# SELinux: look
getenforce ; sestatus # current mode, policy, and the boot setting
ls -Z FILE ; ls -Zd DIR # a file's context
ps -eZ | grep nginx # a process's domain
semanage port -l | grep -w http_port_t # which ports a type covers
getsebool -a | grep httpd # the booleans for a domain
semanage fcontext -l | grep '^/srv' # what the policy thinks a path should be
semanage fcontext -C -l # only the local customisations
# SELinux: the denial
ausearch -m avc -ts recent # denials, recent first (--input-logs in scripts: no tty = reads stdin)
ausearch -m avc -ts recent | audit2why # what WOULD allow it — a list to judge, not advice
sealert -a /var/log/audit/audit.log # setroubleshoot's report
semodule -DB … semodule -B # unmask dontaudit rules while you reproduce
# SELinux: fix
semanage fcontext -a -t httpd_sys_content_t '/srv/status(/.*)?'
restorecon -Rv /srv/status # apply the rules
restorecon -R -n -v /srv/status # DRY RUN: silence = the policy agrees with the labels
semanage port -a -t http_port_t -p tcp 8090 # -m if the port already has a type
setsebool -P httpd_can_network_connect on # -P or it reverts at boot
chcon -t TYPE FILE # now only — temporary by design
touch /.autorelabel && reboot # full relabel
fixfiles -R nginx restore # relabel one package's files
setenforce 0 / 1 # permissive / enforcing — a diagnostic, not a fix
# firewalld
firewall-cmd --state
firewall-cmd --get-active-zones ; firewall-cmd --get-zone-of-interface=eth0
firewall-cmd --zone=public --list-all
firewall-cmd --permanent --zone=public --add-port=8090/tcp ; firewall-cmd --reload
firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --zone=public --query-port=8090/tcp # runtime
firewall-cmd --permanent --zone=public --query-port=8090/tcp # after reboot
firewall-cmd --runtime-to-permanent # save what you got right interactively
firewall-cmd --get-services # the named services available
# network, persistently
nmcli device status ; nmcli connection show
nmcli -g GENERAL.CONNECTION device show eth0 # which profile is on the device
nmcli connection modify "$con" +ipv4.addresses 192.168.5.50/24 # + adds, no + replaces
nmcli connection modify "$con" ipv4.gateway … ipv4.dns … ipv4.method manual
nmcli device reapply eth0 # apply without dropping the link
nmcli connection up "$con" # re-activate the profile
hostnamectl set-hostname web01.lab.example
hostnamectl hostname --static # what survives a reboot
# network, for looking only
ip -4 -br addr ; ip route ; ss -lntp