SELinux "avc: denied": read the denial, then fix the label, the boolean or the port

1. Read the denial

Find recent denials:

sudo ausearch -m AVC -ts recent

Each part of the line answers a question:

So, nginx (httpd_t) may not read a file labeled user_home_t. The file came from someone’s home folder, and was moved, keeping its old label.

2. Ask for an explanation

sudo ausearch -m AVC -ts recent | audit2why

audit2why says which kind of problem this is: a wrong label, or a boolean that’s off, and names the boolean. On a machine with setroubleshoot-server installed, sealert gives a fuller report, with commands:

sudo sealert -a /var/log/audit/audit.log

Both come from the policycoreutils-python-utils and setroubleshoot-server packages.

3. A wrong file label

This is the most common case. See the label:

ls -Z /srv/www/index.html

unconfined_u:object_r:user_home_t:s0 /srv/www/index.html

mv keeps a file’s label, and cp gives it the label of where it lands. That’s why a moved file fails, and a copied one works. Reset labels to what the policy expects for that place:

sudo restorecon -Rv /var/www/html

For a folder the policy doesn’t know about, like /srv/www, tell it first, then apply:

sudo semanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?'
sudo restorecon -Rv /srv/www

Use httpd_sys_rw_content_t for folders the web app must write to, such as uploads. Avoid chcon: its changes are lost the next time anything runs restorecon, while semanage fcontext is permanent.

4. A boolean that’s off

Booleans are switches for common needs. A web server proxying to an app, which is the cause of many 502 errors on RHEL, needs this:

getsebool httpd_can_network_connect
sudo setsebool -P httpd_can_network_connect on

-P keeps it across reboots. Others you’ll meet: httpd_can_network_connect_db for a web app reaching a database, httpd_enable_homedirs for ~/public_html, and httpd_use_nfs for content on NFS. List them all with getsebool -a.

5. A port that’s not allowed

Each service may only listen on ports labeled for it. Nginx on port 8081 fails to start, and the denial says name_bind with src=8081. See the labeled ports, then add yours:

sudo semanage port -l | grep -w http_port_t
sudo semanage port -a -t http_port_t -p tcp 8081

The same goes for SSH on another port, with ssh_port_t. The Port Lookup shows what each port is usually for.

6. Test, without turning it off

To check whether SELinux is really the cause, switch it to permissive for a moment: it logs, and doesn’t block.

getenforce
sudo setenforce 0
# test
sudo setenforce 1

If it works in permissive mode, the fix is one of the above. Turn enforcing back on right away. It resets to the config file’s setting on reboot anyway.

If none of the cases fit, audit2allow can write a small custom policy from the denials. Read what it proposes: it allows exactly what was denied, which may be more than you want.