpd_t
-b  G᭱٭nLȪWhAҦp -b httpd_enable_ftp_server

dҤ@GXؼɮ׸귽O httpd_sys_content_t T
[root@www ~]# sesearch -a -t httpd_sys_content_t
Found 74 av rules:
   allow readahead_t httpd_sys_content_t : file { ioctl read getattr lock };
   allow readahead_t httpd_sys_content_t : dir { ioctl read getattr lock search };
....(Uٲ)....
# y allow  D{ǦwʥO  ؼɮצwʥO z
# pWAoOiHQӥDD{ǪOŪAHΥؼɮ׸귽榡C

dҤGGXD{Ǭ httpd_t BؼɮO httpd ҦT
[root@www ~]# sesearch -s httpd_t -t httpd_* -a
Found 163 av rules:
....(ٲ)....
   allow httpd_t httpd_sys_content_t : file { ioctl read getattr lock };
   allow httpd_t httpd_sys_content_t : dir { ioctl read getattr lock search };
   allow httpd_t httpd_sys_content_t : lnk_file { ioctl read getattr lock };
....(᭱ٲ)....
# qWƴNiHݥX{Ǭ httpd_t oOAOiHŪ 
# httpd_sys_content_t I

dҤTGڪDӥLȬ httpd_enable_homedirs AаݸӥLȳWdhֳWhH
[root@www ~]# sesearch -b httpd_enable_homedirs -a
Found 21 av rules:
   allow httpd_t user_home_dir_t : dir { getattr search };
   allow httpd_t cifs_t : file { ioctl read getattr lock };
   allow httpd_t cifs_t : dir { ioctl read getattr lock search };
....(᭱ٲ)....

[root@www ~]# getsebool [-a] [Lȱ]
ﶵPѼơG
-a  GCXثetΤWҦLȱڳ]w}ҩ

dҤ@GdߥtΤҦLȳ]wp
[root@www ~]# getsebool -a
NetworkManager_disable_trans --> off
allow_console_login --> off
allow_cvs_read_shadow --> off
allow_daemons_dump_core --> on
....(Uٲ)....
# z@IoNiDAثeLȪAoI

[root@www ~]# setsebool [-P] L=[0|1]
ﶵPѼơG
-P  GN]wȼgJ]wɡAӳ]wƥӷ|ͮĪI

dҤ@Gd httpd_enable_homedirs O_AYALI
[root@www ~]# getsebool httpd_enable_homedirs
httpd_enable_homedirs --> on  <==GO on ADNLI

[root@www ~]# setsebool -P httpd_enable_homedirs=0
[root@www ~]# getsebool httpd_enable_homedirs
httpd_enable_homedirs --> off

[root@www ~]# semanage {login|user|port|interface|fcontext|translation} -l
[root@www ~]# semanage fcontext -{a|d|m} [-frst] file_spec
ﶵPѼơG
fcontext GDnΦbwʥ譱γ~A -l dߪNF
-a GW[NAAiHW[@ǥؿw]wʥ]wF
-m Gק諸NF
-d GRNC

dҤ@Gdߤ@U /var/www/html w]wʥ]wI
[root@www ~]# semanage fcontext -l
SELinux fcontext    type          Context
....(eٲ)....
/var/www(/.*)?      all files     system_u:object_r:httpd_sys_content_t:s0
....(᭱ٲ)....

dҤGGQ semanage ]w /srv/samba ؿw]wʥ婴 public_content_t
[root@www ~]# mkdir /srv/samba
[root@www ~]# ll -Zd /srv/samba
drwxr-xr-x  root root root:object_r:var_t    /srv/samba
# pWҥܡAw]pӬO var_t oөNNI

[root@www ~]# semanage fcontext -l | grep '/srv'
/srv/.*                     all files   system_u:object_r:var_t:s0
/srv/([^/]*/)?ftp(/.*)?     all files   system_u:object_r:public_content_t:s0
/srv/([^/]*/)?www(/.*)?     all files   system_u:object_r:httpd_sys_content_t:s0
/srv/([^/]*/)?rsync(/.*)?   all files   system_u:object_r:public_content_t:s0
/srv/gallery2(/.*)?         all files   system_u:object_r:httpd_sys_content_t:s0
/srv                        directory   system_u:object_r:var_t:s0 <==ݳo̡I
# WhOw] /srv UwʥơALAèSw /srv/samba 

[root@www ~]# semanage fcontext -a -t public_content_t "/srv/samba(/.*)?"
[root@www ~]# semanage fcontext -l | grep '/srv/samba'
/srv/samba(/.*)?            all files   system_u:object_r:public_content_t:s0

[root@www ~]# cat /etc/selinux/targeted/contexts/files/file_contexts.local
# This file is auto-generated by libsemanage
# Please use the semanage command to make changes
/srv/samba(/.*)?    system_u:object_r:public_content_t:s0
# NOgJoɮתoI ^_^

[root@www ~]# restorecon -Rv /srv/samba* <==ի_w]
[root@www ~]# ll -Zd /srv/samba
drwxr-xr-x  root root system_u:object_r:public_content_t /srv/samba/
# w]ȡAH restorecon ӭק²I