Exercise: SELinux on web content

Tasks

1. Create /srv/web/index.html with some text.
2. Configure nginx to serve /srv/web on port 80.
3. Fix SELinux without disabling it and without chcon.
4. Prove the page is served with 200.

Verify

ls -dZ /srv/web                # httpd_sys_content_t
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/
getenforce                     # Enforcing

Solution

sudo mkdir -p /srv/web && echo 'hello' | sudo tee /srv/web/index.html
sudo tee /etc/nginx/conf.d/lab.conf >/dev/null <<'EOF'
server { listen 80 default_server; server_name _; root /srv/web; }
EOF
sudo semanage fcontext -a -t httpd_sys_content_t '/srv/web(/.*)?'
sudo restorecon -Rv /srv/web
sudo nginx -t && sudo systemctl enable --now nginx

If 403 persists: ausearch -m AVC -ts recent (SELinux) or ls -la /srv /srv/web (POSIX permissions).