Booleans and troubleshooting denials

The idea

Booleans

The policy ships with booleans: switches that turn optional behaviours on or off without writing any policy. httpd_can_network_connect lets Apache open outbound connections (needed for a reverse proxy), httpd_enable_homedirs lets it serve users’ home directories, use_nfs_home_dirs allows NFS home directories, and hundreds more.

Task	Command
List all	getsebool -a
One	getsebool httpd_can_network_connect
With description and default	semanage boolean -l
Only what you changed	semanage boolean -l -C
Change until reboot	setsebool NAME on
Change permanently	setsebool -P NAME on

The -P is the whole difference between a task you pass and one you fail: without it the value reverts at reboot. Use getsebool -a | grep KEYWORD to find the one you need.

Denials: where they go

Every refusal is an AVC (Access Vector Cache) message in /var/log/audit/audit.log, written by auditd. Search it with ausearch:

sudo ausearch -m avc -ts recent       # last 10 minutes
sudo ausearch -m avc -ts today
sudo ausearch -m avc -ts boot

A denial reads like a sentence:

avc:  denied  { read }  for pid=3401 comm="httpd" name="index.html"
      scontext=system_u:system_r:httpd_t:s0
      tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0

The process of type httpd_t was denied read on a file of type default_t.

The four things to extract: scontext (who: the process type), tcontext (what: the object’s type), tclass (kind of object: file, dir, tcp_socket, …) and the permission in braces. permissive=1 means it was only logged.

ausearch ... | audit2why explains each denial and often names the boolean or says “allow this by relabeling”. The setroubleshoot-server package adds sealert -a /var/log/audit/audit.log (plain-language reports with suggested commands) and puts short messages in the journal under the tag setroubleshoot.

The decision ladder

Do not guess; follow this order and stop at the first that applies:

1. Wrong label on files (most common): restorecon -Rv PATH, or add a rule with semanage fcontext if the location is non-standard.
2. Port not labelled for the service: semanage port -a -t TYPE -p tcp PORT.
3. A boolean covers the behaviour: setsebool -P NAME on.
4. A genuinely new permission: write a small policy module with audit2allow -M mymodule and semodule -i mymodule.pp. This is a last resort: read the generated rules first, because audit2allow will happily allow an attack.

Never fix a denial with setenforce 0 and walk away, and do not disable SELinux “because it was in the way”. Permissive mode is for diagnosis: set it, reproduce the problem, read what was logged (all the denials appear at once instead of one at a time), set enforcing again, apply the proper fix.

Try it

getsebool -a | grep httpd_enable_homedirs
sudo semanage boolean -l | grep httpd_enable_homedirs

httpd_enable_homedirs --> off
httpd_enable_homedirs          (off  ,  off)  Allow httpd to enable homedirs

The pair is (current, default).

sudo setsebool httpd_enable_homedirs on
sudo semanage boolean -l -C
sudo setsebool -P httpd_enable_homedirs on
sudo semanage boolean -l -C

SELinux boolean                State  Default Description

httpd_enable_homedirs          (on   ,   on)  Allow httpd to enable homedirs

The first -C listing printed nothing: the runtime change was not recorded. After -P it is listed. Switch it off again with -P ... off.

Read a denial

sudo ausearch -m avc -ts recent | tail -1
sudo ausearch -m avc -ts recent | audit2why

type=AVC msg=audit(1762171201.431:340): avc:  denied  { read } for  pid=3512 comm="httpd" name="moved.html" dev="vda3" ino=140 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=0

	Was caused by:
		Missing type enforcement (TE) allow rule.

		You can use audit2allow to generate a loadable module to allow this access.

For a label problem audit2why often says “Missing type enforcement rule”, which is not a recommendation to add a rule: look at tcontext. A user_tmp_t file in the web root is mislabelled, and restorecon -Rv /web is the fix. For a boolean, audit2why says Was caused by: The boolean httpd_enable_homedirs was set incorrectly. Allow access by executing: setsebool -P httpd_enable_homedirs 1.

sealert

sudo dnf install -y setroubleshoot-server
sudo sealert -a /var/log/audit/audit.log | head -12

100% done
found 1 alerts in /var/log/audit/audit.log
--------------------------------------------------------------------------------

SELinux is preventing /usr/sbin/httpd from read access on the file moved.html.

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label.
/web/moved.html default label should be httpd_sys_content_t.
Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.
Do
# /sbin/restorecon -v /web/moved.html

Four failures, four fixes

Symptom	Ladder step	Fix
403 on files restored from a backup	Label	restorecon -Rv /web
Service will not start on port 5433	Port	semanage port -a -t postgresql_port_t -p tcp 5433
Apache proxy cannot reach a backend	Boolean	setsebool -P httpd_can_network_connect on
A custom script denied for no visible reason	Read the AVC, then module	`ausearch …

Going further

aureport -a summarises AVC denials; aureport --avc --summary shows counts by command. semodule -l lists loaded modules and semodule -r NAME removes one you added. sesearch -A -s httpd_t -b httpd_enable_homedirs shows what a boolean actually allows. For containers, container_t and the container_file_t label (:Z or :z on volume mounts) follow exactly the same logic. Finally, getenforce, ls -Z, ausearch -m avc -ts recent is the three-command opening to any SELinux investigation.