File contexts and port labels

The idea

Every file gets its label from rules, not from where you decided to put it. The policy contains a table that maps path patterns to types: /var/www(/.*)? is httpd_sys_content_t, /etc/shadow is shadow_t, and so on. Directories outside any pattern (like /web) get the generic default_t, which confined services may not touch.

Two ways to change a label, and only one lasts:

Command	Effect	Survives restorecon / relabel?
chcon -t TYPE PATH	Sets the label on the file now	No
semanage fcontext -a -t TYPE 'PATTERN' + restorecon -R PATH	Adds a rule, then applies it	Yes

The pattern is a regular expression. To cover a directory and everything below it, write '/web(/.*)?': the directory itself, or a slash followed by anything. Quote it so the shell does not touch the parentheses.

restorecon sets files to what the rules say. Useful switches: -R recursive, -v print each change, -n dry run. Run it on anything you moved, extracted from an archive, or restored from backup, because those carry old labels. A reboot with /.autorelabel present relabels the entire disk, which is the heavy hammer.

semanage fcontext -a -e /var/www /web is a shortcut worth knowing: it declares /web equivalent to /var/www, so everything under it gets the same labels as the standard web root, including different types for CGI or writable directories.

Edit, apply, verify

semanage fcontext -a -t httpd_sys_content_t '/web(/.*)?'   # write the rule
restorecon -Rv /web                                         # apply it
ls -Zd /web ; ls -Z /web                                    # check
semanage fcontext -C -l                                     # list local customisations

semanage fcontext -d deletes a rule, -m modifies one.

Ports

Network ports are labelled too. semanage port -l lists which port numbers each service type may use: http_port_t covers 80, 81, 443, 488, 8008, 8009, 8443, 9000. If a confined daemon tries to bind to a port outside its type, SELinux refuses, and the service fails to start with Permission denied. The fix is to add the port to the type:

semanage port -a -t http_port_t -p tcp 8888

Use -a to add a port that has no label yet, and -m to move one that is already assigned to another type. -d removes your addition. These are stored permanently. The firewall is separate: an open port that SELinux forbids, or a permitted port that the firewall blocks, both fail but with different symptoms (a service that won’t start, versus a connection that times out).

Try it

sudo mkdir -p /web && echo 'custom root' | sudo tee /web/index.html
curl -s -o /dev/null -w '%{http_code}\n' http://localhost/
ls -Zd /web /web/index.html

custom root
403
unconfined_u:object_r:default_t:s0 /web
unconfined_u:object_r:default_t:s0 /web/index.html

default_t: httpd is not allowed there. The audit log confirms it:

sudo ausearch -m avc -ts recent | tail -1

type=AVC msg=audit(1762170312.114:312): avc:  denied  { read } for  pid=3401 comm="httpd" name="index.html" dev="vda3" ino=134 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0

Read it as a sentence: the process type httpd_t was denied read on a file of type default_t.

The fix that lasts

sudo semanage fcontext -a -t httpd_sys_content_t '/web(/.*)?'
sudo restorecon -Rv /web
curl -s http://localhost/

Relabeled /web from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
Relabeled /web/index.html from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
custom root

Why chcon is a trap

sudo chcon -t default_t /web/index.html
sudo restorecon -Rv /web

Relabeled /web/index.html from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

restorecon returned the label to what the rule says. Had you fixed the original problem with chcon -t httpd_sys_content_t /web, the next relabel (or the exam’s automatic check that runs restorecon) would revert it and break the site.

Moved versus copied

echo m | sudo tee /tmp/moved.html /tmp/copied.html >/dev/null
sudo mv /tmp/moved.html /web/
sudo cp /tmp/copied.html /web/
ls -Z /web
sudo restorecon -nv /web

unconfined_u:object_r:httpd_sys_content_t:s0 copied.html
unconfined_u:object_r:httpd_sys_content_t:s0 index.html
unconfined_u:object_r:user_tmp_t:s0 moved.html
Would relabel /web/moved.html from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

A port the policy does not know

echo 'Listen 8888' | sudo tee /etc/httpd/conf.d/port8888.conf
sudo systemctl restart httpd
sudo journalctl -u httpd -n 2 --no-pager

Nov 03 15:12:40 node1 httpd[4410]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:8888
Nov 03 15:12:40 node1 systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE

Permission denied for a root-started daemon is the SELinux signature. Fix and verify:

sudo semanage port -a -t http_port_t -p tcp 8888
sudo systemctl restart httpd
sudo firewall-cmd --permanent --add-port=8888/tcp
sudo firewall-cmd --reload
ss -tlnp | grep 8888

LISTEN 0 511 *:8888 *:* users:(("httpd",pid=4602,fd=4))

Going further

semanage fcontext -l -C and semanage port -l -C show only your own additions, which is exactly what to read when auditing a system someone else configured. semanage export > rules.txt and semanage import move custom rules between hosts. For a writable area for the web server use httpd_sys_rw_content_t; for scripts, httpd_sys_script_exec_t. matchpathcon -V PATH verifies an actual label against the policy. restorecon -Rv / is not a quick fix: relabel specific trees, or schedule a full relabel with touch /.autorelabel and a reboot.