SELinux Cookbook

Starting Apache with limited clearance

In the previous chapter, we manipulated the /etc/rc.d/init.d/httpd init script to use runcon in order for the web server to run with a limited clearance. But with the help of mod_selinux, this can be made configurable.

How to do it…

In order to start Apache with limited security clearance, follow the given steps:

1. Edit the Apache web server configuration file (httpd.conf) and add in the following code:

   <IfModule mod_selinux.c>
     selinuxServerDomain *:s0-s0:c0.c10
   </IfModule>

2. Undo the changes made to the service script in the previous chapter.
3. Restart the web server and confirm that it is running with the s0-s0:c0.c10 clearance by issuing the following commands:

   ~# /etc/rc.d/init.d/httpd restart
   ~# ps -efZ | grep httpd ...