4 ms·
"audit2allow -a" or "audit2why" will tell you what the reason for a denial is and potentially how to fix it. Pretty sure it will tell you to run setsebool to a
by obelix150 10y ago
"audit2allow -a" or "audit2why" will tell you what the reason for a denial is and potentially how to fix it. Pretty sure it will tell you to run setsebool to allow httpd_can_network_connect in this instance.
- snuxoll 10y agoaudit2allow is the single greatest tool I've ever used for dealing with SELinux, people need to hear it's name sung from the mountains. I actually write SELinux policies for software I develop, first thing I do is put them in the most restrictive context imaginable with no permissions, set SELinux in permissive mode and run the application through it's paces, at the end run audit2allow and there's 90% of the work done for you outside of defining fcontext's.
- blockoperation 10y agoIt must be used with care though, otherwise you'll end up with so many holes in your policy that you defeat whole point of using SELinux in the first place. Definitely don't use the output directly.
- snuxoll 10y agoCertainly not, but it's a great first step.