SElinux is your Friend?

SElinux is much more involved than I originally had assumed. However, it should not be feared.
# sealert -a /var/log/audit/audit.log

[root@desktop9 audit]# ls -lZd /var/www/html/
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/

user : role : type : sens : cat

# audit2allow
Command to convert audit log to policy updates to allow the tasks that were previously denied.

append { selinux | enforcing } = 0 on the kernel line in grub

IF... you happen to disable and re-enable SElinux, it will require a "relabel -RF" of the entire filesystem.

I'm actually becoming enamored with SElinux... seriously cool stuff.

To update your context, you should use
# semanage fcontext -a
and not just chcon. If you happen to do a restorecon using chcon, it will revert the content back to it's original intended context.

# man -k selinux
# man -k _selinux
-- Check out this location
# /etc/selinux/targeted/contexts/files

# gesebool -a
# semanage boolean -l

-- Prep work - copy a directory to /var/www/html and attempt to access it.
# tail /var/log/messages (look for the UUID to review)
# sealert -l a19fa6d0-90d6-4c8c-8d2f-d964d77a5965
# /sbin/restorecon '/var/www/html/web_content/index.html' (fixes the one file)
# semanage fcontext -a -f "" -t httpd_sys_content_t '/var/www/html/web_content/*' (adds context)
# restorecon -RFvv /var/www/html/web_content/ (fixes the entire directory)


< THIS PAGE NEEDS UPDATES >