Let's start pulling the covers off SELinux and discover a little more about what makes these controls work, starting with SELinux modes.
To begin with, we will discuss three modes that we can run with SELinux. These modes are illustrated for you in the following figure:
When SELinux is disabled, SELinux is not used and the objects are NOT labeled. In the disabled mode, we rely solely on the original DAC. If we later need to enable SELinux, the boot process is lengthened because all the objects need to be relabeled again. Disabling SELinux completely like this is probably not a good idea, but should it be required, it can be set in the /etc/selinux/config file by changing the following line:
SELINUX=disabled
One reason this is not a great idea is that a reboot is required for this to take effect. As mentioned before, files need to be relabeled if SELinux is enabled later. We can force a relabel if all filesystem objects are running by running the...