Display the security context associated with files or directories under SELinux kernel

GIT – Q. I’m using server 5 with SELinux enabled . How do I display the context associated with files or directories under SELinux kernel? Basically I’d like to know which SELinux context applies to some files or directories.

A.. To get more information about SELinux security context applied to files and directory you need to use patched ls command. CentOS comes with modified (patched) ls command. Following are the SELinux ls command options:

  • –lcontext : Display security context. Enable -l. Lines will probably be too wide for most displays.
  • -Z or –context : Display security context so it fits on most displays. Displays only mode, user, group, security context and name.
  • –scontext : Display only security context and file name.

Type ls -Z command you will see the SELinux applied security context:
# ls -Z /var
# ls -Z /home
# ls --lcontext /etc

Enable permissive mode for SELinux purpose

SELinux may create problem for network service if not configured properly. So you can turn off SELinux temporarily i.e. permissive mode for SELinux. In this mode SELinux will continue its work and it will log message to system log files. But it will not block any network service or protected service.

This is great for troubleshooting purpose. For example, server or POP3/IMAP sever known to have problem with SELinux.

You can modify the mode SELinux is running in using setenforce command. Use value 1 to put SELinux in enforcing mode. Use value 0 to put SELinux in permissive mode. Use getenforce command to find out whether SELinux is enforcing, permissive, or disabled.

Get SELinux mode

# getenforce



Set SELinux mode to permissive mode

# setenforce 0
# getenforce



GUI tools for setting up SELinux mode

If you are using Core or Red Hat Enterprise Linux use system-config-securitylevelcommand to SELinux mode and other related properties. Type the following command at shell prompt:

$ system-config-securitylevel

Selinux can be disabled by passing kernel boot parameters. You need to edit grub.conf / menu.lst/ lilo.conf file.

Print Friendly, PDF & Email



Bài viết liên quan

Be the first to comment

Để lại lời nhắn