---
name: "selinux-context-policy-enforcement"
description: "Manage Security-Enhanced Linux (SELinux) contexts, booleans, and audit logs."
metadata:
  author: "SELinux Project"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "fix selinux avc denial"
  - "change selinux file context"
  - "setsebool selinux boolean"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# SELinux Contexts & Policy Enforcement

Administers SELinux on RHEL/Rocky Linux: interpreting audit.log AVC denials with audit2why, configuring file contexts with semanage fcontext and restorecon, and toggling booleans with setsebool.

## When to Invoke
Invoke this skill whenever you need to:
- fix selinux avc denial
- change selinux file context
- setsebool selinux boolean

## Execution SOP & Rules
1. Verify SELinux mode with getenforce (Enforcing, Permissive, Disabled).
2. Apply persistent file context definitions with semanage fcontext -a -t httpd_sys_content_t '/web(/.*)?'.
3. Relabel files according to policy rules using restorecon -Rv /web.
4. Use audit2allow -M mymodule to generate custom policy modules for approved custom actions.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.