🔧 SELinux Troubleshooting

ausearch queries the audit log for SELinux AVC denial events:

# Show recent denials (last 10 minutes)
sudo ausearch -m avc -ts recent

# Show all denials since last boot
sudo ausearch -m avc -ts boot

# Show denials in the last hour
sudo ausearch -m avc -ts today

# Show denials for a specific process/command
sudo ausearch -m avc -c httpd
sudo ausearch -m avc -c nginx
sudo ausearch -m avc -c sshd

# Show denials involving a specific file
sudo ausearch -m avc -f myapp.conf

# Show denials for a specific PID
sudo ausearch -m avc -p 1234

# Show all AVC events since a specific time
sudo ausearch -m avc -ts "04/14/2026 10:00:00"

# Pipe to audit2why for explanation (covered in Example 2)
sudo ausearch -m avc -ts recent | audit2why

audit2why translates raw AVC denials into plain English and tells you what fix to apply:

# Explain recent denials
sudo ausearch -m avc -ts recent | audit2why

# Explain all denials since boot
sudo ausearch -m avc -ts boot | audit2why

# Explain denials for a specific service
sudo ausearch -m avc -ts recent -c httpd | audit2why

# Read directly from audit log
sudo audit2why -a

# From a saved log file
sudo audit2why -i /tmp/mydenials.log

sealert from the setroubleshoot-server package gives the most detailed, human-readable analysis with multiple fix options ranked by likelihood:

# Analyze the entire audit log
sudo sealert -a /var/log/audit/audit.log

# Analyze recent denials only (pipe from ausearch)
sudo ausearch -m avc -ts recent -l | sudo sealert -a /dev/stdin

# Look up a specific alert by UUID from journalctl
sudo sealert -l 8f34a21c-1234-5678-abcd-ef1234567890

# Watch for new alerts live
sudo journalctl -f -t setroubleshoot

# Check /var/log/messages for setroubleshoot summaries
sudo grep "sealert" /var/log/messages | tail -20

When no boolean or context fix applies, audit2allow generates a custom policy module that allows the denied action:

# Generate a policy module from recent denials
sudo ausearch -c 'httpd' --raw | audit2allow -M my-httpd

# This creates two files:
# my-httpd.te  — human-readable policy source
# my-httpd.pp  — compiled policy package

# Review what the policy allows BEFORE installing
cat my-httpd.te

# Install the policy module
sudo semodule -X 300 -i my-httpd.pp

# Verify it is loaded
sudo semodule -l | grep my-httpd

# Remove the module if no longer needed
sudo semodule -r my-httpd

# Generate from a specific log file
sudo audit2allow -M my-policy -i /tmp/denials.log

sesearch and seinfo let you query the loaded policy directly — useful for understanding what is and isn't allowed:

# What can httpd_t read?
sudo sesearch -A -s httpd_t -c file -p read

# Can httpd_t connect to mysqld_port_t?
sudo sesearch -A -s httpd_t -t mysqld_port_t -c tcp_socket

# What types can write to var_log_t?
sudo sesearch -A -t var_log_t -c file -p write

# List all types in the policy
sudo seinfo -t | head -30

# Count total types, roles, users
sudo seinfo

# Show attributes of a type
sudo seinfo -t httpd_t -x

# Find all types with 'http' in the name
sudo seinfo -t | grep http

The most frequently encountered SELinux denial scenarios and their solutions:

Pattern 1 — Wrong file context after copy

# Problem: file copied from home dir has wrong context
# Denial: httpd_t denied read on admin_home_t
sudo restorecon -Rv /var/www/html/

Pattern 2 — Service on non-standard port

# Problem: nginx configured for port 8080, SELinux blocks bind
# Denial: httpd_t denied name_bind on port 8080
sudo semanage port -a -t http_port_t -p tcp 8080

Pattern 3 — Web app cannot connect to database

# Problem: PHP app gets connection refused to MySQL
# Denial: httpd_t denied name_connect to mysqld_port_t
sudo setsebool -P httpd_can_network_connect_db on

Pattern 4 — Custom application directory

# Problem: app installed in /opt/myapp — wrong context
# Denial: httpd_t denied read on default_t or unlabeled_t
sudo semanage fcontext -a -t httpd_sys_content_t "/opt/myapp(/.*)?"
sudo restorecon -Rv /opt/myapp/

Pattern 5 — Service cannot write to log directory

# Problem: custom app cannot write logs to /var/log/myapp/
# Denial: myapp_t denied write on var_log_t
sudo semanage fcontext -a -t var_log_t "/var/log/myapp(/.*)?"
sudo restorecon -Rv /var/log/myapp/

Pattern 6 — SSH key permissions issue

# Problem: SSH authorized_keys not working
# Check context — should be ssh_home_t
ls -Z ~/.ssh/authorized_keys
# Fix:
restorecon -Rv ~/.ssh/

List, install, remove, and manage custom SELinux policy modules:

# List all installed policy modules
sudo semodule -l

# List with priority
sudo semodule -lfull

# Install a compiled module
sudo semodule -i my-httpd.pp

# Install with explicit priority (300 = local customization)
sudo semodule -X 300 -i my-httpd.pp

# Remove a module
sudo semodule -r my-httpd

# Disable a module without removing
sudo semodule -d my-httpd

# Re-enable a disabled module
sudo semodule -e my-httpd

# Rebuild and reload all policy (after manual .te edits)
sudo semodule -B

A practical script for diagnosing SELinux issues on any system:

#!/bin/bash
# selinux-diag.sh — SELinux diagnostic snapshot

echo "========================================"
echo " SELinux Diagnostic — $(hostname)"
echo " $(date)"
echo "========================================"

echo ""
echo "--- MODE AND POLICY ---"
getenforce
sestatus | grep -E "status|mode|policy"

echo ""
echo "--- RECENT DENIALS (last 10 min) ---"
DENIALS=$(sudo ausearch -m avc -ts recent 2>/dev/null)
if [ -z "$DENIALS" ]; then
    echo "No recent AVC denials found."
else
    echo "$DENIALS" | grep "comm=" | \
        awk -F'"' '{print "  Process:", $2}' | sort -u
    echo ""
    echo "--- PLAIN ENGLISH EXPLANATION ---"
    echo "$DENIALS" | sudo audit2why 2>/dev/null
fi

echo ""
echo "--- NON-DEFAULT BOOLEANS ---"
sudo semanage boolean -l -C 2>/dev/null | tail -n +2 | \
    awk '{printf "  %-45s %s\n", $1, $2}' || echo "  None"

echo ""
echo "--- CUSTOM POLICY MODULES ---"
sudo semodule -l 2>/dev/null | grep -v "^base\|^system" | \
    head -20 || echo "  None"

echo ""
echo "--- PERMISSIVE DOMAINS ---"
sudo semanage permissive -l 2>/dev/null | \
    grep -v "^Builtin\|^Custom\|^$" || echo "  None"

echo ""
echo "========================================"
echo " Run: sudo sealert -a /var/log/audit/audit.log"
echo " for full human-readable analysis"
echo "========================================"