Bookmark this page

Practice: Changing SELinux Contexts

In this lab, you will persistently change the SELinux context of a directory and its contents.

Resources
Files: /etc/httpd/conf/httpd.conf
Machines: serverX

Outcomes:

You will have a web server that publishes web content from a non-standard document root.

You should have a working RHEL 7 system with SELinux in enforcing mode.

  1. Log in as root on serverX. Use yum to install the Apache web server.

    [root@serverX ~]# yum install -y httpd
    
  2. Configure Apache to use a document root in a non-standard location.

    1. Create the new document root, /custom.

      [root@serverX ~]# mkdir /custom
      
    2. Create the index.html with some recognizable content.

      [root@serverX ~]# echo 'This is serverX.' > /custom/index.html
      
    3. Configure Apache to use the new location. You need to replace the two occurrences of /var/www/html with /custom in the Apache configuration file, /etc/httpd/conf/httpd.conf.

      [root@serverX ~]# vi /etc/httpd/conf/httpd.conf
      [root@serverX ~]# grep custom /etc/httpd/conf/httpd.conf
      DocumentRoot "/custom"
      <Directory "/custom">
      
  3. Start the Apache web service.

    [root@serverX ~]# systemctl start httpd
    
  4. Open a web browser on serverX and try to view the following URL: http://localhost/index.html. You will get an error message that says you do not have permission to access the file.

  5. Define a SELinux file context rule that sets the context type to httpd_sys_content_t for /custom and all the files below it.

    [root@serverX ~]# semanage fcontext -a -t httpd_sys_content_t '/custom(/.*)?'
    
  6. Use restorecon to change their contexts.

    [root@serverX ~]# restorecon -Rv /custom
    restorecon reset /custom context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:httpd_sys_content_t:s0
    restorecon reset /custom/index.html context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:httpd_sys_content_t:s0
    
  7. Try to view http://localhost/index.html again. You should see the message This is serverX. displayed.

Revision: rh134-7-c643331