AlmaLinux 10: the shortest SELinux troubleshooting path

Test scope

In an AlmaLinux 10.2 VM (kernel 6.12.0-211.64.1.el10_2): getenforce, sestatus, setenforce, ls -Z, chcon, restorecon -Rv, ausearch -m avc, and what happens when semanage is missing. Log: plans/content-expansion/evidence/logs/alma-selinux-basics.log.

This image has no semanage (command not found) — a common cloud-image difference. The install command below is documentation (this VM has no internet, so it was not executed).

Check the state first

getenforce
sestatus | head -6

Enforcing
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing

Current mode is runtime, Mode from config file is what applies after reboot — a mismatch means setenforce was used.

Temporary switching

setenforce 0; getenforce
setenforce 1; getenforce

Permissive
Enforcing

setenforce does not touch the config file, so a reboot returns to the configured mode; it also cannot select Disabled.

Labels: inspect before changing

mkdir -p /srv/lab && echo hi > /srv/lab/f.txt
ls -Z /srv/lab/f.txt
chcon -t user_home_t /srv/lab/f.txt
ls -Z /srv/lab/f.txt
restorecon -Rv /srv/lab
ls -Z /srv/lab/f.txt

unconfined_u:object_r:var_t:s0 /srv/lab/f.txt
unconfined_u:object_r:user_home_t:s0 /srv/lab/f.txt
Relabeled /srv/lab/f.txt from unconfined_u:object_r:user_home_t:s0 to unconfined_u:object_r:var_t:s0
unconfined_u:object_r:var_t:s0 /srv/lab/f.txt

chcon is temporary: one restorecon brings back the policy default. Persistence requires the policy database (semanage).

AlmaLinux 10.2: chcon change reverted to var_t by restorecon

When semanage is missing

semanage fcontext -l

-bash: semanage: command not found

semanage lives in policycoreutils-python-utils. After installing:

sudo dnf install -y policycoreutils-python-utils
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/lab(/.*)?"
sudo restorecon -Rv /srv/lab

In offline or container environments where packages cannot be installed, fall back to chcon for a temporary check and accept that it is lost on reboot or restorecon.

Finding AVCs

ausearch -m avc -ts recent

<no matches>

Denials include denied, scontext, tcontext and tclass; audit2why translates them into plain language.

Common traps

chcon without semanage: lost after reboot or restorecon;
Expecting setenforce 0 to persist: the config file wins on reboot;
Assuming semanage exists: check command -v semanage before planning around it.

Practice: verify labels without semanage

sudo mkdir -p /srv/lab && echo hi | sudo tee /srv/lab/f.txt
ls -Z /srv/lab/f.txt
sudo chcon -t httpd_sys_content_t /srv/lab/f.txt
ls -Z /srv/lab/f.txt
sudo restorecon -Rv /srv/lab
ls -Z /srv/lab/f.txt
command -v semanage || echo "install policycoreutils-python-utils"

Checks:

The initial type is var_t
After chcon it becomes httpd_sys_content_t
After restorecon it returns to var_t
You know whether this image has semanage

FAQ

常见问题

Why does the Alma cloud image lack semanage?

semanage ships in policycoreutils-python-utils, which minimal and cloud images may omit; install it with dnf, or use chcon when offline.

How do chcon and restorecon interact?

restorecon restores labels from the policy database (including semanage rules) and therefore overwrites chcon changes; persistent changes must go through semanage.