13.4. Configuration examples The following examples provide real-world demonstrations of how SELinux complements the Apache HTTP Server and how full function of the Apache HTTP Server can be maintained. 13.4.1. Running a static site To create a static website, label the .html files for that website with the httpd_sys_content_t type. By default, the Apache HTTP Server cannot write to files that are labeled with the httpd_sys_content_t type. The following example creates a new directory to store files for a read-only website: Use the mkdir utility as root to create a top-level directory: As root, create a /mywebsite/index.html file. Copy and paste the following content into /mywebsite/index.html : To allow the Apache HTTP Server read only access to /mywebsite/ , as well as files and subdirectories under it, label the directory with the httpd_sys_content_t type. Enter the following command as root to add the label change to file-context configuration: Use the restorecon utility as root to make the label changes: For this example, edit the /etc/httpd/conf/httpd.conf file as root. Comment out the existing DocumentRoot option. Add a DocumentRoot "/mywebsite" option. After editing, these options should look as follows: Enter the following command as root to see the status of the Apache HTTP Server. If the server is stopped, start it: If the server is running, restart the service by executing the following command as root (this also applies any changes made to httpd.conf ): Use a web browser to navigate to http://localhost/index.html . The following is displayed: 13.4.2. Sharing NFS and CIFS volumes By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS volumes. In common policies, this default context uses the nfs_t type. Also, by default, Samba shares mounted on the client side are labeled with a default context defined by policy. In common policies, this default context uses the cifs_t type. Depending on policy configuration, services may not be able to read files labeled with the nfs_t or cifs_t types. This may prevent file systems labeled with these types from being mounted and then read or exported by other services. Booleans can be enabled or disabled to control which services are allowed to access the nfs_t and cifs_t types. Enable the httpd_use_nfs Boolean to allow httpd to access and share NFS volumes (labeled with the nfs_t type): Enable the httpd_use_cifs Boolean to allow httpd to access and share CIFS volumes (labeled with the cifs_t type): Note Do not use the -P option if you do not want setsebool changes to persist across reboots. 13.4.3. Sharing files between services Type Enforcement helps prevent processes from accessing files intended for use by another process. For example, by default, Samba cannot read files labeled with the httpd_sys_content_t type, which are intended for use by the Apache HTTP Server. Files can be shared between the Apache HTTP Server, FTP, rsync, and Samba, if the required files are labeled with the public_content_t or public_content_rw_t type. The following example creates a directory and files, and allows that directory and files to be shared (read only) through the Apache HTTP Server, FTP, rsync, and Samba: Use the mkdir utility as root to create a new top-level directory to share files between multiple services: Files and directories that do not match a pattern in file-context configuration may be labeled with the default_t type. This type is inaccessible to confined services: As root, create a /shares/index.html file. Copy and paste the following content into /shares/index.html : Labeling /shares/ with the public_content_t type allows read-only access by the Apache HTTP Server, FTP, rsync, and Samba. Enter the following command as root to add the label change to file-context configuration: Use the restorecon utility as root to apply the label changes: To share /shares/ through Samba: Confirm the samba , samba-common , and samba-client packages are installed (version numbers may differ): If any of these packages are not installed, install them by running the following command as root: Edit the /etc/samba/smb.conf file as root. Add the following entry to the bottom of this file to share the /shares/ directory through Samba: A Samba account is required to mount a Samba file system. Enter the following command as root to create a Samba account, where username is an existing Linux user. For example, smbpasswd -a testuser creates a Samba account for the Linux testuser user: If you run the above command, specifying a user name of an account that does not exist on the system, it causes a Cannot locate Unix account for ' username '! error. Start the Samba service: Enter the following command to list the available shares, where username is the Samba account added in step 3. When prompted for a password, enter the password assigned to the Samba account in step 3 (version numbers may differ): User the mkdir utility to create a new directory. This directory will be used to mount the shares Samba share: Enter the following command as root to mount the shares Samba share to /test/ , replacing username with the user name from step 3: Enter the password for username , which was configured in step 3. View the content of the file, which is being shared through Samba: To share /shares/ through the Apache HTTP Server: Confirm the httpd package is installed (version number may differ): If this package is not installed, use the yum utility as root to install it: Change into the /var/www/html/ directory. Enter the following command as root to create a link (named shares ) to the /shares/ directory: Start the Apache HTTP Server: Use a web browser to navigate to http://localhost/shares . The /shares/index.html file is displayed. By default, the Apache HTTP Server reads an index.html file if it exists. If /shares/ did not have index.html , and instead had file1 , file2 , and file3 , a directory listing would occur when accessing http://localhost/shares : Remove the index.html file: Use the touch utility as root to create three files in /shares/ : Enter the following command as root to see the status of the Apache HTTP Server: If the server is stopped, start it: Use a web browser to navigate to http://localhost/shares . A directory listing is displayed: 13.4.4. Changing port numbers Depending on policy configuration, services may only be allowed to run on certain port numbers. Attempting to change the port a service runs on without changing policy may result in the service failing to start. Use the semanage utility as the root user to list the ports SELinux allows httpd to listen on: By default, SELinux allows httpd to listen on TCP ports 80, 443, 488, 8008, 8009, or 8443. If /etc/httpd/conf/httpd.conf is configured so that httpd listens on any port not listed for http_port_t , httpd fails to start. To configure httpd to run on a port other than TCP ports 80, 443, 488, 8008, 8009, or 8443: Edit the /etc/httpd/conf/httpd.conf file as root so the Listen option lists a port that is not configured in SELinux policy for httpd . The following example configures httpd to listen on the 10.0.0.1 IP address, and on TCP port 12345: Enter the following command as the root user to add the port to SELinux policy configuration: Confirm that the port is added: If you no longer run httpd on port 12345, use the semanage utility as root to remove the port from policy configuration:

Commands:
~]# mkdir /mywebsite
<html> <h2>index.html from /mywebsite/</h2> </html>
~]# semanage fcontext -a -t httpd_sys_content_t "/mywebsite(/.*)?"
~]# restorecon -R -v /mywebsite restorecon reset /mywebsite context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0 restorecon reset /mywebsite/index.html context unconfined_u:object_r:default_t:s0->system_u:object_r:httpd_sys_content_t:s0
#DocumentRoot "/var/www/html" DocumentRoot "/mywebsite"
~]# systemctl status httpd.service httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled) Active: inactive (dead)
~]# systemctl start httpd.service
~]# systemctl status httpd.service httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled) Active: active (running) since Wed 2014-02-05 13:16:46 CET; 2s ago
~]# systemctl restart httpd.service
index.html from /mywebsite/
~]# setsebool -P httpd_use_nfs on
~]# setsebool -P httpd_use_cifs on
~]# mkdir /shares
~]USD ls -dZ /shares drwxr-xr-x root root unconfined_u:object_r:default_t:s0 /shares
<html> <body> <p>Hello</p> </body> </html>
~]# semanage fcontext -a -t public_content_t "/shares(/.*)?"
~]# restorecon -R -v /shares/ restorecon reset /shares context unconfined_u:object_r:default_t:s0->system_u:object_r:public_content_t:s0 restorecon reset /shares/index.html context unconfined_u:object_r:default_t:s0->system_u:object_r:public_content_t:s0
~]USD rpm -q samba samba-common samba-client samba-3.4.0-0.41.el6.3.i686 samba-common-3.4.0-0.41.el6.3.i686 samba-client-3.4.0-0.41.el6.3.i686
~]# yum install package-name
[shares] comment = Documents for Apache HTTP Server, FTP, rsync, and Samba path = /shares public = yes writable = no
~]# smbpasswd -a testuser New SMB password: Enter a password Retype new SMB password: Enter the same password again Added user testuser.
~]# systemctl start smb.service
~]USD smbclient -U username -L localhost Enter username 's password: Domain=[ HOSTNAME ] OS=[Unix] Server=[Samba 3.4.0-0.41.el6] Sharename Type Comment --------- ---- ------- shares Disk Documents for Apache HTTP Server, FTP, rsync, and Samba IPCUSD IPC IPC Service (Samba Server Version 3.4.0-0.41.el6) username Disk Home Directories Domain=[ HOSTNAME ] OS=[Unix] Server=[Samba 3.4.0-0.41.el6] Server Comment --------- ------- Workgroup Master --------- -------
~]# mkdir /test/
~]# mount //localhost/shares /test/ -o user= username
~]USD cat /test/index.html <html> <body> <p>Hello</p> </body> </html>
~]USD rpm -q httpd httpd-2.2.11-6.i386
~]# yum install httpd
html]# ln -s /shares/ shares
~]# systemctl start httpd.service
~]# rm -i /shares/index.html
~]# touch /shares/file{1,2,3} ~]# ls -Z /shares/ -rw-r--r-- root root system_u:object_r:public_content_t:s0 file1 -rw-r--r-- root root unconfined_u:object_r:public_content_t:s0 file2 -rw-r--r-- root root unconfined_u:object_r:public_content_t:s0 file3
~]# systemctl status httpd.service httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled) Active: inactive (dead)
~]# systemctl start httpd.service
~]# semanage port -l | grep -w http_port_t http_port_t tcp 80, 443, 488, 8008, 8009, 8443
Change this to Listen on specific IP addresses as shown below to prevent Apache from glomming onto all bound IP addresses (0.0.0.0) # #Listen 12.34.56.78:80 Listen 10.0.0.1:12345
~]# semanage port -a -t http_port_t -p tcp 12345
~]# semanage port -l | grep -w http_port_t http_port_t tcp 12345, 80, 443, 488, 8008, 8009, 8443
~]# semanage port -d -t http_port_t -p tcp 12345