RH134 Ch 4: Fix SELinux for a Web Server

A colleague set up the WebAsha documentation site on servera: Apache serves `/webdata` on port `8818`. It only worked because they switched SELinux to permissive "for now" and wrote that into the config. Put SELinux back into enforcing mode and make the site work the right way: labels, port type and booleans, all persistent.

Tasks

  1. Put SELinux into enforcing mode now, and make sure it stays enforcing after a reboot.
  2. Add a persistent file-context rule so that /webdata and everything below it is labelled httpdsyscontentt, and apply it to the existing files.
  3. Allow Apache to listen on TCP port 8818 by giving the port the right SELinux type.
  4. Start httpd and enable it at boot. curl http://localhost:8818/ must return the WebAsha Docs page (HTTP 200).
  5. Allow Apache to serve users' home directories: turn on the boolean httpdenablehomedirs now and persistently.
  6. While SELinux was permissive, the audit log recorded what would have been denied. Find the AVC record for the web content httpd tried to access (name="webdata"), and write the SELinux type it had (its tcontext type, e.g. somethingt) to /root/avc-type.txt.