Administrator Control Of Selinux; Viewing The Status Of Selinux - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 45. Working With SELinux

45.2. Administrator Control of SELinux

In addition to the tasks often performed by users in
SELinux administrators could be expected to perform a number of additional tasks. These tasks
typically require root access to the system. Such tasks are significantly easier under the targeted
policy. For example, there is no need to consider adding, editing, or deleting Linux users from the
SELinux users, nor do you need to consider roles.
This section covers the types of tasks required of an administrator who maintains Red Hat Enterprise
Linux running SELinux.

45.2.1. Viewing the Status of SELinux

The sestatus command provides a configurable view into the status of SELinux. The simplest form
of this command shows the following information:
[root@localhost ~]# sestatus
SELinux status:
SELinuxfs mount:
Current mode:
Mode from config file:
Policy version:
Policy from config file:
The -v option includes information about the security contexts of a series of files that are specified in
/etc/sestatus.conf:
[root@localhost ~]# sestatus -v
SELinux status:
SELinuxfs mount:
Current mode:
Mode from config file:
Policy version:
Policy from config file:
Process contexts:
Current context:
Init context:
/sbin/mingetty
/usr/sbin/sshd
File contexts:
Controlling term:
/etc/passwd
/etc/shadow
/bin/bash
/bin/login
/bin/sh
/sbin/agetty
/sbin/init
/sbin/mingetty
/usr/sbin/sshd
/lib/libc.so.6
/lib/ld-linux.so.2
The -b displays the current state of booleans. You can use this in combination with grep or other tools
to determine the status of particular booleans:
758
Section 45.1, "End User Control of
enabled
/selinux
enforcing
enforcing
21
targeted
enabled
/selinux
enforcing
enforcing
21
targeted
user_u:system_r:unconfined_t
system_u:system_r:init_t
system_u:system_r:getty_t
system_u:system_r:unconfined_t:s0-s0:c0.c1023
user_u:object_r:devpts_t
system_u:object_r:etc_t
system_u:object_r:shadow_t
system_u:object_r:shell_exec_t
system_u:object_r:login_exec_t
system_u:object_r:bin_t -> system_u:object_r:shell_exec_t
system_u:object_r:getty_exec_t
system_u:object_r:init_exec_t
system_u:object_r:getty_exec_t
system_u:object_r:sshd_exec_t
system_u:object_r:lib_t -> system_u:object_r:lib_t
system_u:object_r:lib_t -> system_u:object_r:ld_so_t
SELinux",