Security-Enhanced Linux mandatory access control for RHEL, CentOS, and Fedora
What is this?
SELinux adds an extra security layer on Linux that controls which programs can access which files.
Step 01
1# Check if installed2rpm -q libselinux selinux-policy3sestatus4 5# Ubuntu (optional):6sudo apt-get install -y selinux-basics selinux-policy-default7sudo selinux-activate # requires rebootStep 02
1# Check current mode2getenforce # Enforcing, Permissive, or Disabled3sestatus4 5# Temporary change6sudo setenforce 0 # Permissive (logs but doesn't block)7sudo setenforce 1 # Enforcing8 9# Permanent — edit /etc/selinux/config:10# SELINUX=enforcing11# SELINUXTYPE=targeted12# Reboot required for Disabled → Enabling1# View file context2ls -Z /var/www/html/3ps auxZ | grep httpd4 5# Restore default context6sudo restorecon -Rv /var/www/html/7 8# Change context type9sudo semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"10sudo restorecon -Rv /web11 12# Boolean settings13getsebool -a | grep httpd14sudo setsebool -P httpd_can_network_connect on1# View AVC denials2sudo ausearch -m avc -ts recent3sudo sealert -a /var/log/audit/audit.log4 5# Generate custom policy from denial6sudo ausearch -m avc -c 'httpd' --raw | audit2allow -M myhttpd7sudo semodule -i myhttpd.pp8 9# audit2why for explanation10sudo ausearch -m avc -ts recent | audit2whyStep 03
1sestatus2semodule -l | head3sesearch --allow -s httpd_t -t httpd_sys_content_tStep 04
1# Allow custom port2sudo semanage port -a -t http_port_t -p tcp 80803sudo semanage port -l | grep http4 5# Install/remove policy module6sudo semodule -i mypolicy.pp7sudo semodule -r mypolicy8 9# Full relabel (after enable)10sudo touch /.autorelabel11sudo reboot