{"id":321,"date":"2023-04-25T11:12:50","date_gmt":"2023-04-25T15:12:50","guid":{"rendered":"https:\/\/daveking.com\/blog\/?p=321"},"modified":"2023-04-25T11:13:14","modified_gmt":"2023-04-25T15:13:14","slug":"troubleshooting-selinux","status":"publish","type":"post","link":"https:\/\/daveking.com\/blog\/index.php\/2023\/04\/25\/troubleshooting-selinux\/","title":{"rendered":"Troubleshooting SELinux"},"content":{"rendered":"\n<p>Make sure that it is SELinux that is causing the problem:<\/p>\n\n\n\n<p class=\"has-ek-indent\" style=\"--ek-indent:40px\"><code>sestatus<\/code> checks the current status of SELinux<br>Temporarily disable SELinux with <code>sudo setenforce 0<\/code> and test to see if the failure persists.<\/p>\n\n\n\n<p>Check audit logs for SELinux errors:<\/p>\n\n\n\n<p class=\"has-ek-indent\" style=\"--ek-indent:40px\"><code>sudo ausearch -m avc<\/code><\/p>\n\n\n\n<p>Generate a policy file that fixes the SELinux errors errors in the audit log:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted has-ek-indent\" style=\"--ek-indent:40px\">sudo ausearch -c 'sendmail' --raw | audit2allow -M my-sendmail\nsudo semodule -i my-sendmail.pp<\/pre>\n\n\n\n<p class=\"has-ek-indent\" style=\"--ek-indent:40px\"><code>-c 'sendmail'<\/code> indicates the <code>comm=<\/code> element from the audit log records that identifies the problems to be fixed. Only these records will be selected for the new policy being created.<\/p>\n\n\n\n<p class=\"has-ek-indent\" style=\"--ek-indent:40px\">Use -ts &#8220;MM\/DD\/YYYY&#8221; &#8220;HH:MM:SS&#8221; in place of the -c option in order to search for log records that were recorded after a certain time.<\/p>\n\n\n\n<p class=\"has-ek-indent\" style=\"--ek-indent:40px\">Browse the my-sendmail.te file before running the semodule command to review the policy changes that will be applied.<\/p>\n\n\n\n<p>Setting security context for files:<\/p>\n\n\n\n<p class=\"has-ek-indent\" style=\"--ek-indent:40px\"><code>ls -lZ<\/code> displays current file context<\/p>\n\n\n\n<p class=\"has-ek-indent\" style=\"--ek-indent:40px\"><code>chcon<\/code> modifies the security context.  For example: <code>chcon -R -t httpd_sys_content_t \/www\/sites<\/code><br><br>Where:<br><code>  httpd_sys_content_t <\/code>&#8211; Apache Read-Only access<br><code>  httpd_sys_rw_content_t<\/code> &#8211; Apache Read\/Write access<br><code>  httpd_log_t<\/code> &#8211; Apache log files<br><code>  httpd_cache_t<\/code> &#8211; Apache caching<br><br>Or, use a reference directory to copy the context it has to another directory tree: <br><code>  chcon -R --reference=\/var\/www\/html \/www\/sites<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>My SELinux commands cheat sheet<\/p>\n","protected":false},"author":1,"featured_media":327,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_editorskit_title_hidden":false,"_editorskit_reading_time":0,"_editorskit_is_block_options_detached":false,"_editorskit_block_options_position":"{}","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[22,7,30],"tags":[23,3],"class_list":["post-321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howto","category-linux-administration","category-security","tag-howto","tag-linux","eq-blocks"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/daveking.com\/blog\/wp-content\/uploads\/2023\/04\/SELinux_logo.png?fit=312%2C282&ssl=1","jetpack-related-posts":[],"jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=321"}],"version-history":[{"count":5,"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/321\/revisions"}],"predecessor-version":[{"id":328,"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/posts\/321\/revisions\/328"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/media\/327"}],"wp:attachment":[{"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daveking.com\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}