Manage SELinux Security Flashcards
What does SELinux stand for?
Security Enhanced Linux
What are SElinux three operator operational modes?
Enforcing, Permissive, and Disabled
What are SELinux policies?
Security rules that define how specific processes access relevant files, directories, and ports.
What do SELinux labels have?
User, role, type and security level.
What resource listing commands use the -Z option to manage SELinux contexts?
ps, ls, cp, mkdir
What command is used to view the current SELinux mode?
getenforce
What command is used to set the SELinux mode?
setenforce
What is used to configure SELinux persistently?
/etc/selinux/config
What command is used to manage the SELinux policy rules that determine the default context for files and directories?
semanage fcontext
What command is used to apply the context defined by the SELinux policy to files and directories?
restorecon
What command preserves the file attributes where possible?
cp -p
What command preservers only SELinux contexts, during copying?
cp –preserve=context
What commands are used to manage SELinux context on files?
semanage fcontext, restorecon, & chcon
What command changes the SELinux context directly on files, without referencing the system’s SELinux policy?
chcon
What command lists all the file context policy rules?
semanage fcontext -l
What are the semanage fcontext command options to add, remove, or list SELinux file context policies?
–add, –delete, –list
What is the most common extended regular expression when viewing policies?
(/.*)?
Where are service specific booleans are documented?
service_selinux man page
What command lists available Booleans for the targeted policies on the system, and current Boolean status?
getsebool -a
What command enables or diables the running state of these behaviors?
setsebool
What option makes the setsebool command persistent by writing to the policy file?
-P
What do you do when a common application or service fails, and the service is known to have a working SELinux policy?
First see the service’s _selinux man page to verify the correct context type label. Then view the affected process and file attributes to verify that the correct labels are set.
Where is an Access Vector Cache (AVC) from a denied SELinux action stored?
/var/log/audit/audit.log
After SELinux troubleshooting service monitors for AVC events where does it send an event summary?
/var/log/messages
