SE Linux Troubleshooting

Setroubleshoot

yum install setroubleshoot setools
sealert -a /var/log/audit/audit.log

Audit2allow (without setroubleshoot)

sudo grep fail2ban /var/log/audit/audit.log | audit2allow -M fail2ban2
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i fail2ban2.pp

[ec2-user@ip-172-26-5-161 ~]$ nano fail2ban2.
[ec2-user@ip-172-26-5-161 ~]$ nano fail2ban2.pp 
[ec2-user@ip-172-26-5-161 ~]$ sudo semodule -i fail2ban2.pp 

Configure SELinux on Amazon Linux AMI

• Install packages

yum install libselinux libselinux-utils selinux-policy-minimum selinux-policy-mls selinux-policy-targeted policycoreutils 

• Edit grub boot options

Edit /etc/grub.conf and change selinux=0 to selinux=1, then add security=selinux enforcing=1

• Then tell selinux you want to relable the filesystem

touch /.autorelabel

• Reboot and check selinux status

sestatus 

SELinux status:                 enabled
SELinuxfs mount:                /selinux
SELinux root directory:         /etc/selinux/
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      30