SELinux cheat sheet

The chapter on one page: what to remember, the commands to have at your fingertips, and flashcards for quick revision.

The chapter in eight sentences

SELinux is mandatory access control: every file, process and port has a context (user:role:type:level), and the type decides what the policy allows.
An access needs both the ordinary permissions and SELinux to allow it; chmod cannot fix a label problem.
getenforce, sestatus and setenforce 0|1 show and switch the mode for now; /etc/selinux/config sets it permanently. Never disable SELinux to solve a denial.
ls -Z, ps -Z and id -Z show contexts; matchpathcon PATH shows the type the policy expects.
Fix a wrong file type permanently with semanage fcontext -a -t TYPE "/dir(/.*)?" followed by restorecon -Rv /dir; chcon is temporary.
cp creates a file with the destination's default label; mv keeps the old label, so run restorecon after moving files into a service directory.
Booleans are on/off switches for optional behaviour (getsebool -a, setsebool -P NAME on); a service on a non-standard port needs semanage port -a -t TYPE -p tcp PORT.
Troubleshoot: test permissive, read the AVC in /var/log/audit/audit.log (or sealert -a), choose label, boolean or port, make the smallest fix, and test in enforcing mode.

Command	Does
`getenforce` · `sestatus`	Mode and policy
`setenforce 0` / `1`	Permissive / enforcing (until reboot)
`/etc/selinux/config`	`SELINUX=enforcing` (permanent)
`ls -Z` · `ps -eZ` · `id -Z`	Contexts
`matchpathcon PATH`	The expected type

Command	Does
`semanage fcontext -a -t T "/p(/.*)?"`	Add a labelling rule
`semanage fcontext -l -C` · `-d "/p(/.*)?"`	List / delete local rules
`restorecon -Rv PATH` (`-n` to preview)	Apply the rules
`chcon -t T FILE`	Temporary label
`getsebool -a` · `setsebool -P B on`	Booleans
`semanage boolean -l -C`	Changed booleans
`semanage port -a -t T -p tcp N` · `-l -C` · `-d`	Port labels

Command	Does
`setenforce 0`, retry, `setenforce 1`	Is it SELinux?
`grep AVC /var/log/audit/audit.log`	The denials
`sealert -a /var/log/audit/audit.log`	Plain-language explanation
`ausearch -m AVC -i` (add `-if FILE` if needed)	Search the audit log
`journalctl -u SERVICE`	What the service says
`audit2allow -M name`	Custom module: last resort

What is a context, and which part matters?: user:role:type:level; the type (…_t) is what the targeted policy rules are about.
See contexts of files, processes, yourself?: ls -Z · ps -Z · id -Z
Show and set the mode?: getenforce · sestatus · setenforce 0|1 (temporary) · SELINUX= in /etc/selinux/config (permanent)
Which type should a path have?: matchpathcon PATH
Permanent label for a directory tree?: semanage fcontext -a -t TYPE "/dir(/.*)?" then restorecon -Rv /dir
Why is chcon temporary?: It records no rule; restorecon or a relabel resets the label.
cp versus mv?: cp takes the destination default; mv keeps the old label: restorecon after mv.
List and set booleans?: getsebool -a · semanage boolean -l · setsebool -P NAME on|off
Allow a service on a non-standard port?: semanage port -a -t http_port_t -p tcp 82 (list: semanage port -l)
Where are denials?: /var/log/audit/audit.log: grep AVC · sealert -a /var/log/audit/audit.log
Is SELinux the cause?: setenforce 0, retry, setenforce 1.
Troubleshooting order?: Test permissive, read the AVC, choose label / boolean / port, smallest fix, test in enforcing.