The Toolkit
There are three tools you will use to resolve SELinux issues, each appropriate for a different root cause:
1. restorecon — Fix a wrong label
Use this when a file has the wrong label because it was moved from another location or created by a process that didn't set the correct context. restorecon resets the label to the policy's default for that path — it can target a single file, recurse through a directory, or run as a dry run that reports what it would change without changing anything.
2. semanage fcontext — Change the default label for a path
Use this when you have a legitimate non-standard directory that should permanently have a specific label. For example, if your application serves content from /opt/myapp/public/ instead of /var/www/html/, you need to tell SELinux that this path should be labeled httpd_sys_content_t. semanage fcontext registers that mapping persistently (viewable later via its own listing flag), and restorecon then applies it to the existing files. This is the correct, persistent solution for non-standard paths. Without semanage, running restorecon on /opt/myapp/public/ would reset labels to the default for /opt/ (which is usr_t), not httpd_sys_content_t.
3. audit2allow — Generate a custom policy module
Use this as a last resort when the label is correct but the policy genuinely doesn't have a rule for what you need. audit2allow reads AVC denials from the audit log and generates SELinux policy rules that would allow those operations — it can print the human-readable rule it would generate, or package it into a compiled policy module that gets installed with semodule.
Critical warning about audit2allow: This tool does exactly what you tell it to — it generates rules to allow whatever was denied. It has no judgment. If your system is being actively exploited and the attacker's malicious process is generating AVC denials, audit2allow will happily generate rules to allow the attack. Always read the generated .te file (the human-readable policy source) before installing the .pp (compiled policy package). Ask yourself: "Does it make sense for this process to need this permission?" If the answer is "I'm not sure," investigate further before installing.