linuxexpert-practice-labs/labs/rhcsa/10-5-selinux-contexts

RHCSA 10.5: SELinux file and process contexts

Web content in a new place, a file moved from /tmp, and what chcon and restorecon do.

Before you start

SELinux must be enforcing; keep it that way. The lab installs httpd (serving the default /var/www/html) and policycoreutils-python-utils (for semanage), and creates /web/index.html, a page that isn't labeled for the web server yet, and /var/www/html/label.html.

Tasks

1. Serve web content from /web, with SELinux enforcing, persistently: DocumentRoot /web plus <Directory /web> / Require all granted / </Directory> in a file in /etc/httpd/conf.d/. Before the fix, curl http://localhost/ gives a 403 and ausearch -m AVC -ts recent shows an httpd denial for /web; after it, curl shows the page and restorecon -Rvn /web lists nothing to change.
2. Create a file /tmp/page.html, mv it into /var/www/html, and fix it. Write the type it had right after the move to /root/lab-answers/2.
3. Change the type of /var/www/html/label.html with chcon, then run restorecon on it. Write the type restorecon put back to /root/lab-answers/3.

Hints

• httpd -t, systemctl restart httpd; ls -Zd /web; semanage fcontext -a -t httpd_sys_content_t '/web(/.*)?', restorecon -Rv /web; matchpathcon /web.
• ls -Z, restorecon -v.
• chcon -t user_home_t FILE, restorecon -v FILE.