Skip to main content
In this lesson, we explore two key concepts related to SELinux:
  1. Modifying SELinux settings at boot time using Boolean values.
  2. Diagnosing and resolving routine SELinux policy violations.

​
Using Boolean Values to Modify SELinux Settings at Boot Time

We’ll start by modifying SELinux behavior directly from the GRUB boot screen of a RHEL machine.
The image shows a boot menu for Red Hat Enterprise Linux, offering options to select or edit the boot process.
At the GRUB screen, press “E” to edit the default kernel entry. In the editor, scroll down to the line beginning with “linux”. Press Control + E to jump to the end of this line, then move the cursor one space before the “quiet” keyword. Here, you can append one of the following Boolean parameters to adjust SELinux behavior at boot:

​
1. Booting in Permissive Mode

Appending enforcing=0 will start SELinux in permissive mode while still applying the appropriate SELinux labels. This method is the Red Hat recommended approach to boot in permissive mode. For example:

​
2. Disabling SELinux Support at Boot

Alternatively, you can disable SELinux entirely during boot by appending selinux=0 to the kernel command line. When this parameter is used, no SELinux components will be loaded by the kernel. A subsequent boot without this parameter will trigger an automatic filesystem relabel.

​
3. Enabling Auto Relabel

You can force a full filesystem relabel by appending autorelabel=1. This is equivalent to creating the /etc/selinux/auto_relabel file and rebooting.
After making your desired changes, press Control + X to boot normally. This concludes the first part of the lesson.

​
Diagnosing and Addressing Routine SELinux Policy Violations

Once the system has booted, log in to your RHEL system.
The image shows a Red Hat login screen with a user named "aaron" and a password entry field. The Red Hat logo is displayed at the bottom.
Even though some systems may boot into a text console, this demonstration uses graphical mode for ease of use. Next, we will explore how to handle one common SELinux issue by changing the default HTTPD port.

​
Example: Changing the HTTPD Port

A typical issue arises when you modify the default port for the Apache HTTPD service. First, verify HTTPD is installed, then inspect the Apache configuration file to locate the Listen directive.
The image shows a text editor window displaying a configuration file for the Apache HTTP server, containing comments and instructions for server setup.
By default, Apache listens on port 80. Assume you change this setting to port 88. Edit the configuration file with:
After saving your changes, attempt to start Apache:
If the service fails to start, you might see an error similar to:
Checking the status helps reveal that Apache encountered a permission error when binding to port 88:
Example output:
Investigating further with journalctl -xe may point out that SELinux is preventing HTTPD from binding to port 88:
The error message advises generating a local policy module with the following commands:
It is recommended to switch to the root shell for these operations:
Then, execute the commands:
Once the policy module my-httpd is installed, restart Apache:
A successful service status should indicate that Apache is active and running on port 88:
Confirm the service response with a curl command:
You should see the HTML content of Apache’s default page in the terminal.

​
Restoring Default File Contexts for Apache

Another common issue occurs when file contexts do not align with SELinux expectations, particularly when Apache’s DocumentRoot is changed to a non-default directory. In this scenario, modify the Apache configuration file to update the DocumentRoot. For example, change it to /kodedu:
The image shows a terminal window displaying the configuration file for an Apache HTTP server, with comments and settings related to server directives and log file paths.
After updating the configuration, create the new document root directory and add a simple HTML file:
Restart Apache to apply the changes:
When you access http://127.0.0.1:88/kodekloud.html, you might receive a “Forbidden” error. This error indicates that SELinux is denying access because the file contexts are incorrect. Check the current SELinux labels with:
Files in /kodedu often have a generic context (e.g., default_t) instead of the required httpd_sys_content_t.
To resolve this, use the semanage command to assign the proper context.
Apply the correct file context with:
Then, run the following command to update the file contexts recursively:
Confirm the updated context by checking again:
Finally, verify that the Apache default page is accessible:
The output should display the expected HTML (“KodeKloud”) content.

​
Summary

In this lesson, you learned how to:
  • Use Boolean values at boot time to modify SELinux behavior.
  • Diagnose SELinux policy violations through systemctl and journalctl.
  • Generate and apply local SELinux policy modules.
  • Correct file contexts using semanage and restorecon to resolve access issues with Apache.
Proceed to your next lab or lecture with these troubleshooting techniques to ensure a secure and smoothly functioning SELinux environment.

Watch Video

Practice Lab