Skill 4 in course 2.4: Network and Security

SELinux Basics

Set the SELinux mode, read and fix file contexts, label ports, toggle booleans, and find out what SELinux denied.

Intermediate3 lessons15 exercises2 h 20 min
Start skill

You will be able to

  • Explain what SELinux adds to ordinary permissions, and read a context as user:role:type:level.
  • Set enforcing or permissive mode temporarily and persistently, and check the current mode.
  • Give a directory the right label persistently, label a non-standard port, and toggle a boolean permanently.
  • Read an AVC denial, find the cause with ausearch or sealert, and apply the smallest correct fix.

Lessons

  1. 01SELinux modes and security contextsUnderstand what SELinux adds, check and change its mode, and read the context on files, processes and users.getenforcesetenforcesestatus/etc/selinux/configls -Zps -eZ0/5 exercises
  2. 02File contexts and port labelsMake a label stick with semanage and restorecon, relabel moved files, and teach SELinux about a service on a non-standard port.chconsemanage fcontextrestoreconsemanage portls -Zsemanage fcontext -l0/5 exercises
  3. 03Booleans and troubleshooting denialsSwitch policy features with booleans, read an AVC message, and choose the smallest correct fix instead of turning SELinux off.getseboolsetsebool -Psemanage booleanausearchaureportsealert0/5 exercises