MISP
/
misp-book
mirror of https://github.com/MISP/misp-book
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [doc] Added pointers on how to debug SELinux fun.

pull/164/head
Steve Clement 2019-05-09 10:19:54 +09:00
parent 90f996771a
commit 6d4863a79e
1 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
faq/README.md
View File

@ -78,7 +78,7 @@ sudo ausearch -c 'php-fpm' --message AVC
sudo ausearch --message AVC
```
#### Redis Connection problems
### Redis Connection problems
If you have the following in **error.log**
@ -109,6 +109,42 @@ sudo systemctl restart rh-php72-php-fpm.service
sudo systemctl restart httpd.service
```
## RHEL/CentOS SELinux debug
More often than not there might be issues with SELinux when not configured correctly. The below will give you pointers where to look and how to figure out what is wrong.
You can investigate SELinux issues without any tools by opening the audit log it generates. This log is found at /var/log/audit/audit.log. However, unless you know exactly what to look for and have a lot of free time, you’re going to find it difficult making sense of the log.
Install some handy tools:
```bash
# Note: This will pull in some X tools, you have been warned
sudo yum install setroubleshoot setools
```
We now have a tool called sealert that analyzes the audit log used by SELinux. Sealert will scan the log file and will then generate a report containing all discovered SELinux issues.
In this overview of what went wrong you will see suggestions on how to fix them after the issue detected.
To run sealert from the command-line, we need to point it to the SELinux audit log.
```bash
sudo sealert -a /var/log/audit/audit.log
```
#### Clearing the audit logs
It is not recommended to clear the audit logs as they might contain information needed in the future for troubleshooting or security investigations. However, if that is not the case, just empty the audit log:
```bash
# > /var/log/audit/audit.log
```
[Partial source](https://www.serverlab.ca/tutorials/linux/administration-linux/troubleshooting-selinux-centos-red-hat/)
[StackExchange](https://unix.stackexchange.com/questions/337704/selinux-is-preventing-nginx-from-writing-via-php-fpm)
[Gentoo Wiki](https://wiki.gentoo.org/wiki/SELinux/Logging#Clearing_the_audit_logs)
## When to update MISP?
One question might be how often to update MISP.