O'Reilly logo

SELinux Cookbook by Sven Vermeulen

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Identifying whether SELinux is to blame

Before blaming the SELinux subsystem and policies for a problem, it is important to verify whether SELinux is to blame at all. Too often, hours of troubleshooting are put in analyzing the SELinux policies and subsystem only to find out that the problem also persists when SELinux is not enabled.

How to do it…

In order to be confident that SELinux is (or isn't) to blame, the following set of steps can be taken:

  1. Is it possible to get more information through the application's internal debugging system? Consider the following instance:
    ~# puppet master
    Error: Could not find class puppet::agent for foo.bar on node foo.bar
    ~# puppet master --debug --no-daemonize --verbose
  2. Is an AVC denial related to the problem shown ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required