Following a security audit, the xFusionCorp Industries security team has opted to enhance application and server security with SELinux. To initiate testing, the following requirements have been established for App server 1
in the Stratos Datacenter:
Task:
- Install the required SELinux
packages:
- Permanently disable SELinux for the time being; it will be re-enabled after necessary configuration changes.
- No need to reboot the server, as a scheduled maintenance reboot is already planned for tonight.
- Disregard the current status of SELinux via the command line; the final status after the reboot should be disabled
.
ssh tony@172.16.238.10
cat /etc/os-release
NAME="CentOS Stream"
VERSION="9"
-- Snipped --
Determine if SELinux tools are installed:
rpm -q policycoreutils selinux-policy
package policycoreutils is not installed
package selinux-policy is not installed
Install with dnf:
sudo dnf install -y policycoreutils policycoreutils-python-utils selinux-policy selinux-policy-targeted
-- Snipped --
Complete!
As per task 2- we need to set the config to be disabled for the moment, this can be done via the config file:
ls /etc/selinux
config semanage.conf targeted
sudo vi /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
-- Snipped --
SELINUX=enforcing <-- Change this value to disabled
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
Remember to use i
to insert / make your change, esc
to come out of insert mode, then wq
to write and quit.