SELinux

selinux.md

SELinux

Controll the folder access by applications

Commands

• getenforce
• sestatus

Generate the Log Messages /var/log/audit/audit.log

1. Set SELinux to permissive

sudo setenforce permissive 

2. tail -f /var/log/audit/audit.log

Use the log messages to create the templates

1. Copy the settings from a default folder, i.e,:

ls -laZ /var/www

2. Change the type of the folder

sudo chcon -Rv --type=httpd_sys_content_t /netshare/www

Non default program

1. Install dnf install policycoreutils-devel to provide audi2allow
2. Set selinux to permissive

sudo setenforce permissive
`

2. Use the audit error log to create a policy module
```bash
sudo grep httpd /var/log/audit/audit.log | audit2allow -M httpd

3. Install the policy file

sudo semodule -i httpd.pp

4. Set SELinux to enforcing mode

sudo setenforce enforcing