Summary
In this chapter, we saw how to enable and disable SELinux, both on a complete system level as well as a per-service level using various methods: kernel boot options, an SELinux configuration file, or plain commands. One such command is semanage permissive, which can disable SELinux protections for a single service.
Next, we saw where SELinux logs its events and how to interpret them, which is one of the most common tasks an administrator has to undertake when dealing with SELinux. To assist us with this interpretation, we can use tools such as setroubleshoot, sealert, and audit2why. We also touched upon several utilities related to Linux auditing to help us sift through various events.
In the next chapter, we will look at the first administrative task on SELinux systems: managing user accounts, their associated SELinux roles, and security clearances for the resources on the system.
