Security, integrity and safe repair

What it covers

• The security view combines SELinux mode/contexts, permission baseline, module integrity, runtime-state checksums, trust, capabilities and access policy.
• The permission baseline shows expected owner/group/mode and drift; safe repair is allow-listed and supports dry-run.
• Important state is written atomically and has checksums; damaged state is preserved for recovery, not empty overwrite.
• Module integrity checks manifests, files, services/binaries and trust.

How to use it

1. Run audit/dry-run.
2. Review the exact drift.
3. Apply safe repair.
4. Re-evaluate integrity.
5. Review audit.

Important rules

• Do not disable SELinux as a universal fix.
• Admin does not bypass confirmations/locks/source policy.
• Integrity failure can hide/block a module.