Selinux Administration - Revision history

Dlk at 15:13, 7 January 2022

2022-01-07T15:13:34Z

Dlk at 23:29, 1 January 2022

2022-01-01T23:29:37Z

Dlk at 23:28, 1 January 2022

2022-01-01T23:28:02Z

Dlk: Created page with "'''Make sure that it is selinux that is causing the problem:''' `sestatus` checks the current status of selinux Temporarily disable selinux with `sudo setenf..."`


2022-01-01T23:27:26Z
Created page with "'''Make sure that it is selinux that is causing the problem:'''  <code>sestatus</code> checks the current status of selinux  Temporarily disable selinux with <code>sudo setenf..."
New page
'''Make sure that it is selinux that is causing the problem:'''



<code>sestatus</code> checks the current status of selinux



Temporarily disable selinux with <code>sudo setenforce 0</code> and test to see if the failure persists.



'''Check audit logs for selinux errors:'''



<pre>

sudo ausearch -m avc

</pre>



'''Generate policy file that fixes selinux errors:'''



<pre>

sudo ausearch -c 'sendmail'  --raw | audit2allow -M my-sendmail

sudo semodule -X 300 -i my-sendmail.pp

</pre>



<code>-c 'sendmail'</code> indicates the <code>comm=</code> element from the audit log records that identifies the problems to be fixed.  Only these records will be selected for the new policy being created.



Use <code>-ts "MM/DD/YYYY" "HH:MM:SS"</code> in place of the <code>-c</code> option in order to search for log records that were recorded after a certain time.



Browse the <code>my-sendmail.te</code> file before running the <code>semodule</code> command to review the policy changes that will be applied.



'''Setting security context for files:'''



<code>ls -lZ</code> displays current file context



<code>chcon</code> modifies the security context:

<ul>

<code>chcon -R -t httpd_sys_content_t /www/sites</code>



<br /><br />Where:

<br /><code>httpd_sys_content_t</code> - Apache Read-Only access

<br /><code>httpd_sys_rw_content_t</code> - Apache Read/Write access

<br /><code>httpd_log_t</code> - Apache log files

<br /><code>httpd_cache_t</code> - Apache caching



<br /><br />Or, use a reference directory to copy the context it has to another directory  tree:



<code>chcon -R --reference=/var/www/html /opt/dashboard</code>

</ul>

Selinux Administration - Revision history

Dlk at 15:13, 7 January 2022

Dlk at 23:29, 1 January 2022

Dlk at 23:28, 1 January 2022

Dlk: Created page with "'''Make sure that it is selinux that is causing the problem:''' sestatus checks the current status of selinux Temporarily disable selinux with sudo setenf..."

Dlk: Created page with "'''Make sure that it is selinux that is causing the problem:''' `sestatus` checks the current status of selinux Temporarily disable selinux with `sudo setenf..."`