Troubleshooting SELinux Denials

The classic SELinux symptom: the config is perfect, permissions look right, the service is running — and it still can't open a port, read a file, or make a connection. On RHEL-family systems, SELinux is the invisible third layer of permissions, and the fix is almost never to turn it off.

1. Is SELinux actually the cause?

Quick test: the denials land in the audit log the moment the action is attempted. Look there before you theorise:

ausearch -m AVC -ts recent          # recent "Access Vector Cache" denials
# or, plain english with a suggested fix:
sealert -a /var/log/audit/audit.log

A fresh AVC denied line matching your service's action is the confirmation. getenforce tells you if it's Enforcing (blocking) or Permissive (logging only).

2. Read the denial

An AVC line names the source context (e.g. httpd_t), the target it was denied, and the permission (name_connect, read, …). That trio tells you which of the three fixes you need.

3. Fix it the right way

• A boolean for a known behaviour — e.g. to let Apache make outbound network connections, flip the matching httpd_can_network_connect boolean on with setsebool -P <boolean> on. List the available booleans with getsebool -a; the sealert output in step 1 names the exact one to toggle and the -P flag makes it persist across reboots.
• A file context when content lives in a non-standard path: semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?" then restorecon -Rv /web.
• A port label for a non-standard port: semanage port -a -t http_port_t -p tcp 8888.

Don't just setenforce 0

Disabling SELinux "fixes" it the way removing the smoke detector fixes a fire. If you must unblock fast in an incident, setenforce 0 drops to permissive temporarily — but capture the denials, apply the real boolean/context/port fix, and turn it back to enforcing.

Practise RHEL incidents

SELinux blocking web traffic is one of the RHEL incidents in the simulator. Work it and the rest of the Linux catalog with Linux troubleshooting practice and a full incident response shift.