Chapter 4. Configuring SELinux for applications and services with non-standard configurations

Procedure

1. Start the httpd service and check the status:

   # systemctl start httpd
   # systemctl status httpd
   …
   httpd[14523]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:3131
   …
   systemd[1]: Failed to start The Apache HTTP Server.
   …

   Copy to Clipboard Toggle word wrap

2. The SELinux policy assumes that httpd runs on port 80:

   # semanage port -l | grep http
   http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
   http_cache_port_t              udp      3130
   http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
   pegasus_http_port_t            tcp      5988
   pegasus_https_port_t           tcp      5989

   Copy to Clipboard Toggle word wrap

3. Change the SELinux type of port 3131 to match port 80:

   # semanage port -a -t http_port_t -p tcp 3131

   Copy to Clipboard Toggle word wrap

4. Start httpd again:

   # systemctl start httpd

   Copy to Clipboard Toggle word wrap

5. However, the content remains inaccessible:

   # wget localhost:3131/index.html
   …
   HTTP request sent, awaiting response... 403 Forbidden
   …

   Copy to Clipboard Toggle word wrap

   Find the reason with the sealert tool:

   # sealert -l "*"
   ...
   SELinux is preventing httpd from getattr access on the file /var/test_www/html/index.html.
   …

   Copy to Clipboard Toggle word wrap

6. Compare SELinux types for the standard and the new path using the matchpathcon tool:

   # matchpathcon /var/www/html /var/test_www/html
   /var/www/html       system_u:object_r:httpd_sys_content_t:s0
   /var/test_www/html  system_u:object_r:var_t:s0

   Copy to Clipboard Toggle word wrap

7. Change the SELinux type of the new /var/test_www/html/ content directory to the type of the default /var/www/html directory:

   # semanage fcontext -a -e /var/www /var/test_www

   Copy to Clipboard Toggle word wrap

8. Relabel the /var directory recursively:

   # restorecon -Rv /var/
   ...
   Relabeled /var/test_www/html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
   Relabeled /var/test_www/html/index.html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

   Copy to Clipboard Toggle word wrap

Verification

1. Check that the httpd service is running:

   # systemctl status httpd
   …
   Active: active (running)
   …
   systemd[1]: Started The Apache HTTP Server.
   httpd[14888]: Server configured, listening on: port 3131
   …

   Copy to Clipboard Toggle word wrap

2. Verify that the content provided by the Apache HTTP server is accessible:

   # wget localhost:3131/index.html
   …
   HTTP request sent, awaiting response... 200 OK
   Length: 0 [text/html]
   Saving to: ‘index.html’
   …

   Copy to Clipboard Toggle word wrap

Procedure

1. Identify SELinux booleans relevant for NFS, CIFS, and Apache:

   # semanage boolean -l | grep 'nfs\|cifs' | grep httpd
   httpd_use_cifs                 (off  ,  off)  Allow httpd to access cifs file systems
   httpd_use_nfs                  (off  ,  off)  Allow httpd to access nfs file systems

   Copy to Clipboard Toggle word wrap

2. List the current state of the booleans:

   $ getsebool -a | grep 'nfs\|cifs' | grep httpd
   httpd_use_cifs --> off
   httpd_use_nfs --> off

   Copy to Clipboard Toggle word wrap

3. Enable the identified booleans:

   # setsebool httpd_use_nfs on
   # setsebool httpd_use_cifs on

   Copy to Clipboard Toggle word wrap
   Note

   Use setsebool with the -P option to make the changes persistent across restarts. A setsebool -P command requires a rebuild of the entire policy, and it might take some time depending on your configuration.

Verification

1. Check that the booleans are on:

   $ getsebool -a | grep 'nfs\|cifs' | grep httpd
   httpd_use_cifs --> on
   httpd_use_nfs --> on

   Copy to Clipboard Toggle word wrap

Procedure

1. List all SELinux-related topics and limit the results to a component you want to configure. For example:

   # man -k selinux | grep samba
   samba_net_selinux (8) - Security Enhanced Linux Policy for the samba_net processes
   samba_selinux (8)    - Security Enhanced Linux Policy for the smbd processes
   …

   Copy to Clipboard Toggle word wrap

   In the man page that corresponds to your scenario, find the related SELinux booleans, port types, and file types.

   Note that the man -k selinux or apropos selinux commands are available only after you install the selinux-policy-doc package.

2. Optional: You can display the default mapping of processes on default locations by using the semanage fcontext -l command, for example:

   # semanage fcontext -l | grep samba
   …
   /var/cache/samba(/.*)?                             all files          system_u:object_r:samba_var_t:s0
   …
   /var/spool/samba(/.*)?                             all files          system_u:object_r:samba_spool_t:s0
   …

   Copy to Clipboard Toggle word wrap

3. Use the sesearch command to display rules in the default SELinux policy. You can find the type and boolean to use by listing the corresponding rule, for example:

   $ sesearch -A | grep samba | grep httpd
   …
   allow httpd_t cifs_t:dir { getattr open search }; [ use_samba_home_dirs && httpd_enable_homedirs ]:True
   …

   Copy to Clipboard Toggle word wrap

4. An SELinux boolean might be the most straightforward solution for your configuration problem. You can display all available booleans and their values by using the getsebool -a command, for example:

   $ getsebool -a | grep homedirs
   git_cgi_enable_homedirs --> off
   git_system_enable_homedirs --> off
   httpd_enable_homedirs --> off
   mock_enable_homedirs --> off
   mpd_enable_homedirs --> off
   openvpn_enable_homedirs --> on
   ssh_chroot_rw_homedirs --> off

   Copy to Clipboard Toggle word wrap

5. You can verify that the selected boolean does exactly what you want by using the sesearch command, for example:

   $ sesearch -A | grep httpd_enable_homedirs
   …
   allow httpd_suexec_t autofs_t:dir { getattr open search }; [ use_nfs_home_dirs && httpd_enable_homedirs ]:True
   allow httpd_suexec_t autofs_t:dir { getattr open search }; [ use_samba_home_dirs && httpd_enable_homedirs ]:True
   …

   Copy to Clipboard Toggle word wrap

6. If no boolean matches your scenario, find an SELinux type that suits your case. You can find a type for your files by querying a corresponding rule from the default policy by using sesearch, for example:

   $ sesearch -A -s httpd_t -c file -p read
   …
   allow httpd_t httpd_t:file { append getattr ioctl lock open read write };
   allow httpd_t httpd_tmp_t:file { append create getattr ioctl link lock map open read rename setattr unlink write };
   …

   Copy to Clipboard Toggle word wrap
7. If none of the previous solutions cover your scenario, you can add a custom rule to the SELinux policy. See the Creating a local SELinux policy module section for more information.

Procedure

1. Open the user_selinux(8) man page in your terminal:

   $ man user_selinux

   Copy to Clipboard Toggle word wrap

   In the MANAGED FILES section, find an attribute or a type that corresponds with your scenario. For example, the user_home_type attribute.

2. Optional: To list all types assigned to an attribute, use the seinfo command with the -x and -a options, for example:

   $ seinfo -x -a user_home_type
   
   Type Attributes: 1
      attribute user_home_type;
   …
   	chrome_sandbox_home_t
   	config_home_t
   	cvs_home_t
   	data_home_t
   	dbus_home_t
   	fetchmail_home_t
   	gconf_home_t
   	git_user_content_t
   …

   Copy to Clipboard Toggle word wrap

3. After you identify a candidate for the corresponding type, the data_home_t type in this example, check its SELinux mapping:

   $ semanage fcontext -l | grep data_home_t
   …
   /root/\.local/share(/.*)?                          all files          system_u:object_r:data_home_t:s0
   …

   Copy to Clipboard Toggle word wrap

4. Map the corresponding type to a directory that you want to make accessible for user_u, for example, /shared-data:

   $ semanage fcontext -a -t data_home_t '/shared-data(/.*)?'

   Copy to Clipboard Toggle word wrap

Verification

1. Check the mapping of the directory you configured:

   # semanage fcontext -l | grep "shared-data"
   /shared-data(/.*)?                             	all files      	system_u:object_r:data_home_t:s0

   Copy to Clipboard Toggle word wrap
2. Log in as a Linux user mapped to the user_u SELinux user, and verify you can access the directory.