4

Since I have written a few answers covering SELinux recently (2 about file labeling and another about booleans), I have been thinking if it would be useful to have some generic Q&A on common SELinux issues. I would be willing to write some, if I had a better idea on what kind of topics would be considered useful.

The default SELinux policy is used by default on RHEL/Fedora based distributions. This sometimes results in questions here about permissions problems. People asking the questions do not always realize that their problem actually is SELinux related. At least, if the problem turns out to be SELinux related the question should in my opinion include tag.

Due the nature of SELinux's default policy (many applications, most daemons have their own file labeling rules, contexts and configurable booleans), a very generic answer probably isn't ever going be specific enough to mark other questions as duplicate. A specific question's answer would still need to have the specific details for the application in question (using booleans, file labeling, additional policy modules, and so on).

What I'm asking here to discuss about:

2

1 Answer 1

4

Please go for it!

Typically such questions asking for an overview of a topic are mostly useful to serve as references in other answers. If you find yourself explaining the same general principles over and over again, it's convenient to have a reference answer with generic explanations. Then, when someone asks a general question “what is X?”, you can close it as a duplicate of “what is X?”. But most often, people have a specific question “how to I do A”, and you want to answer “use X” — and with the reference answer, you can explain how to apply X in a couple of lines, and refer to the generic “what is X” answer for the background.

Such reference answers are not useful when there is already a Wikipedia article about X. They're useful for more detailed technical topics where you need to go beyond what an encyclopedia has to offer. For example, “what is SELinux” would not be a useful question for this site. But Configure SELinux to allow daemons to use files in non-default locations is: it's a common problem, and it can both serve as a duplicate of similar question, and as a link to use in answers of the form “your permission problem is caused by SELinux, as explained in [link] you need to allow the foobar daemon to access /somewhere, run the following command: …”.

I've written quite a few questions of this type, so I'll show a few examples of mine to serve as examples of what a canonical Q&A can be.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .