1httpd_suexec_selinux(8) SELinux Policy httpd_suexec httpd_suexec_selinux(8)
2
3
4
6 httpd_suexec_selinux - Security Enhanced Linux Policy for the
7 httpd_suexec processes
8
10 Security-Enhanced Linux secures the httpd_suexec processes via flexible
11 mandatory access control.
12
13 The httpd_suexec processes execute with the httpd_suexec_t SELinux
14 type. You can check if you have these processes running by executing
15 the ps command with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep httpd_suexec_t
20
21
22
24 The httpd_suexec_t SELinux type can be entered via the
25 httpd_suexec_exec_t file type.
26
27 The default entrypoint paths for the httpd_suexec_t domain are the fol‐
28 lowing:
29
30 /usr/lib/apache(2)?/suexec(2)?, /usr/lib/cgi-bin/(nph-)?cgiwrap(d)?,
31 /usr/sbin/suexec
32
34 SELinux defines process types (domains) for each process running on the
35 system
36
37 You can see the context of a process using the -Z option to ps
38
39 Policy governs the access confined processes have to files. SELinux
40 httpd_suexec policy is very flexible allowing users to setup their
41 httpd_suexec processes in as secure a method as possible.
42
43 The following process types are defined for httpd_suexec:
44
45 httpd_suexec_t
46
47 Note: semanage permissive -a httpd_suexec_t can be used to make the
48 process type httpd_suexec_t permissive. SELinux does not deny access to
49 permissive process types, but the AVC (SELinux denials) messages are
50 still generated.
51
52
54 SELinux policy is customizable based on least access required.
55 httpd_suexec policy is extremely flexible and has several booleans that
56 allow you to manipulate the policy and run httpd_suexec with the tight‐
57 est access possible.
58
59
60
61 If you want to allow all domains to execute in fips_mode, you must turn
62 on the fips_mode boolean. Enabled by default.
63
64 setsebool -P fips_mode 1
65
66
67
68 If you want to allow httpd to use built in scripting (usually php), you
69 must turn on the httpd_builtin_scripting boolean. Enabled by default.
70
71 setsebool -P httpd_builtin_scripting 1
72
73
74
75 If you want to allow HTTPD scripts and modules to connect to the net‐
76 work using TCP, you must turn on the httpd_can_network_connect boolean.
77 Disabled by default.
78
79 setsebool -P httpd_can_network_connect 1
80
81
82
83 If you want to allow HTTPD scripts and modules to connect to databases
84 over the network, you must turn on the httpd_can_network_connect_db
85 boolean. Disabled by default.
86
87 setsebool -P httpd_can_network_connect_db 1
88
89
90
91 If you want to allow http daemon to send mail, you must turn on the
92 httpd_can_sendmail boolean. Disabled by default.
93
94 setsebool -P httpd_can_sendmail 1
95
96
97
98 If you want to allow httpd cgi support, you must turn on the
99 httpd_enable_cgi boolean. Enabled by default.
100
101 setsebool -P httpd_enable_cgi 1
102
103
104
105 If you want to allow httpd to read home directories, you must turn on
106 the httpd_enable_homedirs boolean. Disabled by default.
107
108 setsebool -P httpd_enable_homedirs 1
109
110
111
112 If you want to allow httpd scripts and modules execmem/execstack, you
113 must turn on the httpd_execmem boolean. Disabled by default.
114
115 setsebool -P httpd_execmem 1
116
117
118
119 If you want to allow httpd to read user content, you must turn on the
120 httpd_read_user_content boolean. Disabled by default.
121
122 setsebool -P httpd_read_user_content 1
123
124
125
126 If you want to unify HTTPD to communicate with the terminal. Needed for
127 entering the passphrase for certificates at the terminal, you must turn
128 on the httpd_tty_comm boolean. Disabled by default.
129
130 setsebool -P httpd_tty_comm 1
131
132
133
134 If you want to allow httpd to access cifs file systems, you must turn
135 on the httpd_use_cifs boolean. Disabled by default.
136
137 setsebool -P httpd_use_cifs 1
138
139
140
141 If you want to allow httpd to access FUSE file systems, you must turn
142 on the httpd_use_fusefs boolean. Disabled by default.
143
144 setsebool -P httpd_use_fusefs 1
145
146
147
148 If you want to allow httpd to access nfs file systems, you must turn on
149 the httpd_use_nfs boolean. Disabled by default.
150
151 setsebool -P httpd_use_nfs 1
152
153
154
155 If you want to allow system to run with NIS, you must turn on the
156 nis_enabled boolean. Disabled by default.
157
158 setsebool -P nis_enabled 1
159
160
161
163 The SELinux process type httpd_suexec_t can manage files labeled with
164 the following file types. The paths listed are the default paths for
165 these file types. Note the processes UID still need to have DAC per‐
166 missions.
167
168 cifs_t
169
170
171 fusefs_t
172
173 /var/run/user/[^/]*/gvfs
174
175 nfs_t
176
177
178
180 SELinux requires files to have an extended attribute to define the file
181 type.
182
183 You can see the context of a file using the -Z option to ls
184
185 Policy governs the access confined processes have to these files.
186 SELinux httpd_suexec policy is very flexible allowing users to setup
187 their httpd_suexec processes in as secure a method as possible.
188
189 STANDARD FILE CONTEXT
190
191 SELinux defines the file context types for the httpd_suexec, if you
192 wanted to store files with these types in a diffent paths, you need to
193 execute the semanage command to sepecify alternate labeling and then
194 use restorecon to put the labels on disk.
195
196 semanage fcontext -a -t httpd_suexec_tmp_t '/srv/myhttpd_suexec_con‐
197 tent(/.*)?'
198 restorecon -R -v /srv/myhttpd_suexec_content
199
200 Note: SELinux often uses regular expressions to specify labels that
201 match multiple files.
202
203 The following file types are defined for httpd_suexec:
204
205
206
207 httpd_suexec_exec_t
208
209 - Set files with the httpd_suexec_exec_t type, if you want to transi‐
210 tion an executable to the httpd_suexec_t domain.
211
212
213 Paths:
214 /usr/lib/apache(2)?/suexec(2)?, /usr/lib/cgi-bin/(nph-)?cgi‐
215 wrap(d)?, /usr/sbin/suexec
216
217
218 httpd_suexec_tmp_t
219
220 - Set files with the httpd_suexec_tmp_t type, if you want to store
221 httpd suexec temporary files in the /tmp directories.
222
223
224
225 Note: File context can be temporarily modified with the chcon command.
226 If you want to permanently change the file context you need to use the
227 semanage fcontext command. This will modify the SELinux labeling data‐
228 base. You will need to use restorecon to apply the labels.
229
230
232 semanage fcontext can also be used to manipulate default file context
233 mappings.
234
235 semanage permissive can also be used to manipulate whether or not a
236 process type is permissive.
237
238 semanage module can also be used to enable/disable/install/remove pol‐
239 icy modules.
240
241 semanage boolean can also be used to manipulate the booleans
242
243
244 system-config-selinux is a GUI tool available to customize SELinux pol‐
245 icy settings.
246
247
249 This manual page was auto-generated using sepolicy manpage .
250
251
253 selinux(8), httpd_suexec(8), semanage(8), restorecon(8), chcon(1),
254 sepolicy(8), setsebool(8)
255
256
257
258httpd_suexec 20-05-05 httpd_suexec_selinux(8)