Stop Disabling SELinux: A Real-World Guide
> Jan 31 10:48:54 server audit[16067]: AVC avc: denied { name_connect } for pid=16067 comm="nginx" dest=8000 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:transproxy_port_t:s0 tclass=tcp_socket permissive=0<p>I think one reason security programs are sometime ineffective and end up being disabled is that they give problems to developers and sysadmin but no solutions.<p>I wish that rather than messages like "doesn't work - too bad", these programs would output a solution as well, such as "consider setting `httpd_can_network_connect` to `true` to allow it".<p>In some cases it might be tricky to propose a solution, in which case even a link to the doc would be useful like "check <a href="http://example.com/doc#456" rel="nofollow">http://example.com/doc#456</a> for more information". That would go a long way towards making security software issues less of a pain for those who aren't expert in the topic.