SELinux troubleshooting and common fixes

One of the main problems in getting used to SELinux is that many people who are not familiar with it blame it for things not working; however, this argument is getting a bit outdated: SELinux was introduced in Red Hat Enterprise Linux 4, which was back in 2005.

Most of the time, issues with SELinux and our systems are related to changed file contexts and changing ports for services, and fewer time issues with the policy itself.

First of all, there are several places where we can check for errors, but in our list we should start with the audit log or the system messages. For example, we can start with the /var/log/audit/audit.log file that we introduced earlier in this chapter.

Also bear in mind that SELinux Mandatory Access Control (MAC) only plays once we have cleared access from regular Discretionary Access Controls (DAC), that is, if we've no permission to check a file (for example, mode 400 and our user not being the owner...