SELinux context contains a user, role and context type
Contexts are stored in /etc/selinux/targeted/contexts/files/file_contexts
Assign the context name_log_t to the logs directory
semanage fcontext -a -t named_log_t '/var/named/chroot/logs(/.*)?'
Assign the dns_port_t context to TCP port 12345
semanage port -a -t dns_port_t -p tcp 12345
Change the context of a file based on another file (not persistent)
chcon --reference /var/www/html /var/www/html2
Set the files to their default context
restorecon -Rv /var/www/html
List booleans on a system
getsebool -a
List boolean values with descriptions
semanage boolean -l
Change a boolean value ("-P" makes this persistent)
setsebool -P ftpd_anon_write on
Report SELinux violations by analyzing the audit log file
sealert -a /var/log/audit/audit.log
You can remedy violations with auti2allow. The output from sealert
shows the commands you need to run.
List system user to SELinux mappings
semanage login -l
Change the defaul user mapping to user_u instead of default
semanage login -s -S targeted -s "user_u" -r so __default__
Map the user ollie to the SELinux user staff_u
semanage login -a -s staff_u ollie