Red Hat Security: Linux in Physical, Virtual, and Cloud

To migrate a system that has SELinux disabled to enforcing mode, switch to permissive mode, review the audit log, relabel files and resolve issues, and then switch to enforcing mode.

Confined SELinux users can allow you to restrict users from using sudo or su to switch user, log in using ssh, or run some commands on the system.

You can use the sesearch command to look up the access rules and transition rules that SELinux enforces.

You can use the sepolicy transition command to analyze whether or not a process running in one domain can potentially use one or more domain transitions to run a process in another domain.

You can use the matchpathcon command to determine the expected context of a file created in a particular location even if the file does not exist.