Troubleshooting SELinux issues

1 hour
  • 2 Learning Objectives

About this Hands-on Lab

In this exercise, you will troubleshoot SELinux issues preventing a service from starting, as well as functioning correctly.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives:

Start Apache.

Attempt to start the service:

systemctl start httpd

View the status log:

systemctl status httpd -l

View recent SELinux errors:

ausearch -m avc -ts recent

Find the inode it’s attempting to write to:

find / -inum <inode number>

View the SELinux context of the directory/file:

ls -Z /var/log/httpd

Restore the proper file context:

restorecon -Rv /var/log/httpd
Resolve SELinux issues preventing viewing web content.

Attempt to view the web content:

curl localhost

View recent AVC errors:

ausearch -m avc -ts recent

Find the inode of the file/directory:

find / -inum <inode number>

View the context of the file/directory:

ls -Z /home/cloud_user/html/index.html

Install sealert:

yum -y install setroubleshoot setroubleshoot-server

Restart the auditd service:

service auditd restart

Use sealert for more information:

sealert -a /var/log/audit/audit.log

Lookup the httpd_read_user_content boolean:

getsebool httpd_read_user_content

Set the boolean to permit reading user content:

setsebool -P httpd_read_user_content=1

View the web content:

curl localhost

Additional Resources

Successfully start Apache and have it serve content from the configured location by resolving SELinux issues.

What are Hands-on Labs

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Sign In
Welcome Back!

Psst…this one if you’ve been moved to ACG!

Get Started
Who’s going to be learning?