SELinux Configuration

Enable troubleshoot tools

base::enable_auditd: true
selinux::setroubleshootd: true

Enable or disable selinux on a machine (default depends on the RHEL version)

base::selinux_mode: 'disabled'

Options:

enforcing
permissive
disabled

Use nfs home directory:

selinux::use_nfs_home_dirs: true

Set selinux booleans

selinux::booleans: [ 'httpd_can_network_connect', 'domain_can_mmap_files']

Set fcontext for specific directories/directory

selinux::fcontext:
  logbook-data:
    pathspec: '/var/www/html/logbook-data(/.*)?'
    seltype: 'httpd_sys_rw_content_t'
  logbook-data-local:
    pathspec: '/var/www/html/logbook-data-local(/.*)?'
    seltype: 'httpd_sys_rw_content_t'

(you can choose any unique key name)

Explicitly specify a selinux module:

selinux::modules::te:
  # SELinux is preventing /usr/local/bin/musrview from setattr access on the directory /usr/lib/fontconfig/cache
  'musrview-font-cache': |
    module musrview-font-cache 1.0;
    require {
        type lib_t;
        type httpd_sys_script_t;
        class dir setattr;
    }
    allow httpd_sys_script_t lib_t:dir setattr;

For troubleshooting SELinux related problems please have a look at SELinux Troublehooting Guide`

1.3 KiB Raw Blame History

SELinux Configuration

1.3 KiB

Raw Blame History