Skip to main content
In this lesson we’ll cover SELinux port labeling — how SELinux controls which network ports services are allowed to bind to and how to update that policy when you need a service to use a non-standard port. SELinux maps ports to SELinux types (for example http_port_t). A service with a given domain/type (like Apache running under httpd_t) can only bind to ports labeled with the corresponding SELinux port type. If you configure a service to listen on a port that is not labeled for that service type, the bind will fail while SELinux is enforcing, even if the service configuration is otherwise correct. This helps prevent services from running on unauthorized or unexpected ports.
A dark-themed infographic titled "SELinux Ports" showing a flow from a Service Process (Apache httpd_t) to a Policy Check that branches into two outcomes. Authorized ports (80, 443) are marked "Success" with a green check, while custom/unauthorized ports are marked "Blocked" with a red cross.
Demo overview
  • Configure Apache (httpd) to listen on a non-standard TCP port: 9496.
  • Attempt to restart httpd while SELinux is enforcing (it will fail).
  • Temporarily switch SELinux to permissive to confirm the denial is SELinux-related.
  • Add the new port to the SELinux policy with semanage.
  • Re-enable enforcing and verify httpd can bind to the port.
Run the following steps as root.
  1. Edit the HTTPD configuration and change the Listen directive to the new port:
  1. Try to restart httpd (expected to fail while SELinux is enforcing):
  1. Confirm SELinux is blocking the bind by switching to permissive and restarting httpd:
  1. Inspect SELinux port mappings. semanage port -l lists ports and their SELinux types; filter for HTTP-related entries:
Here http_port_t does not include 9496, so SELinux prevents the httpd_t process from binding to that port while in enforcing mode.
If semanage is not available (semanage: command not found), install the package that provides it. Package names vary by distribution — for example policycoreutils-python-utils or policycoreutils-python on some RHEL/CentOS/Fedora releases.
  1. Add the new TCP port to the http_port_t type:
  1. Verify the port was added to http_port_t:
  1. Return SELinux to enforcing mode and restart httpd:
  1. Optionally verify the service is listening on the new port:
Quick reference
Adding a port to an SELinux type grants processes of that type permission to bind to the port — consider the security implications before changing policies. Make sure firewall rules and overall network exposure are adjusted accordingly. semanage changes are persistent across reboots.
Summary
  • SELinux maps ports to types (for example http_port_t) and enforces which types of processes may bind to those ports.
  • If a service fails to bind to a configured port while SELinux is enforcing, check audit.log and semanage port -l for denials and mappings.
  • Use semanage port -a -t <type> -p <protocol> <port> to add a port to a type. Ensure semanage is installed and run commands as root.
Further reading

Watch Video