🛡️ SELinux Alert: NGINX Cert Access Denied

🚨 SELinux: NGINX Fails to Start After Update (Cert Access Denied)

Symptom:
After running dnf update, nginx fails to restart.
Even though nginx -t passes, you get:

Job for nginx.service failed because the control process exited with error code.

✅ Root Cause

SELinux has blocked nginx from accessing one of your certificate files (star_fullchain.crt), likely due to a label mismatch after updates or file changes.

🔍 Confirm with:

journalctl -xe | grep nginx

You’ll see something like:

SELinux is preventing nginx from reading /etc/pki/nginx/star_fullchain.crt

🛠️ Fix It (TL;DR)

sudo restorecon -Rv /etc/pki/nginx
sudo systemctl restart nginx

This resets SELinux labels to what nginx expects.

🧠 Optional: Full Analysis with `sealert`

If setroubleshoot is installed:

sealert -a /var/log/audit/audit.log

This will explain the exact denial and recommend a fix (e.g., restorecon, semanage, etc.)

If not installed:

sudo dnf install setroubleshoot-server
sudo systemctl enable --now setroubleshootd

🧪 Show Labels for Debugging

ls -Z /etc/pki/nginx

Correct label for certs is typically:

cert_t

📌 Do NOT Disable SELinux

The proper fix is to correct the label, not to weaken security.

💬 Summary

Step	Command
Check logs	`journalctl -xe \| grep nginx`
Fix labels	`restorecon -Rv /etc/pki/nginx`
Full audit help	`sealert -a /var/log/audit/audit.log`
Restart nginx	`systemctl restart nginx`