config file: enforcing Policy version: 24 Policy from config file: targeted [root@zeus ~]# getenforce Enforcing [root@zeus ~]# setenforce permissive [root@zeus ~]# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: enforcing Policy version: 24 Policy from config file: targeted [root@zeus ~]# setenforce enforcing [root@zeus ~]# getenforce Enforcingyou can also edit /etc/selinux/config. Regardless of the method you should reboot the system. When you change the mode the files must be relabed (their contexts will change) this is done on the boot process.It is possible to disable enforcing mode, will only audit:setenforcing 0Check the boolean values or getsebool -a | grep http: sestatus -b | grep httpallow_httpd_anon_write offallow_httpd_mod_auth_ntlm_winbind offallow_httpd_mod_auth_pam offallow_httpd_sys_script_anon_write offhttpd_builtin_scripting onhttpd_can_check_spam offhttpd_can_network_connect offhttpd_can_network_connect_cobbler offhttpd_can_network_connect_db offhttpd_can_network_memcache offhttpd_can_network_relay offhttpd_can_sendmail offhttpd_dbus_avahi onhttpd_enable_cgi onhttpd_enable_ftp_server offhttpd_enable_homedirs offWhile I was reading about SELinux I found something very useful that I didn't know until now. Well, during the reading the author says to issue a commando called semanage that will explain each of the boolean options. However, I don't have semanage on my system and don't know which package provides it. So, the following command told me what package I should install to have semanage.yum whatprovides *bin/semanageHere we go, from the output it's clear to me that policycoreutils-python-2.0.83-19.1.el6.i686 has the binary that I was looking for.Ok. moving on... so, to see what each boolean value does, issue:[root@zeus ~]# semanage boolean -l | grep httphttpd_can_network_relay -> off Allow httpd to act as a relayhttpd_can_network_connect_db -> off Allow HTTPD scripts and modules to connect to databases over the network.httpd_use_gpg -> off Allow httpd to run gpg in gpg-web domainhttpd_enable_cgi -> on Allow httpd cgi supportallow_httpd_mod_auth_pam -> off Allow Apache to use mod_auth_pamChanging boolean values:setsebool -P httpd_enable_homedirs=1Context is formed of:User : role : domainUsers are usually one of these:unconfined_u: Unprotected usersystem_u: System useruser_u: Normal userRoles are usually one of these:object_r: File system_r: Users and processes Domains (AKA type) are usually one of these:unconfined_r: Unprotected file or process httpd_t: used for httpd process.....Roles do NOT have influence under files so object_r is used as a generic role for any file.Checking files' context:# ls -Z-rw-------. root root system_u:object_r:admin_home_t:s0 anaconda-ks.cfg-rwxr-xr-x. root root unconfined_u:object_r:admin_home_t:s0 a.outChecking processes' context: ps -eZ | grep httpdunconfined_u:system_r:httpd_t:s0 14784 ? 00:00:00 httpdunconfined_u:system_r:httpd_t:s0 14786 ? 00:00:00 httpdunconfined_u:system_r:httpd_t:s0 14787 ? 00:00:00 httpdChanging contexts (domains) http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Confined_Services/sect-Managing_Confined_Services-Targeted_policy-Unconfined_processes.html[root@zeus ~]# touch myfile[root@zeus ~]# ls -Z myfile-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 myfile[root@zeus ~]# chcon -vu system_u myfilechanging security context of `myfile'[root@zeus ~]# ls -Z myfile-rw-r--r--. root root system_u:object_r:admin_home_t:s0 myfile[root@zeus ~]# chcon -vt etc_t myfilechanging security context of `myfile'[root@zeus ~]# ls -Z myfile-rw-r--r--. root root system_u:object_r:etc_t:s0 myfile[root@zeus ~]# chcon -vr system_r myfilechanging security context of `myfile'[root@zeus ~]# ls -Z myfile-rw-r--r--. root root system_u:system_r:etc_t:s0 myfile[root@zeus ~]# touch myfile2[root@zeus ~]# ls -Z myfile2-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 myfile2[root@zeus ~]# chcon --reference myfile myfile2[root@zeus ~]# ls -Z myfile2-rw-r--r--. root root system_u:system_r:etc_t:s0 myfile2[root@zeus ~]# restorecon myfile[root@zeus ~]# ls -Z myfile-rw-r--r--. root root system_u:object_r:admin_home_t:s0 myfileChanging ports for services:[root@zeus ~]# semanage port -l | grep httphttp_port_t tcp 80, 443, 488, 8008, 8009, 8443[root@zeus ~]# semanage port -a -t http_port_t -p tcp 81[root@zeus ~]# semanage port -l | grep httphttp_port_t tcp 81, 80, 443, 488,