How do I investigate an SELinux denial without disabling SELinux?
An SELinux denial is evidence that a process attempted an operation outside its current policy. Diagnose the exact process, object and requested permission before choosing a correction. A UNIX file-mode change alone may not fix an SELinux label problem, and disabling enforcement hides the cause.
Before you start
- Administrative permission to read audit events.
- The exact failing file or service and incident time.
Instructions
1. Check enforcement and recent denials
Reproduce the approved failing operation once, then inspect matching recent audit events. Correlate the executable, target path and timestamp; an unrelated denial should not drive the fix.
getenforce
sudo ausearch -m AVC,USER_AVC -ts recentShows enforcement mode and recent SELinux access-denial events. No policy changes are made.
2. Inspect the selected file label
Replace the example with the exact path implicated by the denial. Check directory traversal and application access separately from the SELinux context.
ls -lZ /var/www/app/public/index.html
sudo restorecon -n -v /var/www/app/public/index.htmlThe -n option previews a default-context correction without changing the file label.
3. Choose a supported correction
If the preview identifies an incorrect standard label, review that precise correction. Custom locations may require a persistent file-context rule; unexpected network access may require a documented application policy setting. Do not automatically convert every denial into an allow rule.
Check the result
- The reason for the denial is understood and any approved targeted correction is followed by a successful application test with enforcement still enabled.
Troubleshooting
- No relevant audit event appears
- Confirm the event time, audit availability and actual failure path. The error may be ordinary permissions or application configuration rather than SELinux.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.