getsebool -a | grep ssh on my CentOS 7 shows
fenced_can_ssh --> off
selinuxuser_use_ssh_chroot --> off
ssh_chroot_rw_homedirs --> off
ssh_keysign --> off
ssh_sysadm_login --> off
so based on your question the command
setsebool -P fenced_can_ssh on
should fix it.
But you could also go the "hard" way and install the
policycoreutils-python package with:
yum -y install setroubleshoot-server policycoreutils-python
and then temporarily set SELinux mode to
After that try whatever did not work previously. It should work now.
Now take a look at the following file
/var/log/audit/audit.log. It usually shows problems SELinux found.
grep -i "denied" /var/log/audit/audit.log
If you get no denied messages in the log it is possible that SELinux thinks the event would produce to much log so it did not log it. You can enable logging of all events in this case with
But make sure you turn it back to normal with
semodule -B at the end of troubleshooting.
If you found problems you can now use the
audit2allow tool to create a policy module for your needs.
audit2allow has many options, so you should first read ALLOWING ACCESS: AUDIT2ALLOW to get used with
Don't forget to turn on SELinux againg and (if changed) enable reduced logging!