In this lab, you will be presented with inadequate SELinux configurations that are causing problems. Your job is to perform the correct reconfigurations so everything works properly for the given cases. The first problem involves a web server running that needs to be accessed through an atypical port not usually used by the web servers. SELinux, however, is not allowing you to do this. You need to figure out why, how it is doing this, and effect changes that will persist after reboots. There’s also another problem: The web server is not able to serve the proper files to the end user due to improper configuration. The idea is to be able to grant or revoke access with SELinux depending on the needs and problems you encounter. In order to troubleshoot problems with SELinux, you will need to access and analyze the log files, locate the problems, and then implement an adequate solution. You should not use the global SELinux permissive state for verification.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Install Troubleshooting Tools
Install the troubleshooting tools:
sudo yum install -y setroubleshoot setools- Attempt to Start Apache Web Server on Port 9100. When It Fails, Find the Line in the Log Files Confirming SELinux Is the Core Issue.
Using
grepgrep httpd /var/log/audit/audit.logUsing Both
tailandgreptail -n 100 /var/log/audit/audit.log | grep -i httpdUsing
tailtail -f /var/log/audit/audit.logWatch the Log in Real Time, in Another Terminal
sudo systemctl start httpdUsing
ausearchsudo ausearch -p <process id>Look at the Auditor
sudo grep httpd /var/log/audit/audit.log | audit2why- Find the Right Port Label for Apache Web Server and Add the Needed Port. Then Restart the Apache Web Server.
List all the possible port labels and search the list for
http:semanage port -l | grep -i httpAdd port 9100 to the
http_port_tlabel:semanage port -m -t http_port_t -p tcp 9100
- Find the Right SELinux Context for the `index.html` in `/var/www/html/` and Set It Permanently
Create a file:
sudo touch /var/www/html/testView the context:
ls -Z /var/www/html/Change the context of the file:
semanage fcontext -a -t httpd_sys_content_t /var/www/html/index.htmlReset the security context:
restorecon -v /var/www/html/index.html
