Manage SELinux mandatory access control policies.
high risk
ausearch -m avc -ts recent | audit2whyFind out what is being denied.semanage fcontext -a -t <type> '<path>(/.*)?' && restorecon -Rv <path>Fix the label permanently.SELinux (Security-Enhanced Linux) enforces mandatory access control policies beyond traditional file permissions. When applications fail silently, SELinux denials are often the cause. Use getenforce/setenforce to check and toggle mode, and audit2why to understand denials.
getenforceCheck current SELinux mode (Enforcing/Permissive/Disabled) · explain & risk-check →setenforce 0Set to Permissive (logs denials, doesn't enforce) · explain & risk-check →setenforce 1Set back to Enforcing · explain & risk-check →ausearch -m avc -ts recent | audit2whyExplain recent SELinux denials in plain English · explain & risk-check →ausearch -m avc -ts recent | audit2allow -M mypolicy && semodule -i mypolicy.ppGenerate and install a policy to fix a denial · explain & risk-check →ls -Z /var/www/htmlShow SELinux context of files · explain & risk-check →restorecon -Rv /var/www/htmlRestore default SELinux file contexts · explain & risk-check →Before permanently disabling SELinux, try `setenforce 0` and test — if the issue resolves, use `audit2allow` to create a proper policy instead of leaving enforcement disabled.
Reference text is hand-written and may be incomplete — check man selinux for your version. Test destructive commands on a non-production system first.