Oh,
the familiar orange glow, meaning that you've succeeded another tick on
your path to becoming an excellent administrator.
In this module, we've introduced the different SELinux modes.
So we have enforcing, which is our default mode,
meaning that all of the SELinux rules are enforced,
as well as logging any violations.
If we're having difficulties and we need to debug issues,
then we can go through and set the permissive mode.
Here we don't enforce the rules,
but do log the violations so we know what's going wrong
and we can work out how to fix it.
We want to avoid disabling SELinux because this we have no clue as to how
much we need to do to get our system into an enforcing mode.
And also, if we ever need to move to enforcing or permissive,
we have to reboot our system and do a complete file system check to ensure the
correct context is set on every file in our file system.
We've also seen that we can use booleans to prevent runtime changes.
Now this is good because then we can prevent administrators changing the mode,
but we've also seen the effect that it might have when we want to
go through and start adding in file contexts.
Our purpose of the SELinux is to ensure that correct
access is always managed properly.
Many of our services are running with root access,
which gives them access to absolutely everything on the system.
Being a mandatory access control system,
we can then restrict even our root user.
We saw how we could set our file contexts.
We could set them in our policy so we could use a restorecon.
We could also use the chcon command to change the context of existing files.
Using ausearch, we're able to check our audit log for our policy violations.
And we're going to be searching for the module AVC, access vector controls,
a very glorious name for something that's not so interesting really.
But that's it.
This is your module.
You have completed it.
Give yourself a pat on the back, but not for too long.
We're about to move into a similar system that is used on
Susa by default and that is AppArmor.
So I'm going to see you back, hopefully, in the next module where we delve a little bit into AppArmor.