linuxexpert-practice-labs/labs/linux-plus/3-3-3-selinux/README.md

Linux+ 3.3.3: SELinux

The classic moved-file problem with a web server, reading the denial, and a boolean. Keep SELinux enforcing throughout.

Before you start

RHEL family only. SELinux must be enforcing. The web server isn't installed or started by the lab: that's task 1. The lab sets the boolean httpd_enable_homedirs off. Write answers to the files in /root/lab-answers/.

Tasks

1. Look around (sestatus, ls -Zd, ps -eZ, getsebool -a). Install httpd, and enable and start it.
2. As your normal user, create ~/moved.html with the text moved, and sudo mv it into /var/www/html/. curl http://127.0.0.1/moved.html returns 403. Read the denial, fix the file's label, and see the page served. Then try chcon -t user_home_t on it and see restorecon undo that too.
3. Write the SELinux type the moved file had before you fixed it to /root/lab-answers/3.
4. Turn the boolean httpd_enable_homedirs on, persistently. (The chapter turns it off again afterward; leave it on until you've checked.)

Hints

• dnf install httpd, systemctl enable --now.
• ls -Z, ausearch -m AVC -ts recent; sealert -a /var/log/audit/audit.log needs the setroubleshoot-server package; restorecon -v.
• The type is the third field of the label.
• setsebool -P, getsebool.