Security-Enhanced Linux for mere mortals
Why Unix & Linux Stack Exchange recommends it
Unix & Linux Stack Exchange users link it as a friendly explainer of how SELinux works when answering questions about contexts, booleans and writing a first policy.
Recommended by 2 people across 2 different months, 2018 to 2020.
What it is
A 44-minute Red Hat Summit 2018 conference session introducing SELinux through real-world examples. It covers configuring SELinux, analyzing and fixing SELinux denials, and writing basic policies for applications on SELinux-protected systems.
What people said
Strong rec znpy · 2018-12 · Unix & Linux Stack Exchange · on “SELinux is preventing $_POST variables on Amazon Linux 2”
Make sure to check /var/log/audit/audit.log for selinux warnings. It might suggest what policy to enable. Otherwise, you can set SELinux in permissive mode and then use the aforementioned logfile to build a custom policy encompassing all the needs of your application. In order to do this, set SELinux in permissive mode, use all the features of your code and then use the audit2allow to generate a custom policy. You can then bundle and distribute the policy file with your code so that SELinux will allow all and only the special permissions that your code needs: # generate a custom policy grep "AVC" /var/log/audit/audit.log | audit2allow -M yourapp # install that policy semodule -i yourapp.pp W
Recommends Sonia · 2020-07 · Unix & Linux Stack Exchange · on “Modify OS Security Module Configuration on SELinux vs AppArmor”
AppArmor and SELinux work differently. When AppArmor works on tunables and profiles, such as /etc/apparmor.d/usr.sbin.mysqld, SELinux works on contexts and booleans. If you want to make some change for the file /usr/sbin/mysqld, you can check it's context by listing it with "-Z" option: ls -Z /usr/sbin/mysqld Then you can set appropriate boolean for the context, but it really depends on what exactly you want to do. If you want to learn more on how SELinux works, there's a good explanatory video: [this video]
Cites mister mcdoogle · 2020-10 · Unix & Linux Stack Exchange · on “SELinux: My First Policies”
I am at the point it's time to create my first policies. I have read the HowTo Security SELinux [LINK] , watched the video SELinux for mere mortals [this video] and multiple other documents I have received from the community. I understand with a wide scope of what the purpose and intentions of SELinux is and now ready to start implementing policies with the the policy generation gui tool. Just not sure exactly where to start. There are so many options. I am looking to be coached through my first few policies and have my hand held. I know must achieve a minimum the following: enable users to be able to ssh into the network | Got this figured out using the gui SELinux Management tool, very cool! ge