SELinux modes<\/p>\n
SELinux gives that extra layer of security to the resources in the system. It provides the MAC (mandatory access control) as contrary to the DAC (Discretionary access control). Before we dive into setting the SELinux modes, let us see what are the different SELinux modes of operation and how do they work. SELinux can operate in any of the 3 modes :<\/p>\n
1. Enforced : Actions contrary to the policy are blocked and a corresponding event is logged in the audit log.
\n2. Permissive : Actions contrary to the policy are only logged in the audit log.
\n3. Disabled : The SELinux is disabled entirely.<\/p>\n
Configuration file<\/p>\n
SELinux configuration file \/etc\/selinux\/config :<\/p>\n
# cat \/etc\/selinux\/config<\/p>\n
# This file controls the state of SELinux on the system.
\n# SELINUX= can take one of these three values:
\n# enforcing – SELinux security policy is enforced.
\n# permissive – SELinux prints warnings instead of enforcing.
\n# disabled – No SELinux policy is loaded.
\nSELINUX=disabled
\n# SELINUXTYPE= can take one of three two values:
\n# targeted – Targeted processes are protected,
\n# minimum – Modification of targeted policy. Only selected processes are protected.
\n# mls – Multi Level Security protection.
\nSELINUXTYPE=targeted
\nToggling SELinux modes (Temporarily)<\/p>\n
To switch between the SELinux modes temporarily we can use the setenforce command as shown below :<\/p>\n
# setenforce [ Enforcing | Permissive | 1 | 0 ]
\n0 \u2013> Permissive
\n1 \u2013> Enforcing<\/p>\n
Verify the current mode of SELinux :<\/p>\n
# getenforce
\nEnforcing
\nor we can also use the sestatus command to get a detailed status :<\/p>\n
# sestatus
\nSELinux status: enabled
\nSELinuxfs mount: \/selinux –> virtual FS similar to \/proc
\nCurrent mode: enforcing –> current mode of operation
\nMode from config file: permissive –> mode set in the \/etc\/sysconfig\/selinux file.
\nPolicy version: 24
\nPolicy from config file: targeted
\nToggling SELinux modes (Permanently) [reboot require]<\/p>\n
SELinux mode can be set permanently using either of below methods :
\n1. editing \/etc\/selinux\/config file
\n2. editing kernel boot options<\/p>\n
1. editing \/etc\/selinux\/config file<\/p>\n
to set SELinux to permissive, set the below line in the file \/etc\/selinux\/config to :<\/p>\n
vi \/etc\/selinux\/config
\n….
\nSELINUX=permissive
\n…
\nSimilarly the mode can be set to enforcing\/disable by setting the mode in the same line.<\/p>\n
2. editing kernel boot options<\/p>\n
Edit the kernel boot line and append enforcing=0 to the kernel boot options. For example:<\/p>\n
title Red Hat Enterprise Linux AS (2.6.9-42.ELsmp)
\nroot (hd0,0)
\nkernel \/vmlinuz-2.6.9-42.ELsmp ro root=LABEL=\/ rhgb quiet enforcing=0
\ninitrd \/initrd-2.6.9-42.ELsmp.img
\nReboot the server.<\/p>\n
# shutdown -r now
\nForcing reboot on changing mode<\/p>\n
We can force a reboot on changing the selinux mode :<\/p>\n
# setsebool secure_mode_policyload on<\/p>\n","protected":false},"excerpt":{"rendered":"
SELinux modes<\/p>\n
SELinux gives that extra layer of security to the resources in the system. It provides the MAC (mandatory access control) as contrary to the DAC (Discretionary access control). Before we dive into setting the SELinux modes, let us see what are the different SELinux modes of operation and how do they work. SELinux […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[73],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6708"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6708"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6708\/revisions"}],"predecessor-version":[{"id":6709,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/6708\/revisions\/6709"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}