All right. Let's understand SLinux modes. So SLinux is either disabled or enabled. And
to switch between either of these states, you need to reboot. Obviously, in your RHCSA
exam, you never want to be in disabled mode. But in case you find a system that is in disabled,
you need to use the appropriate kernel parameter to set it to enabled. Now, when SLinux is enabled,
you can have it in two different states. And that is either enforcing or permissive,
where permissive is useful for troubleshooting and enforcing is the normal operational state
where you want it to be. And if you want to change between permissive and enforcing,
well, you can use the setenforce command. And in a perfect world, that will be all that you
will be doing. Never get it to disabled mode, particularly not on the RHCSA exam,
because in the end, your systems must always be in enabled mode. Okay. So how do we manage
these SLinux states? Simple. Getenforce will show you the current state that SLinux is in.
And setenforce allows you to toggle between enforcing and permissive mode. You can edit
etcsysconfig SLinux to set the default state to permissive or enforcing. And alternatively,
you can use boot parameters. In the rare case where you want to switch to disabled,
you need to pass boot parameters. Now, you should never set to disabled if it is meant
as a temporary measure only. I would like to make it even stronger. Never set to disabled, period.
Then people come and tell me, yeah, but I have this application that doesn't support SLinux.
Well, I can tell you, every application can be made to work with SLinux. There are so many
options to get your application working without disabling SLinux. So really, there is no need
to disable SLinux. It's like you install this beautiful lock on your door and then you think
it's so complicated to turn the key. Then are you going to leave the door unlocked? That's
the same situation. So do not disable SLinux ever, particularly not on the RHCSA exam because you
will fail if you do so. Now, you can manage SLinux states while booting. And you might find a system
that has an option that you don't want to use as a boot time kernel parameter that's set
in grub.conf. Now, what are the options? Enforcing is zero. That will have SLinux enabled,
but in permissive mode. I don't think that makes sense as a default option. So enforcing is one,
is what you want to see. And that's a standard. Then if you really don't want it, you can use
SLinux is zero to disable SLinux. And SLinux is one to enable SLinux. And you can access the grub
bootloader prompt to change these settings while booting or change it in ETC default grub and
the related files if the persistent configuration is off. Now, let's explore how this works.
So let's use get enforced to start with. And oh my goodness, we can see that it's disabled.
Now, you can only toggle between disabled and enabled while rebooting.
So I need to find out where this comes from. How do we do that? Well, ETC default grub,
that's where you change your grub configuration, right? Well, yes, that is kind of right,
but we have grub enable BLS CFG is true. And that means that this is no longer the leading file.
So if you are looking for the responsible file, you get into bootloader. And there you have
the entries subdirectory with an entry for your current kernel. And that will be the D87 and so
on. Let's complete to 6.12. And there we can see, aha, there we can see the nasty option. The nasty
option is SLinux is zero. Well, I want SLinux is one. You can also remove the option because
SLinux enabled is the default mode. Saving my changes. And now I'm going to use grub2-mkconfig
minus O slash boot slash grub2 slash grub.cfg. And then we are going to reboot.
So now I'm back. And let's use get enforced again.
And as you can see, we're in enforcing mode. That's good. So set and force allows you to
toggle between permissive and enforcing mode. Why would you want to go to permissive mode?
Well, you will learn all about it in the next demo. That's for troubleshooting purposes.
But the default set and force, you need to be in enforcing mode. I'm not even going to show you
I'm not even going to show you how to set permissive mode persistently,
because that is always a very bad idea. Don't ever do it. You want to be in enforcing mode.
And for troubleshooting, you can toggle to permissive mode. And hey, if in real life you
ever come across one of these applications that has a hard time working with SLinux,
check out my video course, Managing SLinux. That is going in depth about SLinux and
is telling you everything that I'm not telling you here in this class.
Check it out if you want to go deep in SLinux and keep your data secure.