You let's talk
about Selinux.
Selinux works with context to define rules in a policy that allows services to access files
in these contexts. These are labels that are assigned to processes but also to files.
The default selinux policy is very rich and it allows for all default access.
To allow the httpd process, for example to access the document root in
var wwht process uses the httpdt context type and the document root also
needs a context type which in this case is set to httpd syscontentt.
If access is blocked, a message will be sent to the audit system. You
can use grabavc on var log auditaudit log to find out when a system
is working with sclinux. Getenforce will show you that it is in enforcing mode.
If you want to temporarily disable it to fix problems that occurred because of Selinux, you can switch
to permissive mode and permissive mode if you don't change it back will stay until the next reboot.
And if ever services don't work at Selinux, you can search for selert output in the system
logs and follow instructions and on location that is giving useful information. Now to set context labels
because that is what Selinux is all about. You use selmanage fcontext that will change file context
after which the restorecon command applies the context from the policy to the file system.
And to allow services to bind to non standard ports you use semanage port.
Wow, that was a lot in not even five minutes.
Well I can tell you there is a lot more to learn about Selinux. I have a five hour recorded video
course on this platform about it, but that is too much for now. I'd like to do a quick demo that
is showing the most common elements that you will use while working with Selinux so that we already have the Apache
process up and running. Let me check psaux pipe grab HTTP and that is showing the apache process.
Now I am going to add the uppercase z option because the uppercase z option
is displaying selinux information and this is what it is all about. The u r
part we don't care. We care about the t which is a context type.
To understand what is going on I'm using LS z in var www
where we can see the default directories that Apache has access to.
So on HTML we have httpd sysctentd and on CGI bin we have httpd syscript
execd and that suggests, and that is true that you cannot run scripts from The
HTML directory, you need a specific context label in order to do that.
The good thing about Selinux is that as long as you are using standard functionality, it will work.
Now, if ever you are going to change the standards, you need to do something.
So let's change the etchtpd conf HTTP conf
which is the Apache web server configuration.
I'm looking for document root and I'm going to change my document root to
web and then I need to tell Apache about it. And that is what
I do by changing it here as well, because otherwise Apache will deny access.
Now I need to create this web directory and I want to show you before we
get started. LS lzd on slash web and what do we see? We see that that
has default t as context type. Now that's going to be the big issue.
In the Sclinux policy there is a rule that allows HTTPD to access the target that has httpdt.
But there is no rule that allows HTTPD to access default T. On the contrary, that would
open Apache to access anything. And that is against what you want to accomplish with Selinux.
So let me show you what is happening when we do
that. I'm going to use sudo sh c echo hello. Great.
Then web index HTML to create a simple index HTML.
And next I'm restarting the HTTPD process.
That's systemctl restart.
That will tell it to pick up the new configuration. And I'm using curl to localhost as
a quick test. And oh no, I see the default Apache document root and it's not working.
That's also what we can find if I would use sudo grab
avc from var log audit audit log. That's the audit log. And
there you can see, hey, Apache has denied access for the command
httpd to the path index HTML. Why is that?
Well, we have httpdt on the source and we
have default t on the target and not allowed.
You can also see it in a different way
using sudo grab sealert on var log messages.
Could also get it from the journal CTL output, but this should also work. And there we can
see a message that's summarizing what you've just seen with an interesting addition. And that's this command.
I'm going to copy this command and I'm going to paste it while running it through less.
And there we can see some explanation. Sometimes the explanation is very good, sometimes it's not.
It's telling us, hey, this is not working. You need to change the label on web
index HTML and this command is all right, but then it's not really helpful in the
label. How do you ever pick your choice from six different screens of context labels?
Nevertheless, you can. You should always check selert output because sometimes the output is pretty good. Now what do we need
to do? We need to make sure that the slash web directory, including its contents has the appropriate context label.
And the best way to do so is by having a look at the
man page semanage f context using uppercase d to go all the way down.
And then here it happens that we see exactly what needs to be done.
Two lines, and without even reading them, I'm going to copy them and I'm going to paste them one
by one. Well, that doesn't work, but there's a comment sign in front of it. Let me type it.
Sudo semanage f context a t that will add
a context. And the context is httpd syscontent and
I want it to be on web.
And in case you are wondering what is this weird stuff behind web, do
you remember regular expressions? This is a regular expression that ensures that the context
will apply to the web directory and everything that might exist within.
And then I need to use sudo restorecon rv on/web to apply the new context.
And you know what? If now I'm going to Repeat the last
CU command, it works and that's your SELinux in 5 minutes primer.