Manage Security thru Selinux

Commands to remember

sestatus show selinux status
getenforce show enforcing status of selinux
setenforce enforcing|permissive set status of selinux
getsebool -a show the boolean value of the service
setsebool -P set the the boolean value
chcon - u(user) -r (role) -t (type) change context of a file
chcon --reference=<dir> <dir_to_change_context> copy the context of the dir as referrence
restorecon -F myfile restore file default file context

User
unconfined_u unprotected user
system_u system user
user_u normal user

Role
object_r file
system_r users processes

domain
unconfined_r unprotected file or process

Set enforcing and permissive modes for SELinux
-thru configfile edit /etc/sysconfig/selinux
-or use the command setenforce
#setenforce Enforcing|Permissive

List and identify SELinux file and process context
- File
ls -lZ

-Process
ps -eZ|grep <process name>

Restore default file contexts
restorecon -F myfile
chcon - u(user) -r (role) -t (type) change context of a file
chcon --reference=<dir> <dir_to_change_context> copy the context of the dir as referrence

Use boolean settings to modify system SELinux settings
getsebool -a show the boolean value of the service
setsebool -P <boolean>=1/0 set the the boolean value

Diagnose and address routine SELinux policy violations

To get man pages for a certain commands
man -k _selinux

Description of the boolean
semanage boolean -l #provided by the policycoreutils-python

To survive a SELinux relabel
ex: #semanage fcontext -a -s system_u -t httpd_sys_script_exec_t /var/www/cgi-bin