I'm trying to set up a system based on AlmaLinux 9.2, to use SELinux and NetworkManager, with a read-only rootfs. For various reasons, I want to keep my 'keyfiles' on a separate partition. I have added a small config file /etc/NetworkManager/conf.d/20-system-connections.conf, which contains:


As long as SELinux is 'Permissive' this works very well.

But, as soon as I have SELinux 'Enforcing', NetworkManager refuses to read the config file. Looking at journalctl -u NetworkManager | grep 'Read config' I see that it doesn't read the config files:

SELinux Enforcing:

Feb 05 16:34:23 almatest NetworkManager[39809]: <info>  [1707147263.6083] Read config: /etc/NetworkManager/NetworkManager.conf (run: 15-carrier-timeout.conf)

(Note - no 20-system-connections.conf)

SELinux Permissive:

Feb 05 16:40:59 almatest NetworkManager[43518]: <info>  [1707147659.1304] Read config: /etc/NetworkManager/NetworkManager.conf (run: 15-carrier-timeout.conf) (etc: 20-system-connections.conf)

(Note - there it is!)

I have set the SELinux context with semanage fcontext -a -e /etc/NetworkManager/NetworkManager.conf /etc/NetworkManager/conf.d/20-system-connections.conf - and it shows up as a 'Local fcontext Equivalence' with semanage fcontext --list, and

# ls -lZ /etc/NetworkManager/conf.d/20-system-connections.conf /etc/NetworkManager/NetworkManager.conf
-rw-r--r--. 1 root root system_u:object_r:NetworkManager_etc_rw_t:s0 2291 Feb  5 16:34 /etc/NetworkManager/NetworkManager.conf
-rw-r--r--. 1 root root system_u:object_r:NetworkManager_etc_rw_t:s0  275 Feb  5 15:06 /etc/NetworkManager/conf.d/20-system-connections.conf

This is all based on AlmaLinux 9.2, using NetworkManager-1.42.2-1.el9.x86_64.

What am I doing wrong?

I have tried adding


in the /etc/NetworkManager/NetworkManager.conf - but it doesn't add anything interesting.

  • What do the SELinux logs say when the config is being loaded? What is the SELinux context for the directory /etc/NetworkManager/NetworkManager.conf? Feb 6 at 20:38
  • > What do the SELinux logs say when the config is being loaded? That's part of my problem. Where does SELinux put it logs? It seems to be partly in /var/log/audit/audit.log and partly in journalctl --facility=authpriv. Is there anywhere else to look?
    – Popup
    Feb 7 at 7:16
  • 1
    The contents of /var/log/audit/audit.log while you have SELinux problems should suffice. There should be entries for the denial specifically pointing to why it was denied. Feb 7 at 20:33
  • The problem I had was that some aspects of the SELinux was set to dontaudit -- I discovered that it's possible to disable this with semodule --build --disable_dontaudit. (semodule -DB) Then I got much more logging to /var/log/audit/audit.log - some of it relevant to my issue.
    – Popup
    Feb 8 at 9:59

1 Answer 1


Partial answer:

It's possible that some SELinux policies are set to dontaudit - which means that they will not get logged in /var/log/audit/audit-log. It's possible to disable this with semodule --build --disable_dontaudit (semodule -DB for short).

That provides much more information in the audit report, some of which was relevant to my issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .