معمل 22.1: Make a web server work with SELinux

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

الهدف

Serve web pages from a non-standard folder and port, and from user home folders — with SELinux enforcing the whole time.

قبل أن تبدأ

Work on server1 as root with httpd installed (lab 21.1 or dnf install -y httpd).
SELinux must be enforcing: getenforce.

المهام

Change the DocumentRoot of Apache to /web with an index.html that says "selinux lab". Make it work with the right SELinux label (permanent).
Make Apache also listen on port 1001. Fix SELinux and the firewall.
Create /home/student/public_html/index.html with the text "home page". Enable userdir in Apache (UserDir public_html in /etc/httpd/conf.d/userdir.conf) and set the SELinux boolean that allows home folders (permanent). Set the permissions so apache can read the file.
Move a file from /root into /web with mv. Show that the web page for it fails, then fix the label.
Reboot and check that everything still works in enforcing mode.

تحقّق من عملك

$curl http://localhost/
$curl http://localhost:1001/
$curl http://localhost/~student/
#getenforce; getsebool httpd_enable_homedirs
#ls -Zd /web /web/*

All three curl commands show the page text.
getenforce = Enforcing, the boolean is on, /web has httpd_sys_content_t.

تلميحات

اعرض التلميحات

semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?" + restorecon -Rv /web.
semanage port -a -t http_port_t -p tcp 1001.
setsebool -P httpd_enable_homedirs on; home folder needs chmod 711, public_html 755.
restorecon after mv.

الحل

اعرض الحل

New DocumentRoot.

#mkdir /web; echo "selinux lab" > /web/index.html
#sed -i 's|^DocumentRoot.*|DocumentRoot "/web"|; s|<Directory "/var/www/html">|<Directory "/web">|' /etc/httpd/conf/httpd.conf
#semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
#restorecon -Rv /web
#systemctl restart httpd

Port 1001.

#echo "Listen 1001" > /etc/httpd/conf.d/port1001.conf
#semanage port -a -t http_port_t -p tcp 1001
#firewall-cmd --add-port=1001/tcp --permanent; firewall-cmd --reload
#systemctl restart httpd

User home pages.

#sed -i 's/^\s*UserDir disabled/#UserDir disabled/; s/^\s*#UserDir public_html/UserDir public_html/' /etc/httpd/conf.d/userdir.conf
#mkdir /home/student/public_html; echo "home page" > /home/student/public_html/index.html
#chown -R student: /home/student/public_html
#chmod 711 /home/student; chmod 755 /home/student/public_html
#setsebool -P httpd_enable_homedirs on
#systemctl restart httpd

The mv problem.

#echo "moved" > /root/moved.html; mv /root/moved.html /web/
$curl -s -o /dev/null -w '%{http_code}\n' http://localhost/moved.html
403
#restorecon -v /web/moved.html

Make a web server work with SELinux

الهدف

قبل أن تبدأ

المهام

تحقّق من عملك

تلميحات

الحل

ملاحظاتي

دروس هذا المعمل

الأوامر في هذا المعمل