Security Enhanced Linux,
also known as SELinux is the default context based
permission scheme provided with CentOS OS
and Red Hat Enterprise Linux.
This program was actually developed by NSA
to provide additional file system and network security.
In this demonstration,
we're going to walk through how to define security context
on our web files and directories
to ensure the web server is operational.
First thing we want to do is go ahead and just check
the status of the SELinux and we see it's currently enabled
and the current mode is enforcing.
Those are the key parameters
that you're going to be looking at.
Next thing we're going to do is we're just going to create
a directory to hold the web server files.
Going to do sudo.
We're going to make a directory.
We're just going to name it,
well let's do test web.
Next we're going to create a file in this.
Now let's just make sure that the file was stored correctly.
Okay. We see that.
All right.
We just want to make sure next that
that file has read privileges, which it does to all users.
Remember that's that last field
but we also need to check the directory.
So let's list out the directory privileges.
Okay.
We just verifying that all users,
which is the last field,
have read and execute privileges on this directory.
Next thing we're going to do
is we're going to configure the Apache settings
to use the new path in that document.
Okay. So we're going to open the configuration file.
So, sudo.
And what we're going to be looking for is the document route.
It's already highlighted there
but just in case it was hard for someone to find,
we can just do the forward slash,
a new document route just to get to where we need.
Okay.
Now we just need to change this insertation here
to the new directory that we just created
for our web server files.
So we go to insert mode and do test web.
Here.
And one more thing we want to do is change this directory tag.
So what this directory tag does is creates a container
to enclose a group of configuration directives
to apply only to a specific directory,
because typically the route is very restrictive.
So we had to add other directives
to make it a little less restrictive
so we can provide for other access to other users.
We'll change that here.
Okay.
And again, just to clarify the document route
is going to be the top level directory that once a user
hits the website that's going to be the first directory
that they come in contact with.
All right.
That looks good.
Last thing we need to do is actually restart Apache.
So we do system control.
Restart.
All right.
Now let's try to actually access this webpage.
Now we should get an error because SELinux
is enforcing these policies
and we shouldn't be able to get to it.
All right.
This is the response that we should receive
because we haven't lowered the context permission
to make access available for everyone.
Now we see we have this alert.
Let's click this and see what it tells us.
Okay, we want to click this right here.
Let's troubleshoot this.
Okay.
We're going to click here.
Let's read this.
It says you need to change the label
of the var/testweb/test.html
se manage fcontext.
So it gives us a lot of detailed information
of how to fix this problem.
All right.
Now we don't need to go through all this on this example
but you see it's very descriptive on what you need to do
to get the correct solution.
But we're going to fix it ourselves.
Let's get out of here real quick.
So what we're about to do now
is we're going to look at the previous context and see
what that file had for the www, the default one.
Now basically what we're going to do at this point
is just copy that previous file permissions
and apply it to our new directory that we just created
in the var test web.
And if you look at the fields,
the first field is set for the user context.
The next field's going to be for the object role,
and the last context is going to be for the type.
And again, these are all defined SELinux context.
The user context defines what the users can access
on that object.
The role context defines what roles can access the object.
And the type context is the label portion
of the mandatory access control.
All right.
So we know that
the appropriate type should be httpd_assist_content_t.
Now we're going to apply that to our directory,
but let's just look and see what we have currently.
Okay.
So the var_t is the default context
that was passed down from the var folder
which is our parent directory.
So we're going to need to change this.
All right.
So let's go ahead and apply the appropriate context
to the new directory.
We're going to sudo
se manage
fcontext.
So that's the context we're going to use.
We're going to add
a particular context our specific type
which is going to be a file.
So it's going to be the httpd
sys_content_t that's going to be the context.
We're going to add it to the var test web
and we're going to use the regular expressions to
just let the system know
we want to apply this to all the subdirectories as well.
Looks like that it went through successfully.
Let's go ahead and check this context.
Now it shouldn't change because again
we're going to need to restart the context or reset it.
Okay. We see it sealed the var_t.
Now we're going to restore this context.
Pretty much what it makes the system do
is check the configuration file for the context.
Okay. Now let's check it now.
Looks like it successfully went through.
Last but not least,
we'll go ahead and check this again.
Now let's see if we have access to this.
Voila.
So we walked through how to configure some context files
in order to allow the web server to give access
to users who are trying to access the files
through a web browser.
Thank you.
And I'll see you in the next one.