Diagnose and address routine SELinux policy violations

You have three main tools for diagnosing SELinux policy violations:

1. audit log (/var/log/audit/audit.log)
2. ls -Z
3. ps -AZ

I think that if you have realized that the issue lies with SELinux that is half the battle and the above can help you with that.

In order to address the policy violations that you might encounter, you will need the audit2why and audit2allow commands. You'll need to install policycoreutils-python

yum install policycoreutils-python

To illustrate how to use this, set SELinux to enforcing:

setenforce 1

Save your iptables configuration to a file:

iptables-save >myiptables.txt

This file is empty, so check the audit log and you'll see the following message:

type=AVC msg=audit(1307819809.595:16342): avc:  denied  { write } for  pid=22969 comm="iptables-save" path="/root/mytables.txt" dev=sda3 ino=144189 scontext=unconfined_u:unconfined_r:iptables_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file

Copy this line to a file, say iptables.audit and run:

audit2why < iptables.audit

You'll get this ouput:

 Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.

This confirms that the issue is with SELinux, so now let's resolve it:

audit2allow -M iptables -i iptables.audit

This will create a module called iptables.pp, that can be installed with this command:

semodule -i iptables.pp

Now you can safely save your iptables configuration.

As mentioned in a previous post, you should actually set SELinux to permissive in dev/testing as you might have more than one SELinux policy violation and then you'll end up creating loads of modules unnecessarily.

Use boolean settings to modify system SELinux settings

In order to list the SELinux settings you can use this command:

getsebool -a

Since SELinux settings don't really have catchy names, your best bet is using grep in conjunction with the -a switch, e.g to find all SELinux settings related to ssh: 

getsebool -a | grep ssh

You can now use the setsebool command to change the settings like this:

setsebool -P selinuxsetting boolean

where boolean is 1 to switch on and 0 to switch off.

Alternatively, you could you use tooglesebool, which flips the value.
e.g.

[root@centos1 examples]# getsebool -a | grep virt_use_nfs
virt_use_nfs --> off
[root@centos1 examples]# togglesebool virt_use_nfs
virt_use_nfs: active
[root@centos1 examples]# getsebool -a | grep virt_use_nfs
virt_use_nfs --> on

Restore default file contexts

Another easy objective, yay!!!

To restore default file contexts use:

restorecon  -vv filename

List and identify SELinux file and process context

You'll need to use the -Z switch for this objective.
Thus in order to list SELinux files' context I normally use:

ls -lZ

and to list processes' context:

ps -AZ

Set enforcing and permissive modes for SELinux

You can check the current SELinux status with:

getenforce

You can also look at /etc/selinux/config, which will tell you the status at boot time. This does not necessarily mean that it is the current SELinux status, because you can switch it off on the fly by issuing the following command:

echo 0 >/selinux/enforce

or this command:

setenforce 0

Similarly, you can switch it back on with:

echo 1 >/selinux/enforce

or this command:

setenforce 1

 Let's get back on track and look at the objective. You'll need to set the appropriate value for this line in the /etc/selinux/config file. So for enforcing mode, you'll have:

SELINUX=enforcing

and for permissive you'll have:

SELINUX=permissive

In development/test permissive mode should be used, so that you can diagnose and fix failures, in production you should use enforcing.