Chapter 4. Configuring SELinux for applications and services with non-standard configurations

Procedure

1. Start the httpd service and check the status:

   # systemctl start httpd
   # systemctl status httpd
   …
   httpd[14523]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:3131
   …
   systemd[1]: Failed to start The Apache HTTP Server.
   …

2. The SELinux policy assumes that httpd runs on port 80:

   # semanage port -l | grep http
   http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
   http_cache_port_t              udp      3130
   http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
   pegasus_http_port_t            tcp      5988
   pegasus_https_port_t           tcp      5989

3. Change the SELinux type of port 3131 to match port 80:

   # semanage port -a -t http_port_t -p tcp 3131

4. Start httpd again:

   # systemctl start httpd

5. However, the content remains inaccessible:

   # wget localhost:3131/index.html
   …
   HTTP request sent, awaiting response... 403 Forbidden
   …

   Find the reason with the sealert tool:

   # sealert -l "*"
   …
   SELinux is preventing httpd from getattr access on the file /var/test_www/html/index.html.
   …

6. Compare SELinux types for the standard and the new path using the matchpathcon tool:

   # matchpathcon /var/www/html /var/test_www/html
   /var/www/html       system_u:object_r:httpd_sys_content_t:s0
   /var/test_www/html  system_u:object_r:var_t:s0

7. Change the SELinux type of the new /var/test_www/html/ content directory to the type of the default /var/www/html directory:

   # semanage fcontext -a -e /var/www /var/test_www

8. Relabel the /var directory recursively:

   # restorecon -Rv /var/
   …
   Relabeled /var/test_www/html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
   Relabeled /var/test_www/html/index.html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

Verification

1. Check that the httpd service is running:

   # systemctl status httpd
   …
   Active: active (running)
   …
   systemd[1]: Started The Apache HTTP Server.
   httpd[14888]: Server configured, listening on: port 3131
   ...

2. Verify that the content provided by the Apache HTTP server is accessible:

   # wget localhost:3131/index.html
   …
   HTTP request sent, awaiting response... 200 OK
   Length: 0 [text/html]
   Saving to: 'index.html'
   …

Procedure

1. Identify SELinux booleans relevant for NFS, CIFS, and Apache:

   # semanage boolean -l | grep 'nfs\|cifs' | grep httpd
   httpd_use_cifs                 (off  ,  off)  Allow httpd to access cifs file systems
   httpd_use_nfs                  (off  ,  off)  Allow httpd to access nfs file systems

2. List the current state of the booleans:

   $ getsebool -a | grep 'nfs\|cifs' | grep httpd
   httpd_use_cifs --> off
   httpd_use_nfs --> off

3. Enable the identified booleans:

   # setsebool httpd_use_nfs on
   # setsebool httpd_use_cifs on

   Note

   Use setsebool with the -P option to make the changes persistent across restarts. A setsebool -P command requires a rebuild of the entire policy, and it might take some time depending on your configuration.

Verification

1. Check that the booleans are on:

   $ getsebool -a | grep 'nfs\|cifs' | grep httpd
   httpd_use_cifs --> on
   httpd_use_nfs --> on

Procedure

1. List all SELinux-related topics and limit the results to a component you want to configure. For example:

   # man -k selinux | grep samba
   samba_net_selinux (8) - Security Enhanced Linux Policy for the samba_net processes
   samba_selinux (8)    - Security Enhanced Linux Policy for the smbd processes
   …

   In the man page that corresponds to your scenario, find the related SELinux booleans, port types, and file types.

   Note that the man -k selinux or apropos selinux commands are available only after you install the selinux-policy-doc package.

2. Optional: You can display the default mapping of processes on default locations by using the semanage fcontext -l command, for example:

   # semanage fcontext -l | grep samba
   …
   /var/cache/samba(/.*)?                             all files          system_u:object_r:samba_var_t:s0
   …
   /var/spool/samba(/.*)?                             all files          system_u:object_r:samba_spool_t:s0
   …

3. Use the sesearch command to display rules in the default SELinux policy. You can find the type and boolean to use by listing the corresponding rule, for example:

   $ sesearch -A | grep samba | grep httpd
   …
   allow httpd_t cifs_t:dir { getattr open search }; [ use_samba_home_dirs && httpd_enable_homedirs ]:True
   …

4. An SELinux boolean might be the most straightforward solution for your configuration problem. You can display all available booleans and their values by using the getsebool -a command, for example:

   $ getsebool -a | grep homedirs
   git_cgi_enable_homedirs --> off
   git_system_enable_homedirs --> off
   httpd_enable_homedirs --> off
   mock_enable_homedirs --> off
   mpd_enable_homedirs --> off
   openvpn_enable_homedirs --> on
   ssh_chroot_rw_homedirs --> off

5. You can verify that the selected boolean does exactly what you want by using the sesearch command, for example:

   $ sesearch -A | grep httpd_enable_homedirs
   …
   allow httpd_suexec_t autofs_t:dir { getattr open search }; [ use_nfs_home_dirs && httpd_enable_homedirs ]:True
   allow httpd_suexec_t autofs_t:dir { getattr open search }; [ use_samba_home_dirs && httpd_enable_homedirs ]:True
   …

6. If no boolean matches your scenario, find an SELinux type that suits your case. You can find a type for your files by querying a corresponding rule from the default policy by using sesearch, for example:

   $ sesearch -A -s httpd_t -c file -p read
   …
   allow httpd_t httpd_t:file { append getattr ioctl lock open read write };
   allow httpd_t httpd_tmp_t:file { append create getattr ioctl link lock map open read rename setattr unlink write };
   …

7. If none of the previous solutions cover your scenario, you can add a custom rule to the SELinux policy. See the Creating a local SELinux policy module section for more information.

Procedure

1. Open the user_selinux(8) man page in your terminal:

   $ man user_selinux

   In the MANAGED FILES section, find an attribute or a type that corresponds with your scenario. For example, the user_home_type attribute.

2. Optional: To list all types assigned to an attribute, use the seinfo command with the -x and -a options, for example:

   $ seinfo -x -a user_home_type
   
   Type Attributes: 1
      attribute user_home_type;
   …
   	chrome_sandbox_home_t
   	config_home_t
   	cvs_home_t
   	data_home_t
   	dbus_home_t
   	fetchmail_home_t
   	gconf_home_t
   	git_user_content_t
   …

3. After you identify a candidate for the corresponding type, the data_home_t type in this example, check its SELinux mapping:

   $ semanage fcontext -l | grep data_home_t
   …
   /root/\.local/share(/.*)?                          all files          system_u:object_r:data_home_t:s0
   …

4. Map the corresponding type to a directory that you want to make accessible for user_u, for example, /shared-data:

   $ semanage fcontext -a -t data_home_t '/shared-data(/.*)?'

Verification

1. Check the mapping of the directory you configured:

   # semanage fcontext -l | grep "shared-data"
   /shared-data(/.*)?                             	all files      	system_u:object_r:data_home_t:s0

2. Log in as a Linux user mapped to the user_u SELinux user, and verify you can access the directory.