===== Beispiel: Webserver auf anderem Port =====
Pakete: httpd

''/etc/httpd/conf/httpd.conf'' :
<file>
Listen 88
</file>

  service httpd start

-> Fehler

==== Ursache ====

/var/log/audit/audit.log:

<file>
type=AVC msg=audit(1404208507.970:1184): avc:  denied  { name_bind } for  pid=3907 comm="httpd" src=88 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:kerberos_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1404208507.970:1184): arch=c000003e syscall=49 success=no exit=-13 a0=4 a1=7f8dbbdcd820 a2=1c a3=7fff56fc58a0 items=0 ppid=3906 pid=3907 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=4 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1404208507.971:1185): avc:  denied  { name_bind } for  pid=3907 comm="httpd" src=88 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:kerberos_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1404208507.971:1185): arch=c000003e syscall=49 success=no exit=-13 a0=3 a1=7f8dbbdcd760 a2=10 a3=7fff56fc5b0c items=0 ppid=3906 pid=3907 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=4 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
</file>

scontext = source context
tcontext = target context

==== Lösungsmöglichkeit: SELinux abschalten ====
  setenforce 0
  service httpd start

==== Lösungsmöglichkeit: SELinux audit2allow ====
  setenforce permissive
  service httpd start

  cp -a /var/log/audit/audit.log /tmp/audit.log
  vim /tmp/audit.log
entsprechende Zeilen aus ''/tmp/audit.log'' heraussuchen:
<file>
type=AVC msg=audit(1404208813.307:1194): avc:  denied  { name_bind } for  pid=3960 comm="httpd" src=88 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:kerberos_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1404208813.307:1194): arch=c000003e syscall=49 success=yes exit=0 a0=4 a1=7f0c8a9b3820 a2=1c a3=7fff7a5dac30 items=0 ppid=3959 pid=3960 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=4 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
</file>
  cat /tmp/audit.log  | audit2why
  cat /tmp/audit.log  | audit2allow -M httpd_listen88
  semodule -i httpd_listen88.pp
  setenforce enforcing
  semodule -l | grep  httpd_listen88

==== Lösungsmöglichkeit: SELinux booleans? ====
  setenforce enforcing

==== Lösungsmöglichkeit: SELinux semanage ====
  semanage port -l | grep  http
  semanage port -a -t http_port_t -p tcp 88