5) SELINUX

Question 1

Which packages have restorecon & semanage commands?

Answer 1

policycoreutils & policycoreutils-python

Question 2

How do you show SELINUX file context?

Answer 2

$ semanage fcontext -l

$ ls -Zd /virtual

Question 3

How do you temporarily change SELINUX file context?

Answer 3

chcon -t httpd_sys_content_t /virtual

returns to default if restorecon is run

Question 4

What does the expression (/.*)? mean

Answer 4

optionally, match a / followed by any nubmer of characters

Question 5

Define a SELinux file context rule that defines httpd_sys_content_t for /custom recursively

Answer 5

# semanage fcontext -a -t httpd_sys_content_t '/custom(/.*)?'
# restorecon -Rv /custom

Question 6

What do SELinux booleans do?

Answer 6

booleans are switches that change the behavior of SELinux policy. They are rule that can be disabled or enabled.

Question 7

Show SELinux boolean settings

Answer 7

$ getsebool -a

$ getsebool httpd_enable_homedirs

Question 8

Enable httpd hosting within home directories using SELinux. Make it persistent across reboot.

Answer 8

$ setsebool -P httpd_enable_homedirs on

Question 9

Compare SELinux file context of /moo to /moocow

Answer 9

ls -dZ /moo /moocow