So sometimes, SQLinux will cause problems, it doesn't work, and then you need to know
how to troubleshoot.
So how does troubleshooting work?
Well, first you are going to check events that are in the audit log.
We already did that.
All the SQLinux events are written with AVC, so you use grep AVC on varlogaudit audit.log
to make sure that you understand what is going on.
And messages in the audit log are not always very readable.
Well, you know, I don't even agree to that.
Messages in the audit log are pretty readable, but you need to know what you are checking.
Let's check it out.
So grep AVC on varlogaudit audit.log is showing what?
Well, let's take this one.
That's one that we haven't talked about yet.
This is telling me denied BPF.
BPF, that's a system call.
The PID is the process that was involved.
And this process apparently is to command mdadm.
And this mdm is using a source context mdadm underscore T. And the target context is what
you see right here, is mdadm underscore T.
So what does that mean?
Well, that is, in fact, a very curious error message.
That means that mdadm is not allowed to issue the BPF system call, even if it has a source
context mdadm T going to the target context mdadm underscore T.
Source and target context are the same normally that should work.
So here, well, you know what is wrong.
And next, you need to find out what to do about it.
Let's take another one.
Like this one.
This was the Apache web server.
And what do we see in the Apache web server?
Well, we see ABC denied read.
So it has tried to read something.
Well, what did it read for PID 1253 command HTTPD?
Name index HTML.
Aha.
HTTPD was accessing index HTML.
There we have the source context HTTPD underscore T, the target context default underscore T.
Well, you know what to do in that case, don't you?
And that is why I think that messages in the audit log are pretty readable and should
always be the start of your troubleshooting.
The next utility, se-alert, is only useful if you know what is going on.
Edit or start a slide from here.
So what is se-alert?
Se-alert is part of the se-troubleshoot server package, and it logs readable messages to
your logging system.
And you can look for se-alert in your log files and learn the suggested command to find
out what to do.
In some cases, you get very useful information.
In some cases, it will be completely useless.
Let's check out what it is doing in this case.
So I'm going to use journal CTL by grab se-alert.
And there we can see that se-alert has generated a couple of messages.
And what you need to do is to run this command.
So I'm going to do it on the webindex.html case first.
And then just because I'm curious, I also want to do it for mdadm.
Now I know that a lot of output is coming, so I'm filtering through less.
And what is it doing?
It's telling me, plug-in catch-all boolean with 57.6% confidence suggests that this is
the solution.
Well, I can tell you it's not.
Then it comes with another suggestion.
And there it's telling that se-manage-fcontext-a-t-file-type is the solution.
So we need to set a file type.
But then the problematic part, make your choice of the long list of file types that follows.
That is not very useful either.
But believe me, sometimes se-alert is just giving you a command that does make sense.
So you can give it a try.
But my advice is to always match se-alert to your own understanding of what is going
wrong.
Now, as a bonus, and because I haven't seen it before, I want to investigate this mdadm
as well.
So apparently, this is something that was not configured all right in CentOS 10.
And what is se-alert telling me about it?
Well, se-alert is telling me that I need to report this as a bug.
I agree.
It sounds like a bug.
But it also is telling me that this is the solution to fix it.
It's going too far for what we are doing right here.
With this solution, we'll generate an se-Linux policy module.
And in this se-Linux policy module, everything that was denied for mdadm is going to be allowed.
And that will make your message go away after you have used se-module minus I to insert
this new policy module.
So what to remember about this?
Start with your own understanding on the varlogaudit audit.log and use se-alert as a help to try
to narrow down the problem.
Sometimes it's useful.
Sometimes it completely is not.