SELinux Basics

# Check current SELinux mode and policy
sestatus
getenforce

# Temporarily switch to permissive (survives until reboot)
sudo setenforce 0    # 0 = permissive
sudo setenforce 1    # 1 = enforcing

# Permanently change mode — edit /etc/selinux/config
sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
# Options: enforcing | permissive | disabled
# Changes take effect on next reboot

# Check current mode in the config file
cat /etc/selinux/config | grep "^SELINUX="

# Check which SELinux policy is loaded
cat /etc/selinux/config | grep "^SELINUXTYPE="
# Common policies: targeted (most systems), mls (multi-level security)

# Show SELinux context of files — add -Z flag to standard commands
ls -laZ /var/www/html/
ls -Z /etc/shadow

# Show SELinux context of running processes
ps -eZ | grep nginx
ps auxZ | grep httpd

# Show SELinux context of network ports
sudo semanage port -l | grep http

# Show your current login context
id -Z

# Show SELinux context of a specific file
stat --printf="%C\n" /var/www/html/index.html

# View the full context of all files in a directory
ls -laZ /etc/ssh/

# View recent SELinux denials from the audit log
sudo ausearch -m AVC -ts recent
sudo ausearch -m AVC,USER_AVC -ts today

# View denials in the system journal
sudo journalctl | grep "SELinux is preventing"

# The setroubleshoot-server package provides the best human-readable explanations
sudo dnf install setroubleshoot-server -y
sudo sealert -a /var/log/audit/audit.log

# Use audit2why to explain a specific denial
sudo ausearch -m AVC -ts recent | audit2why

# Generate a policy module to allow a specific denial (use with caution)
sudo ausearch -m AVC -ts recent | audit2allow -M mypolicy
sudo semodule -i mypolicy.pp

# Check if SELinux is causing an application failure
# Step 1: switch to permissive temporarily
sudo setenforce 0
# Step 2: reproduce the error
# Step 3: if it works now, SELinux was the cause — check audit.log
# Step 4: return to enforcing and fix properly
sudo setenforce 1

# ── File context management ───────────────────────────────────────

# View the SELinux file context database — what type should /var/www/* have?
sudo semanage fcontext -l | grep "/var/www"

# Add a custom file context rule (for a non-standard web root)
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/myapp(/.*)?"
sudo restorecon -Rv /srv/myapp/

# Change a file's context temporarily (survives until restorecon is run)
sudo chcon -t httpd_sys_content_t /srv/myapp/index.html

# Reset a file to its correct default context
sudo restorecon -v /srv/myapp/index.html

# ── Boolean management ────────────────────────────────────────────

# Search booleans related to nginx/httpd
getsebool -a | grep httpd | grep -v "off$"   # show only enabled booleans

# Common booleans for web servers
getsebool httpd_can_network_connect          # allow nginx/Apache to make outbound connections
getsebool httpd_can_network_connect_db       # allow httpd to connect to databases
getsebool httpd_enable_homedirs              # allow httpd to serve from home directories

# Enable nginx to connect to a backend application server (e.g. Node.js, uWSGI)
sudo setsebool -P httpd_can_network_connect on

# Complete workflow — nginx on a new Rocky Linux server serving /srv/myapp/

# 1. Register the correct context for the non-standard web root
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/myapp(/.*)?"

# 2. Apply labels
sudo restorecon -Rv /srv/myapp/

# 3. If nginx needs to proxy to a backend service
sudo setsebool -P httpd_can_network_connect on

# 4. If nginx needs to connect to a database (PHP apps, etc.)
sudo setsebool -P httpd_can_network_connect_db on

# 5. Verify no remaining denials
sudo ausearch -m AVC -ts today | audit2why

# Full audit: relabel the entire filesystem (useful after major changes — slow!)
# sudo touch /.autorelabel && sudo reboot