The blessing and the curse that is SELinux. Stop turning it off.
Get the right tools
yum install setroubleshoot-server selinux-policy-devel
Checking the current mode
getenforce
Edit /etc/sysconfig/selinux
to switch modes. Enabled or Disabled
Switching modes requires a reboot
setenforce 0
Set to permissive
setenforce 1
Set to enforce
Context labels
- user
- role
- type
Finding issues:
SELinux logs to /var/log/audit/audit.log
and /var/log/messages
grep AVC /var/log/audit/audit.log
Use semanage
to change context labels.
Monitor/View SELinux on many commands with -Z option.
man semanage-fcontext
has useful examples
Booleans
A boolean is an on/off-switch for a specific functionality.
Use getsebool -a
for an overview
Use setsebool [-P]
to change booleans
Use touch /.autorelabel
to apply default context to all files and directories.
Use restorecon -R
to apply default context to files and directories