Triaging SELinux denials without disabling enforcement on RHEL

Goal

Find the cause of an SELinux denial and apply the narrowest fix, keeping enforcement on throughout.

Prerequisites

Root or sudo access; the audit daemon running (denials are recorded to /var/log/audit/audit.log).

Steps

1. Confirm the mode first, since a "permissive" system logs denials without blocking them:

getenforce

2. Find recent denials:

ausearch -m AVC -ts recent

-ts recent restricts the search window; today or a specific timestamp work the same way. 3. Get a plain-language explanation and a suggested fix:

ausearch -m AVC -ts recent | audit2why

audit2why translates the raw audit records into a description of why the denial happened and what would resolve it. Where setroubleshoot is installed, sealert -a /var/log/audit/audit.log gives the same analysis with a tracked fix ID. 4. If the suggested fix is a boolean, check its current value and flip it persistently (-P writes it to the policy so it survives a reboot; without -P it only lasts until the next boot):

getsebool <boolean_name>
setsebool -P <boolean_name> on

5. If the fix is a mislabeled path, add a persistent context rule and apply it:

semanage fcontext -a -t <type_t> '/opt/app/data(/.*)?'
restorecon -Rv /opt/app/data

6. If a daemon needs a nonstandard port, add it to that port type instead of touching the daemon's domain:

semanage port -a -t <type_t> -p tcp 8443

7. Only for a single service under active debugging, make just that domain permissive instead of the whole system:

semanage permissive -a <domain_t>

Expected result

ausearch -m AVC -ts recent after the fix returns nothing new for the same operation; the service performs the action it was denied.

Limits and test basis

Every change above is reversible: setsebool -P <bool> off, semanage fcontext -d, semanage port -d, semanage permissive -d <domain_t>. None of these commands prompt interactively, so they are safe to script. Making a whole domain permissive removes SELinux protection for that service until removed again — scope it to one domain, one host, and remove it once the real fix (boolean or context) is confirmed.