On CentOS Linux, how do you manage ceiling (limiters)? Is it always disabled or active?

SeLinux (Security-Enhanced Linux) is a Mandatory Access Control (MAC) mechanism. By default, it is active and operates in one of the following modes:

• Enforcing: Enforces security policies. All prohibited operations are blocked.
• Permissive: Prohibited operations are not blocked but generate warnings and are logged.
• Disabled: SeLinux is completely turned off.

In practice, I try to keep SeLinux active in Enforcing mode on production servers. This adds an extra layer of security. Disabling SeLinux is an extreme measure, used only for troubleshooting or in specific, fully controlled environments.

Commands used to manage SeLinux include:

• Checking current status and mode:

  sestatus
  # SeLinux status and current mode
  

• Switching modes (without reboot):

  setenforce 0 # Permissive mode
  setenforce 1 # Enforcing mode
  

• Changing default mode (requires reboot), editing /etc/selinux/config:

  nano /etc/selinux/config
  # Change SELINUX=enforcing to permissive or disabled
  

• Managing boolean settings (allowing or disallowing certain policies):

  getsebool -a # List all booleans
  setsebool -P <boolean_name> on/off # Set boolean permanently (-P)
  

When configuring new services or applications incompatible with the current SeLinux policy, I prefer to create/update a local policy (module) instead of disabling SeLinux entirely. This is a safer approach.

Steps to create a local policy:

1. Install necessary utilities:

   yum install policycoreutils policycoreutils-python
   

2. Set SeLinux to Permissive mode to monitor violations:

   setenforce 0
   

3. Perform actions that cause violations.
4. Generate policy based on audit.log:

   grep <service_name> /var/log/audit/audit.log | audit2allow -M my_service_policy
   

   where <service_name> is the name of the service causing violations.
5. Install the generated policy:

   semodule -i my_service_policy.pp
   

6. Return SeLinux to Enforcing mode:

   setenforce 1
   

Thus, my strategy is to keep SeLinux in Enforcing mode and fine-tune it as needed.