6.2. Securing the System Using SELinux

Security-Enhanced Linux (SELinux) is an implementation of a mandatory access control mechanism in the Linux kernel, checking for allowed operations after standard discretionary access controls are checked. SELinux can enforce rules on files and processes in a Linux system, and on their actions, based on defined policies.

Note

For increased security requirements, Red Hat recommends running Certificate System with SELinux in enforcing mode.
In most cases, no actions are required to run Certificate System with SELinux in enforcing mode. If a procedure in the Certificate System documentation requires to manually set SELinux-related settings, such as when using a Hardware Security Module (HSM), it is mentioned in the corresponding section.
For further details about SELinux, see the SELinux User's and Administrator's Guide.

6.2.1. Verifying if SELinux is Running in Enforcing Mode

By default, after installing Red Hat Enterprise Linux, SELinux is enabled and running in enforcing mode and no further actions are required.
To display the current SELinux mode, enter:
# getenforce

6.2.2. Enabling the SELinux Enforcing Mode

If SELinux is disabled or running in permissive mode, update the settings on Red Hat Enterprise Linux to enable enforcing mode.
For details, see the Enabling SELinux section in the SELinux User's and Administrator's Guide.