If root user want to disable
Enforcing
, should do following:
$ setsebool secure_mode_policyload off
$ setenforce 0
$ getenforce
Permissive
4.7.1.5 Demo 2: enabling remote access control
This demo shows how SELinux can also be used to provide website visiting permissions. A web client cannot access website
files remotely if it is not authorized.
Example 1: Denying an HTTP client from visiting a private website
Use the following commands for running this sample demo:
1. root: Copy index.html to /root
$ cp /var/www/html/index.html /root
2. root: Move index.html to apache2
$ mv /root/index.html /var/www/html/index.html
3. root: turn on SELinux and
wget
website
$ setenforce 1
$ wget localhost
--2020-05-28 21:01:33-- http://localhost/
Resolving localhost (localhost)... ::1, 127.0.0.1
Connecting to localhost (localhost)|::1|:80... failed: Connection refused.
Connecting to localhost (localhost)|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 403 Forbidden
2020-05-28 21:01:33 ERROR 403: Forbidden.
Now
wget
, as a http client, fails to visit apache2 home page.
4. root: check type of index.html.
$ ls -Z /var/www/html/index.html
sysadm_u:object_r:user_home_t:SystemLow /var/www/html/index.html
The index.html has a type of home_root_t which cannot be access by the http client with type httpd_t.
5. root: restore index.html to a right type.
$ setenforce 0
$ restorecon /var/www/html/index.html
$ ls -Z /var/www/html/index.html
sysadm_u:object_r:httpd_sys_content_t:SystemLow /var/www/html/index.html
The index.html now contains the httpd_sys_content_t and can be access by httpd_t.
6. root: turn on SELinux and visit again.
$ setenforce 1
$ wget localhost
--2020-05-28 21:03:39-- http://localhost/
Resolving localhost (localhost)... ::1, 127.0.0.1
Connecting to localhost (localhost)|::1|:80... failed: Connection refused.
NXP Semiconductors
Industrial features
Open Industrial User Guide, Rev. 1.8, 05/2020
User's Guide
65 / 199
