Utilizing SELinux(Security-Enhanced Linux) effectively can significantly enhance the security posture of your operating system.
SELinuxoperates by enforcing mandatory access control(MAC)policies that restric users and processes to only the resources they're explicitly allowed to access. # ------------------------------------- Here's a cheat sheet with basic commands, code snippets, and comments to help you manage SELinux on your system. # -------------------------------------
1. Checking SELinux Status
- Check if SELinux is enabled:
sestatus
sestatus
This command shows the current SELinux status and the enforced mode.
2. Managing SELinux Modes
- Set SELinux to enforcing mode (actively enforcing policies):
sudo setenforce 1
sudo setenforce 1
- Set SELinux to permissive mode (logs actions that would have been blocked):
sudo setenforce 0
sudo setenforce 0
- Disable SELinux (not recommended for secure environments): - You need to edit
/etc/selinux/config
/etc/selinux/config
and set
SELINUX=disabled
SELINUX=disabled
, then reboot.
3. Managing Policies
- List all SELinux boolean settings:
getsebool -a
getsebool -a
- Change a SELinux boolean setting (temporarily):
sudo setsebool httpd_can_network_connect 1
sudo setsebool httpd_can_network_connect 1
Replace
httpd_can_network_connect
httpd_can_network_connect
with the boolean you wish to change.
- Change a SELinux boolean setting (persistently across reboots):