I85PREP
⌘ K
OLE study materials
OLE study resources

OLE: Security Administration: SELinux, firewalld, and System Hardening

OLE · Work through your exam, one topic at a time.

All guide sections

Security Administration: SELinux, firewalld, and System Hardening

This domain tests the two access-control layers that most often break services on Oracle Linux: SELinux mandatory access control and firewalld zone-based filtering.

SELinux

  • Modes: getenforce/sestatus show Enforcing, Permissive, or Disabled. /etc/selinux/config sets the persistent mode; changing to or from Disabled requires a reboot and often a full relabel.
  • Contexts: ls -Z, ps -eZ, id -Z. Temporary change with chcon; persistent mapping with semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?" followed by restorecon -Rv /web.
  • Booleans: getsebool -a, semanage boolean -l, setsebool -P httpd_can_network_connect on (-P makes it persistent).
  • Ports: semanage port -a -t http_port_t -p tcp 8080; semanage port -l | grep http.
  • Denials: ausearch -m avc -ts recent, sealert -a /var/log/audit/audit.log; policy generation with audit2allow -M mypol then semodule -i mypol.pp.

firewalld

  • firewall-cmd --state, --get-default-zone, --list-all, --list-all-zones.
  • Change runtime or permanent: firewall-cmd --permanent --add-service=https, --add-port=8080/tcp, --add-source=192.0.2.0/24 --zone=trusted, then firewall-cmd --reload. --runtime-to-permanent promotes the running config.
  • Zones: public (default), trusted (accept all), drop (silent discard). Interfaces are assigned with --add-interface=ens3 --zone=internal.

Hardening

  • sshd: PermitRootLogin no, PasswordAuthentication no, AllowGroups sshusers; validate with sshd -t before restarting.
  • Enable auditd, use authselect for PAM profiles, and review aide for file integrity.

Worked example

Apache must listen on 8080. Open the port with firewall-cmd --permanent --add-port=8080/tcp && firewall-cmd --reload, then allow SELinux to bind: semanage port -a -t http_port_t -p tcp 8080, restart httpd. Reasoning: without the SELinux port label, httpd is denied even though the firewall is open.

Traps

  • --permanent changes do not take effect until --reload.
  • Runtime-only firewall changes vanish on reload or restart.
  • chcon labels are lost on the next relabel; use semanage fcontext plus restorecon.
  • setsebool without -P does not survive a reboot.