Red Hat System Administration II
In addition to file context and process type labeling, SELinux labels network ports with an SELinux context. SELinux controls network access by labeling the network ports and including rules in a service's targeted policy. For example, the SSH targeted policy includes the 22/TCP port with an ssh_port_t port context label. In the HTTP policy, the default 80/TCP and 443/TCP ports use an http_port_t port context label.
When a targeted process attempts to open a port for listening, SELinux verifies that the policy includes entries that enable the binding of the process and the context. SElinux can then block a rogue service from taking over ports that other legitimate network services use.
If a service attempts to listen on a nonstandard port, and the port is not labeled with the correct SELinux type, then SELinux might block the attempt. You can correct this problem by changing the SELinux context on the port.
Typically, the targeted policy already labeled all expected ports with the correct type. For example, because port 8008/TCP is often used for web applications, that port is already labeled with http_port_t, which is the default port type that a web server uses. Individual ports can be labeled with only one port context.
Use the grep command to filter the port number.
[root@host ~]# grep gopher /etc/services
gopher 70/tcp # Internet Gopher
gopher 70/udpUse the semanage command to list the current port label assignments.
[root@host ~]# semanage port -l
...output omitted...
http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
http_cache_port_t udp 3130
http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000
...output omitted...Use the grep command to filter the SELinux port label by using the service name.
[root@host ~]# semanage port -l | grep ftp
ftp_data_port_t tcp 20
ftp_port_t tcp 21, 989, 990
ftp_port_t udp 989, 990
tftp_port_t udp 69A port label can appear in the list many times for each supported networking protocol.
Use the grep command to filter the SELinux port label by using the port number.
[root@host ~]# semanage port -l | grep -w 70
gopher_port_t tcp 70
gopher_port_t udp 70Use the semanage command to assign new port labels, remove port labels, and modify existing ones.
Important
Almost all of the services that are included in the RHEL distribution provide an SELinux policy module, which includes that service's default port contexts. You cannot change default port labels by using the semanage command. Instead, you must modify and reload the targeted service's policy module. Writing and generating policy modules is not discussed in this course.
You can label a new port with an existing port context label (type). The semanage port command's -a option adds a new port label; the -t option denotes the type; and the -p option denotes the protocol.
[root@host ~]# semanage port -a -t port_label -p tcp|udp PORTNUMBERIn the following example, enable the gopher service to listen on the 71/TCP port:
[root@host~]# semanage port -a -t gopher_port_t -p tcp 71To view local changes to the default policy, use the semanage port command's -C option.
[root@host~]# semanage port -l -C
SELinux Port Type Proto Port Number
gopher_port_t tcp 71The targeted policies include many port types.
Service-specific SELinux man pages are named by using the service name plus _selinux. These man pages include service-specific information on SELinux types, Booleans, and port types, and are not installed by default. To view a list of all of the available SELinux man pages, install the package and then run a man -k keyword search for the _selinux string.
[root@host ~]#dnf -y install selinux-policy-doc[root@host ~]#man -k _selinux
Use the semanage command for deleting a port label, with the -d option. In the following example, remove the binding of port 71/TCP to the gopher_port_t type:
[root@host ~]# semanage port -d -t gopher_port_t -p tcp 71To change a port binding, when requirements change, use the -m option. This option is more efficient than deleting the earlier binding and adding the latest one.
For example, to modify port 71/TCP from gopher_port_t to http_port_t, use the following command:
[root@server ~]# semanage port -m -t http_port_t -p tcp 71View the modification by using the semanage command.
[root@server ~]#semanage port -l -CSELinux Port Type Proto Port Numberhttp_port_ttcp71[root@server ~]#semanage port -l | grep httphttp_cache_port_t tcp 8080, 8118, 8123, 10001-10010 http_cache_port_t udp 3130http_port_ttcp71, 80, 81, 443, 488, 8008, 8009, 8443, 9000 pegasus_http_port_t tcp 5988 pegasus_https_port_t tcp 5989
References
semanage(8), semanage-port(8), and *_selinux(8) man pages
