8.3. Fixing Problems
The following sections help troubleshoot issues. They go over: checking Linux permissions, which are checked before SELinux rules; possible causes of SELinux denying access, but no denials being logged; manual pages for services, which contain information about labeling and Booleans; permissive domains, for allowing one process to run permissive, rather than the whole system; how to search for and view denial messages; analyzing denials; and creating custom policy modules with
8.3.1. Linux Permissions
When access is denied, check standard Linux permissions. As mentioned in Chapter 2, Introduction, most operating systems use a Discretionary Access Control (DAC) system to control access, allowing users to control the permissions of files that they own. SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first.
If access is denied and no SELinux denials are logged, use the
ls -lcommand to view the standard Linux permissions:
ls -l /var/www/html/index.html-rw-r----- 1 root root 0 2009-05-07 11:06 index.html
In this example,
index.htmlis owned by the root user and group. The root user has read and write permissions (
-rw), and members of the root group have read permissions (
-r-). Everyone else has no access (
---). By default, such permissions do not allow
httpdto read this file. To resolve this issue, use the
chowncommand to change the owner and group. This command must be run as the Linux root user:
chown apache:apache /var/www/html/index.html
This assumes the default configuration, in which
httpdruns as the Linux apache user. If you run
httpdwith a different user, replace
apache:apachewith that user.
Refer to the Fedora Documentation Project "Permissions" draft for information about managing Linux permissions.