SELinux Configuration

Linux

Audience

Public

Product

FlashBlade

FlashArray

Technology Integrations

Linux

Source Type

Documentation

Understanding SELinux with FC Storage

SELinux does not directly govern FC transport (no TCP/IP layer involved), but it does control access to block devices and multipath device nodes.

Check SELinux status:

getenforce
sestatus

SELinux Policies for Multipath Devices

Allow multipath and LVM access:

# Multipath device access should work out-of-the-box with default policies
# Check for denials
sudo ausearch -m avc -ts recent | grep -E "multipath|dm-"

# If denials found, generate policy
sudo ausearch -m avc -ts recent | audit2allow -M fc_multipath
sudo semodule -i fc_multipath.pp

Allow raw block device access if needed:

sudo setsebool -P virt_use_rawio 1

SELinux Best Practices

Never disable SELinux in production: use permissive mode for troubleshooting only.
Monitor audit logs regularly:
```
sudo ausearch -m avc -ts today 
```
Document custom policies: keep .te files in version control with a note explaining the use case.