第 4 章 为使用非标准配置的应用程序和服务配置 SELinux

步骤

1. 启动 httpd 服务并检查状态：

   # systemctl start httpd
   # systemctl status httpd
   …
   httpd[14523]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:3131
   …
   systemd[1]: Failed to start The Apache HTTP Server.
   …

   Copy to Clipboard

2. SELinux 策略假设 httpd 在端口 80 上运行：

   # semanage port -l | grep http
   http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
   http_cache_port_t              udp      3130
   http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
   pegasus_http_port_t            tcp      5988
   pegasus_https_port_t           tcp      5989

   Copy to Clipboard

3. 更改 SELinux 类型端口 3131 使其与端口 80 匹配：

   # semanage port -a -t http_port_t -p tcp 3131

   Copy to Clipboard

4. 再次启动 httpd ：

   # systemctl start httpd

   Copy to Clipboard

5. 但是，内容仍无法访问：

   # wget localhost:3131/index.html
   …
   HTTP request sent, awaiting response... 403 Forbidden
   …

   Copy to Clipboard

   使用 sealert 工具查找原因：

   # sealert -l "*"
   …
   SELinux is preventing httpd from getattr access on the file /var/test_www/html/index.html.
   …

   Copy to Clipboard

6. 使用 matchpathcon 工具比较标准 SELinux 类型以及新路径：

   # matchpathcon /var/www/html /var/test_www/html
   /var/www/html       system_u:object_r:httpd_sys_content_t:s0
   /var/test_www/html  system_u:object_r:var_t:s0

   Copy to Clipboard

7. 将新 /var/test_www/html/ 内容目录的 SELinux 类型改为默认 /var/www/html 目录的类型：

   # semanage fcontext -a -e /var/www /var/test_www

   Copy to Clipboard

8. 递归重新标记 /var 目录：

   # restorecon -Rv /var/
   ...
   Relabeled /var/test_www/html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
   Relabeled /var/test_www/html/index.html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

   Copy to Clipboard

验证

1. 检查 httpd 服务是否正在运行：

   # systemctl status httpd
   …
   Active: active (running)
   …
   systemd[1]: Started The Apache HTTP Server.
   httpd[14888]: Server configured, listening on: port 3131
   ...

   Copy to Clipboard

2. 验证 Apache HTTP 服务器提供的内容是否可以访问：

   # wget localhost:3131/index.html
   …
   HTTP request sent, awaiting response... 200 OK
   Length: 0 [text/html]
   Saving to: ‘index.html'
   …

   Copy to Clipboard