Mastering Linux Security and Hardening

Viewing setroubleshoot messages

Whenever something happens that violates an SELinux rule, it gets logged in the /var/log/audit/audit.log file. Tools are available that can let you directly read that log, but to diagnose SELinux problems, it's way better to use setroubleshoot. The beauty of setroubleshoot is that it takes the cryptic, hard-to-interpret SELinux messages from the audit.log file and translates them into plain, natural language. The messages that it sends to the /var/log/messages file even contain suggestions about how to fix the problem. To show how this works, let's go back to our problem where a file in the /var/www/html directory had been assigned the wrong SELinux type. Of course, we knew right away what the problem was because ...