selinux(8)	      SELinux Command Line documentation	    selinux(8)



NAME
       SELinux - NSA Security-Enhanced Linux (SELinux)


DESCRIPTION
       NSA  Security-Enhanced Linux (SELinux) is an implementation of a flexi-
       ble mandatory access control architecture in the Linux  operating  sys-
       tem.   The  SELinux  architecture  provides  general  support  for  the
       enforcement of many kinds of mandatory access control policies, includ-
       ing  those  based  on  the concepts of Type Enforcement(R), Role- Based
       Access Control, and Multi-Level Security.  Background  information  and
       technical    documentation    about    SELinux	 can   be   found   at
       http://www.nsa.gov/research/selinux.

       The /etc/selinux/config configuration file controls whether SELinux  is
       enabled	or  disabled, and if enabled, whether SELinux operates in per-
       missive mode or enforcing mode.	The SELINUX variable may be set to any
       one  of	disabled,  permissive,	or  enforcing  to  select one of these
       options.	 The disabled option completely disables  the  SELinux	kernel
       and  application	 code,	leaving the system running without any SELinux
       protection.  The permissive option enables the SELinux code, but causes
       it  to  operate in a mode where accesses that would be denied by policy
       are permitted but audited.  The enforcing option	 enables  the  SELinux
       code  and causes it to enforce access denials as well as auditing them.
       Permissive mode may yield a different set  of  denials  than  enforcing
       mode,  both  because enforcing mode will prevent an operation from pro-
       ceeding past the first denial and because some  application  code  will
       fall back to a less privileged mode of operation if denied access.

       The /etc/selinux/config configuration file also controls what policy is
       active on the system.  SELinux  allows  for  multiple  policies	to  be
       installed on the system, but only one policy may be active at any given
       time.  At present, two kinds of	SELinux	 policy	 exist:	 targeted  and
       strict.	 The  targeted	policy is designed as a policy where most pro-
       cesses operate without restrictions, and	 only  specific	 services  are
       placed  into distinct security domains that are confined by the policy.
       For example, the user would run in a completely unconfined domain while
       the  named  daemon or apache daemon would run in a specific domain tai-
       lored to its operation.	The strict policy  is  designed	 as  a	policy
       where  all processes are partitioned into fine-grained security domains
       and confined by policy.	It is anticipated in  the  future  that	 other
       policies	 will  be created (Multi-Level Security for example).  You can
       define which policy you will run by setting the SELINUXTYPE environment
       variable within /etc/selinux/config.  The corresponding policy configu-
       ration	for   each   such   policy   must   be	 installed   in	   the
       /etc/selinux/SELINUXTYPE/ directories.

       A given SELinux policy can be customized further based on a set of com-
       pile-time tunable options and a set of runtime policy  booleans.	  sys-
       tem-config-securitylevel	 allows	 customization	of  these booleans and
       tunables.

       Many domains that are protected by SELinux  also	 include  SELinux  man
       pages explaining how to customize their policy.


FILE LABELING
       All files, directories, devices ... have a security context/label asso-
       ciated with them.  These context are stored in the extended  attributes
       of  the	file  system.  Problems with SELinux often arise from the file
       system being mislabeled. This can be caused by booting the machine with
       a  non  SELinux kernel.	If you see an error message containing file_t,
       that is usually a good indicator that you have a serious	 problem  with
       file system labeling.

       The  best  way  to  relabel  the file system is to create the flag file
       /.autorelabel and reboot.  system-config-securitylevel, also  has  this
       capability.   The  restorcon/fixfiles  commands	are also available for
       relabeling files.


AUTHOR
       This manual page was written by Dan Walsh <dwalsh@redhat.com>.


SEE ALSO
       booleans(8), setsebool(8), selinuxenabled(8), togglesebool(8), restore-
       con(8),	     setfiles(8),      ftpd_selinux(8),	     named_selinux(8),
       rsync_selinux(8), httpd_selinux(8),  nfs_selinux(8),  samba_selinux(8),
       kerberos_selinux(8), nis_selinux(8), ypbind_selinux(8)



FILES
       /etc/selinux/config



dwalsh@redhat.com		  29 Apr 2005			    selinux(8)