Re: SELinux nightmare!

Le 30/06/2026 à 16:09, Thomas Cameron via users a écrit :
>
> On 6/30/26 8:24 AM, François Patte wrote:
>> Bonjour,
>>
>> I try to have a fail2ban jail for emby-server...
>>
>> Fail2ban complains that it cannot find a log file for emby but this 
>> file exists and setting setenforce 0 shows that fail2ban can find it.
>>
>> ls -Z /var/lib/emby/logs/embyserver.txt gives:
>>
>> system_u:object_r:var_lib_t:s0 /var/lib/emby/logs/embyserver.txt
>>
>> What can I do to give fail2ban permissons on this file?
>>
>> Thank you.
>>
>> -- 
>> François Patte
>> tél : +33 (0)6 7892 5822
>> https://www.pingala.homelinux.org/~fp
>>
>>
>
Thank you very much for this answer.


> You can tell SELinux to add the var_log_t context (label) to your logs 
> using this command:
>
> semanage fcontext -a -t var_log_t "/var/lib/emby/logs(/.*)?"
>
> Then, once SELinux knows about it, you can run this command to apply 
> those labels to the files and directories:
>
> restorecon -R -v /var/lib/emby/logs
>
> That should enable emby-server to be able to modify those log files.
>
I think that emby-server was able to modify this file for it is its 
creator, the problem was fail2ban which could not read it and so, I 
could not define a jail for emby with fail2ban.

Selinux is really difficult for people who are not aware of everything 
in computer science... I was struggling with this case because fail2ban 
complained that it could not *find* the log file and this log file 
existed with normal unix permissions and so everybody could read it.

It took me a while to try to find out why...  and after some times  I 
thought "and if this was a selinux problem?" setenforce 0 gave the 
reason, but not the solution....

> I did a presentation at Red Hat Summit on SELinux. It's gotten about 
> 157,000 views, and the comments are generally positive. It's older, 
> but the content is still accurate: 
> https://www.youtube.com/watch?v=_WOKRaM-HI4
>
> If you have any questions, let me know. Happy to help out.

Thanks again

-- 
François Patte
tél : +33 (0)6 7892 5822
https://www.pingala.homelinux.org/~fp

-- 
_______________________________________________
users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new