SELinux add a mandatory access control to the traditional Linux permissions. When an action is blocked, the logs AVC and context file or process usually identify the rule in question; disable SELinux mask the symptom without correcting the policy.
Simple definition
A mandatory access control mechanism used on several Linux distributions.
Technical definition
A mandatory access control mechanism used on several Linux distributions. Under Linux, this concept is part of the system administration, storage, services or host security.
Correct. SELinux from stroke
Interpret the stroke to identify the process domain, resource type and rejected action. First, correct the context with the standard tools if it is wrong. Then check the documented booleans for the service; setsebool -P Only after validation of the need is used. A customised policy comes last, when access is legitimate and there are no existing rules that cover the case.
What is it used for?
Administer, diagnose or secure a Linux system.
Practical example
Example: an administrator can use this concept during a diagnostic SSH.
How to diagnose a blockage SELinux ?
Start with getenforce or sestatus to know the active mode. Then reproduce the problem and search for recent refusals with ausearch -m AVC -ts recent. Check contexts with ls -Z. If a file has a bad context after moving or restoring, restorecon often allows the policy context to be re-applyed.
Common issues
Passing in or deactivating SELinux This may confirm that a policy is taking place, but it is not a lasting correction. The problem may come from an incorrect context, a deactivated boolean or a really forbidden action. Check also the classic Unix permissions: a refusal of access may exist independently of SELinux, and changing the policy will not repair an incorrect owner or file mode.
FAQ — SELinux
SELinux Does he replace chmod and chown ?
No, the Unix and the permissions SELinux apply together; access must satisfy the relevant controls.
What does Enforcing mean?.
Rules SELinux are applied and the access is blocked and then logged.
What’s the point of the bull??…
Command applies context SELinux expected according to the file policy, which is useful after a move, restoration or mislabelling.