Red Hat Enterprise Linux 5 Administration Unleashed

464CHAPTER 23Protecting Against Intruders with Security-Enhanced LinuxSelecting an SELinux ModeWhen your Red Hat Enterprise Linux system is booted for the first time, the Setup Agentis started as described in Chapter 2. When you reach the SELinux step, the SELinux modeis set to Enforcing by default. The following modes are available:. Enforcing: Enable and enforce the SELinux security mechanism on the system,logging any actions denied because of it.. Permissive: Enable SELinux but don’t enforce the policy. Only warn about filesprotected by SELinux.. Disabled: Turn off SELinux.The SELinux mode can be changed at a later time by using the SELinux Management Tool, agraphical application for customizing SELinux. The policycoreutils-gui RPM package mustbe installed to use this program. Refer to Chapter 3 for details on package installation. Startthe tool by executing the system-config-selinux command or selecting Administration,SELinux Management from the System menu of the top panel of the desktop. If you arenot the root user, you are prompted to enter the root password before continuing. As shownin Figure 23.1, choose the SELinux mode for the following two options:. System Default Enforcing Mode: The mode to use when the system is booted. Choosebetween Enforcing, Permissive, and Disabled (described earlier in this section). Themode change does not take place immediately. This preference is written to the/etc//selinux/config file. The next time the system is rebooted, this mode is used.If the mode is changed from Disabled to Permissive or Enforcing, the filesystemmust be relabeled for SELinux during the reboot, which can be quite time-consumingdepending on the size of the filesystem. It is highly recommended that thefilesystem be backed up before changing modes in case of disk failure or other errorsduring the conversion process.. Current Enforcing Mode: The SELinux mode current being implemented. If thesystem was booted into the enforcing or permissive mode, the current mode can beimmediately changed between the two without a reboot.TIPThe mode changes can be confirmed by executing the sestatus command.If you do not have a graphical desktop, are logged in remotely without X forwarding, or justprefer the command line, these mode preferences can be made using the command line.To change the currently running SELinux mode, use the setenforce command as the rootuser, replacing with either Enforcing or Permissive:setenforce To confirm the change, execute the getenforce command, which displays the currentSELinux mode.