On 09/29/2017 03:30 PM, Lukas Vrabec wrote:
I'm planning change the default value of httpd_graceful_shutdown
in Fedora Rawhide because of improving SELinux configuration. Rawhide
builds with this change will be available in ~5 days.
Together with Dan Walsh, we agreed on that httpd_graceful_shutdown
boolean should be by default turned off. This boolean allows HTTPD to
connect to port 80 for graceful shutdown, but it's breaking the
functionality of another boolean called: httpd_can_network_connect. This
boolean allows HTTPD scripts and modules to connect to the network using
TCP and it's turned off by default.
Turning this boolean off can cause some troubles, on web-servers where
processes with httpd_t SELinux domain connecting to tcp ports: 80, 81,
443, 488, 8008, 8009, 8443, 9000
If you would like to turn in on again, use semanage command:
# semanage boolean -m --on httpd_graceful_shutdown
If you have any questions, feel free to contact me.
This change is already in Fedora Rawhide. I had discussion with Dan
Walsh and Joe Orton (apache maintainer) about this and I would be great
have it also in Fedora 27.
Users, upgrading from F26 to F27 won't be affected (we change only
default value of boolean not a actual value), but fresh installs will be
affected. Apache in default configuration doesn't need this boolean
anymore and as I said above, this is big security improvement. Is it
somehow possible to push it into F27 ?
Software Engineer, Security Technologies
Red Hat, Inc.