Mastering SELinux: Labels and Laws

SELinux is famous for being "Difficult." Many administrators disable it the moment they encounter a problem. But SELinux is actually very logical if you understand its one core rule: The Context.

In SELinux, every file, every process, every user, and even every network port has a Label (called a Security Context). SELinux is simply a "Matchmaker." If the process label doesn't have a rule allowing it to talk to the file label, the kernel stops the operation.

In this lesson, we will learn to read labels and fix context mismatches like a Pro.

1. The Anatomy of a Context

An SELinux label has four parts, separated by colons: user:role:type:level

For 99% of troubleshooting, you only care about the Type (the 3rd part).

Examples:

httpd_sys_content_t: Files that the web server is allowed to read.
etc_t: Configuration files.
ssh_port_t: The network ports SSH is allowed to listen on.

# View labels on files
ls -Z /var/www/html

# View labels on running processes
ps -eZ | grep nginx

2. Managing the States

Enforcing: Policy is active. Denials are BLOCKED.
Permissive: Policy is active but only LOGS denials. Great for troubleshooting.
Disabled: System is off. (Requires a reboot to re-enable).

# Check current status
getenforce

# Switch to troubleshooting mode immediately (no reboot)
sudo setenforce 0

3. Fixing Context Mismatches

The #1 cause of SELinux errors is moving a file from your home folder (where it is labeled user_home_t) to the web folder (where it should be httpd_sys_content_t). SELinux "Remembers" the old label and blocks the web server.

The Fix: restorecon

Linux has a database of where files should be and what their labels should be.

# Reset a file to its "Correct" label according to the system policy
sudo restorecon -v /var/www/html/index.html

# Fix an entire directory recursively
sudo restorecon -Rv /var/www/html

4. Booleans: Turning Features On/Off

SELinux has a series of "Light Switches" called Booleans. These allow you to change the security policy without writing code.

# Allow the web server to send email (off by default)
sudo setsebool -P httpd_can_sendmail on

# List all available switches and their status
getsebool -a | grep httpd

5. Troubleshooting: The 'sealert' Tool

If your app is failing and you suspect SELinux, look for the "Translator" tool.

# Install the troubleshooting tools
sudo dnf install setroubleshoot-server

# Find out what happened recently
sudo sealert -a /var/log/audit/audit.log

sealert is amazing. It doesn't just say "Access Denied." It says: "Access was denied because the label was wrong. To fix this, run command: restorecon ...". It literally gives you the solution!

6. Example: An SELinux Context Auditor (Python)

If you are deploying a web app, you need to be sure all your files have the "Web" label. Here is a Python script that flags any file in your web directory that has a "Suspect" label (like home_t).

import subprocess
import os

def audit_web_labels(directory="/var/www/html"):
    """
    Checks for non-standard web labels in a directory.
    """
    print(f"--- SELinux Logic Audit: {directory} ---")
    
    # ls -Z gives: unconfined_u:object_r:httpd_sys_content_t:s0 filename
    try:
        res = subprocess.run(["ls", "-Z", directory], capture_output=True, text=True)
        for line in res.stdout.splitlines():
            if not line: continue
            
            parts = line.split()
            # The context is usually the first part if filename is included
            context = parts[0]
            filename = parts[-1]
            
            if "httpd_" not in context and "admin_home_t" in context:
                print(f"[!!!] MISMATCH: '{filename}' has a HOME label! Web server cannot read this.")
                print(f"      Fix: sudo restorecon {os.path.join(directory, filename)}")
            else:
                print(f"[OK] {filename} is correctly labeled.")
                
    except Exception as e:
        print(f"Error checking labels: {e}")

if __name__ == "__main__":
    audit_web_labels()

7. Professional Tip: Use 'audit2allow'

If you are running a custom application that SELinux doesn't recognize (and thus blocks), you can "Generate" a custom security policy based on the rejection.

Let the app fail.
Run sudo grep myapp /var/log/audit/audit.log | audit2allow -M myapp_policy.
Load the new policy: sudo semodule -i myapp_policy.pp. Now SELinux knows about your app and will allow it.

8. Summary

SELinux is not a monster; it is a meticulous librarian.

Labels (Contexts) are the heart of the system.
restorecon is your primary tool for fixing moved files.
Booleans allow you to toggle features like "Web server connecting to DB."
sealert provides the answers to your troubleshooting questions.
NEVER disable SELinux; use Permissive mode instead.

In the next lesson, we will look at the Ubuntu alternative: Mastering AppArmor.

Quiz Questions

Why does moving a file from /home to /var/www often result in a "Permission Denied" error if SELinux is active?
What is the difference between setenforce 0 and setenforce 1?
How do you find the specific "Boolean" to allow the web server to access network databases?

Continue to Lesson 3: The Ubuntu Shield—Mastering AppArmor.

The Labeling Engine: Mastering SELinux