norboten · cheat sheet

Three layers of "permission denied" — cheat sheet

firewall-selinux, networking
# SELinux: look
getenforce ; sestatus                  # current mode, policy, and the boot setting
ls -Z FILE ; ls -Zd DIR                # a file's context
ps -eZ | grep nginx                    # a process's domain
semanage port -l | grep -w http_port_t # which ports a type covers
getsebool -a | grep httpd              # the booleans for a domain
semanage fcontext -l | grep '^/srv'    # what the policy thinks a path should be
semanage fcontext -C -l                # only the local customisations

# SELinux: the denial
ausearch -m avc -ts recent             # denials, recent first (--input-logs in scripts: no tty = reads stdin)
ausearch -m avc -ts recent | audit2why # what WOULD allow it — a list to judge, not advice
sealert -a /var/log/audit/audit.log    # setroubleshoot's report
semodule -DB … semodule -B             # unmask dontaudit rules while you reproduce

# SELinux: fix
semanage fcontext -a -t httpd_sys_content_t '/srv/status(/.*)?'
restorecon -Rv /srv/status             # apply the rules
restorecon -R -n -v /srv/status        # DRY RUN: silence = the policy agrees with the labels
semanage port -a -t http_port_t -p tcp 8090     # -m if the port already has a type
setsebool -P httpd_can_network_connect on       # -P or it reverts at boot
chcon -t TYPE FILE                     # now only — temporary by design
touch /.autorelabel && reboot          # full relabel
fixfiles -R nginx restore              # relabel one package's files
setenforce 0 / 1                       # permissive / enforcing — a diagnostic, not a fix

# firewalld
firewall-cmd --state
firewall-cmd --get-active-zones ; firewall-cmd --get-zone-of-interface=eth0
firewall-cmd --zone=public --list-all
firewall-cmd --permanent --zone=public --add-port=8090/tcp ; firewall-cmd --reload
firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --zone=public --query-port=8090/tcp          # runtime
firewall-cmd --permanent --zone=public --query-port=8090/tcp   # after reboot
firewall-cmd --runtime-to-permanent    # save what you got right interactively
firewall-cmd --get-services            # the named services available

# network, persistently
nmcli device status ; nmcli connection show
nmcli -g GENERAL.CONNECTION device show eth0        # which profile is on the device
nmcli connection modify "$con" +ipv4.addresses 192.168.5.50/24   # + adds, no + replaces
nmcli connection modify "$con" ipv4.gateway … ipv4.dns … ipv4.method manual
nmcli device reapply eth0              # apply without dropping the link
nmcli connection up "$con"             # re-activate the profile
hostnamectl set-hostname web01.lab.example
hostnamectl hostname --static          # what survives a reboot

# network, for looking only
ip -4 -br addr ; ip route ; ss -lntp