SELinux: modes, contexts, troubleshooting

Goal

SELinux is enforcing by default on RHEL. The exam tests configuration as much as diagnosis.

Modes

getenforce
setenforce 0            # permissive until reboot

/etc/selinux/config:

SELINUX=enforcing
SELINUXTYPE=targeted

Contexts

ls -Z /var/www/html
ps -eZ | grep httpd
semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"
restorecon -Rv /srv/web

🔴 restorecon alone does nothing if no fcontext rule covers the path: it applies the policy, it does not invent it. chcon works but does not survive a relabel.

Booleans

getsebool -a | grep httpd
setsebool -P httpd_can_network_connect on     # -P = persistent

Diagnose

ausearch -m AVC -ts recent | tail -30
sealert -a /var/log/audit/audit.log 2>/dev/null | head
journalctl -t setroubleshoot --since "1 hour ago"

An AVC denial reads like: denied { read } for pid=... comm="nginx" name="index.html" scontext=... tcontext=... tclass=file.

Non-standard ports

semanage port -a -t http_port_t -p tcp 8080
semanage port -l | grep http_port_t

Verify

getenforce; ls -Z /srv/web | head -3; getsebool httpd_can_network_connect