selinux Flashcards
How do you list the ports allowed for http ?
semanage port -l | grep http
Where are the audit logs for selinux?
/var/log/audit/audit.log
How do you get the status of selinux?
getenforce
What is the context attibuted to nginx by selinux?
httpd
How do you authorize another port for httpd context? For instance, port 5000?
semanage port -m -t http_port_t -p tcp 5000
What is the wider alternative to allow nginx to network and how can you set it and remove it?
To enable:
setsebool -P httpd_can_network_connect 1
To disable:
setsebool -P httpd_can_network_connect 0
If you have an error in the selinux log how can investigate the error and understand why it’s happening? Let’s say the id is:
1694301099.423:104
grep 1694301099.423:104 /var/log/audit/audit.log | audit2why
How can you investigate errors related to the httpd context?
By putting the context in permissive mode:
semanage permissive -a httpd_t
This will log the errors instead of blocking them.
How can you set the context for httpd to permissive mode?
semanage permissive -a httpd_t
How do you remove the permissive mode for httpd if it’s enabled?
semanage permissive -d httpd_t
Where is the selinux config?
/etc/sysconfig/selinux
Create a command using grep to find the nginx denied error
grep nginx /var/log/audit/audit.log | \
grep denied
