yea selinux is good. plus its easy.
# this will show you the selinux permissions.
ls -lZ /path/to/files
# ... just an example ...
drwx------ user group user_u
bject_r:user_home_t bin
-rw-rw-r-- user group user_u
bject_r:user_home_t some.tar
Then you can find the logs about why something is failing in /var/log/audit/audit.log. So cause the failure and do, this will show you why its failing. Read them they are pretty self explanatory.
sudo tail /var/log/audit/audit.log
#... just an example ... Here the problem was the context was unconfined_t, i needed to relabel the file.
type=USER_CMD msg=audit(13391111118.101:30000): user pid=795 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='cwd="/path/to/file" cmd=7888999463336562121E20266671711 (terminal=pts/0 res=failed)'
# Then run this. It may tell you to relabel your files. something like restorecon /path/to/file, in which case just do that. but if it shows a module type output, see John VV's links for more info,
# you will need to make a new module to fix it.
sudo tail /var/log/audit/audit.log | audit2allow
###
### My guess is you need to do restorecon on your newyorkdog.png file.
###
# then to fix it you can do.
sudo tail /var/log/audit/audit.log | audit2allow -M test
sudo semodule -i test.pp
# this should solve your problem. If you find you need to add stuff to test.pp, then you can change the audit2allow command like this.
sudo tail /var/log/audit/audit.log | audit2allow -o test
sudo semodule -i test.pp
this will add "more" to the test.pp module. So you can try it and if you get another failure for a different file or something.
