Tuesday 22 October 2013

Common SELinux problems and tasks

List current selinux context labels on files:

[root@machine1:/var/www/html]# ls -alZ
total 124K
drwxr-xr-x. root   root   system_u:object_r:httpd_sys_content_t:s0 ./
drwxr-xr-x. root   root   system_u:object_r:httpd_sys_content_t:s0 ../
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 administrator/
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 bin/
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 cache/
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 cli/
...


Change the selinux context:

[root@machine1:/var/www/html]# chcon -Rv --type=httpd_sys_content_t ./*
changing security context of `./administrator/templates/hathor/less/forms.less'
changing security context of `./administrator/templates/hathor/less/buttons.less'
...


Enable Apache to make outbound database connections:

[root@machine1:/var/www/html]# setsebool -P httpd_can_network_connect=1

Enable Apache to use sendmail:

[root@machine1:/var/www/html]# setsebool httpd_can_sendmail 1

No comments: