tai/runbooks/selinux.md

service, symptoms, tags

service	symptoms	tags
selinux	permission denied despite correct unix permissions, service blocked by selinux, avc denied, file context mismatch, port binding denied, boolean missing, domain transition failure	selinux, avc, enforcing, security, policy, restorecon, audit, sealert, semanage

Symptoms

• Service gets Permission denied even though file ownership and mode look correct
• Process cannot bind to a port or open a file after a config change
• AVC denials appear in audit logs
• App works when SELinux is permissive but fails in enforcing mode
• Newly created files under custom paths are inaccessible to a confined service

Diagnostics

Confirm SELinux mode and policy

getenforce
sestatus
cat /etc/selinux/config

If SELinux is Permissive, denials are logged but not enforced.

Check AVC denials

auditctl -s
ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts recent
journalctl -t setroubleshoot -n 50
dmesg | grep -i -e type=1300 -e type=1400

AVC denials are the primary source of truth for SELinux policy failures.

If AVCs are missing but SELinux still appears involved, temporarily disable dontaudit rules to expose hidden denials:

semodule -DB

Re-enable them after reproducing the issue:

semodule -B

Inspect file contexts

ls -lZ /path/to/file
ps -eZ | grep <service>
matchpathcon -V /path/to/file

A service can have correct Unix permissions and still fail if the SELinux context is wrong.

Check port labeling and booleans

semanage port -l | grep <port>
getsebool -a | grep <service-or-feature>
semanage boolean -l | grep <service-or-feature>

Custom ports often require explicit SELinux port labels.

Check for relabeling needs

restorecon -nRv /path
matchpathcon /path/to/file
sealert -l "*"

restorecon -n shows what would change without modifying labels.

sealert is often the fastest way to turn a raw AVC into a concrete fix, but treat audit2allow suggestions as a last resort, not a first response.

Remediation

Wrong file context: Restore the default context:

restorecon -Rv /path

Custom application path needs persistent labeling:

semanage fcontext -a -t <type> '/custom/path(/.*)?'
restorecon -Rv /custom/path

Custom port binding denied: Add the port label required by the service type:

semanage port -a -t <port_type> -p tcp <port>

Boolean disabled: Enable the needed boolean persistently:

setsebool -P <boolean_name> on

Still unsure whether SELinux is the blocker: Temporarily switch to permissive mode and reproduce the issue:

setenforce 0

If the problem still occurs, SELinux is not the root cause.

Do not disable SELinux or generate custom policy modules as a first response. Fix labels, booleans, or port mappings first.