Red Hat Enterprise Linux 5 Administration Unleashed

476CHAPTER 23Protecting Against Intruders with Security-Enhanced LinuxFIGURE 23.5Adding Default Security ContextNOTEThe restorecon command can be used to manually relabel a filesystem using thedefault security contexts.To perform the same action on the command line, execute the following command as theroot user:semanage fcontext -a -t httpd_sys_content_t ‘/home/html(/.*)?’Either method creates the /etc/selinux//contexts/files/file_contexts.localfile if it doesn’t already exist and adds the following line to it:/home/html(/.*)?system_u:object_r:httpd_sys_content_t:s0If you require additional security contexts such as httpd_sys_script_exec_t for acgi_bin directory, add those as well.SummaryImplemented at the kernel level, SELinux provides the ability to define a policy fromwhich the SELinux mechanism allows or denies file access to specific users and processes.The default policy in Red Hat Enterprise Linux, the targeted policy, restricts access toparticular processes so that the security layer does not interfere with the day-to-day activitiesof most users. Basic options such as turning off protection for specific daemons andallowing certain service features that may be insecure can be enabled and disabledwithout writing a new policy.