RHCSA Rapid Track
Use SELinux log analysis tools and display useful information during SELinux troubleshooting with the
sealertcommand.
When applications unexpectedly fail to work due to SELinux access denials, methods and tools are available to resolve these issues. It is helpful to start by understanding some fundamental concepts and behaviors when SELinux is enabled.
SELinux consists of targeted policies that explicitly define allowable actions.
A policy entry defines a labeled process and a labeled resource that interact.
The policy states the process type, and the file or port context, by using labels.
The policy entry defines one process type, one resource label, and the explicit action to allow.
An action can be a system call, a kernel function, or another specific programming routine.
If no entry is created for a specific process-resource-action relationship, then the action is denied.
When an action is denied, the attempt is logged with useful context information.
Red Hat Enterprise Linux provides a stable targeted SELinux policy for almost every service in the distribution. Therefore, it is unusual to have SELinux access problems with common RHEL services when they are configured correctly. SELinux access problems occur when services are implemented incorrectly, or when new applications have incomplete policies. Consider these troubleshooting concepts before making broad SELinux configuration changes.
Most access denials indicate that SELinux is working correctly by blocking improper actions.
Evaluating denied actions requires some familiarity with normal, expected service actions.
The most common SELinux issue is an incorrect context on new, copied, or moved files.
File contexts can be fixed when an existing policy references their location.
Optional Boolean policy features are documented in the
_selinuxman pages.Implementing Boolean features generally requires setting additional non-SELinux configuration.
SELinux policies do not replace or circumvent file permissions or access control list restrictions.
When a common application or service fails, and the service is known to have a working SELinux policy, first see the service's _selinux man page to verify the correct context type label. View the affected process and file attributes to verify that the correct labels are set.
The SELinux troubleshooting service, from the setroubleshoot-server package, provides tools to diagnose SELinux issues. When SELinux denies an action, an Access Vector Cache (AVC) message is logged to the /var/log/audit/audit.log security log file. The SELinux troubleshooting service monitors for AVC events and sends an event summary to the /var/log/messages file.
The AVC summary includes an event unique identifier (UUID). Use the sealert -l command to view comprehensive report details for the specific event. Use the UUIDsealert -a /var/log/audit/audit.log command to view all existing events.
Consider the following example sequence of commands on a standard Apache web server. You create /root/mypage and move it to the default Apache content directory (/var/www/html). Then, after starting the Apache service, you try to retrieve the file content.
[root@host ~]#touch /root/mypage[root@host ~]#mv /root/mypage /var/www/html[root@host ~]#systemctl start httpd[root@host ~]#curl http://localhost/mypage<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> </body></html>
The web server does not display the content, and returns a permission denied error. An AVC event is logged to the /var/log/audit/audit.log and /var/log/messages files. Note the suggested sealert command and UUID in the /var/log/messages event message.
[root@host ~]#tail /var/log/audit/audit.log...output omitted... type=AVC msg=audit(1649249057.067:212): avc: denied { getattr } for pid=2332 comm="httpd" path="/var/www/html/mypage" dev="vda4" ino=9322502 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0 ...output omitted [root@host ~]#tail /var/log/messages...output omitted... Apr 6 08:44:19 host setroubleshoot[2547]: SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/mypage. For complete SELinux messages run: sealert -l 95f41f98-6b56-45bc-95da-ce67ec9a9ab7 ...output omitted...
The sealert output describes the event, and includes the affected process, the accessed file, and the attempted and denied action. The output includes advice for correcting the file's label, if appropriate. Additional advice describes how to generate a new policy to allow the denied action. Use the given advice only when it is appropriate for your scenario.
Important
The sealert output includes a confidence rating, which indicates the level of confidence that the given advice will mitigate the denial. However, that advice might not be appropriate for your scenario.
For example, if the AVC denial is because the denied file is in the wrong location, then advice that states either to adjust the file's context label, or to create a policy for this location and action, although technically accurate, is not the correct solution for your scenario. If the root cause is a wrong location or file name, then moving or renaming the file and then restoring a correct file context is the correct solution instead.
[root@host ~]#sealert -l 95f41f98-6b56-45bc-95da-ce67ec9a9ab7SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/mypage.*****Plugin restorecon (99.5 confidence) suggests************************ If you want to fix the label./var/www/html/mypage default label should be httpd_sys_content_t.Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly. Do # /sbin/restorecon -v /var/www/html/mypage *****Plugin catchall (1.49 confidence) suggests************************** If you believe that httpd should be allowed getattr access on the mypage file by default.Then you should report this as a bug.You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'httpd' --raw | audit2allow -M my-httpd # semodule -X 300 -i my-httpd.pp Additional Information: Source Context system_u:system_r:httpd_t:s0 Target Context unconfined_u:object_r:admin_home_t:s0 Target Objects /var/www/html/mypage [ file ] Source httpd Source Path /usr/sbin/httpd ...output omitted... Raw Audit Messages type=AVC msg=audit(1649249057.67:212): avc: denied { getattr } for pid=2332 comm="httpd" path="/var/www/html/mypage" dev="vda4" ino=9322502 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1649249057.67:212): arch=x86_64 syscall=newfstatat success=no exit=EACCES a0=ffffff9c a1=7fe9c00048f8 a2=7fe9ccfc8830 a3=100 items=0 ppid=2329 pid=2332 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null) Hash: httpd,httpd_t,admin_home_t,file,getattr
In this example, the accessed file is in the correct location, but does not have the correct SELinux file context. The Raw Audit Messages section displays information from the /var/log/audit/audit.log event entry. Use the restorecon /var/www/html/mypage command to set the correct context label. To correct multiple files recursively, use the restorecon -R command on the parent directory.
Use the ausearch command to search for AVC events in the /var/log/audit/audit.log log file. Use the -m option to specify the AVC message type and the -ts option to provide a time hint, such as recent.
[root@host ~]#ausearch -m AVC -ts recent---- time->Tue Apr 6 13:13:07 2019 type=PROCTITLE msg=audit(1554808387.778:4002): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44 type=SYSCALL msg=audit(1554808387.778:4002): arch=c000003e syscall=49 success=no exit=-13 a0=3 a1=55620b8c9280 a2=10 a3=7ffed967661c items=0 ppid=1 pid=9340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="httpd"exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1554808387.778:4002): avc:denied{ name_bind } for pid=9340comm="httpd" src=82 scontext=system_u:system_r:httpd_t:s0tcontext=system_u:object_r:reserved_port_t:s0 tclass=tcp_socket permissive=0
The RHEL web console includes tools for troubleshooting SELinux issues. Select from the menu on the left. The SELinux policy window displays the current enforcing state. The section lists current SELinux issues.
Click the > character to display event details. Click to display all event details and advice. You can click .
After correcting the issue, the section should remove that event from view. If the No SELinux alerts message appears, then you have corrected all current SELinux issues.
References
sealert(8) man page