Bookmark this page

Guided Exercise: Change the SELinux Enforcement Mode

In this lab, you manage SELinux modes, both temporarily and persistently.

Outcomes

  • View and set the current SELinux mode.

As the student user on the workstation machine, use the lab command to prepare your system for this exercise.

This command prepares your environment and ensures that all required resources are available.

[student@workstation ~]$ lab start selinux-opsmode

Instructions

  1. On the workstation machine, use the ssh command to log in to the servera machine as the student user and then switch to the root user.

    [student@workstation ~]$ ssh student@servera
    ...output omitted...
    [student@servera ~]$ sudo -i
    [sudo] password for student: student
    [root@servera ~]#
  2. Change the default SELinux mode to permissive.

    1. Use the getenforce command to verify the current SELinux mode on the servera machine.

      [root@servera ~]# getenforce
      Enforcing
    2. Use the vim /etc/selinux/config command to edit the configuration file. Change the SELINUX parameter from enforcing to permissive mode.

      [root@servera ~]# vim /etc/selinux/config
    3. Use the grep command to confirm that the SELINUX parameter displays the permissive mode.

      [root@servera ~]# grep '^SELINUX' /etc/selinux/config
      SELINUX=permissive
      SELINUXTYPE=targeted
    4. Use the setenforce command to change the SELINUX parameter to the permissive mode and verify the change.

      [root@servera ~]# setenforce 0
      [root@servera ~]# getenforce
      Permissive
  3. Change the default SELinux mode back to the enforcing mode in the configuration file.

    1. Use the vim /etc/selinux/config command to edit the configuration file. Change the SELINUX parameter from permissive to enforcing mode.

      [root@servera ~]# vim /etc/selinux/config
    2. Use the grep command to confirm that the SELINUX parameter sets the enforcing mode on booting.

      [root@servera ~]# grep '^SELINUX' /etc/selinux/config
      SELINUX=enforcing
      SELINUXTYPE=targeted
  4. Set the SELinux mode to enforcing on the command line. Reboot the servera machine and verify the SELinux mode.

    1. Use the setenforce command to set the current SELinux mode to the enforcing mode. Use the getenforce command to confirm that SELinux is set to the enforcing mode.

      [root@servera ~]# setenforce 1
      [root@servera ~]# getenforce
      Enforcing
    2. Reboot the servera machine to implement the persistent configuration.

      [root@servera ~]# systemctl reboot
      Connection to servera closed by remote host.
      Connection to servera closed.
      [student@workstation ~]$
    3. Log in to the servera machine and verify the SELinux mode.

      [student@workstation ~]$ ssh student@servera
      ...output omitted...
      [student@servera ~]$ sudo -i
      [sudo] password for student: student
      [root@servera ~]# getenforce
      Enforcing
  5. Return to the workstation machine as the student user.

    [root@servera ~]# exit
    logout
    [student@servera ~]$ exit
    logout
    Connection to servera closed.
    [student@workstation ~]$

Finish

On the workstation machine, change to the student user home directory and use the lab command to complete this exercise. This step is important to ensure that resources from previous exercises do not impact upcoming exercises.

[student@workstation ~]$ lab finish selinux-opsmode

This concludes the section.

Revision: rh134-9.0-fa57cbe