User Interface Mode Configuration RHEL5 and Web Server Guide

The subject of this article is the SELinux configuration on RHEL 5. RHEL also provides a graphical user interface (GUI) and command line configuration of SELinux. To demonstrate the ease of use of SELinux, this article uses RHEL's GUI to enable SELinux.

To enable SELinux from the RHEL GUI, click on System > Administration > Security Level and Firewall. Go to the SELinux tab, set SELinux to "permissive mode" and restart the server.

Starting SELinux in Allow mode is a good practice (learning to configure SELinux). In this mode, you can feel and touch SELinux up close, but it doesn't affect anything in the server and application/database. During the test, you must review the log information carefully, checking all warnings and all refusal errors generated by the program and database during the operation.

After setting SELinux to allow mode and restarting my RHEL, I didn't notice any difference. I log in to the system as the root account and then use the sestatus command to view the health of the SELinux environment.

Since SELinux has been started and running in the allowed mode, it is time to manage SELinux. RHEL provides a GUI for SELinux policy management, and the root user can initialize the GUI using the system-config-SELinux command. This command will open the main interface of the GUI. You can see the following window in RHEL or Fedora Linux:

In the figure above, you can find it in the left box. The main options for SELinux management. The second option, "Boolean", contains the Boolean conditions for most of the default services and processes in SELinux management. The same conditions can also be listed using the getsebool command. For example, if you only want to know the existing Boolean conditions for the ftpd daemon, then you can use the following command:

To change the Boolean condition, such as allow_ftpd_use_cifs =off - This condition means that the FTP process cannot use the cifs protocol for public file transfer - we can click the corresponding condition (entry) under the "Boolean" tab in the system-config-SELinux interface, as shown in the following figure. This action will allow the FTP service to use the cifs protocol for public file transfers. You can execute the getsebool and grep commands against the ftpd process to see if the operation just took effect.