Chapter 16: SELinux

Exercise: SELinux review

Publish a small portal on a non-standard port with SELinux enforcing: set up the web server, hit the denials one by one, and fix each one in the right way, without ever leaving enforcing mode.

SELinux review

  • Label a port and a directory tree for a service.
  • Set a boolean permanently.
  • Diagnose denials from the audit log.

Before you start: reset the servers and complete this chapter's lessons. You work on servera as root (sudo -i); lab start and lab grade run on workstation. The grader checks the SELinux mode, the policy customisations you made, and that the portal answers.

On servera, keeping SELinux enforcing:

  1. Install httpd, audit and setroubleshoot-server; start auditd; enable and start httpd.
  2. Serve /srv/portal (with an index.html containing Portal is up) on TCP port 8090 only.
  3. Fix the SELinux denials correctly: label port 8090, add a permanent file-context rule for /srv/portal and below and apply it, turn on httpd_can_network_connect permanently, and leave httpd_enable_homedirs off.
  4. On workstation, fill in answers.txt.

Start the exercise

[student@workstation ~]$ lab start sa-selinux-review
[student@workstation ~]$ ssh student@servera
[student@servera ~]$ sudo -i
[root@servera ~]#

Install and configure httpd

[root@servera ~]# dnf install -y httpd audit setroubleshoot-server > /dev/null
[root@servera ~]# systemctl enable --now auditd
[root@servera ~]# mkdir -p /srv/portal
[root@servera ~]# echo "Portal is up" > /tmp/index.html && mv /tmp/index.html /srv/portal/
[root@servera ~]# sed -i 's/^Listen 80$/Listen 8090/' /etc/httpd/conf/httpd.conf
[root@servera ~]# cat > /etc/httpd/conf.d/portal.conf <<'EOT'
DocumentRoot "/srv/portal"
<Directory "/srv/portal">
    Require all granted
</Directory>
EOT
[root@servera ~]# systemctl enable --now httpd
Job for httpd.service failed because the control process exited with error code.

The failure is expected: SELinux does not allow httpd on port 8090 yet.

Fix the denials one at a time

[root@servera ~]# grep AVC /var/log/audit/audit.log | tail -1 | cut -c1-250
type=AVC msg=audit(...): avc:  denied  { name_bind } for  pid=1398 comm="httpd" src=8090 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0
[root@servera ~]# semanage port -a -t http_port_t -p tcp 8090
[root@servera ~]# systemctl restart httpd
[root@servera ~]# curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8090/
403
[root@servera ~]# semanage fcontext -a -t httpd_sys_content_t "/srv/portal(/.*)?"
[root@servera ~]# restorecon -Rv /srv/portal
[root@servera ~]# curl -s http://localhost:8090/
Portal is up
[root@servera ~]# setsebool -P httpd_can_network_connect on
[root@servera ~]# getsebool httpd_can_network_connect httpd_enable_homedirs
httpd_can_network_connect --> on
httpd_enable_homedirs --> off
[root@servera ~]# getenforce
Enforcing

Answers and grade

On workstation, fill in answers.txt (ps -eZ | grep httpd shows the process type), and grade:

Check your work with lab grade sa-selinux-review, then put the exercise away with lab finish sa-selinux-review.