In this video, I'll tell you about the configuration of the SL Linux mode.
So SL Linux can be in different states.
It can be either disabled or enabled.
The state is defined in the Linux kernel and you can only set it while booting.
By using the grub bootloader argument, SL Linux is 0 or SL Linux is 1.
If SL Linux is enabled, you can toggle between permissive and enforcing mode.
In permissive mode, nothing is blocked, but all SL Linux events are logged.
Permissive mode is excellent for troubleshooting because you get a clear idea of everything
that is going on.
In enforcing mode, SL Linux is fully operational.
You can use get-enforce to get the current mode and you can use set-enforce to set the
current mode.
Let me show you.
All right, let's check out what we've got.
When I use get-enforce on this system, we can see that I'm in enforcing mode.
And if I use set-enforce permissive, then get-enforce will reveal that we are in permissive mode.
Now why is that relevant?
Well, it is relevant because if I would configure my web server, let's go to etc.httpd.conf.
Let's tweak the document route, for instance, which by default is set to var www.html.
I want to set that to the slash web directory.
I need to modify web server permissions by modifying this directory slash web as well.
And then I'm going to create a directory slash web.
I'm using vim on slash web index.html.
Hello world, or whatever.
And a systemctl restart.httpd.
Okay, let's do a test.
I'm using curl to localhost.
And what do we see?
We see hello world.
And if I use set-enforce enforcing, and I do curl localhost, then we see a lot of error
messages.
And that is how permissive mode allows you to do your stuff.
Now why is it useful?
That is useful by the time you use grep avc on var log audit audit.log to figure out what
was going on.
Here we can see what has been logged in permissive mode.
And in a permissive mode, we can see the entire flow of the events.
And that is useful for troubleshooting, whereas in enforcing mode, you can only see the first
action that has immediately been blocked, because that is what sLinux is supposed to
do at that moment.