Chapter 16: SELinux

Understand SELinux contexts and modes, fix file labels, booleans and ports the right way, and troubleshoot denials without disabling the protection.

What you will learn

• Explain mandatory access control, read security contexts, and show and switch the SELinux mode.
• Set permanent file-context rules with semanage fcontext and apply them with restorecon.
• Change booleans and port labels permanently, and choose between a label, a boolean and a port.
• Diagnose denials from the audit log and fix them with the smallest change, testing in enforcing mode.

Sections

1. What SELinux does
2. Exercise: Read the labels
3. File contexts: rules, restorecon and chcon
4. Exercise: Fix a 403 caused by a label
5. Booleans and ports
6. Exercise: Flip a switch and label a port
7. Troubleshooting SELinux denials
8. Exercise: Two faults, one symptom
9. Exercise: SELinux review
10. SELinux quiz
11. SELinux cheat sheet