3 ms·

I read that HOWTO, actually, and the stuff you're describing isn't really explained in it. For example, there's a httpd example changing a label right there in

I read that HOWTO, actually, and the stuff you're describing isn't really explained in it. For example, there's a httpd example changing a label right there in the HOWTO, and it doesn't explain where I'm supposed to discover the correct label. And the recommended audit-script-to-config doesn't show the correct labels, it prompts you to relax the rule instead of changing labels. My procmail rules don't correspond to what you said procmail does. And how was I supposed to discover procmail_home_t ? I'm not saying I'm Mr. Super Smart, I'm just saying that it's quite a bit of investment.

jamble 10y ago
> I read that HOWTO, actually, and the stuff you're describing isn't really explained in it. Did you read this part? It explains a solution to your first gripe: https://wiki.centos.org/HowTos/SELinux#head-0f6390ddacfab39ee973ed8018a32212c2a02199 https://wiki.centos.org/HowTos/SELinux#head-0f6390ddacfab39e... I find audit2why helpful, as well as semanage boolean -l, semanage user -l, semanage fcontext -l. Often times more than not, these tools either help me fix an 'audit' issue or point me in the right direction. Check them out sometime, if you don't want to go digging through docs or serverfault - the labels tend to be generally straight forward IMO :-)
nnutter 10y ago
The man pages are useful, especially once you know the basics. For example, start at [man selinux](http://linux.die.net/man/8/selinux http://linux.die.net/man/8/selinux) in See Also see the reference to [man httpd_selinux](http://linux.die.net/man/8/httpd_selinux http://linux.die.net/man/8/httpd_selinux) and in there you find every type and boolean including `httpd_enable_homedirs`. See also, [man procmail_selinux](http://linux.die.net/man/8/procmail_selinux http://linux.die.net/man/8/procmail_selinux).

3 ms·

I read that HOWTO, actually, and the stuff you're describing isn't really explained in it. For example, there's a httpd example changing a label right there in

by greglindahl 10y ago

jamble 10y ago
> I read that HOWTO, actually, and the stuff you're describing isn't really explained in it. Did you read this part? It explains a solution to your first gripe: https://wiki.centos.org/HowTos/SELinux#head-0f6390ddacfab39ee973ed8018a32212c2a02199 https://wiki.centos.org/HowTos/SELinux#head-0f6390ddacfab39e... I find audit2why helpful, as well as semanage boolean -l, semanage user -l, semanage fcontext -l. Often times more than not, these tools either help me fix an 'audit' issue or point me in the right direction. Check them out sometime, if you don't want to go digging through docs or serverfault - the labels tend to be generally straight forward IMO :-)
nnutter 10y ago
The man pages are useful, especially once you know the basics. For example, start at [man selinux](http://linux.die.net/man/8/selinux http://linux.die.net/man/8/selinux) in See Also see the reference to [man httpd_selinux](http://linux.die.net/man/8/httpd_selinux http://linux.die.net/man/8/httpd_selinux) and in there you find every type and boolean including `httpd_enable_homedirs`. See also, [man procmail_selinux](http://linux.die.net/man/8/procmail_selinux http://linux.die.net/man/8/procmail_selinux).