Jaxelson at 20:48, 13 September 2010

Jaxelson — Mon, 13 Sep 2010 20:48:42 GMT

←Older revision		Revision as of 20:48, 13 September 2010
Line 34:		Line 34:
	----		----
	<references/>		<references/>
		+
		+	[[Category:Notebook]]

RichardHaines: New page: = SELinux Permissive and Enforcing Modes = SELinux has three major modes of operation: : '''Enforcing''' - SELinux is enforcing the loaded policy. : '''Permissive''' - SELinux has loade...

RichardHaines — Sun, 16 May 2010 14:59:20 GMT

New page: = SELinux Permissive and Enforcing Modes = SELinux has three major modes of operation: : '''Enforcing''' - SELinux is enforcing the loaded policy. : '''Permissive''' - SELinux has loade...

New page

= SELinux Permissive and Enforcing Modes =
SELinux has three major modes of operation:

: '''Enforcing''' - SELinux is enforcing the loaded policy.

: '''Permissive''' - SELinux has loaded the policy, however it is not enforcing the policy. This is generally used for testing as the audit log will contain the AVC denied messages as defined in the [[NB_AL | Audit Logs]] section. The SELinux utilities such as <tt>audit2allow(1)</tt> and <tt>audit2why(8)</tt> can then be used to determine the cause and possible resolution by generating the appropriate allow rules.

: '''Disabled''' - The SELinux infrastructure (in the kernel) is not loaded.

These flags are set in the <tt>/etc/selinux/config</tt> file as described in the [[GlobalConfigurationFiles | Global Configuration Files]] section.

There is another method for running specific domains in permissive mode using the <tt>permissive</tt> statement. This can be used directly in a user written loadable module or <tt>semanage(8)</tt> will generate the appropriate module and load it using the following example command:
<pre>
# This example will add a new module in
# /etc/selinux/<policy_name> # /modules/active/modules/permissive_unconfined_t.pp
# and then reload the policy:

semanage permissive -a unconfined_t
</pre>

The <tt>sestatus(8)</tt> command will show the current policy mode in its output as follows:
<pre>
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: permissive
Mode from config file: enforcing
Policy version: 24
Policy from config file: modular-test
</pre>

----
<references/>

NB PandE - Revision history

Jaxelson at 20:48, 13 September 2010

RichardHaines: New page: = SELinux Permissive and Enforcing Modes = SELinux has three major modes of operation: : '''Enforcing''' - SELinux is enforcing the loaded policy. : '''Permissive''' - SELinux has loade...