7.2. Using the command-line assistant to troubleshoot SELinux issues

Procedure

1. On your terminal, enter the following command to list the httpd package version that you have installed in your system:

   $ sudo rpm -qa httpd
   httpd-2.4.62-2.fc40.x86_64

2. Query all httpd packages:

   $ sudo rpm -qa httpd

3. Identify the ports on which the web server accepts incoming requests:

   $ cat /etc/httpd/conf/httpd.conf | grep Listen
   # Listen: Allows you to bind Apache to specific IP addresses and/or
   # Change this to Listen on a specific IP address, but note that if
   #Listen 12.34.56.78:80
   Listen 80

4. Restart the httpd service:

   $ systemctl restart httpd
   
   Job for httpd. Service failed because the control process exited with error code.
   See "systemctl status httpd.service" and "journalctl -xeu httpd.service" for details.

   1. Run the journalctl command for more details on the failed service:

      $ sudo journalctl -xeu httpd.service

5. Use the command-line assistant to troubleshoot the issue and ask why the service is failing:

   $ sudo c "why did httpd fail to start"

   1. Ask the command-line assistant about the selinux httpd port:

      $ c "selinux httpd port"

      The assistant advises using the sestatus command to check the current SELinux status and the content of the httpd services with the following command:

      $ sudo sestatus
      
      SELinux status:                 enabled
      SELinuxfs mount:                /sys/fs/selinux
      SELinux root directory:         /etc/selinux
      Loaded policy name:             targeted
      Current mode:                   enforcing
      Mode from config file:          enforcing
      Policy MLS status:              enabled
      Policy deny_unknown status:     allowed
      Memory protection checking:     actual (secure)
      Max kernel policy version:      33

   2. View the specific SELinux policy for the httpd services by running the following command:

      $ sudo cat /usr/share/selinux/targeted/contexts/httpd_var_run_t
      No such file or directory

   3. Ask the command-line assistant about contexts.

      $ c "i don't have a httpd_var_run_t contexts"

      The command-line assistant takes some time to process the request, then provides several possible suggestions.

   4. The assistant says that you might not have context and need to set it with the following command:

      $ sudo chcon -R -t httpd_var_run_t

   5. Ask the CLA about the port:

      $ c "selinux won't let httpd listen on port 12345"

   6. Try the following suggestion, run the command:

      $ sudo semanage port -a -t httpd_port_t -p tcp 12345
      ValueError: Type httpd_port_t is invalid, must be a port type

   7. Ask the CLA about the error you see in the output:

      $ c "how do I fix ValueError: Type httpd_port_t is invalid, must be a port type"

6. Run the steps provided by the CLA:

   $ sudo ls -Z /usr/sbin/httpd
   system_u:object_r:httpd_exec_t:s0 /usr/sbin/httpd
   
   $ chcon -t httpd_exec_t /usr/sbin/httpd
   
   $ sudo setenforce 1

   1. Restart the httpd service and check the status of httpd.service:

      $ sudo systemctl restart httpd
      Job failed
      
      $ sudo systemctl status httpd.service
      Failed to start the Apache Server

7. Ask the CLA how to enable httpd to listen on port 12345:

   $ c "how do I enable httpd to listen on port 12345 selinux"

   1. Run the command advised by the CLA:

      $ sudo setsebool -P httpd_can_network_connect=1

8. Restart the httpd service and check the status of httpd.service again:

   $ sudo systemctl status httpd
   $ sudo systemctl restart httpd
   Job failed, see journalctl

9. Check the journalctl service:

   $ journalctl -xeu httpd
   Output: An ExecStart= process belonging to unit httpd.service has exited.

10. Use the output to ask the CLA to troubleshoot:

    $ c "An ExecStart= process belonging to unit httpd.service has exited."

    1. Run the command that the CLA responds with:

       $ sudo ausearch -m AVC,USER_AVC -ts recent
       Output: "avc:  denied  {name_bind}  for pid=7184 comm="httpd" src=12345 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r: unreserved_port_t:s0 tclas=tcp_socket permissive=0"

    2. Copy the output of the previous command:

       $ sudo c "avc: denied {name_bind} for pid=7184 comm="httpd" src=12345 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r: unreserved_port_t:s0 tclas=tcp_socket permissive=0"

    3. Run the following command to resolve the error “SELinux is preventing Apache Server (httpd) from binding to port 12345".

       $ sudo semanage port -a -t http_port_t -p tcp 12345