In this video, we'll explore SELinux working.
And I'm going to work out a demo where you can see a use case where you need to configure
SELinux.
So what am I going to do in this demo?
I'm going to change the Apache document route.
I'm making it slash web.
And I'm creating a file, hello web, slash web index.html.
And then I'm going to edit my etc.httpd.conf.
And in the document route, I'm going to comment out the old one, and I'm going to add a new
document route, which is going to be slash web.
Right.
Now I'm going to restart my HTTP server.
So systemctl restart HTTP.
Before I continue, one comment, and I will repeat this comment at the end of this lesson.
I'm changing the configuration of the HTTP server here.
Once you're done with this lesson, you need to change it back to service the old document
route because the HTTP server needs to provide access to the repositories later on.
If that doesn't work, then you'll be in trouble in later lessons.
But for now, systemctl restart HTTP.
And I am going to use curl localhost.
That's the ultimate test, right?
And oh my goodness, I'm getting a fail to connect to localhost port 80, could not connect
to service.
Well, we need to figure out what is happening.
Systemctl status on HTTPD should tell us more about it.
And well, apparently, it is still restarting.
So I need to give it a little moment, and then we try again.
All right.
So let's check what is going on.
Here we can see systemctl status HTTPD activating auto restart.
OK, let's do some unforeseen troubleshooting.
Now, this is an SC Linux system.
So you might wonder, is this because of SC Linux or not?
Well, if the web server doesn't restart, that is kind of unexpected behavior.
So I would guess primarily that this is not SC Linux.
So I am going to analyze what the web server is doing using journalctl minus U HTTPD.
And then an uppercase G. And in the uppercase G, I'm getting what?
Status one is failure and filled with the result exit code.
And if I reproduce this status HTTPD, I can see that it's in a restarting loop.
Do you see that?
Eight seconds ago, it's still activating auto restart.
I need to dig a little bit deeper.
And if you need to dig a little bit deeper in web server world,
you need to go to the var log directory.
Because Apache has its own logs in HTTPD.
And that's a little bit confusing.
But the information here is information that you won't find in journal D.
So I am going to check the error log.
Let me use still on HTTPD error log.
And there I can see, oh, look at that.
No search file or directory could not create ETC HTTP run, HTTP.PID.
So it wants to write the PID somewhere, but it can't.
So let's investigate what is going on using LS minus L, ETC HTTPD.
And ah, there we can see an invalid symbolic link.
It's red.
And I know as it is an L symbolic link.
If you see that, it's an invalid symbolic link.
So LS minus L on run HTTPD most likely does not exist.
I have no clue why, but RHEL 10 has just been released.
And I don't know why.
I do know I can fix it.
MKDIR slash run slash HTTPD.
And now a system CTL restart HTTPD.
And a system CTL status HTTPD.
And now we can see that it is active and running.
And that's good.
That is what I wanted it to do.
And now we can get back to our initial test.
And that is the curl localhost, which is showing all of this.
Oh, my goodness.
To understand what is going on, I want to show you what it looks like in Firefox.
So let me go to Firefox because it's a little bit more readable.
And in Firefox, I'm going to HTTP colon colon slash slash localhost.
And there we can see that this is the Red Hat Enterprise Linux test page.
So we do see it has been installed, but we don't get to the document route.
And you know what is going on.
This is what typically is happening if there is some misconfiguration.
So I need to check if the misconfiguration is SELinux or not.
And in any case where SELinux is involved,
the first thing that you are going to do is turn to permissive mode.
Turn to permissive mode.
You don't have to restart anything else.
And repeat the last command.
And ah, there we can see curl localhost.
So what does that mean?
Well, that means that in permissive mode, it works.
And that means that it is because of SELinux.
So as it is because of SELinux, we need to figure out why exactly.
Well, let me already give you a grab.
AVC var on slash var slash log slash audit slash audit dot log.
AVC is the message type that will be logged for anything that relates to SELinux.
And here we have one of the related messages.
Where we can see AVC denied.
AVC denied is indicating that something has been denied by SELinux.
What?
Well, command HTTPD trying to access web index HTML
with the source context HTTPD underscore T
and the target context default underscore T.
And that is what is wrong.
So the source context HTTPD underscore T
does have no permissions to access the target context default underscore T.
So there's two options.
Option number one, you can create a rule in SELinux
to allow HTTPD underscore T to access default underscore T.
That's probably a bad idea because default underscore T
sounds as it is not really a controlled context.
So option number two is probably much better.
You need to set the appropriate context.
Well, if you listened carefully,
then you should know what the appropriate context is.
You can look at the default document route, HTML.
It's HTTPD sys content T.
So make sure it's set to HTTPD sys content T and you should be all right.
In the next video, I'll show you how to do this.