SELinux Blocking Grafana Connection: How I Fixed It

Estimated reading time: 3 minutes

If you’re using Grafana and finding it unable to connect over HTTP, it might be SELinux causing the problem. I recently faced this exact situation with SELinux Blocking Grafana Connections and went through a complete top-down troubleshooting process. I checked every config—network, Prometheus, LDAP, and Grafana itself—before realizing SELinux was behind it. This guide is for anyone facing similar issues and will save you from chasing the wrong leads!

Verify if SELinux is the Culprit

First, you’ll need to confirm if SELinux is actually blocking Grafana’s connection attempts. I started by checking SELinux’s status to ensure it was in enforcing mode, which logs all its actions:

sestatus 

getenforce

If SELinux is set to enforcing, it actively blocks unauthorized actions and logs them. I knew that if Grafana’s connection failed, the log would have some details, so I attempted a connection to trigger any SELinux logging.

Generate and Check Audit Logs for SELinux Denials

After attempting the connection, I checked SELinux’s audit logs to find any relevant denials:

ausearch -m avc -c grafana-server

You can also search directly in the audit log using grep:

grep -i denied /var/log/audit/audit.log | grep grafana-server 

In the logs, look for entries showing denied actions related to the Grafana server. If SELinux is blocking the connection, it should mention the attempted access on your specified port. Here’s where I found confirmation—Grafana was indeed being blocked when trying to reach Prometheus over HTTPS.

Troubleshooting SELinux Denials

Once you know SELinux is blocking Grafana, you have options to address it. A good place to start is by adjusting SELinux booleans to allow Grafana the network access it needs. I used this command to list SELinux booleans specific to Grafana:

getsebool -a | grep grafana 

Another essential step was to ensure the httpd_can_network_connect boolean was enabled, allowing HTTP services like Grafana to connect over the network:

sudo setsebool -P httpd_can_network_connect on 

Additional SELinux Troubleshooting Tips

If the above doesn’t solve your issue, creating a custom SELinux policy for Grafana may be necessary. You can generate an SELinux policy using audit2allow, which converts your log findings into policy allowances:

1. Run audit2allow with the latest denial entries:

grep grafana-server /var/log/audit/audit.log | audit2allow -M grafana_policy 

2. Apply the policy:

semodule -i grafana_policy.pp 

This process enables SELinux to permit the exact actions Grafana needs, based on the recent logs.

More Troubleshooting Tips for Grafana and SELinux

1. Check Port Protocols and Security Groups: Ensure that the ports are open and accepting HTTP/HTTPS connections. In my case, I double-checked the security group settings and firewall rules.
2. Verify Service Dependencies: If Grafana relies on other services like LDAP or Prometheus, make sure those services are configured to allow non-standard HTTP/HTTPS ports as well.
3. Review Prometheus and LDAP Configurations: Don’t overlook configuration files in Grafana and other linked services, as their security policies may also prevent the connection.
4. Restart Grafana After Changes: After making any SELinux or configuration changes, always restart the Grafana service:

sudo systemctl restart grafana-server 

Further reading

• SELinux Documentation on Red Hat
• SELinux Boolean Configuration on Fedora Project
• List Open Ports On Linux and Stop Services
• Troubleshoot `tr` command “Illegal Byte Sequence” Error in Linux
• How to generate a random string in Linux
• How to Change Default Run Target on Linux
• [Solved] Error sudo: add-apt-repository: command not found