Working with SELinux

#!/bin/bash
if [[ "$(getenforce)" == "Enforcing" ]]; then
  echo "SELinux is active and enforcing policies."
else
  echo "SELinux is not in enforcing mode."
fi

setenforce 0

# Edit /etc/selinux/config
SELINUX=enforcing

$ ls -Z /etc/passwd
system_u:object_r:etc_t:s0 /etc/passwd

$ ps -eo pid,comm,sestatus | grep firefox
1234 firefox unconfined_t

# View current context
ls -Z /var/www/html/index.html

# Change to httpd context
chcon -t httpd_sys_content_t /var/www/html/index.html

# Verify change
ls -Z /var/www/html/index.html

# Restore default context to web directory
restorecon -R /var/www/html

# Verify the context was restored
ls -Z /var/www/html/index.html

sudo setsebool -P sshd_can_network_connect on

# View recent SELinux denials
auditctl -l | grep avc

# Monitor real-time denials
ausearch -m avc --start recent

# Analyze recent SELinux denials
sealert -a /var/log/audit/audit.log

# Show only the most recent denials
sealert -a /var/log/audit/audit.log | tail -20

# Create a policy module file named myapp.te
module myapp 1.0;

require {
    type myapp_t;
    type http_port_t;
    class tcp_socket name_connect;
}

# Allow myapp to connect to HTTP ports
allow myapp_t http_port_t:tcp_socket name_connect;

# Compile the policy module
checkmodule -M -m -o myapp.mod myapp.te

# Convert to binary policy
semodule_package -o myapp.pp -m myapp.mod

# Install the policy module
sudo semodule -i myapp.pp

semanage login -a -s staff_u -r s0-s0:c0.c255 newuser

semanage login -l

sudo semanage port -a -t http_port_t -p tcp 8080

sudo semanage port -l | grep http_port_t

sestatus
ausearch -m avc --start recent

setenforce 0