Chapter 5. Controlling and Maintaining SELinux

69

runcon  t httpd_t ~/bin/contexttest  ARG1  ARG2

# You can also specify the entire context

runcon user_u:system_r:httpd_t ~/bin/contexttest

5.2.15. Useful Commands for Scripts

You many need access to SELinux information and capabilities for scripts you write in administrating

your system. This is a list of useful commands introduced with SELinux:

getenforce

This command returns the enforcing status of SELinux.

setenforce [ Enforcing | Permissive | 1 | 0 ]

This command controls the enforcing mode of SELinux. The option

1

or

Enforcing

tells

SELinux to begin enforcing. The option

0

or

Permissive

tells SELinux to stop enforcing,

although it continues logging access violations.

selinuxenabled

This command exits with a status of

0

if SELinux is enabled, and

 256

if SELinux is disabled.

selinuxenabled

echo $?

0

getsebool [ a] [boolean_name]

This command shows the status of all (

 a

) or a specific Boolean can be determined.

setsebool [ P] boolean_name value | bool1=val1 bool2=val2 ...

This command sets one or more Boolean values. The option

 P

commits all pending Boolean

changes to the configuration file at

/etc/selinux/targeted/booleans

.

togglesebool boolean ...

This command toggles the setting of one or more Booleans. Whatever the setting was, it is now

switched to the opposite. This effects Boolean settings in memory only, and does not change the

Boolean setting in

/etc/selinux/targeted/booleans

.

5.2.16. Assume a New Role

This program lets you run a new shell with the specified type and/or role. Switching roles does not have

the same meaning in the targeted policy as it does in a strict policy, so that function is largely ignored.

It may be useful to you to assume a new type for testing, validation, and development purposes:

newrole  r role_r  t type_t [   [ARGS]...]

The

ARGS

following the

are passed directly to the shell. The shell chosen is based on the user's

entry in

/etc/passwd

.