1、启用SELinux策略并安装httpd服务，改变网站的默认主目录为/website,添加SELinux文件标签规则，使网站可访问
开启selinux
安装httpd服务
[root@centos6 app]#mkdir website ---创建一个website目录
[root@centos6 app]#cd website/
[root@centos6 website]#vim index.html ---制作一个网页标签
1 <h1>/app/website/index.html</h1>
[root@centos6 website]#vim /etc/httpd/conf/httpd.conf ---修改httpd的配置文件，将默认主目录设置为新建的目录
279 # UseCanonicalName: Determines how Apache constructs self-referencing
280 # URLs and the SERVER_NAME and SERVER_PORT variables.
281 # When set "Off", Apache will use the Hostname and Port supplied
282 # by the client. When set "On", Apache will use the value of the
283 # ServerName directive.
284 #
285 UseCanonicalName Off
286
287 #
288 # DocumentRoot: The directory out of which you will serve your
289 # documents. By default, all requests are taken from this directory, but
290 # symbolic links and aliases may be used to point to other locations.
291 #
292 #DocumentRoot "/var/www/html" ---把这一行注释掉
293
294 DocumentRoot "/app/website" ---增加一个路径
295
296
297 #
298 # Each directory to which Apache has access can be configured with respect
299 # to which services and features are allowed and/or disabled in that
300 # directory (and its subdirectories).
301 #
302 # First, we configure the "default" to be a very restrictive set of
303 # features.
304 #
305 <Directory />
306 Options FollowSymLinks
"/etc/httpd/conf/httpd.conf" 1012L, 34450C written
[root@centos6 website]#service httpd restart ---重启网络服务，让配置文件生效，此时我们无法在访问网页了
[root@centos6 html]#ll -Z
-rw-r--r--. root root system_u:object_r:httpd_sys_content_t:s0 index.html ---查看一下原来的安全标签
[root@centos6 html]#semanage fcontext -a -t httpd_sys_content_t "/app/website(/.*)?" ---把website这个目录的安全标签也改为
和/var/www/httpd/目录一样，并添加到selinux数据库中，也就是变成
期望的安全标签
[root@centos6 html]#restorecon -R /app/website/ ---将这个目录设置为系统期望的安全标签
这样就可以访问了
2、修改上述网站的http端口为9527，增加SELinux端口标签，使网站可访问
[root@redhat7 html]#semanage port -l |grep "http" ---查看一下系统期望的端口号
http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
http_cache_port_t udp 3130
http_port_t tcp 80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t tcp 5988
pegasus_https_port_t tcp 5989
[root@redhat7 html]#semanage port -a -t http_port_t -p tcp 9527 ---添加端口9527到期望的端口号
[root@redhat7 html]#semanage port -l |grep "http"
http_cache_port_t tcp 8080, 8118, 8123, 10001-10010
http_cache_port_t udp 3130
http_port_t tcp 9527, 80, 81, 443, 488, 8008, 8009, 8443, 9000
pegasus_http_port_t tcp 5988
pegasus_https_port_t tcp 5989
[root@redhat7 html]#systemctl restart httpd ---重启网络服务
3、启用相关的SELinux布尔值，使上述网站的用户student的家目录可通过http访问
[root@redhat7 html]#setsebool httpd_enable_homedirs on ---修改布尔值
[root@redhat7 html]#getsebool -a |grep home ---查看布尔值
git_cgi_enable_homedirs --> off
git_system_enable_homedirs --> off
httpd_enable_homedirs --> on
4、编写脚本selinux.sh，实现开启或禁用SELinux功能
#!/bin/bash
#
#chkconfig:2345 90 10
selinuxon () {
setenforce 1
source /etc/init.d/functions
action "selinux start successful!" true
}
selinuxoff () {
setenforce 0
source /etc/init.d/functions
action "selinux stop successful!" true
}
case $1 in
start) if [ `getenforce` == Permissive ];then
selinuxon
else
echo "selinux is start before"
fi
;;
stop) if [ `getenforce` == Enforcing ];then
selinuxoff
else
echo "selinux is stopped before"
fi
;;
*) echo "the usage: start|stop"&&exit 100
;;
esac
