To work with SELinux, the first thing you need to take care of is that it is in the
appropriate mode.
So SELinux can be used in different states.
It is either disabled or enabled.
That is something that you enable in the kernel, and it can only be set while booting.
By using the bootline arguments, SELinux is 0 or SELinux is 1.
If SELinux is enabled, you can toggle between permissive and enforcing mode.
In permissive mode, nothing is blocked, but all SELinux events are logged.
That makes permissive mode an excellent mode to find out what is happening when you want
to enable an application for SELinux.
In enforcing mode, SELinux is fully operational.
You can use getEnforce to get the current mode, and you can use setEnforce to set the
current mode.
Let me show you how this works.
So getEnforce is telling me that currently I'm in enforcing mode, and enforcing mode
that means that SELinux is fully operational, fully protected.
Now let me simulate a situation.
I'm going to edit etc.httpd.conf, and in this configuration, I'm going to start my example
that we will work out in the next couple of lessons.
In this example, I'm going to use document root slash web, and I also need to change
the Apache configuration a little bit to loosen security settings on this custom document
root.
All right.
Next, I'm going to create this slash web directory, and I'm creating the file index.html with
text like hello world.
Okay.
So now I'm going to use systemctl enable minus minus now httpd to start it, and I'm using
curl to local host.
And what is going on?
Well, what you see here is the default embedded Apache web server error page telling us that
Apache can't read its document root, and probably the administrator needs to do something.
Now at this point, I'm going to use set and force permissive, and I'm going to try again.
So now SCLinux is in permissive mode, and it still fails.
Now we can draw an important conclusion, and that is that the error apparently is not because
of SCLinux.
We will further investigate what is going on, but the thing here is that in permissive
mode, you are sure that SCLinux is allowing everything.
Now you can also find out using grep avc on var log audit audit.log to check if anything
has happened for SCLinux, and oh, here I can see we are in permissive mode, and the only
thing that I can see is error messages regarding mdadm, and you know what that means?
That means that the problem is not SCLinux related.
My problem is Apache related.
Now let me also show you how you can disable SCLinux, because there's no set and force
disable.
That's for security reasons, as you need to reboot if you want to disable SCLinux.
And you need to get access to the grep boot menu, and in the grep boot menu, oh, we still
have to choose a name and password, well, that is okay.
I can handle it.
In the grep boot menu, at the end of the line that reads Linux, I'm going to use SCLinux
is zero, and then I'm using control X, and that will start the system again with SCLinux
in disabled mode.
Now you should never use SCLinux in disabled mode as a temporary solution, because if you
are in disabled mode, then nothing is protected, nothing is traced by SCLinux, and it might
mess up your SCLinux security settings, and for that reason, when you get out of disabled
mode, you will very often see that your system is going to relabel the SCLinux context settings.
I'll tell you later what that is and how that works.
We will see it, but for now, I'd like to show you the current SCLinux mode.
So get and force is telling me that SCLinux is disabled.
Now back to Apache.
What is going on in Apache?
Well, let's go to var log, because in var log, we have an Apache log, and that is in
HTTPd, and in this HTTPd, you can see an error log.
I'm going to check on the error log if we can see any obvious errors, and what do I
see?
I see cannot serve var www.html, no matching directory found.
Is this the message that we are talking about?
804, that is likely.
So what I'm seeing here is that apparently it's still trying to serve var www.html, and
it doesn't use slash web as a document route at all.
Okay, is that so?
Let's try on etc.httpd.conf, where I can see my document route being set to slash web.
Now that is interesting, and I need to try it again.
I'm going to use systemctl restart HTTPd, and then I'm going to check this error log
again.
So right now it is 0808 in my time zone, so we are looking for timestamps following 0808,
and I don't see this timestamp anymore.
So what happened?
Well, I'm not really sure what happened, but apparently I didn't start Apache after the
modification was made.
So what does that mean?
Well, it means that if I'm going to use my curl to local host again, I see hello world,
and I see hello world because I'm in disabled mode, and now I'm getting back into enforcing
mode, and while restarting, we can see that the auto-relabel is taking place right now.
You can see that on my screen.
Once the auto-relabel is done, it will restart again.
That is normal, and that is expected behavior, but this is happening because STLinux temporarily
was not protecting the system, and STLinux needs to verify that everything is still okay.
So that is why you see two different reboots.
So now I'm back on my system, and as I did not change anything persistently in GRUB,
getEnforce is giving me enforcing, so when I use curl to local host, I'm getting this
Apache error page, and now I can demonstrate permissive mode because in permissive mode,
setEnforce, permissive is what I'm going to need.
Curl local host, suddenly it works, and what was the big deal about this GRUB?
Well, when I use GRUB AVC on var log audit, audit.log, I can see a trace of all the STLinux
messages, and what we are looking for is permissive is one.
This is all that has been logged in permissive mode, and this is what we need to go troubleshoot
later.
So what do we see?
Command HTTP, bad index HTML, we get AVC denied.
All STLinux messages are logged with AVC denied, if there's a denial, and there you can see
the source context HTTP underscore T, trying to reach out the target context default underscore
T, and in the next video, I will tell you all about the meaning of that.