In this lab, you will persistently change the SELinux context of a directory and its contents.
| Resources | |
|---|---|
| Files: | /etc/httpd/conf/httpd.conf |
| Machines: | serverX |
Outcomes:
You will have a web server that publishes web content from a non-standard document root.
You should have a working RHEL 7 system with SELinux in enforcing mode.
Log in as root on serverX. Use
yum to install the Apache web server.
[root@serverX ~]#yum install -y httpd
Configure Apache to use a document root in a non-standard location.
Create the new document root, /custom.
[root@serverX ~]#mkdir /custom
Create the index.html with some
recognizable content.
[root@serverX ~]#echo 'This is serverX.' > /custom/index.html
Configure Apache to use the new location. You need to replace
the two occurrences of “/var/www/html” with
“/custom” in the Apache configuration file,
/etc/httpd/conf/httpd.conf.
[root@serverX ~]#vi /etc/httpd/conf/httpd.conf[root@serverX ~]#grep custom /etc/httpd/conf/httpd.confDocumentRoot "/custom" <Directory "/custom">
Start the Apache web service.
[root@serverX ~]#systemctl start httpd
Open a web browser on serverX and try to view
the following URL: http://localhost/index.html. You
will get an error message that says you do not have permission
to access the file.
Define a SELinux file context rule that sets the
context type to httpd_sys_content_t for
/custom and all the files below it.
[root@serverX ~]#semanage fcontext -a -t httpd_sys_content_t '/custom(/.*)?'
Use restorecon to change their contexts.
[root@serverX ~]#restorecon -Rv /customrestorecon reset /custom context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:httpd_sys_content_t:s0 restorecon reset /custom/index.html context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:httpd_sys_content_t:s0
Try to view http://localhost/index.html again. You
should see the message “This is serverX.”
displayed.