How to Install and Use setroubleshoot to Fix SELinux Denials

Updated: 28 September 2026 · Applies to: setroubleshoot 3.3.35 on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10

When SELinux blocks something, the raw audit messages ("avc: denied ...") are hard to read. setroubleshoot turns each denial into a plain-language report: what was blocked, why, and which command would allow it. It is the quickest way to fix an SELinux problem properly instead of switching SELinux off.

1. Install it

dnf install setroubleshoot-server

There is no service to enable: the audit daemon passes denials to it automatically through a plugin (/etc/audit/plugins.d/sedispatch.conf). Restart auditd once so the plugin is loaded: service auditd restart (auditd must be restarted this way, not with systemctl).

2. Read the reports

After the next denial, the journal contains a short line such as "SELinux is preventing /usr/sbin/httpd from write access on the directory uploads. For complete SELinux messages run: sealert -l 1a2b...".

journalctl -t setroubleshoot --since today     # the short messages
sealert -l 1a2b3c4d-...                        # the full report for one alert
sealert -a /var/log/audit/audit.log            # analyse all denials in the log

Each full report lists possible causes, from most to least likely, with the command for each, for example a semanage fcontext and restorecon to relabel files, a setsebool to switch on a boolean, or a local policy module as a last resort.

3. Apply the right fix

• Prefer relabelling or a boolean over a custom policy module. They are designed for the common cases, such as web content in a non-standard folder (httpd_sys_rw_content_t) or a web app that connects to the network (httpd_can_network_connect).
• Only create a local module (ausearch -c 'name' --raw | audit2allow -M mymodule, then semodule -i mymodule.pp) when the report recommends it and you understand what it allows.
• Avoid setenforce 0 except for a short test: it switches off protection for the whole system.

On servers without setroubleshoot

ausearch -m avc -ts recent
ausearch -m avc -ts recent | audit2why

audit2why (from policycoreutils-python-utils) explains each denial briefly.

Official documentation: Troubleshooting problems related to SELinux (Red Hat).