Summary

We saw how to enable and disable SELinux both on a complete system level as well as a per service level using various methods: kernel boot options, SELinux configuration file, or plain commands. One of the commands is the use of semanage permissive, which can disable SELinux protections for a single service.

Next, we saw where SELinux log its events and how to interpret them, which is one of the most important capabilities of an administrator when dealing with SELinux. To assist us with this interpretation, there are tools such as setroubleshoot, sealert, and audit2why.

In the next chapter, we will look at the first administrative task on SELinux systems: managing user accounts and their associated SELinux roles and security clearances towards the resources on the system.