Manage security
SELinux modes and contexts
There are three modes: enforcing, permissive, and disabled. At runtime use getenforce and setenforce 0|1. Persistently, set SELINUX= in /etc/selinux/config, which requires a reboot. Files carry contexts (ls -Z, ps -Z). restorecon -Rv /path resets a path to its policy default; chcon changes a context temporarily and the change is lost at the next relabel. Permanent custom contexts use semanage fcontext -a -t httpd_sys_content_t '/web(/.*)?' followed by restorecon -Rv /web. Non-standard ports need semanage port -a -t http_port_t -p tcp 8080. Booleans: getsebool -a | grep httpd and setsebool -P httpd_can_network_connect on, where -P makes it persistent.
Audit and access control
Denials land in /var/log/audit/audit.log; read them with ausearch -m AVC -ts recent or sealert -a. sestatus shows the mode, policy, and load state. Combine SELinux with firewall-cmd for network filtering, a hardened /etc/ssh/sshd_config, and well-scoped sudo rules.
Traps: setsebool without -P reverts at reboot. chcon looks correct until a relabel reverts it. After changing a service port you must label it, or the service is denied even though the firewall permits traffic. Switching from permissive to enforcing without a relabel (touch /.autorelabel) can break booting.
Rule of thumb: semanage plus restorecon survives relabeling; chcon does not.
Worked example:
semanage fcontext -a -t httpd_sys_content_t '/www(/.*)?'
restorecon -Rv /www