Lesson 3.39: Reading and fixing SELinux denials
On Red Hat family systems SELinux decides, after the ordinary permissions, whether a process may touch a file or a port. Each file carries a label, each service runs in a domain, and the policy lists what a domain may do. When it says no, the program just sees 'Permission denied' and the reason sits in the audit log. In the lab Northwind's wiki moved to a new Rocky Linux server and answers 403, then 502. You read the labels and the AVC records, fix the file context the permanent way, and turn on the one boolean the search page needs, without ever switching SELinux off.
19 min
You will learn to
- Explain labels, domains and type enforcement
- Read contexts with ls -Z and ps -Z
- Find denials with ausearch -m AVC
- Fix labels with semanage fcontext and restorecon
- Use audit2why and booleans for allowed exceptions
Key terms
- Mandatory access control (MAC)
- Rules set by the system's policy that even root-owned processes can't override; checked after ordinary permissions.
- Context (label)
- user:role:type:level attached to every file and process; the type is what policy rules use.
- Domain
- The type a process runs as; it decides what the process may access.
- AVC denial
- The audit record written when policy refuses an access.
- File context rule
- A path pattern and the type files there should have; restorecon applies the rules.
- Boolean
- An on/off switch the policy authors built in for common needs.
← ACLs: precise access without loosening permissions · All lessons · LUKS key slots: who can unlock the disk →