Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
Wat het doet
With setroubleshoot-server installed, every AVC denial is analyzed. sealert -a /var/log/audit/audit.log prints a report per problem: what was blocked, why, and suggestions ("you need to change the label…", "turn on boolean…", "allow the port…"). Short messages also go to the journal (journalctl -t setroubleshoot) with an ID for sealert -l ID.
Zo schrijf je het
sealert -a FILE
sealert -l ID | -l "*"
sealert -bOpties 9
Meest gebruikt
Niets past bij dit filter.
Voorbeelden 10
$ als gewone gebruiker# als root (of met sudo)
1Install it
dnf install -y setroubleshoot-serverRestart auditd or reboot so it gets the events.
2Analyze the whole audit log
sealert -a /var/log/audit/audit.log | lessOne block per kind of denial, with fixes.
3Short messages in the journal
journalctl -t setroubleshoot --since -1h setroubleshoot[2310]: SELinux is preventing /usr/sbin/httpd from read access on the file index.html. For complete SELinux messages run: sealert -l 3f6a…Copy the ID.
4Full report for one alert
sealert -l 3f6a2b1c-…Cause and suggestions.
5All alerts
sealert -l "*"Every stored alert.
6Typical suggestion: wrong label
sealert -a /var/log/audit/audit.log | grep -A3 'restorecon'Run the restorecon it shows.
7Typical suggestion: boolean
sealert -a /var/log/audit/audit.log | grep setseboolUse the boolean it names (with -P).
8Do not just follow audit2allow advice (security)
sealert -a /var/log/audit/audit.log | grep -B2 audit2allowThe last suggestion is often "make a module" — only if nothing else fits.
9Analyze an old log
sealert -a /var/log/audit/audit.log.1Rotated logs.
10Check the service
systemctl status setroubleshootdRuns on demand through D-Bus.
Niets past bij dit filter.
Exitcodes
0 | Done. |
1 | Error. |