So a good while back I posted an article on how to troubleshoot SELinux violations and after reviewing that article as part of a troubleshooting exercise, I realized that I left out a few details. Needless to say my original article was not as clear as it should be. Anyway I wanted to use up a few more bytes of the internet to clarify.
When the package setroubleshoot-server is installed, SELinux violations will be sent to /var/log/messages, which makes it fairly easy to troubleshoot SELinux issues.
So first lets install setroubleshoot and all its parts
# yum install setroubleshoot*
In my case on RHEL6, the following packages were installed
setroubleshoot-plugins-3.0.40-1.el6.noarch
setroubleshoot-server-3.0.47-3.el6_3.x86_64
setroubleshoot-3.0.47-3.el6_3.x86_64
Note that the setroubleshoot-server is the one that you need to troubleshoot via the command line.
Now lets generate a violation. In this case I am just dropping a file with the wrong selinux context into /var/www/html and am trying to access it.
# touch /root/file3 && cp /root/index.html /var/www/html/file3
Check the context if you must to make sure that its not correct for httpd content. In this case you can see that it is not.
# ls -lZ /var/www/html/file3
-rwxrwxrwx. root root system_u:object_r:admin_home_t:s0 /var/www/html/file3
Now start Apache and try to access the file via elinks or a browser. You will get a Forbidden error, which I have omitted below.
# elinks -dump http://localhost/file3
Note that you may need to restart auditd if your message does not show up in the messages file.
Aug 11 17:08:39 vfatmin01 setroubleshoot: SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/file3. For complete SELinux messages. run sealert -l 5a413022-af89-4222-b055-0cc1edc4bbad
Note: You will also find a the same error in /var/log/audit/audit.log, albeit in a bit less friendly format.
type=AVC msg=audit(1344719319.890:7196): avc: denied { getattr } for pid=6765 comm=”httpd” path=”/var/www/html/file3″ dev=dm-1 ino=656718 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
Anyway back to the error from the messages file. At the end of the error you are shown the UUID of the error and the sealert command to run to get more information on the error.
# sealert -l 5a413022-af89-4222-b055-0cc1edc4bbad
Output below:
SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/file3.
***** Plugin restorecon (99.5 confidence) suggests *************************
If you want to fix the label.
/var/www/html/file3 default label should be httpd_sys_content_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /var/www/html/file3
Wow, sealert actually tells you why the file is being blocked and the commands that you should run to fix the problem. Nice!