![\"SELinux\"](\"https:\/\/unihost.com\/help\/minio.php?.\/1200px-SELinux_logo.jpg\" "\\"Understanding"){kind=logo}
<\/p>\n<\/p>\n
Security-Enhanced Linux\u00a0(SELinux) is a\u00a0Linux kernel\u00a0security module\u00a0that provides a mechanism for supporting\u00a0access control\u00a0security policies, including\u00a0mandatory access controls\u00a0(MAC).<\/span>SELinux is a set of kernel modifications and user-space tools that have been added to various\u00a0Linux distributions. Its\u00a0architecture strives to separate enforcement of security decisions from the security policy, and streamlines the amount of software involved with security policy enforcement.<\/span><\/p>\n In this article, I will show you how to configure selinux without turning it off.<\/span><\/p>\n The\u00a0audit2allow utility gathers information from logs of denied operations and then generates SELinux policy allow rules.<\/span><\/p>\n Denial message and the associated system call are logged to the \/var\/log\/audit\/audit.log<\/em>\u00a0file:<\/span><\/p>\n In my example I am getting the error “Access denied” and I am unable to open a website.<\/span><\/p>\n Run\u00a0audit2allow<\/span><\/p>\n View the Type Enforcement rule that allows the denied access.<\/span><\/p>\n Run the following command as root to create a custom module. The -M\u00a0option creates a Type Enforcement file (.te) with the name specified with\u00a0-M, in your current working directory.<\/span><\/p>\n \u00a0Install the policy package<\/span><\/p>\n Now I am able to open my website.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":" Security-Enhanced Linux\u00a0(SELinux) is a\u00a0Linux kernel\u00a0security module\u00a0that provides a mechanism for supporting\u00a0access control\u00a0security policies, including\u00a0mandatory access controls\u00a0(MAC).<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[158],"tags":[58,553],"class_list":["post-7746","post","type-post","status-publish","format-standard","hentry","category-dedicated-servers","tag-centos","tag-selinux"],"yoast_head":"\ntype=AVC msg=audit(1582800535.799:670): avc: denied { read } for pid=13951 comm=\"nginx\" name=\"index.html\" dev=\"sda1\" ino=263511 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=...<\/span><\/pre>\nInstall audit2allow utility<\/span><\/h2>\n
# dnf install setroubleshoot setools<\/span><\/pre>\n# audit2allow -w -a<\/span>\n\ntype=AVC msg=audit(1582800535.799:670): avc: denied { read } for pid=13951 comm=\"nginx\" name=\"index.html\" dev=\"sda1\" ino=263511 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1<\/span>\nWas caused by:<\/span>\nUnknown - would be allowed by active policy<\/span>\nPossible mismatch between this policy and the one under which the audit message was generated.<\/span>\nPossible mismatch between current in-memory boolean settings vs. permanent ones.<\/span><\/pre>\n# audit2allow -a<\/span>\n#============= httpd_t ==============<\/span>\n#!!!! This avc is allowed in the current policy<\/span>\nallow httpd_t http_port_t:tcp_socket name_connect;<\/span>\n\n#!!!! This avc is allowed in the current policy<\/span>\nallow httpd_t user_home_t:file { map open read };<\/span><\/pre>\n# audit2allow -a -M mycertwatch<\/span>\n******************** IMPORTANT ***********************<\/span>\nTo make this policy package active, execute:<\/span>\n\nsemodule -i mycertwatch.pp<\/span><\/pre>\n# semodule -i mycertwatch.pp<\/span><\/pre>\n