4.1.3. SELinux: Mandatory Access Control

💡 First Principle: SELinux assigns a context (label) to every process and every file: user:role:type:level. Access is only permitted if the SELinux policy explicitly allows that type of process to access that type of file. Even if standard Unix permissions allow access, SELinux can deny it — and vice versa. Both layers must permit access.

SELinux is the difference between an nginx process that can only read files labeled httpd_sys_content_t and a compromised nginx that could read /etc/shadow. The policy says "httpd processes access httpd content" — nothing else.

SELinux States and Modes:

getenforce                      # Enforcing / Permissive / Disabled
sestatus                        # Detailed status including policy name
setenforce 1                    # Switch to Enforcing (runtime, not persistent)
setenforce 0                    # Switch to Permissive (runtime, not persistent)
# Persistent: edit /etc/selinux/config → SELINUX=enforcing

SELinux Contexts:

ls -Z /var/www/html/            # Show file security context
# -rw-r--r--. root root system_u:object_r:httpd_sys_content_t:s0 index.html
#                               ^--------^  ^------------------^
#                               user:role   type (most important for access)

ps -eZ | grep nginx             # Show process context
id -Z                           # Show current user's SELinux context

Managing Contexts:

# Fix incorrect context (most common fix)
restorecon -v /var/www/html/myfile.html     # Restore to policy default
restorecon -Rv /var/www/html/               # Recursive restore

# Temporarily change context (lost on relabel)
chcon -t httpd_sys_content_t /data/myfile.html

# Persistently change context mapping (survives restorecon)
semanage fcontext -a -t httpd_sys_content_t "/data/website(/.*)?"
restorecon -Rv /data/website/               # Apply the new mapping

# Move/copy files — preserve context
cp --preserve=context file /var/www/html/   # Preserve context on copy
mv file /var/www/html/                      # Move preserves context automatically

SELinux Booleans — Tunable Policy Options:

getsebool -a                               # List all booleans and their state
getsebool httpd_can_network_connect_db     # Check specific boolean
setsebool httpd_can_network_connect_db on  # Set boolean (runtime only)
setsebool -P httpd_can_network_connect_db on  # Set boolean persistently (-P)

Booleans let you enable optional policy rules without writing custom policy. Common ones: httpd_can_network_connect (allow Apache to make outbound connections), httpd_enable_homedirs (allow Apache to serve content from home dirs).

Diagnosing and Resolving SELinux Denials:

# Check for denials
ausearch -m avc -ts recent              # Recent AVC denials
journalctl | grep "SELinux is preventing" # systemd journal view
sealert -a /var/log/audit/audit.log     # Friendly analysis with suggestions

# Generate policy from denial (use with caution)
audit2allow -a                          # Show what allow rules would fix all recent denials
audit2allow -a -M mypolicy             # Generate a policy module
semodule -i mypolicy.pp                # Install the policy module

⚠️ Exam Trap (M5): Setting SELINUX=permissive does NOT protect your system — it only logs what Enforcing would deny. Many admins set Permissive to "fix" a problem and never return to Enforcing. The correct fix is to identify the denial with sealert/ausearch, fix the context with restorecon or semanage fcontext, and keep SELinux in Enforcing mode.

Reflection Question: You move a web application's content to /srv/www/ instead of /var/www/html/. Apache can read files in the new location (Unix permissions are correct), but it returns 403 Forbidden. SELinux is in Enforcing mode. What is the most likely cause and what two commands resolve it permanently?