Lab 22.2: Find and fix SELinux denials

Goal

Break a service on purpose, find the SELinux denial in the logs, understand it, and fix it the right way.

Before you start

Finish lab 22.1. Work as root.

Tasks

Install setroubleshoot-server and selinux-policy-doc.
Run chcon -t user_home_t /web/index.html and request the page. Find the AVC message, name the source type, target type and class, and fix the problem.
Change the sshd port to 2222 in a drop-in file without a SELinux change. Restart sshd, see it fail, find the denial, and fix it. Restore port 22 afterwards (or keep both ports).
Set only httpd_t to permissive, check that SELinux is still enforcing for the rest, then undo it.
Use the man page of httpd to find the boolean that allows Apache to connect to a database over the network.

Check your work

#ausearch -m AVC -ts today | grep -c denied
#ls -Z /web/index.html
#semanage port -l | grep ssh_port_t
#semanage permissive -l

The web page works again; index.html has httpd_sys_content_t.
sshd runs; ssh_port_t has 2222.
semanage permissive -l shows no httpd_t at the end.
Boolean: httpd_can_network_connect_db.

Hints

Show the hints

ausearch -m AVC -ts recent, sealert -a /var/log/audit/audit.log, journalctl -t setroubleshoot.
The fix for a label is restorecon, for a port semanage port.
semanage permissive -a httpd_t / -d.
man httpd_selinux, search for "database".

Solution

Show the solution

Tools.

#dnf install -y setroubleshoot-server selinux-policy-doc

Label problem.

#chcon -t user_home_t /web/index.html
$curl -s -o /dev/null -w '%{http_code}\n' http://localhost/
403
#ausearch -m AVC -ts recent | grep index.html
#restorecon -v /web/index.html

Port problem.

#echo "Port 2222" > /etc/ssh/sshd_config.d/05-port.conf
#systemctl restart sshd
#ausearch -m AVC -ts recent -c sshd
#semanage port -a -t ssh_port_t -p tcp 2222
#systemctl restart sshd
#rm /etc/ssh/sshd_config.d/05-port.conf; systemctl restart sshd

Permissive domain.

#semanage permissive -a httpd_t
#getenforce
#semanage permissive -d httpd_t

Find the boolean.

$man httpd_selinux | grep -B2 -A2 -i database
#getsebool httpd_can_network_connect_db

My notes

No notes yet.

Find and fix SELinux denials