My SELinux Quick Reference

tested for RHEL/Centos 5

Check status of selinux

sestatus

List security context of file and/or directories

ls -Z /dir

List security context of a/processes

ps axZ | proc

Change security context for a file/dir

chcon -Rv --type=proc_sys_content_t /dir (reboot persistent)
semanage fcontext -a -t proc_sys_content_t "/dir(/.*)?" (filesystem relable persistent)

Restore security contect of a file/dir

restorecon -Rv /dir/subdir

Allow access to a port, eg.

semanage port -a -t http_port_t -p tcp 81

Toggling SELinux policies with boolean commands;

see this wiki

When you are hitting a security restriction in your server that's being enforced by SELinux (in enforcing mode) You can troubleshoot such issues by first setting selinux to permissive and check the audited security context breaches.

setenforce 0

If SELinux (in permissive mode) is complaining about a specific process' access to files(/var/log/audit/audit.log), we can resolve these issues by reviewing what SELinux would have wanted inorder to allow access. e.g for snmpd:

grep snmpd_t /var/log/audit/audit.log | audit2allow -r

If the results look reasonable, then make custom policy module to allow the actions;

grep snmpd_t /var/log/audit/audit.log | audit2allow -M snmpdlocal

and then load the module

semodule -i snmpdlocal.pp

then check if module is loaded correctly

semodule -l

Monitor the audit.log to see if issue is resolved. If all looks ok, then revert your SELinux to enforcing

setenforce 1