Book Image

SELinux System Administration

By : Sven Vermeulen
Book Image

SELinux System Administration

By: Sven Vermeulen

Overview of this book

NSA Security-Enhanced Linux (SELinux) is a set of patches and added utilities to the Linux kernel to incorporate a strong, flexible, mandatory access control architecture into the major subsystems of the kernel. With its fine-grained yet flexible approach, it is no wonder Linux distributions are firing up SELinux as a default security measure. SELinux System Administration covers the majority of SELinux features through a mix of real-life scenarios, descriptions, and examples. Everything an administrator needs to further tune SELinux to suit their needs are present in this book. This book touches on various SELinux topics, guiding you through the configuration of SELinux contexts, definitions, and the assignment of SELinux roles, and finishes up with policy enhancements. All of SELinux's configuration handles, be they conditional policies, constraints, policy types, or audit capabilities, are covered in this book with genuine examples that administrators might come across. By the end, SELinux System Administration will have taught you how to configure your Linux system to be more secure, powered by a formidable mandatory access control.
Table of Contents (13 chapters)

SELinux on, SELinux off


We can toggle the SELinux state through the /etc/selinux/config file and reboot the system to have the changes being reflected. But this is not the only way.

Switching to permissive (or enforcing) temporarily

On most SELinux enabled systems, we can call the setenforce command to switch the system between permissive (0) and enforcing (1) mode. This takes effect immediately, allowing us to easily identify if SELinux is preventing access or not.

Try it out. Switch to the permissive mode and validate (again using sestatus, that the SELinux state has indeed been changed immediately as follows:

# setenforce 0

The effect of setenforce is the same as writing the value into the /sys/fs/selinux/enforce (or /selinux/enforce) pseudo file:

# echo 0 > /sys/fs/selinux/enforce

The ability to switch between the permissive and enforcing mode can be of interest for policy developers or system administrators who are modifying the system to use SELinux properly. This SELinux feature is...