sestatus tips — authorized SELinux status literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run sestatus on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any mode change that follows status review — never alter production SELinux without change control.
3. Record short factual notes; quote short Evidence (SELinux status + mode + policy name — never secrets).
4. Optional: mode-only peer → getenforce-tips.
5. Optional: boolean peers → getsebool-tips / setsebool-tips.
6. Prefer disposable lab VMs for status drills; quote non-secret status labels afterward as Evidence.
7. Prefer read-only sestatus / sestatus -b for most Evidence binders — refuse unauthorized hostile-status cookbooks.
8. Stop at literacy — no attack or unauthorized MAC-bypass cookbooks.

Allowed framing

• Classroom labs reviewing sestatus and sestatus -v / -b on authorized disposable hosts.
• Binding short factual notes as Evidence (mode + policy name + selected process/context lines — no secrets).
• Documenting expected vs observed SELinux status for authorized notes.
• Comparing sestatus ↔ getenforce / selinux / getsebool / setsebool peer tip pages under one binder.
• Testing syllabus-approved status reads only when change control authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via sestatus.
• No intentional unauthorized SELinux status probing against foreign hosts.
• No secret-theft or status-inventory credential harvesting against hosts you do not own.
• No cookbooks that weaken SELinux via hostile mode flips for attack without authorization.
• No setenforce 0 framed as an exploit step against production (mode change is out of scope here).

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with SELinux status tooling available.
2. Prefer a throwaway lab VM before any status drill tied to mode changes.
3. With authorization, run sestatus (and optional -b); quote selected status/policy labels as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized status-bypass cookbooks.

Practical notes for authorized labs

• sestatus reports SELinux status, mode, and policy identity — keep Evidence labels distinct from getenforce-tips mode-only reads.
• Pair with getsebool-tips when sestatus -b leads into boolean literacy.
• Status output is generally non-secret — still avoid pasting unrelated host inventories into notes or git.
• Prefer documenting mode / policy name / selected boolean lines the syllabus authorized without dumping unrelated privileged state.
• Never commit SELinux status dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host SELinux status probe → refuse.
• Unauthorized MAC-bypass / hostile-status attack cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources