Bookmark this page

Guided Exercise: Control SELinux File Contexts

Persistently change the SELinux context of a directory and its contents.

Outcomes

  • Configure the Apache HTTP server to publish web content from a non-standard document root.

As the student user on the workstation machine, use the lab command to prepare your system for this exercise.

This command prepares your environment and ensures that all required resources are available.

[student@workstation ~]$ lab start selinux-filecontexts

Instructions

  1. Log in to servera as the student user and switch to the root user.

    [student@workstation ~]$ ssh student@servera
    ...output omitted...
    [student@servera ~]$
    [student@servera ~]$ sudo -i
    [sudo] password for student: student
    [root@servera ~]#
  2. Configure Apache to use a document directory in a non-standard location.

    1. Create the /custom directory.

      [root@servera ~]# mkdir /custom
    2. Create the index.html file in the /custom directory that contains the This is SERVERA. text.

      [root@servera ~]# echo 'This is SERVERA.' > /custom/index.html
    3. Configure Apache to use the new directory location. Edit the Apache /etc/httpd/conf/httpd.conf configuration file, and replace the two occurrences of the /var/www/html directory with the /custom directory. You can use the vim /etc/httpd/conf/httpd.conf command to do so. The following example shows the expected content of the /etc/httpd/conf/httpd.conf file.

      [root@servera ~]# cat /etc/httpd/conf/httpd.conf
      ...output omitted...
      DocumentRoot "/custom"
      ...output omitted...
      <Directory "/custom">
      ...output omitted...
  3. Start and enable the Apache web service and confirm that the service is running.

    1. Start and enable the Apache web service by using the systemctl command.

      [root@servera ~]# systemctl enable --now httpd
      Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.
    2. Verify that the service is running.

      [root@servera ~]# systemctl status httpdhttpd.service - The Apache HTTP Server
           Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
           Active: active (running) since Wed 2022-04-06 05:21:19 EDT; 22s ago
             Docs: man:httpd.service(8)
         Main PID: 1676 (httpd)
      ...output omitted...
      Apr 06 05:21:19 servera.lab.example.com systemd[1]: Starting The Apache HTTP Server...
      Apr 06 05:21:19 servera.lab.example.com systemd[1]: Started The Apache HTTP Server.
      Apr 06 05:21:19 servera.lab.example.com httpd[1676]: Server configured, listening on: port 80
  4. Open a web browser on workstation and try to view the http://servera/index.html web page. You get an error message that you do not have permission to access the file.

  5. To grant access to the index.html file on servera, you must configure the SELinux context. Define an SELinux file context rule that sets the context type to httpd_sys_content_t for the /custom directory and all the files under it.

    [root@servera ~]# semanage fcontext -a \
    -t httpd_sys_content_t '/custom(/.*)?'
  6. Correct the file contexts in the /custom directory.

    [root@servera ~]# restorecon -Rv /custom
    Relabeled /custom from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
    Relabeled /custom/index.html from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
  7. Try to view http://servera/index.html again in the web browser on the workstation machine. You should see the This is SERVERA. message.

  8. Return to the workstation machine as the student user.

    [root@servera ~]# exit
    logout
    [student@servera ~]$ exit
    logout
    Connection to servera closed.
    [student@workstation ~]$

Finish

On the workstation machine, change to the student user home directory and use the lab command to complete this exercise. This step is important to ensure that resources from previous exercises do not impact upcoming exercises.

[student@workstation ~]$ lab finish selinux-filecontexts

Revision: rh199-9.3-8dd73db