SElinux provides mandatory access controls that confine processes and restrict access between processes and files based on security contexts. It operates by default in enforcing mode, where no access is allowed unless explicitly granted by a policy rule. Users can view and manage security contexts, booleans that toggle rules, and troubleshoot issues using various GUI and command line tools.

1. Something like sandboxing…
2.6.x kernel and later, created from :
What is it?
SΕlinux
SElinux Page 1

2. How does it work?
A context determine whether a process can access a file, directory, or port.
By default, the policy does not allow any interaction unless an explicit rule grants
access.
No allow rule => No access is allowed
ps -eZ
contexts: user , role, type, and sensitivity
enforcing permissive disabled
setenforce:
getenforce:
/etc/selinux/config
/etc/selinux/*/contexts/files
SElinux Page 2

3. Managing context
chcon -t
restorecon
semanage
Booleans
getsebool -a
semanage boolean -l
semanage boolean -l -C
setsebool -P <name> on/off
yum install policycoreutils-gui setroubleshoot ---> system-config-selinux , sealert
yum -y install setools-console ---> sesearch !
What is actualy changing when you turn on/off a boolean switch??
sla
SElinux Page 3

4. SElinux tutorials
sealert -a /var/log/audit/audit.log
How can I see if something is allowed by a policy?
sealert
SElinux Page 4

5. SElinux tutorials
SElinux Page 5