Red Hat Enterprise Linux 5 Administration Unleashed

468CHAPTER 23Protecting Against Intruders with Security-Enhanced LinuxAlternatively, use the setsebool command to set the boolean to the desired value:setsebool -P To view the status of a boolean via the command line, execute the getsebool command:getsebool use_nfs_home_dirsTo completely disable SELinux for a specific service, place a checkmark next to the correspondingboolean under the SELinux Service Protection category or the category for thespecific service such as Kerberos. While this will allow the service to work with SELinuxenabled, the service will no longer be protected by SELinux and is not recommended. If aservice can not be started because of SELinux, look at the boolean values that can bechanged for it. The SELinux Troubleshooting Tool summarizes why the action wasblocked by the SELinux policy. It also offers possible solutions for the problem. Refer tothe “Utilizing the SELinux Troubleshooting Tool” for details.Utilizing the SELinux Troubleshooting ToolLog messages for SELinux are written to /var/log/messages unless the Linux AuditingSystem is used (refer to Chapter 25, “Linux Auditing System,” for details). If audit isenabled, messages are written to the /var/log/audit/audit.log file. The log messages arelabeled with the AVC keyword so they can be easily filtered from other messages.Starting with Red Hat Enterprise Linux 5, instead of having to read through log files todetermine why SELinux is preventing an action, the SELinux Troubleshooting Tool can beused to analyze the SELinux AVC messages. It consists of a graphical interface for displayingthese messages and possible solutions, a desktop notification icon that appears whenthere are messages to view, and a daemon that checks for new SELinux AVC messages sothat you are alerted by the notification icon of them as soon as they occur. The tool isprovided by the setroubleshoot RPM package, which is installed by default.The daemon, setroubleshootd, is started by default with the /etc/rc.d/init.d/setroubleshootinitialization script. The /var/log/setroubleshootd.log file contains any logmessages concerning the tool. This log file is automatically rotated on a weekly basis, andold log files for the previous two weeks are kept.If you are working on the local desktop for the system(sitting at the computer), a star iconappears in the notification area of the top desktop panel when SELinux AVC messages areavailable for viewing. Click on it to view the SELinux Troubleshooting Tool as shown inFigure 23.3.TIPIf working on the local desktop, you can also open the SELinux Troubleshooting Tool byselecting Administration, SELinux Troubleshooting from the System menu on the toppanel.