How to Enable/Disable SELinux Booleans for Apache

ByContributor

SELinux, or Security-Enhanced Linux, is a security mechanism for mandatory access control (MAC) implemented in the Linux kernel to add an extra layer of protection by controlling access to files, processes, and resources.

One aspect of SELinux is managing Booleans, which are switches that control various security policies.

In this article, we’ll focus on enabling or disabling specific SELinux Booleans, especially for Apache on RHEL-based distributions, to ensure optimal security and functionality.

Understanding SELinux Booleans

Booleans in SELinux are like on-off switches that determine whether certain actions are allowed or denied. These Booleans can be toggled to enable or disable specific security policies.

For Apache, there are several Booleans that control its interactions with SELinux.

Enabling or Disabling Apache SELinux Booleans

To view all SELinux booleans, use the getsebool command together with less command.

getsebool -a | less
Check SELinux Boolean Values
Check SELinux Boolean Values

To view all boolean values of the Apache program (or daemon), use the ‘getsebool‘ command with the grep utility, which will list all httpd-related booleans.

getsebool -a | grep httpd
Check HTTP SELinux Boolean Values
Check HTTP SELinux Boolean Values

Here are some common Apache-related SELinux Booleans:

  • httpd_can_network_connect: Allows Apache to make network connections.
  • httpd_can_network_connect_db: Allows Apache to connect to databases over the network.
  • httpd_can_sendmail: Allows Apache to send email.
  • httpd_enable_cgi: Allows Apache to execute CGI scripts.
  • httpd_enable_homedirs: Allows Apache to read user home directories.

These Booleans control various aspects of Apache’s interactions with SELinux, helping to maintain security while allowing necessary functionality.

To enable a boolean, you can use the switch ‘On‘ or the numerical value (1). To disable a boolean, you can use the switch ‘Off‘ or the numerical value (0) using the setsebool command as described below.

Enable Booleans for Apache

If you have a web server installed on your system, you can permit HTTPD scripts to write files in directories labeled public_content_rw_t by enabling the allow_httpd_sys_script_anon_write boolean.

getsebool allow_httpd_sys_script_anon_write 
setsebool -P allow_httpd_sys_script_anon_write on
OR
# setsebool -P allow_httpd_sys_script_anon_write 1
Enable Apache SELinux Boolean
Enable Apache SELinux Boolean

The -P option in the setsebool command ensures that changes persist across system reboots, which is important for maintaining consistent security policies.

Disable Booleans for Apache

Similarly, to disable or turn off the above SELinux boolean value, run the following command.

setsebool allow_httpd_sys_script_anon_write off
setsebool allow_mount_anyfile off
OR
setsebool allow_httpd_sys_script_anon_write  0
setsebool allow_mount_anyfile  0

Don’t forget to read the following security-related articles.

SELinux Booleans provides a flexible way to control security policies on Linux systems. For Apache, enabling or disabling specific Booleans can enhance security while allowing necessary functionality.

By understanding how to manage these Booleans, administrators can tailor SELinux policies to suit their organization’s needs effectively.

Similar Posts

How to Use the Linux Zip Command to Compress and Uncompress Files Quickly

How to Use the Linux Zip Command to Compress and Uncompress Files Quickly
by George Whittaker

In the world of Unix-based operating systems like Linux, file packaging and compression utilities play a pivotal role. One such utility is the zip command, an effective tool for compressing files to save disk space and facilitate faster file transfers​. This article provides an in-depth guide to using the Linux zip command, featuring common use cases and practical examples.

Understanding the Syntax

The basic syntax for the Linux zip command is as follows:

zip [options] zipfile files_list

In this syntax:

  • options represent any command-line options you want to use.
  • zipfile is the name of the zip file you want to create.
  • files_list represents the files you wish to compress.

For instance, if you want to compress a file named filename.txt into a zip file named myfile.zip, you’d use the command:

$zip myfile.zip filename.txt​`oaicite:{"index":1,"metadata":{"title":"","url":"https://www.javatpoint.com/linux-zip-command","text":"Syntax:nn zip [options] zipfile files_list nn### Syntax to create any zip file:nn $zip myfile.zip filename.txt","pub_date":null}}`​.

Common Use Cases

The zip command is versatile and can be used in several different scenarios. Here are a few common use cases:

  1. Creating a zip archive: To compress multiple files into a single zip file, simply list the files you want to compress after the name of the zip file. For example:

zip files.zip file1.txt file2.txt file3.txt

This command compresses the three .txt files into a single .zip file named files.zip​.

  1. Deleting a file from a zip archive: To remove a file from an existing zip archive, use the -d command-line option, followed by the name of the file you want to remove. For instance, to remove file3.txt from files.zip, you’d use:

    zip -d files.zip file3.txt

    The tool will notify you of the deletion operation​​.

  2. Adding new files to an existing zip archive: To add new files to an existing zip archive, use the -u command-line option, followed by the names of the files you want to add. For example:

    zip -u files.zip file3.txt file4.txt

    This command adds file3.txt and file4.txt to the files.zip archive​​.

Exploring Useful Command Line Options

The zip command comes with a variety of command-line options that extend its functionality:

Go to Full Article

Understanding System Log Management Using Logrotate

Introduction System logs are akin to a continuous, detailed journal that records events and activities happening within a computer system. These logs are pivotal for diagnosing problems, understanding user activities, and ensuring the security and smooth functioning of systems. At the heart of effective log management lies Logrotate, a robust utility designed to simplify the…

How to Succeed in Enterprise SEO

How to Succeed in Enterprise SEO

Enterprise SEO can be defined by the size of the company or website, the complexity of the technology or teams, or by global operations. The goal is to increase visibility for these companies in organic search results. How do you know if your company counts as an enterprise? I like to joke that you know it’s…

Organizing Secure Document Collaboration: How to Install ONLYOFFICE DocSpace Server on Linux

Organizing Secure Document Collaboration: How to Install ONLYOFFICE DocSpace Server on Linux

Organizing Secure Document Collaboration: How to Install ONLYOFFICE DocSpace Server on Linux
by George Whittaker

Introduction

Nowadays, online document collaboration is a must for everyone. You definitely need to co-edit numerous docs with your teammates as well as work on office files with various external users, almost everyday.

Keeping this in mind, the open-source project ONLYOFFICE released the DocSpace solution which allows connecting people and files and levels up document collaboration. Let’s discover its features and installation options.

Key features

ONLYOFFICE DocSpace is intended to improve collaboration on documents with various  people you need to interact, for example, your colleagues, teammates, customers, partners, contractors, sponsors, etc.

The platform comes with integrated online viewers and editors allowing you to work with files of multiple formats, including text docs, digital forms, sheets, presentations, PDFs, e-books, and multimedia.

How to Install ONLYOFFICE DocSpace Server on Linux Content Image 1

Rooms

ONLYOFFICE DocSpace provides a room-based environment which allows organizing a clear file structure depending on your needs or project goals. DocSpace rooms are group spaces with the pre-set access level to ensure quick file sharing and avoid unnecessary repeated actions.

Currently, two types of rooms are available:

  • Collaboration rooms to co-author docs, track changes and communicate in real time.
  • Custom rooms for any custom purpose, for example, to request document review or comments, or share any content for viewing only.

How to Install ONLYOFFICE DocSpace Server on Linux Content Image 2In the future releases, the ONLYOFFICE developers are going to add further room types such as form filling rooms and private rooms for end-to-end encrypted collaboration.

User roles

Flexible access permissions allow you to fine-tune the access to the whole space or separate rooms. Available actions with files in a room depend on the given role.

Go to Full Article