Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i am running centos 6.2

recently i noticed that apache was running with selinux enabled

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=Permissive
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

i noticed that these errors were coming on dmesg

type=1400 audit(1354453732.704:9056368): avc:  denied  { name_connect } for  pid=39006 comm="httpd" dest=11211 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:memcache_port_t:s0 tclass=tcp_socket
type=1400 audit(1354453735.777:9056369): avc:  denied  { name_connect } for  pid=39046 comm="httpd" dest=6379 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket

i then enabled

 /usr/sbin/setsebool httpd_can_network_connect=1

and this stopped the errors and also the webpages started to work.

My question is if selinux is in permissive mode will selinuxtype=targeted enforce any polices?

if not how did it solve the problem with apache as selinux was already in permissive mode?

share|improve this question
add comment

2 Answers 2

In permissive mode, SElinux will log items which would have resulted in denial of access in enforcing mode, but will not actually deny those actions. So no, it will not enforce policies in permissive mode, but it will consult those policies. Had you been in enforcing mode, you would not have been able to start/use httpd until you issued the setsebool command since the link between it and a network connection would have been prevented by SELinux.

share|improve this answer
add comment

As already answered by John, SELinux just logs the errors, instead of blocking services.

We use SElinux in scenarios where we would like to test things before deploying them into the production and would like to understand what all could went wrong.

Though you can test the same in production also, and keep fixing the policies until the time you are sure that everything is in place and later on change the mode to targeted.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.