1、啟用SELinux策略并安裝httpd服務(wù)饮潦，改變網(wǎng)站的默認主目錄為/website,添加SELinux文件標簽規(guī)則，使網(wǎng)站可訪問

開啟selinux
安裝httpd服務(wù)
[root@centos6 app]#mkdir website   ---創(chuàng)建一個website目錄
[root@centos6 app]#cd website/
[root@centos6 website]#vim index.html   ---制作一個網(wǎng)頁標簽
  1 <h1>/app/website/index.html</h1>
[root@centos6 website]#vim /etc/httpd/conf/httpd.conf  ---修改httpd的配置文件，將默認主目錄設(shè)置為新建的目錄
 279 # UseCanonicalName: Determines how Apache constructs self-referencing 
 280 # URLs and the SERVER_NAME and SERVER_PORT variables.
 281 # When set "Off", Apache will use the Hostname and Port supplied
 282 # by the client.  When set "On", Apache will use the value of the
 283 # ServerName directive.
 284 #
 285 UseCanonicalName Off
 286 
 287 #
 288 # DocumentRoot: The directory out of which you will serve your
 289 # documents. By default, all requests are taken from this directory, but
 290 # symbolic links and aliases may be used to point to other locations.
 291 #
 292 #DocumentRoot "/var/www/html"   ---把這一行注釋掉
 293 
 294 DocumentRoot "/app/website"    ---增加一個路徑
 295 
 296 
 297 #
 298 # Each directory to which Apache has access can be configured with respect
 299 # to which services and features are allowed and/or disabled in that
 300 # directory (and its subdirectories). 
 301 #
 302 # First, we configure the "default" to be a very restrictive set of 
 303 # features.  
 304 #
 305 <Directory />
 306     Options FollowSymLinks
"/etc/httpd/conf/httpd.conf" 1012L, 34450C written  
[root@centos6 website]#service httpd restart ---重啟網(wǎng)絡(luò)服務(wù)，讓配置文件生效，此時我們無法在訪問網(wǎng)頁了
[root@centos6 html]#ll -Z
-rw-r--r--. root root system_u:object_r:httpd_sys_content_t:s0 index.html   ---查看一下原來的安全標簽
[root@centos6 html]#semanage fcontext -a -t httpd_sys_content_t "/app/website(/.*)?"    ---把website這個目錄的安全標簽也改為
和/var/www/httpd/目錄一樣，并添加到selinux數(shù)據(jù)庫中凌节，也就是變成
期望的安全標簽
[root@centos6 html]#restorecon -R /app/website/   ---將這個目錄設(shè)置為系統(tǒng)期望的安全標簽
這樣就可以訪問了

2、修改上述網(wǎng)站的http端口為9527洒试，增加SELinux端口標簽倍奢，使網(wǎng)站可訪問

[root@redhat7 html]#semanage port -l |grep "http"  ---查看一下系統(tǒng)期望的端口號
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t            tcp      5988
pegasus_https_port_t           tcp      5989
[root@redhat7 html]#semanage port -a -t http_port_t -p tcp 9527  ---添加端口9527到期望的端口號
[root@redhat7 html]#semanage port -l |grep "http"
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
http_port_t                    tcp      9527, 80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t            tcp      5988
pegasus_https_port_t           tcp      5989
[root@redhat7 html]#systemctl restart httpd  ---重啟網(wǎng)絡(luò)服務(wù)

3、啟用相關(guān)的SELinux布爾值垒棋，使上述網(wǎng)站的用戶student的家目錄可通過http訪問

[root@redhat7 html]#setsebool httpd_enable_homedirs on ---修改布爾值
[root@redhat7 html]#getsebool -a |grep home  ---查看布爾值
git_cgi_enable_homedirs --> off
git_system_enable_homedirs --> off
httpd_enable_homedirs --> on

4娱挨、編寫腳本selinux.sh，實現(xiàn)開啟或禁用SELinux功能

#!/bin/bash
#
#chkconfig:2345 90 10
selinuxon () {
                      setenforce 1
                  source /etc/init.d/functions
                      action "selinux start successful!" true
}
selinuxoff () {
                         setenforce 0
                  source /etc/init.d/functions
                      action "selinux stop successful!" true
}
case $1 in
      start) if [ `getenforce` == Permissive ];then
                  selinuxon
                
              else
                      echo "selinux is start before"
             fi
            ;;
      stop)    if [ `getenforce` == Enforcing ];then
                  selinuxoff
                  else
                      echo "selinux is stopped before"
                 fi
           ;;
       *) echo "the usage: start|stop"&&exit 100
             ;;
esac