SELinux

---

• Toggle SELinux
• Audit2allow
• Setroubleshoot
  • Look for policy denials
• Compile & Install TE
• Search Audit
• Log Silent Denials

Toggle SELinux

setenforce 0
setenforce 1

Audit2allow

Check denials since last policy reload

audit2allow -law

Setroubleshoot

 yum install -y setroubleshoot-server

Look for policy denials

sealert -a /var/log/audit/audit.log

Compile & Install TE

checkmodule -M -m -o rule.mod rule.te
semodule_package -o rule.pp -m rule.mod
semodule -i rule.pp

Search Audit

ausearch -m avc --start 15:15:00 27/06/20

Pipe output to audti2allow

ausearch -m avc --start 15:15:00 27/06/20 | audit2allow -w

Log Silent Denials

Reference (opens new window)

# Log silent denials
semodule -DB

# Don't log silent denials (default)
semodule -B