Ubuntu系统下SELinux端口配置全攻略：安全与效率两不误

Allowing access to ports through SELinux is one of the things that came across while setting up Elasticsearch cluster on Cent OS servers and I wanted to share a quick run down of steps/commands required to allow a port through the firewall.

基本上，透過了解 SELinux 的三種模式 (disabled, permissive, enforcing)、功能規範開放與否 (getsebool, setsebool)、 安全本文的修改 (chcon, restorecon, semanage fcontext)，以及埠口規範 (semanage port) 的方法， 對於 SELinux 的管理，大概就不會差太多了！

在Ubuntu系统中，合理配置SELinux端口对于保障系统安全至关重要。 本文将详细介绍如何在Ubuntu系统下配置SELinux端口，确保安全与效率两不误。

To prevent consequent SELinux denials, follow the steps in this procedure to adjust your system’s SELinux policy. The httpd package is installed and the Apache HTTP server is configured to listen on TCP port 3131 and to use the /var/test_www/ direct

当应用程序服务器开始监听端口号时，selinux会检查端口号的安全上下文scontext类型和程序的源secontext类型，如果发现程序并没有绑定该端口号的权限，例如发现该端口号只属于保留端口号，则会禁止deny程序绑定端口的操作，导致服务器无法正常启动。 此时可以通过semanage来增加需要绑定的端口的secontext类型，例如给82端口增加类型，这样服务器程序就具有82端口的绑定权限了。

semanage port -a -t http_port_t -p tcp 16700 is the correct action to allow the port in SELinux. If it "doesn't work" then you need to figure out why. Check the error messages you may have received, check the audit log, check the rest of the

On a SELinux enabled machine, in order to use any port other than the default ports in the Session Monitor, add the port in the SELinux port list using the following commands. Run this command that allows SELinux-specific service and adds the port number.