> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# SELinux Port
> Explains SELinux port labeling and how to add a nonstandard port for services like Apache using semanage to allow binding while enforcing
In this lesson we'll cover SELinux port labeling — how SELinux controls which network ports services are allowed to bind to and how to update that policy when you need a service to use a non-standard port.
SELinux maps ports to SELinux types (for example `http_port_t`). A service with a given domain/type (like Apache running under `httpd_t`) can only bind to ports labeled with the corresponding SELinux port type. If you configure a service to listen on a port that is not labeled for that service type, the bind will fail while SELinux is enforcing, even if the service configuration is otherwise correct. This helps prevent services from running on unauthorized or unexpected ports.
Demo overview
* Configure Apache (`httpd`) to listen on a non-standard TCP port: `9496`.
* Attempt to restart `httpd` while SELinux is `enforcing` (it will fail).
* Temporarily switch SELinux to `permissive` to confirm the denial is SELinux-related.
* Add the new port to the SELinux policy with `semanage`.
* Re-enable `enforcing` and verify `httpd` can bind to the port.
Run the following steps as `root`.
1. Edit the HTTPD configuration and change the Listen directive to the new port:
```bash theme={null}
root@control:~# vim /etc/httpd/conf/httpd.conf
# change:
# Listen 80
# to:
# Listen 9496
```
2. Try to restart httpd (expected to fail while SELinux is enforcing):
```bash theme={null}
root@control:~# systemctl restart httpd
Job for httpd.service failed because the control process exited with error code.
See "systemctl status httpd.service" and "journalctl -xeu httpd.service" for details.
```
3. Confirm SELinux is blocking the bind by switching to permissive and restarting httpd:
```bash theme={null}
root@control:~# setenforce 0
root@control:~# systemctl restart httpd
# No error — httpd can start when SELinux is permissive
```
4. Inspect SELinux port mappings. `semanage port -l` lists ports and their SELinux types; filter for HTTP-related entries:
```bash theme={null}
root@control:~# semanage port -l | grep http
http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
http_cache_port_t udp 3130
http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000
http_port_t udp 80, 443
pegasus_http_port_t tcp 5988
pegasus_https_port_t tcp 5989
```
Here `http_port_t` does not include `9496`, so SELinux prevents the `httpd_t` process from binding to that port while in enforcing mode.
If `semanage` is not available (`semanage: command not found`), install the package that provides it. Package names vary by distribution — for example `policycoreutils-python-utils` or `policycoreutils-python` on some RHEL/CentOS/Fedora releases.
5. Add the new TCP port to the `http_port_t` type:
```bash theme={null}
root@control:~# semanage port -a -t http_port_t -p tcp 9496
```
6. Verify the port was added to `http_port_t`:
```bash theme={null}
root@control:~# semanage port -l | grep http
http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
http_cache_port_t udp 3130
http_port_t tcp 9496, 80, 81, 443, 488, 8008, 8009, 8443, 9000
http_port_t udp 80, 443
pegasus_http_port_t tcp 5988
pegasus_https_port_t tcp 5989
```
7. Return SELinux to enforcing mode and restart httpd:
```bash theme={null}
root@control:~# setenforce 1
root@control:~# systemctl restart httpd
# httpd should now start cleanly under enforcing SELinux
```
8. Optionally verify the service is listening on the new port:
```bash theme={null}
root@control:~# ss -tulnp | grep 9496
tcp LISTEN 0 511 *:9496 *:* users:(("httpd",pid=7573,fd=4),("httpd",pid=7572,fd=4),("httpd",pid=7571,fd=4),("httpd",pid=7569,fd=4))
```
Quick reference
| Task | Command / Example |
| - | - |
| List SELinux port mappings | `semanage port -l` |
| Add a TCP port to a type | `semanage port -a -t http_port_t -p tcp 9496` |
| Remove a port from a type | `semanage port -d -t http_port_t -p tcp 9496` |
| Temporarily set SELinux to permissive | `setenforce 0` |
| Re-enable enforcing | `setenforce 1` |
| Check listening sockets | `ss -tulnp` |
Adding a port to an SELinux type grants processes of that type permission to bind to the port — consider the security implications before changing policies. Make sure firewall rules and overall network exposure are adjusted accordingly. `semanage` changes are persistent across reboots.
Summary
* SELinux maps ports to types (for example `http_port_t`) and enforces which types of processes may bind to those ports.
* If a service fails to bind to a configured port while SELinux is enforcing, check `audit.log` and `semanage port -l` for denials and mappings.
* Use `semanage port -a -t -p ` to add a port to a type. Ensure `semanage` is installed and run commands as `root`.
Further reading
* [SELinux Project Wiki: SELinux Policy](https://selinuxproject.org/page/Main_Page)
* `man semanage` (local manual)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.