SELinux Port Labels
One objective. Ports are labelled just as files are, and a confined service may only bind to a port whose label its type is allowed to use. The failure is a permission error on a port nothing else is using, which reads like a bug and is policy working.
Security and SELinux Guide 58 of 67 Intermediate
- OSRHEL 10.0
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 13 min
Check the port is genuinely unlabelled before assuming a denial. Many non-obvious ports are already in http_port_t - 8008, 8009, 8443, 9000 among them - so a service on one of those starts with no complaint and demonstrates nothing.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
This guide includes
Use this when a service refuses to bind to a port that is demonstrably free. This matters because SELinux labels ports too - the port is available and the type is simply not permitted to use it.
- finding which ports a type is allowed to use
- meeting the refusal on a port that is free
- labelling the port so the service can bind to it
Before you start
- A sudo-capable account and
httpdinstalled. - The session adds a port label and removes it.
-
Which ports a type may use
-
The refusal
-
Labelling it