Intermediate LevelLinux Commands & SysAdmin
How does SELinux (Security-Enhanced Linux) enforce Mandatory Access Control (MAC)?
❓ Interview Prompt: Explain SELinux MAC vs DAC, security contexts (user:role:type:level), modes (Enforcing, Permissive, Disabled), audit logs, and restorecon.
Unlike standard Discretionary Access Control (DAC - file permissions), SELinux enforces Mandatory Access Control (MAC) based on security context labels ('user:role:type:level'):
Modes:
•
Enforcing: Blocks unauthorized access attempts and logs violations to '/var/log/audit/audit.log'.
•
Permissive: Allows unauthorized access, but logs violations for policy debugging.
•
Fixing Contexts: Use 'restorecon -Rv /var/www' or 'chcon' to reset incorrect security labels.
Code Implementation Example
bash
# Inspect SELinux security context labels of web files (-Z)
ls -Z /var/www/html
# Check active SELinux operating mode
sestatus
# Restore default security context labels recursively
sudo restorecon -Rv /var/www/html💡Inspecting SELinux security contexts and restoring default file labels.
🎯 Interview Key Takeaway
Use SELinux Permissive mode to debug access denials before enforcing production Mandatory Access Control.
#SELinux#MAC Security#restorecon#Intermediate
Back to all Linux Commands & SysAdmin Questions→