- sestatus - to get status, e.g., whether in enforcing or not
- also setenforce and getenforce
- getsebool -a | grep httpd
- semanage boolean -l | sort | less
- SE Control programs: getsebool, setsebool, booleans, togglesebool, semanage
- CentOS6 SELinux troubleshooting
- "SELinux decisions, such as allowing or disallowing access, are cached. This cache is known as the Access Vector Cache (AVC). Denial messages are logged when SELinux denies access. These denials are also known as "AVC denials""
- CentOS7 SELinux troubleshooting
SELinux and webservers
- SELinux Policy Management tool
semanage fcontext -a -t httpd_sys_content_t "/var/www/lgorders/admin(/.*)?
- restore file(s) default SELinux security contexts.
- passively check whether the file contexts are all set as specified by the active policy
restorecon -Rv .
- -n is dry-run (passive-check)
- When you cp files from one location to another, they keep their original context
- If you scp (from another machine?) directly into place, they get the context corresponding to the receiving location.
- Every time you copy (cp) new/modified files into /var/www/lgorders you’ll have to run
sudo restorecon -R /var/www/lgorders to allow httpd to use them.
- If Linux audit daemon (see below) is turned on, SELinux problems should be written to file
service auditd status
- dumps infos to /var/log/audit/audit.log
ausearch -m avc -ts recent - denials from the last 10 minutes
- a utility to assist controlling the kernel's audit system
- -a always,exit = append action always to syscall exit list
- -S open = any open call made by a program
- -F success!=0 = create a rule field evaluating on the exit value
auditctl -a always,exit -S all -F pid=1005
- To see all syscalls made by a specific program
auditctl -a always,exit -S openat -F auid=510
- To see files opened by a specific user
auditctl -a always,exit -S openat -F success=0
- To see unsuccessful openat calls
auditctl -w /etc/shadow -p wa or
auditctl -a always,exit -F path=/etc/shadow -F perm=wa
- To watch a file for changes
auditctl -w /etc/ -p wa or
auditctl -a always,exit -F dir=/etc/ -F perm=wa
- To recursively watch a directory for changes
auditctl -a always,exit -F dir=/home/ -F uid=0 -C auid!=obj_uid
- To see if an admin is accessing other user's files