Now, as you've seen,
we have some tools that we can use out of the box with SELinux,
but as always, we can enhance our toolset.
Here, we're adding in some extra tools,
and these are going to give me access to additional commands
that are going to help me manage SELinux,
and we'll show you some of them.
Looking at how we can manage our changes to our mode,
we've seen that we've been able to change from our
enforcing mode to our permissive mode,
and maybe this is something we don't want to happen because maybe
a rogue administrator wants to make changes,
realize he can't, but if he puts it into permissive mode,
which he can do whilst the system is running,
then he's able to carry out the tasks that he wants,
he can quickly set it back.
To prevent that, we can go through and start looking at some of our Booleans.
Our SELinux Booleans are really designed as condiments,
allowing us to be able to control to some degree our
policy and the behavior of the policy.
Getsebool ‑a is going to list all of our Booleans,
and there's certainly going to be a lot.
We can also use the command semanage, but this we have to install.
It's not installed by default.
We can go through and list our Booleans,
and we can see the current value and the default value,
so we get a little bit more.
If we want to change one of our Booleans,
as I say,
if we want to prevent administrators making changes to our runtime mode,
then we can go through and do it with the secure_mode_policyload.
Once we then loaded our policy, we can change it from enforcing to permissive,
or even from permissive to enforcing.
If we don't set it in the policy itself with the ‑P,
a reboot then will load the policy from the configuration file.
We can then go through and make changes as necessary.
But if we set it with ‑P, every time we load the SELinux policy,
we will be loading the fact that we are unable to change our mode.
So that we have to be careful with,
but at least it's preventing us from making changes as
administrators whilst the system is running.
We can only implement a change after a reboot.
We're going to see some of this now by moving out to our command line
and taking a look at a demonstration where we're going to look at
installing our tools and using some of those tools with semanage so we
can look at our Boolean values.
So working on our glorious command line,
we can go and use some of our standard tools straight out of the box,
and even as a standard user, I can go through and read my Booleans.
So, getsebool ‑a.
Of course, we're getting a lot of information coming back,
we're seeing all of the possible Booleans.
If I want to, though, I can look at a particular one.
Here we'll cheat and just take the bottom one.
So if we do know the name of the Boolean,
it is easy to see the specific value that we want.
However,
we can also pipe the output of all through to grep and then
search for whatever we're looking for.
So we might want to look at our secure_mode_policyload,
and if we search then for the term policy,
we can see we've got one Boolean that matches,
and we can see its current running value is turned off.
Now I say, we can install some additional tools,
and that will allow us to see a little bit more about our
Booleans and other elements that make up SELinux.
So if I go through and install, and we had the package list before,
now I'm going to cheat just a little and paste the list in from the slides.
But you can see we've got policycoreutils,
setools, setools‑console, and setroubleshoot.
We'll see some of these tools as we go through,
especially the troubleshooting, which we're going to really enjoy later.
Now we can allow this to run through.
I'm going to cut just a little bit out because we don't
need to see the whole installation.
But important to me as far as managing my Boolean values,
so I've now got semanage,
but it's going to read the information a little bit differently.
If I try and run as a standard user and run the semanage boolean ‑‑list,
we can see that we're unable to return the values from the policy.
We're not just looking at runtime values, we're reading from the policy.
So I can repeat the command using sudo, and then again we get to see everything.
But we're not just seeing the current running value,
we're able to go through and see the default value.
If I look just at the head, we can see then the titles and the values,
and we've got our current state and the default,
as well as the description.
Although to be honest, the description often isn't that helpful.
The name of the policy gives as much away as the description.
But in any case, it is there if we want to use it.
Now, just as we have seen before, we can still list the complete output,
but search the output for the particular Boolean that we want.
So if we search for policy again, we're getting just that one Boolean showing,
and we can see then that it's currently turned off and its
default state in the policy is also turned off.
If we want to change that, we use setsebool.
We can make sure that we put the correct Boolean name,
I'm just going to paste it, and then the state that we want.
So we want it to be turned on,
preventing administrators from changing the current mode.
Having made the change, we can go back and search again for our Boolean,
and we can see now its current state is turned on.
Its default state is still turned off.
If we needed to change to the default state,
we would use the uppercase P and we would store then
the Boolean value in our policy,
which is going to be loaded each time we load SELinux.
We can check the effect now.
If I go through and look at my current SELinux mode,
we're in enforcing,
so I might want to then go through and quickly change it
to permissive so perhaps I could get away with doing
something that maybe I shouldn't.
So if I set my enforcing mode to 0, which is the same as permissive,
I can either use permissive or 0, we can see that this is not allow.
So we're effectively preventing administrators making quick changes without enforcing a reboot.