Security Enhanced Linux

Sometimes you cannot do things with Linux because of the firewall or iptables, other times it is file permissions related to your user and/or group. However it might be the "Enhanced Security" solution, automatically installed with your Linux distribution. If you are using RedHat, Fedora or CentOS then it will be "Security Enhanced Linux". Alternatively if you have Gentoo, openSUSE or Ubuntu it will be AppArmor but that is another story, here we are looking at Security Enhanced Linux, or SELinux as it is more commonly known.

The official page for SELinux is Main Page - SELinux Wiki, however I have found that both Security-Enhanced Linux - Wikipedia, the free encyclopedia and HowTos/SELinux - CentOS Wiki are useful for getting an overview and general understanding.

The command sestatus is a great way to see is SELinux is running and what it is doing. If you look at the "Current Mode" this will either be "enforcing" where things are blocked, or "permissive" where things are allowed but logged and alerted. The current mode, which will get reset on reboot can be changed with sudo setenforce Permissive or sudo setenforce Enforcing. If you wish to permanently change this then edit the file /etc/selinux/config as root or via sudo and change the line starting "SELINUX=" to "SELINUX=disabled", then reboot.

When diagnosing issues I suggest looking at SELinux - Sysadm which has proved useful. My other suggestion is to install "policycoreutils-gui" (yum install policycoreutils-gui), which then allows you to "see" the policy via /usr/bin/system-config-selinux or "SELinux Management" from the menu.

Files

When working with SELinux you might find a problem related to files, I hit this working with Apache on CentOS. This is some of the things I learnt along the way. To examine file security information and this is beyond the basic rwx model we are all used to, you should be able to execute this:
ls -Z /var/www/html/index.html
Which should output something like this:
-rw-r--r--  username username system_u:object_r:httpd_sys_content_t /var/www/html/index.html
The key of course is making sure that this lines up with the application trying to access the file. You can examine what role within SELinux the process has with this:
ps axZ | grep httpd
Which should output something like:
system_u:system_r:httpd_t        3234 ?        Ss     0:00 /usr/sbin/httpd
So, now you might have noticed with your files you need to change this, I found on my files that this was not set correctly, I was seeing "unconfined_u:object_r:user_home_t:s0", so I executed:
chcon -Rv --type=httpd_sys_content_t ./html
Note that the R means recursive but after doing this I was getting "unconfined_u:object_r:httpd_sys_content_t:s0", which was much better.