runcon tips — authorized SELinux-context literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run runcon on the lab host (syllabus box you own; transitions need policy that allows them).
2. Prefer documenting who / why / ticket before any domain transition — never escalate production contexts without change control.
3. Record short factual notes; quote short Evidence (user:role:type:range labels — never secrets or foreign process dumps).
4. Optional: mode peer → getenforce-tips.
5. Optional: module peer → semodule-tips.
6. Prefer disposable lab VMs for runcon drills; quote non-secret context labels afterward as Evidence.
7. Prefer syllabus-approved target types — refuse unauthorized privilege-escalation cookbooks.
8. Stop at literacy — no attack or unauthorized MAC-bypass cookbooks.

Allowed framing

• Classroom labs reviewing runcon -t TYPE COMMAND on authorized disposable hosts in Enforcing mode.
• Binding short factual notes as Evidence (context labels — no secrets).
• Documenting expected vs observed domain transitions for authorized inventory notes.
• Comparing runcon ↔ getenforce / selinux / semodule / ausearch peer tip pages under one binder.
• Testing syllabus-approved transitions only when policy and change control authorize that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via runcon.
• No intentional unauthorized SELinux domain escalation against foreign hosts.
• No secret-theft or process-context credential harvesting against hosts you do not own.
• No cookbooks that abuse runcon for attack without authorization.
• No hostile type transitions framed as exploit steps.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with SELinux Enforcing and a known lab type.
2. Prefer a throwaway lab VM before any transition drill.
3. With authorization, run a syllabus-approved runcon -t LAB_TYPE true (or similar); quote the resulting context label as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized escalation cookbooks.

Practical notes for authorized labs

• runcon launches a command in a specified SELinux context — keep Evidence labels distinct from getenforce-tips mode drills.
• Pair with ausearch-tips when the syllabus zooms on AVC denials after a failed transition.
• Process contexts may reveal roles and MLS ranges — never paste secrets into notes or git.
• Prefer documenting context labels the syllabus authorized without dumping full privileged process tables.
• Never commit SELinux process dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host SELinux context escalation → refuse.
• Unauthorized privilege-escalation / MAC-bypass cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources