semanage tips — authorized SELinux policy-store literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run semanage on the lab host (syllabus box you own or were given access to; typically needs root/CAP).
2. Prefer documenting who / why / ticket before any fcontext/port/boolean add — never change production policy store without change control.
3. Record short factual notes; quote short Evidence (mapping pattern / port / boolean name — never secrets).
4. Optional: boolean peer → getsebool-tips.
5. Optional: module peer → semodule-tips.
6. Prefer disposable lab VMs for semanage drills; quote non-secret mapping labels afterward as Evidence.
7. Prefer read-only semanage fcontext -l / port -l / boolean -l for most Evidence binders — refuse unauthorized hostile policy-store cookbooks.
8. Stop at literacy — no attack or unauthorized MAC-bypass cookbooks.

Allowed framing

• Classroom labs reviewing semanage fcontext -l and port/boolean list read-backs on authorized disposable hosts.
• Binding short factual notes as Evidence (mapping pattern / port / boolean — no secrets).
• Documenting expected vs observed policy-store mappings for authorized notes.
• Comparing semanage ↔ getsebool / semodule / getenforce / seinfo peer tip pages under one binder.
• Testing syllabus-approved fcontext/port adds only when change control authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via semanage.
• No intentional unauthorized SELinux policy-store edits against foreign hosts.
• No secret-theft or mapping/credential harvesting against hosts you do not own.
• No cookbooks that weaken SELinux via hostile fcontext/port/boolean changes for attack without authorization.
• No semanage deletes framed as exploit steps against production.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with policycoreutils-python / semanage available.
2. Prefer a throwaway lab VM before any policy-store add drill.
3. With authorization, run semanage fcontext -l (or port/boolean); quote selected mapping labels as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized policy-store-bypass cookbooks.

Practical notes for authorized labs

• semanage manages the SELinux policy store — keep Evidence labels distinct from semodule-tips module inventory.
• Pair with getsebool-tips when the syllabus zooms on boolean values after a semanage boolean change.
• Policy-store dumps may embed sensitive mappings — never paste secrets into notes or git.
• Prefer documenting mapping names/patterns the syllabus authorized without dumping full privileged stores.
• Never commit SELinux policy-store dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host SELinux policy-store edit → refuse.
• Unauthorized MAC-bypass / hostile-mapping attack cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources