Exercise 2: SELinux Commands That Don't Apply on Ubuntu — Possible Solution ==================================================================== WHAT STEP 4 ACTUALLY DESCRIBES ------------------------------ Per this chapter, Step 4 is explicitly labeled "SELinux, Fedora Only," with the semanage fcontext and restorecon commands introduced as steps "required when serving from a non-default directory" specifically on Fedora - the chapter's own heading already signals this isn't a universal, cross-distribution step. WHY THESE COMMANDS DON'T APPLY ON UBUNTU ------------------------------ Per this chapter, "neither Debian/Ubuntu nor Arch require this step at all, since neither runs SELinux by default." The semanage and restorecon tools exist specifically to manage SELinux security contexts - on a system that doesn't run SELinux in the first place, there's no SELinux context to set, and the underlying reason the step exists on Fedora (SELinux enforcing an additional access-control layer beyond ordinary Unix permissions) simply doesn't apply to Ubuntu at all. WHY THIS IS A DIRECT PAYOFF OF CHAPTER 3's OWN MATERIAL ------------------------------ Per this chapter, this is "a direct, concrete instance of Chapter 3's own warning finally showing up in a real deployment." Chapter 3 already established that SELinux is "enabled and Enforcing by default on Fedora and RHEL" specifically, contrasted with Debian/Ubuntu's own default use of a different security model (AppArmor). Serving a site from a custom directory triggering an SELinux-specific fix on Fedora, but requiring no equivalent step on Ubuntu, is exactly what that earlier chapter's own distinction predicted would happen in practice. WHY THE COLLEAGUE'S CONFUSION IS UNDERSTANDABLE BUT RESOLVABLE ------------------------------ It's reasonable to expect a step described in a capstone walkthrough to apply universally unless told otherwise - but this chapter's own explicit "Fedora Only" labeling, plus Chapter 3's own earlier explanation of why SELinux is Fedora/RHEL-specific, together make clear that this step was never meant to run on Ubuntu at all. The commands "don't do anything useful" there simply because there's no SELinux policy layer present to configure in the first place - not because the commands are broken or misapplied. WHY THIS WORKS AS AN ANSWER ------------------------------ It restates this chapter's own explicit "Fedora Only" framing for Step 4, explains precisely why SELinux tooling has nothing to act on when SELinux itself isn't running, and ties the observation back to Chapter 3's own earlier SELinux-vs-AppArmor distinction as the real underlying reason.