SELinux Without Turning It Off

Tue, 22 Oct 2024 10:00:00 +0000

Every homelab has a moment where a service refuses to start, the logs are useless, and setenforce 0 is sitting right there in your shell history from the last time this happened. I’ve typed it more times than I’d like to admit. It fixes the immediate problem the way unplugging a smoke alarm fixes a burning pan — technically true, and a bad habit to build.

SELinux gets a reputation as the thing you disable during setup, right after you set a root password you’ll forget. That reputation is earned by tooling that used to be genuinely hostile to newcomers, but it’s stale. Modern SELinux on Fedora, RHEL, Rocky and Alma ships with tools that turn “why won’t this start” into a five-minute diagnosis, and once you’ve done it a few times it stops being scary. This post is the workflow I actually use: read the denial, understand why it happened, and either fix the context or write a scoped policy module — never reach for the global off switch.

Selinux - vo.rs

SELinux Without Turning It Off