Troubleshooting: Security Issues

Updated

October 30, 2026

Troubleshooting: Security Issues

When system hardening mechanisms are enforced, legitimate software can break due to strict confinement rules. Learning to distinguish security blocks from software bugs is vital.

1. SELinux Denials (avc: denied)

Symptom: Nginx fails to start or returns HTTP 403 Forbidden, even though file permissions are set to 755 and owned by www-data.

Diagnosis: Inspect kernel audit logs:

# ausearch -m avc -ts recent
type=AVC msg=audit(1730000000.123:456): avc:  denied  { read } for  pid=1420 comm="nginx"
 name="index.html" dev="vda1" ino=134522
 scontext=system_u:system_r:httpd_t:s0
 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0

Analysis: Nginx (httpd_t) attempted to read a file labeled with user_home_t. SELinux blocked the read because web servers are forbidden from accessing user home directories.

Remedy: Relabel the file with the appropriate context:

# restorecon -Rv /var/www/html/
# Or set type explicitly:
# chcon -t httpd_sys_content_t /var/www/html/index.html

2. AppArmor Permission Denied

Symptom: OpenSSH logs fatal: Access denied by security policy.

Diagnosis: Inspect dmesg:

[  140.210400] audit: type=1400 audit(1730000000.789:12): apparmor="DENIED"
 operation="open" profile="/usr/sbin/sshd" name="/etc/ssh/custom_key"
 pid=2310 comm="sshd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

Remedy: Edit /etc/apparmor.d/usr.sbin.sshd to grant read access to /etc/ssh/custom_key, then reload:

# apparmor_parser -r /etc/apparmor.d/usr.sbin.sshd

3. Buffer Overflow Caught by _FORTIFY_SOURCE

Symptom: An application crashes instantly with:

*** buffer overflow detected ***: terminated
Aborted (core dumped)

Analysis: This is not a crash; it is a successful defense! The application attempted to write more bytes into a buffer than its allocated length. _FORTIFY_SOURCE intercepted the write and called abort() before memory corruption could occur.

Remedy: Run the binary inside gdb with core dumps enabled to pinpoint the offending C source code line:

$ gdb ./myprog core
(gdb) bt
#0  __GI_raise ()
#1  __GI_abort ()
#2  __libc_message ()
#3  __fortify_fail ()
#4  __strcpy_chk () at strcpy_chk.c:30
#5  0x0000000000401140 in main () at main.c:15

Inspect line 15 of main.c and replace unsafe strcpy() with bounded strncpy() or snprintf().