#SELinux
#SELinux Troubleshooting | selinux tutorial for beginners | selinux Explained
Identify the Problem - SELinux Audits
Using ausearch and sealert
Using audit2allow Utility
SELinux Troubleshoot Browser
The setroubleshootd
Installation, configuration and working
Sending e-mails
Testing setroubleshoot functionality
Binding sshd on a non standard port
SELinux Logging - Interacting with systemd-journal
Policy Rules V/s other Options
Generally the causes of SELinux related problems are contexts and boolean settings. Logs are available in /var/log/audit/audit.log. Tools are available to help decipher this log. The audit search command can help filter for specific types of problems.
ausearch -m AVC,USER_AVC,SELINUX_ERR -ts today
The audit2allow utility gathers information from logs of denied operations and then generates SELinux policy-allow rules. For example:
To produce a human-readable description of why the access was denied:
audit2allow -w -a
To view the type enforcement rule that allows the denied access:
audit2allow -a
To create a custom module:
audit2allow -a -M mypolicy
The -M option creates a type enforcement file (.te) with the name specified and compiles the rule into a policy package: mypolicy.pp mypolicy.te
If the source and target contexts match, the file context is not the issue. By process of elimination, that points to the user context as the problem. The UID of the user should be listed later in the file, under “Raw Audit Messages.” If the user in question requires access to the su and sudo commands, change the role with the semanage login command. Any access to the sudo command will be documented in the /var/log/secure log file.Visit www.theskillpedia.com for Online Training on this technology