Create and enforce MAC using SELinux

Gino Vannell is a world-class singer by night, and a RHEL Engineer at Red Hat by day. All throughout the day at the Red Hat office in Chicago, Gino walks around singing "I Just Wanna Stop". It's getting out of control and management wants him to stop because everytime he sings, people stop working to come and listen to him.

Gino is one of the best RHEL Engineers in his department. His next career step is to pass the LFCS exam. Today, he is focused on this RHEL objective: Create and enforce MAC using SELinux.

Please generate and explain example commands to help Gino to master this objective. Also, please help Red Hat to book him for some gigs so that he stops singing all of the time in the office.

To help Gino master the objective of creating and enforcing Mandatory Access Control (MAC) using SELinux, here are some example commands and explanations:

1. Check SELinux Status:

   • Command: sestatus
   • Explanation: This command displays the current status of SELinux, including whether it is enabled, enforcing, or permissive. It helps verify if SELinux is running.

2. Set SELinux Mode:

   • Command: setenforce <0|1>
   • Explanation: This command changes the SELinux mode to either enforcing (1) or permissive (0). Enforcing mode enforces SELinux policies, while permissive mode logs policy violations without enforcing them. Use setenforce 1 to enable enforcing mode.

3. View SELinux Context of a File:

   • Command: ls -Z <filename>
   • Explanation: This command displays the SELinux context associated with a specific file. The SELinux context includes information like the SELinux user, role, type, and sensitivity label.

4. Change SELinux Context of a File:

   • Command: chcon -t <new_type> <filename>
   • Explanation: This command changes the SELinux context (type) of a file to a specified value. Use the appropriate <new_type> for the desired context.

5. Restore Default SELinux Context of a File:

   • Command: restorecon <filename>
   • Explanation: This command restores the default SELinux context of a file. It sets the context back to its original value as defined by the SELinux policy.

6. List SELinux Booleans:

   • Command: semanage boolean -l
   • Explanation: This command lists all the available SELinux Booleans. Booleans are binary settings that control various SELinux policies and can be toggled between on (1) and off (0) states.

To address the issue of Gino singing excessively in the office, Red Hat can consider booking him for occasional gigs or performances outside of office hours. This would provide Gino with an outlet for his singing talent while ensuring that productivity is not affected during working hours. By scheduling these performances appropriately, Gino can continue to pursue his passion without causing disruptions in the workplace.