Writing generic SELinux Q&A

Question

Since I have written a few answers covering SELinux recently (2 about file labeling and another about booleans), I have been thinking if it would be useful to have some generic Q&A on common SELinux issues. I would be willing to write some, if I had a better idea on what kind of topics would be considered useful.

The default SELinux policy is used by default on RHEL/Fedora based distributions. This sometimes results in questions here about permissions problems. People asking the questions do not always realize that their problem actually is SELinux related. At least, if the problem turns out to be SELinux related the question should in my opinion include selinux tag.

Due the nature of SELinux's default policy (many applications, most daemons have their own file labeling rules, contexts and configurable booleans), a very generic answer probably isn't ever going be specific enough to mark other questions as duplicate. A specific question's answer would still need to have the specific details for the application in question (using booleans, file labeling, additional policy modules, and so on).

What I'm asking here to discuss about:

• Is having some generic Q&A regarding SELinux useful at all?
• What kind of questions and answers would be useful?
  • How do I configure SELinux to allow daemons to use files in non-default locations?
  • How to troubleshoot SELinux issues?
  • How to install the manpage httpd_selinux? (applies to other module manpages as well)
  • How to customize SELinux policy for daemon (to allow access to X)?
  • ...
• Is it acceptable (or a good idea) to answer topics which are explained in multiple howtos/tutorials/FAQs elsewhere but haven't been featured in U&L SE (at least in a generic question)?

Answer 1

Please go for it!

Typically such questions asking for an overview of a topic are mostly useful to serve as references in other answers. If you find yourself explaining the same general principles over and over again, it's convenient to have a reference answer with generic explanations. Then, when someone asks a general question “what is X?”, you can close it as a duplicate of “what is X?”. But most often, people have a specific question “how to I do A”, and you want to answer “use X” — and with the reference answer, you can explain how to apply X in a couple of lines, and refer to the generic “what is X” answer for the background.

Such reference answers are not useful when there is already a Wikipedia article about X. They're useful for more detailed technical topics where you need to go beyond what an encyclopedia has to offer. For example, “what is SELinux” would not be a useful question for this site. But Configure SELinux to allow daemons to use files in non-default locations is: it's a common problem, and it can both serve as a duplicate of similar question, and as a link to use in answers of the form “your permission problem is caused by SELinux, as explained in [link] you need to allow the foobar daemon to access /somewhere, run the following command: …”.

I've written quite a few questions of this type, so I'll show a few examples of mine to serve as examples of what a canonical Q&A can be.

• What is a bind mount? — because I found myself explaining what a bind mount is over and over again, and there's no Wikipedia article. (Arguably I should write one, but that would require finding references. And a Wikipedia article would explain the concept, but not how to make it work, which my answer also covers.)
• Why does my shell script choke on whitespace or other special characters? — because it's an extremely common question in one form or another. Sometimes that question is good enough as a duplicate, sometimes there are other problems in the script in the question and the generic question is useful to be able to just write “you need double quotes around variable substitutions” without having to explain what that means and why it's necessary.
• How do keyboard input and text output work? — useful as background for explanations when people ask about a concrete problem.
• How do I run 32-bit programs on a 64-bit Debian/Ubuntu? — I actually wrote that one because I'd needed to do that specific thing, but over the years I've cited it many times when people wanted to run a distribution on top of another.