Linux Tutorial

Linux File/Directory Management

Linux Packaging And Compression

Vim Text Editor

Linux Text Processing

Linux Software Installation

Linux User/User Group Management

Linux Permission Management

Linux Filesystem Management

Linux Advanced Filesystem Management

Linux System Management

Linux Backup and Recovery

Linux System Service Management

Linux System Log Management

Linux Boot Management

LAMP/LNMP Environment

SELinux Management

SELinux Work Mode Settings (getenforce, setenforce And sestatus Commands)

In this tutorial, we will cover the three primary SELinux commands used to manage and query the working mode settings of Security-Enhanced Linux (SELinux): getenforce, setenforce, and sestatus. These commands will allow you to determine the current SELinux mode, switch between modes, and check the overall SELinux status.

1. getenforce The getenforce command is used to display the current SELinux mode: Enforcing, Permissive, or Disabled.

To check the current SELinux mode, simply run:

getenforce

The output will be one of the following:

Enforcing
Permissive
Disabled

2. setenforce The setenforce command allows you to switch between the Enforcing and Permissive modes of SELinux without rebooting the system. To use setenforce, you will need root privileges.

To switch to Enforcing mode, run:
```
sudo setenforce 1
```
To switch to Permissive mode, run:
```
sudo setenforce 0
```

Please note that the setenforce command does not change the mode permanently; it only changes the current session. To make the changes persistent across reboots, modify the /etc/selinux/config file as described in the previous tutorial.

3. sestatus The sestatus command provides comprehensive information about the SELinux status, including the current mode, policy type, and policy version.

To check the SELinux status, run:

sestatus

The output will look something like this:

SELinux status:                 enabled
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 31
Policy from config file:        targeted

In the output above, you can see that SELinux is enabled, and the current mode is set to Enforcing. Additionally, the policy version is 31, and the policy type in use is the targeted policy.

In conclusion, understanding and utilizing the getenforce, setenforce, and sestatus commands will help you manage and monitor the working mode settings of SELinux. These commands provide you with the ability to easily switch between modes, check the current SELinux mode, and get detailed information about your SELinux status. Remember that proper configuration of SELinux is crucial for maintaining the security and stability of your Linux system.

How to use getenforce command in SELinux:
- Description: The getenforce command is used to retrieve the current SELinux enforcement mode.
- Code:
```
getenforce
```
View SELinux status with sestatus command:
- Description: The sestatus command provides detailed information about SELinux status, including the current mode, policy version, and more.
- Code:
```
sestatus
```
Using getenforce to check SELinux mode:
- Description: getenforce displays the current SELinux enforcement mode, which can be Enforcing, Permissive, or Disabled.
- Code:
```
mode=$(getenforce)
echo "SELinux is in $mode mode."
```
Change SELinux mode with setenforce command:
- Description: The setenforce command is used to change SELinux enforcement modes. For example, to set it to Permissive:
```
setenforce Permissive
```
Check SELinux enforcement status with sestatus:
- Description: The sestatus command provides a detailed summary of SELinux status, including the enforcement mode, policy type, and more.
- Code:
```
sestatus | grep "SELinux status"
```

Examples of getenforce, setenforce, and sestatus commands:

Description: Examples of using these commands together:

current_mode=$(getenforce)
echo "Current SELinux mode: $current_mode"

setenforce Permissive

updated_mode=$(getenforce)
echo "Updated SELinux mode: $updated_mode"

sestatus

SELinux status command line options:
- Description: The sestatus command can be used with various options to display specific information. For example:
```
sestatus -v
```
Troubleshooting SELinux with getenforce and sestatus:
- Description: Use getenforce and sestatus to troubleshoot SELinux-related issues. Check the enforcement mode and detailed status to identify problems.
- Code:
```
current_mode=$(getenforce)
echo "Current SELinux mode: $current_mode"

sestatus
```
Setting SELinux to Enforcing or Permissive with setenforce:
- Description: Use setenforce to switch between Enforcing and Permissive modes. For example:
```
setenforce Enforcing
```