RH134 Ch 4: SELinux Without Switching It Off

SELinux adds a second gate behind normal permissions. Every process and file carries a context such as systemu:objectr:httpdsyscontentt:s0; for the targeted policy only the third field, the type, matters. The policy says which process types may touch which file and port types. A web server running as httpdt may read httpdsyscontentt files and bind httpportt ports, and nothing else.

Modes. enforcing blocks and logs, permissive only logs, disabled turns the whole thing off. setenforce 0|1 switches the running mode; the boot-time mode is SELINUX= in /etc/selinux/config. A task that says "enforcing" means both. Never answer an SELinux problem by disabling SELinux: the exam checks the mode after a reboot.

bash getenforce; sestatus setenforce 1 && sed -i 's/^SELINUX=./SELINUX=enforcing/' /etc/selinux/config

File labels. New files inherit the type of their parent directory; mv keeps the old label, cp takes the new one. chcon changes a label directly, but the next restorecon or full relabel puts the policy default back. The lasting fix is a rule plus restorecon:

bash semanage fcontext -a -t httpdsyscontentt '/webdata(/.)?' restorecon -Rv /webdata ls -Zd /webdata; matchpathcon /webdata/index.html

Ports. A service on a non-standard port needs that port labelled: semanage port -a -t httpportt -p tcp 8818. If the port already belongs to another type, use -m instead of -a. semanage port -l | grep http lists the current ones.

Booleans switch optional parts of the policy on or off, for example httpdenablehomedirs or httpdcannetworkconnect. getsebool -a lists them, semanage boolean -l explains them. Always use setsebool -P; without -P the value is lost at boot.

Finding denials. Denials are AVC records in /var/log/audit/audit.log. ausearch -m AVC -ts recent shows the raw records: scontext is who asked, tcontext what was touched, tclass the kind of object. sealert -a /var/log/audit/audit.log (setroubleshoot) explains each one and usually prints the exact restorecon, semanage or setsebool command to run. Read its advice and don't apply audit2allow modules blindly.

Common exam mistakes - setenforce 1 only, so the box comes back permissive after the reboot. - chcon instead of semanage fcontext + restorecon. - setsebool without -P. - Forgetting the port label, so httpd or sshd fails to start with "Permission denied" on bind.