Date:      2008-07-09 09:53
Subject:   setroubleshoot for servers
ItemID:    81

In Fedora 6 and Red Hat Enterprise Linux 5 we introduced setroubleshoot.&nbsp;&nbsp; This is a tool which listens for AVC audit messages and then runs them through a database of plugins looking for a match, and then trying to explain what SELinux has prevented and how to fix the problem or to react to a potential break in.&nbsp; It has been fairly successful in explaining what SELinux is doing. Most people that have used setroubleshoot see a bubble window appear in the top tool bar and the "old West Sheriff Star" appear.&nbsp; If you click on the Star, the message appears.&nbsp;&nbsp; 

This is great for the Desktop, but what about people using this on servers?

Setroubleshoot can be run without X windows and without the GUI.&nbsp; setroubleshoot is broken into three different RPMS.

On Fedora 9:

# rpm -qa setroubleshoot\*
setroubleshoot-server-2.0.8-2.fc9.noarch
setroubleshoot-2.0.8-2.fc9.noarch
setroubleshoot-plugins-2.0.4-5.fc9.noarch

On a server only machine you can install just the server and the plugins.&nbsp; You only need setroubleshoot if you are using the graphical interfaces. With the server component installed you will see messages like the following&nbsp; appear in /var/log/messages.

Jul&nbsp; 1 22:03:01 localhost setroubleshoot: SELinux is preventing semodule (staff_t) "read" to ./BackupPC.pp (semanage_store_t). For complete SELinux messages. run sealert -l bca0cd18-5a5b-4cc5-9b08-5f5778439b2c

You can then use sealert to look at any AVC messages you get.&nbsp; sealert also has a neat feature, that you can execute 'sealert -l \*' to look at all the alert messages that you received.
While these messages do not instantly appear on you desktop, you can still use setroubleshoot on a server.

If you want to receive email whenever SELinux reports a problem, you can configure setroubleshoot-server to send email messages.&nbsp; Edit /var/lib/setroubleshoot/email_alert_recipients, add a line containing your email address, if you only want email the first time an alert fires and not subsequently add "filter_type=after_first" after the email address.

Partially borrowed from an Email message from John Dennis.