Linux Tutorial

Linux File/Directory Management

Linux Packaging And Compression

Vim Text Editor

Linux Text Processing

Linux Software Installation

Linux User/User Group Management

Linux Permission Management

Linux Filesystem Management

Linux Advanced Filesystem Management

Linux System Management

Linux Backup and Recovery

Linux System Service Management

Linux System Log Management

Linux Boot Management

LAMP/LNMP Environment

SELinux Management

SELinux Working Modes (Disabled, Permissive, And Enforcing)

SELinux (Security-Enhanced Linux) is a Linux kernel security module that provides a flexible and fine-grained mechanism for enforcing mandatory access controls (MAC) in Linux systems. In this tutorial, we will discuss the two main working modes of SELinux: Enforcing and Permissive mode, as well as a Disabled mode.

1. Enforcing Mode In this mode, SELinux enforces the security policy, actively controlling the access and actions that users, processes, and files can perform. If a user, process, or file attempts to perform an action that is not permitted by the policy, SELinux will block it and generate an audit log entry.

To set SELinux to enforcing mode, run the following command:

sudo setenforce 1

To verify that SELinux is in enforcing mode, use the getenforce command:

getenforce

The output should be:

Enforcing

2. Permissive Mode In permissive mode, SELinux does not actively enforce the security policy. Instead, it allows all actions to be performed, regardless of whether they are permitted by the policy or not. However, SELinux still logs violations to the audit log, which allows you to identify potential security issues without impacting system operation.

To set SELinux to permissive mode, run the following command:

sudo setenforce 0

To verify that SELinux is in permissive mode, use the getenforce command:

getenforce

The output should be:

Permissive

3. Disabled Mode In disabled mode, SELinux is completely turned off and does not provide any security mechanisms or log any actions.

To disable SELinux, you must modify the /etc/selinux/config file. Open it using your preferred text editor:

sudo nano /etc/selinux/config

Find the line that starts with SELINUX= and change its value to disabled:

SELINUX=disabled

Save and close the file. You will need to reboot your system for the changes to take effect:

sudo reboot

After the reboot, to verify that SELinux is disabled, use the sestatus command:

sestatus

The output should show:

SELinux status:                 disabled

Remember that disabling SELinux reduces the overall security of your system, so only do so if you have a specific reason.

In conclusion, SELinux provides a robust mechanism for enforcing mandatory access controls on Linux systems. By understanding the different working modes, you can choose the appropriate level of security and flexibility for your system. Remember to always assess the trade-offs between security and usability when configuring SELinux.

How to check SELinux mode in Linux:
- Description: To check the SELinux mode, you can use the sestatus command:
```
sestatus
```
Switching SELinux modes in CentOS/Red Hat:
- Description: To switch SELinux modes in CentOS/Red Hat, edit the /etc/selinux/config file and change the SELINUX parameter. After modification, reboot the system or use the setenforce command:
```
setenforce Enforcing|Permissive|0
```
SELinux mode change audit logs:
- Description: SELinux mode changes are logged in the audit log. To view SELinux-related entries, use tools like ausearch or sealert:
```
ausearch -m avc -ts recent
```