Show Table of Contents
2.6. SELinux Policies
For each of the RPMs listed in the table, specific SELinux policies are installed and applied as a default.
Table 2.1. RPMs and Default SELinux Policies
| Name | Port Information | Policy Information |
|---|---|---|
| mod_cluster | Two ports (6666 for TCP and 23364 for UDP) are added for httpd_port_t to allow the httpd process to use them. | A post installation script configures the context mapping for /var/cache/mod_cluster to enable the httpd process to write at this location. |
| mod_snmp | The installed mod_snmp policy allows httpd processes to bind to snmp_port_t ports. This allows httpd to use port 161 and 162 (used with both UDP and TCP). | A post installation script configures the context mapping for /var/cache/mod_snmp to enable the httpd process to write at this location. |
| tomcat | Four ports are added to http_port_t (TCP ports 8080, 8005, 8009 and 8443) to allow the httpd process to use them. | The Tomcat{version} policy is installed, which sets ths appropriate SELinux domain for the process when Tomcat executes. It also sets the appropriate contexts to allow tomcat to write to /var/lib/tomcat{version}, /var/log/tomcat{version}, /var/cache/tomcat{version} and /var/run/tomcat{version}.pid. |
For more information about using SELinux and other Red Hat Enterprise Linux security information, see the Red Hat Enterprise Linux 6 Security Guide.
2.6.1. Default SELinux Policies for a ZIP Installation
No SELinux configuration is provided (or supported) as a default for the JBoss Enterprise Web Server ZIP files. For the ZIP files,
httpd and Tomcat processes run in httpd_t or unconfined_java_t domains. These domains do not confine the processes, therefore the administrator must take the following security precautions:
- Run
httpdusing theapachectlscript. This ensures that the userapacheowns the processed instead of the userroot. - Confine file access for users
tomcatandapacheto files and directories that are not necessary to the JBoss Enterprise Web Server runtime. - Do not run Tomcat as the user
root.
To avoid the listed security suggestions, it is recommended to use the RPM version of the JBoss Enterprise Web Server installation.
Where did the comment section go?
Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.