Red Hat System Administration II

Objectives

After completing this section, you should be able to verify that network ports have the correct SELinux type so that services are able to bind to them.

SELinux Port Labeling

SELinux does more than just file and process labeling. Network traffic is also tightly enforced by the SELinux policy. One of the methods that SELinux uses for controlling network traffic is labeling network ports; for example, in the targeted policy, port 22/TCP has the label ssh_port_t associated with it. The default HTTP ports, 80/TCP and 443/TCP, have the label http_port_t associated with them.

Whenever a process wants to listen on a port, SELinux checks to see whether the label associated with that process (the domain) is allowed to bind that port label. This can stop a rogue service from taking over ports otherwise used by other (legitimate) network services.

Managing SELinux Port Labeling

If you decide to run a service on a nonstandard port, SELinux almost certainly will block the traffic. In this case, you must update SELinux port labels. In some cases, the targeted policy has already labeled the port with a type that can be used; for example, since port 8008/TCP is often used for web applications, that port is already labeled with http_port_t, the default port type for the web server.

Listing Port Labels

To get an overview of all the current port label assignments, run the semanage port -l command. The -l option lists all current assignments in this form:

port_label_t     tcp|udp    comma,separated,list,of,ports

Example output:

[root@host ~]# semanage port -l
...output omitted...
http_cache_port_t       tcp   8080, 8118, 8123, 10001-10010
http_cache_port_t       udp   3130
http_port_t             tcp   80, 81, 443, 488, 8008, 8009, 8443, 9000
...output omitted...

To refine the search, use the grep command:

[root@host ~]# semanage port -l | grep ftp
ftp_data_port_t                tcp      20
ftp_port_t                     tcp      21, 989, 990
ftp_port_t                     udp      989, 990
tftp_port_t                    udp      69

Note that a port label can appear twice in the output, once for TCP and once for UDP.

Managing Port Labels

Use the semanage command to assign new port labels, remove port labels, or modify existing ones.

To add a port to an existing port label (type), use the following syntax. The -a adds a new port label, the -t denotes the type, the -p denotes the protocol.

[root@host ~]# semanage port -a -t port_label -p tcp|udp PORTNUMBER

For example, to allow a gopher service to listen on port 71/TCP:

[root@host~]# semanage port -a -t gopher_port_t -p tcp 71

To view local changes to the default policy, administrators can add the -C option to the semanage command.

[root@host~]# semanage port -l -C 
SELinux Port Type              Proto    Port Number

gopher_port_t                  tcp      71

[root@host ~]# yum -y install selinux-policy-doc
[root@host ~]# man -k _selinux

Removing Port Labels

The syntax for removing a custom port label is the same as the syntax for adding a port label, but instead of using the -a option (for Add), use the -d option (for Delete).

For example, to remove the binding of port 71/TCP to gopher_port_t:

[root@host ~]# semanage port -d -t gopher_port_t -p tcp 71

Modifying Port Bindings

To change a port binding, perhaps because requirements changed, use the -m (Modify) option. This is a more efficient process than removing the old binding and adding a new one.

For example, to modify port 71/TCP from gopher_port_t to http_port_t, an administrator can use the following command:

[root@server ~]# semanage port -m -t http_port_t -p tcp 71

As before, view the modification using the semanage command.

[root@server ~]# semanage port -l -C
SELinux Port Type              Proto    Port Number

http_port_t                    tcp      71
[root@server ~]# semanage port -l | grep http
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
http_port_t                    tcp      71, 80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t            tcp      5988
pegasus_https_port_t           tcp      5989