\begin{exe} {SELinux: Contexts}

   \begin{info}
      This exercise can only be performed on a system (such as
      \textbf{RHEL}) where \textbf{SELinux} is installed.  While it
      is possible to install on \textbf{Debian}-based distributions,
      such as \textbf{Ubuntu}, it is not the easiest task and it
      is not often done.
   \end{info}
   \begin{enumerate}
      \item

      Verify \textbf{SELinux} is enabled and in
      \textbf{enforcing} mode, by executing
      \textbf{getenforce} and \textbf{sestatus}.  If not, edit
      \filelink{/etc/selinux/config}, reboot, and check again.

      \item
      Install the \textbf{httpd} package (if not already
      present) which provides the \textbf{Apache} web
      server, and then verify that it is working:

      \begin{cmd}
$ sudo dnf install  httpd
$ elinks http:/localhost
      \end{cmd}
      (You can also use \textbf{lynx} or \textbf{elinks} etc. as
      the browser, or use your graphical browser such as \textbf{firefox}
      or \textbf{chrome}, in this and succeeding steps.)
      \item
      As superuser, create a small file in
      \filelink{/var/www/html}:
      \begin{cmd}
$ sudo sh -c "echo file1 > /var/www/html/file1.html"
      \end{cmd}
      \item
      Verify you can see it:
      \begin{cmd}
$ elinks -dump http://localhost/file1.html
      \end{cmd}
      \begin{response}
file1
      \end{response}
      Now create another small file in \textbf{root}'s home
      directory and \textbf{move} it to
      \filelink{/var/www/html}.  (Do not copy it, move it!)
      Then try and view it:
      \begin{cmd}
$ sudo cd /root
$ sudo sh -c "echo file2 > file2.html"
$ sudo mv file2.html /var/www/html
$ elinks -dump http://localhost/file2.html
      \end{cmd}
      \begin{response}
                                   Forbidden

   You don't have permission to access /file2.html on this server.
      \end{response}
      \item
      Examine the security contexts:
      \begin{cmd}
$ cd  /var/www/html
$ ls -Z file*html
      \end{cmd}
      \begin{response}
-rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 file1.html
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 file2.html
      \end{response}
      \item
      Change the offending context and view again:
      \begin{cmd}
$ sudo chcon -t httpd_sys_content_t file2.html
$ elinks http://localhost/file2.html
      \end{cmd}
      \begin{response}
file2
      \end{response}
   \end{enumerate}

\end{exe}

