I had a SELinux problem in my Fedora Core 9 box the other day. I tried searching Google for a while, and I found out that we are able to solve SELinux permission problems based on particular SELinux error log messages. The SELinux error messages are logged by auditd daemon, so you may want to make sure that it has been started, and the logs are usually saved into /var/log/audit/audit.log. Note that unlike several notes using previous releases of FC that I found, we don't need selinux-policy-targeted-sources package to solve the problem in FC9.
In my case, the problem was about allowing httpd to connect to a CGI socket. Typing the following command:
audit2allow -l -i /var/log/audit/audit.log
generates:
#============= httpd_t ==============
allow httpd_t initrc_t:unix_stream_socket connectto;
So, to alleviate the problem, we only have to do the following steps (as also mentioned in FedoraProject's page):
- audit2allow -m local -l -i /var/log/audit/audit.log > local.te
- make sure that what is written in local.te is the process that you want to allow.
- checkmodule -M -m -o local.mod local.te
- semodule_package -o local.pp -m local.mod
- semodule -i local.pp
- check if your problem is solved now. It worked for me :)
Other References:
http://www.tummy.com/journals/entries/kevin_20050203_120753
News of the Post:
Google finds no privacy on private roads
