What to do when your scenario is blocked by SELinux?

What to do when your scenario is blocked by SELinux?

When your scenario is blocked by SELinux, the /var/log/audit/audit.log file is the first place to check for more information about a denial. To query Audit logs, use the ausearch tool.

How to confine new users in SELinux context?

Confining New Linux Users: useradd 6.3. Confining Existing Linux Users: semanage login 6.4. Changing the Default Mapping 6.6. Booleans for Users Executing Applications 7. Securing Programs Using Sandbox 7.1. Running an Application Using Sandbox 8.1. Security and Virtualization 9. Secure Linux Containers 10.

What happens when access is denied to SELinux?

SELinux systemd Access Control 10.1. SELinux Access Permissions for Services 10.2. SELinux and journald 11. Troubleshooting 11.1. What Happens when Access is Denied 11.2. Top Three Causes of Problems 11.2.1.

What do you need to know about SELinux systemd?

SELinux systemd Access Control 10.1. SELinux Access Permissions for Services 10.2. SELinux and journald 11. Troubleshooting 11.1. What Happens when Access is Denied 11.2. Top Three Causes of Problems 11.2.1. Labeling Problems 11.2.2. How are Confined Services Running? 11.2.3. Evolving Rules and Broken Applications 11.3. Fixing Problems 11.3.1.

Why is SELinux blocking remote SSH access without a…?

In the system that works the log entry has this in it: So, I’m confused. There is no file in /root/.ssh that has context system_u:system_r:sshd_t. So, I don’t understand why that context is logged.

Is there a tool to troubleshoot SELinux issues?

We now have a tool called sealert that analyzes the audit log used by SELinux. Sealert will scan the log file and report and will then generate a report containing all discovered SELinux issues. To run sealert from the command-line, we need to point it to the SELinux audit log.

How to check the history of SELinux alerts?

A history of alerts generated by SELinux can be view by using the SELinux Audit Log Analysis application. This allows you to easily audit SELinux-related problems that occurred while you were logged out of the server. To see a history of alerts click the Application menu, expand System Tools, and then click SELinux Audit Log Analysis.

How can I change SELinux from enforcing to permissive?

The ‘setenforce’ command may be used to switch between Enforcing and Permissive modes on the fly but note that these changes do not persist through a system reboot. To make changes persistent through a system reboot, edit the ‘SELINUX=’ line in /etc/selinux/config for either ‘enforcing’, ‘permissive’, or ‘disabled’.

Why does SELinux cause problems for system administrators?

The end result is that SELinux is likely to cause problems for system administrators and end users and rather than resolve these issues, system administrators may just disable SELinux thereby defeating the built-in protections. By design, SELinux allows different policies to be written that are interchangeable.

Do you need to modify applications to work with SELinux?

Because SELinux is implemented within the kernel, individual applications do not need to be especially written or modified to work under SELinux although, of course, if written to watch for the error codes which SELinux returns, vide infra, might work better afterwards.

How to troubleshoot problems related to SELinux red?

The policycoreutils-python-utils and setroubleshoot-server packages are installed on your system. List more details about a logged denial using the sealert command, for example: $ sealert -l “*” SELinux is preventing /usr/bin/passwd from write access on the file /root/test.

How to stop SELinux from blocking QEMU / libvirt?

Make sure denies are being logged in /var/log/audit.log. If nothing is present, run semodule -DB and run the offending program again; logs should be generated. Once they are, run semodule -B to disable verbose logging.

How to query audit logs in SELinux red?

To query Audit logs, use the ausearch tool. Because the SELinux decisions, such as allowing or disallowing access, are cached and this cache is known as the Access Vector Cache (AVC), use the AVC and USER_AVC values for the message type parameter, for example: If there are no matches, check if the Audit daemon is running.

What do you need to know about SELinux denials?

Note that in most cases, SELinux denials are signs of misconfiguration. 5.1. Identifying SELinux denials Follow only the necessary steps from this procedure; in most cases, you need to perform just step 1.

Is there a policy for Pi-hole in SELinux?

That is indeed the case, http://pi.hole/ returns a blank page, and without disabling SELinux / setting it to permissive on /etc/sysconfig/selinux Pi-Hole does not work at all. The question is, how do I create a policy that allows Pi-Hole to work as intended while having Enforced status on?

How to create a SELinux policy for a container?

Creating and enforcing an SELinux policy for a custom application 7.3. Creating a local SELinux policy module 7.4. Additional resources 8. Creating SELinux policies for containers 8.1. Introduction to the udica SELinux policy generator 8.2. Creating and using an SELinux policy for a custom container 8.3. Additional resources 9.