Linux SELinux Blocking Application Fix

In this tutorial, you'll learn about Linux SELinux Blocking Application Fix. We cover key concepts, practical examples, and best practices.

SELinux blocks applications from accessing files, ports, and processes even when traditional Linux permissions allow it. Applications fail silently or with vague errors like "permission denied", while SELinux logs the real reason in the audit log.

The Problem

sudo systemctl start nginx

Fails, but:

ls -la /var/www/html/

Shows correct permissions:

drwxr-xr-x. nginx nginx html

Nginx logs show:

open() "/var/www/html/index.html" failed (13: Permission denied)

Wrong Approach

# WRONG — disabling SELinux entirely
sudo setenforce 0
# This removes security — not a real fix

Right Approach

# Check the audit log for SELinux denials
sudo ausearch -m avc -ts recent

Expected output:

type=AVC msg=audit(1623456789.123:456): avc:  denied  { read } for  pid=1234
comm="nginx" name="index.html" dev="sda1" ino=56789
scontext=system_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file

Step-by-Step Fix

Step 1: Find the SELinux denial

sudo ausearch -m avc -ts recent

Or use audit2why for a human-readable explanation:

sudo ausearch -m avc -ts recent | audit2why

Step 2: Fix the file context

# Restore the default SELinux context
sudo restorecon -Rv /var/www/html/

Step 3: Set the correct context for custom paths

# Change SELinux file type for custom web roots
sudo semanage fcontext -a -t httpd_sys_content_t "/custom/www(/.*)?"
sudo restorecon -Rv /custom/www/

Step 4: Allow a specific permission

# If restorecon does not work, create a custom policy
sudo ausearch -m avc -ts recent | audit2allow -M myapp
sudo semodule -i myapp.pp

Step 5: Check SELinux booleans

# List booleans related to HTTP
sudo getsebool -a | grep httpd

# Enable a boolean if needed
sudo setsebool -P httpd_can_network_connect on

Step 6: Verify the fix

sudo systemctl restart nginx
curl http://localhost

Prevention Tips

• Always use restorecon after moving or creating files in SELinux-managed directories
• Check SELinux context before changing file permissions: ls -Z
• Run audit2allow to create targeted policies instead of disabling SELinux
• Use semanage to set default contexts for custom file paths
• Monitor denials with journalctl -l | grep -i selinux

Common Mistakes with selinux blocking

1. Forgetting deriving (Show, Eq) on custom data types needed for debugging
2. Placing the wildcard pattern first in case expressions, making all subsequent patterns unreachable
3. Using head and tail instead of pattern matching, causing runtime errors on empty lists

These mistakes appear frequently in real-world LINUX code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ