Hands-on Lab·Red Hat Certified System Administrator
SELinux Port Labels
One objective. Ports are labelled just as files are, and a confined service may only bind to a port whose label its type is allowed to use. The failure is a permission error on a port nothing else is using, which reads like a bug and is policy working.
Security and SELinux Guide 58 of 67 Intermediate
- OSRHEL 10.0 (Coughlan)
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 13 min
- Reviewed23 August 2026
Written against the versions above. Check the port is genuinely unlabelled before assuming a denial. Many non-obvious ports are already in `http_port_t` - 8008, 8009, 8443, 9000 among them - so a service on one of those starts with no complaint and demonstrates nothing.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 (Coughlan) | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
Before you start
- A sudo-capable account and
httpdinstalled. - The session adds a port label and removes it.
-
Which ports a type may use
-
The refusal
-
Labelling it