Some of SELinux's tips

Some of SELinux's tips-Linux Enterprise Application-Linux server application information. The following is a detailed description. DAC: Discretionary access control the access control method used in traditional Linux. It is implemented by three users: user, group, and other.
MAC: Mandatory access control SELinux adopts the method, which is determined by the security administrator, namely root, to control the access permission.
Each process or object has a security context, including identity: role: domain/type.
Security Policy (targeted) defines which operations require the context permission
Some commands:
Sestatus view SELinux activation status
Setenforce 0 will enforcing --> permissive
Setenforce 1 will permissive --> enforcing
Getsebool httpd_disable_trans: Check whether httpd is protected by SELinux. RHEL4: inactive is protected, active is not protected, RHEL5: off is protected, and on is not protected.
Setsebool-P httpd_disable_trans = 1 boolean value from inactive to active, so that httpd is not protected by SELinux
Off --> on, making httpd unprotected
Setsebool httpd_disable_trans = 1-P to change the configuration file, permanent settings, no-P temporary settings
Boolean values in/etc/selinux/targeted/booleans RHEL4 are stored in this file
/Selinux/booleans RHEL5. The files named by booleans are displayed in this directory. The content is 11 | 00
System-config-securitylevel graphical interface Configure Firewall/SELinux, modify/etc/sysconfig/iptables and selinux
Configure Firewall/SELinux on the system-config-securitylevel-tui text interface, and modify/etc/sysconfig/iptables and selinux.
Detailed Content of system-config-selinux graphic configuration SELinux, booleans...
Ps-Z: view the context of the process
Ls-Z: view the context of the file
Id-Z indicates the context of the user.
Chcon-t user_home_t install. log modify the context of install. log to the user_home_t type
Runcon uses a specific context to execute commands
Runcon-t httpd_t cat/etc/passwd
Grep avc/var/log/messages to view some selinux Information
/Var/log/audit. log SELinux log