· about 50 minutes · runs on rocky-10 · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
The team moved the internal status site to this server. nginx now serves it from /srv/status
on port 8090, and proxies /api/ to a small status service on 127.0.0.1:9100.
It does not work. nginx does not stay up, nothing is logged that makes sense to anyone, and when
it did run for a moment the page was "403 Forbidden" and /api/ was "502 Bad Gateway".
The same change request also asked for this server to be known as web01.lab.example with an
additional address 192.168.5.50/24 on eth0. Someone did that by hand. It did not survive
the last reboot.
What is expected, and graded:
http://127.0.0.1:8090/ serves the page from /srv/status.http://127.0.0.1:8090/api/status returns the status service's answer through nginx./srv/status have the right SELinux context — one that a full relabel keeps.The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_site_served_on_8090 | Manage SELinux port labels |
| 02_api_reached_through_nginx | Use Boolean settings to modify system SELinux settings |
| 03_contexts_survive_relabel | Restore default file contexts |
| 04_firewall_open_persistently | Configure firewall settings using firewall-cmd/firewalld |
| 05_network_config_persistent | Configure IPv4 and IPv6 addresses |
| 06_selinux_enforcing | Set enforcing and permissive modes for SELinux |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
man 8 ausearchman 8 semanage-portman 8 getseboolman 8 setseboolman 8 semanage-fcontextman 8 restoreconman 1 firewall-cmdman 1 nmcliman 1 hostnamectlman 8 selinux4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
Why is `chcon -t httpd_sys_content_t /srv/site` not a lasting fix?
A relabel or restorecon sets the context back to what the policy's rules say
The label survives a reboot, but the policy still maps /srv/site to another type, so the next restorecon or full relabel undoes it. semanage fcontext -a changes the rule; restorecon then applies it.
man 8 semanage-fcontext · man 8 restorecon
nginx cannot bind port 8090 and SELinux logs a denial. What is the fix that keeps SELinux enforcing?
semanage port -a -t http_port_t -p tcp 8090
The policy lets httpd_t bind ports labelled http_port_t; labelling 8090 extends that. The firewall controls traffic, not binding, and ports are not files.
man 8 semanage-port
What does the -P in `setsebool -P httpd_can_network_connect on` do?
Makes the change persistent across reboots
Without -P the boolean changes in the running policy only and resets at boot. With -P it is written to the policy store as well.
man 8 setsebool