-rw-r--r-- root root root:object_r:httpd_sys_script_exec_t myprogram.cgi Now the cgi should be able to execute. Enable User home Directories and Change Context You may want to allow users to show web pages from their home directory. # setsebool -P httpd_enable_homedirs 1 # chcon -R -t httpd_sys_content_t ~user/public_html Enable Access to Terminal httpd may need to prompt for a password on a certificate file # setsebool -P httpd_tty_comm 1 Disable File Control Contexts # setsebool -P httpd_unified 0 Disable PHP You will need to manage the PHP settings for SELinux in order to run PHP. # setsebool -P httpd_builtin_scripting 0 Enable Network Connections from httpd Disabled to prevent hackers from attacking other machines from httpd. # setsebool -P httpd_can_network_connect 1 Disable suexec Transition # setsebool -P httpd_suexec_disable_trans 1 Disable Protection for httpd Daemon # setsebool -P httpd_disable_trans 1 # service httpd restart Changing a http Port You may want to change a port number for http. You cannot do this without editing the configuration for SELinux. # semanage port -l | grep http http_cache_port_t tcp 3128, 8080, 8118 http_cache_port_t udp 3130 http_port_t tcp 80, 443, 488, 8008, 8009, 8443 pegasus_http_port_t tcp 5988 pegasus_https_port_t tcp 5989 Change httpd to port 81 in the httpd.conf file. Listen 81 Now restart, and you will see that it will fail to restart. Check /var/log/messages for output. Dec 10 08:03:46 cent2 setroubleshoot: SELinux is preventing the /usr/sbin/httpd (httpd_t) from binding to port 81. For complete SELinux messages. run sealert -l 9d1872a0-da1f-48b3-b7bc-4ed7094387e5 In order to fix this you will need to use the semanage command to add port 81 to the ports allowed by SELinux. # semanage port -a -t http_port_t -p tcp 81 Restart httpd and you will find that it works. Now verify that port 81 was added to the default allowed ports. # semanage port -l | grep http http_cache_port_t tcp 3128, 8080, 8118 http_cache_port_t udp 3130 http_port_t tcp 81, 80, 443, 488, 8008, 8009, 8443 pegasus_http_port_t tcp 5988 pegasus_https_port_t tcp 5989 Managing Context Problems A common problem is when you create HTML pages in a user directory with the context of the user and then copy them to the http directories to be used as web pages. Here is an example. Mike build an index.html page to be moved into the root directory for httpd. The file is created in the user's home directory and as you can see it will have this context: # ls -Z index.html -rw-rw-r-- mike mike root:object_r:user_home_t index.html That file is copied into /var/www/html as the main index page but still has the same context, at least in some scenarios if the user has rights in the directory. # ls -Z /var/www/html -rw-r--r-- root root root:object_r:httpd_sys_content_t index.html Changing the Type Type Enforcement is the primary method of security for the targeted policy. The Type can be changed using the chcon command. However, the chcon command can only change to a Type that is defined by the policy. # ls -Z -rw-r--r-- root root root:object_r:httpd_sys_content_t index.html # chcon -t tmp_t index.html # ls -Z -rw-r--r-- root root root:object_r:tmp_t index.html You may also want