SELinux

Chapter 4. Using and Administering SELinux

At this point we’ll assume your SELinux system has been installed and that you are ready to log in. This chapter lays out the first administrative tasks you need to do and some ongoing administrative tools you’ll want to know about as you continue to add software and users to your system.

As with any multiuser system, you have to create accounts for users and assign them the proper privileges. In SELinux these tasks are not much more complicated than in other systems, although you’ll have to learn some new commands to carry them out. And in the future, after SELinux has become widely adopted, the wrinkles have been ironed out, and thoroughly tested policy files are available, these typical sysadmin tasks may be all that’s involved for most people running SELinux.

But unfortunately, we are not yet at that stage of maturity. As explained in earlier chapters, each release of SELinux on each distribution has its own rough spots. These will be manifested in various hard-to-diagnose ways, including:

• Users being unable to log in

• Users logging in but having their X desktops or particular applications freeze

• Applications failing (silently or with obnoxious complaints) because they cannot access files or other necessary resources

Thus, basic sysadmin tasks for SELinux include checking log files and tracing what has happened to users and applications. This chapter contains a substantial section to help you understand SELinux logging and make use of that ...