I know I have an issue with SElinux. So I am following a tutorial that will help me understand the nature of the file access problems I am having. That was I can still have SElinux enforce as supposed to just disabling it.
Basically I have set SElinux set to permissive mode, for testing, and done a file action that would fail while it is enforcing. That way I will see what the message in the log looks like. Such a line looks like this:
type=USER_CMD msg=audit(1452912989.069:324790): pid=66581 uid=1001 auid=1001 ses=1352 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/srv/dpca/www" cmd=7461696C202F7661722F6C6F672F61756469742F61756469742E6C6F67 terminal=pts/0 res=success'
Now since I am really new to this I refered to the tutorial and how it talks about getting
audit2why to lay this out for me.
[matt@localhost www]$ sudo grep 1452912989.069:324790 /var/log/audit/audit.log | audit2why
Nothing to do
grep does return the correct text. However
audit2why appears to be returning "Nothing to do".
Is there something fundamental that I am doing wrong? End of the day I am trying to figure out what context to assign to some NGINX directories. I am sure I can just look them up but I wanted also to understand what I am doing as supposed to just running commands I see on the internet.
In case you are curious this is a small snippet of my web root directory context
drwxr-xr-x. nginx nginx unconfined_u:object_r:httpd_sys_content_t:s0 administrator
drwxr-xr-x. nginx nginx unconfined_u:object_r:httpd_sys_content_t:s0 bin
drwxr-xr-x. nginx nginx unconfined_u:object_r:httpd_sys_content_t:s0 cache