Using the Command 'semanage port' (with examples)

The semanage port command is a part of the SELinux suite used to manage and manipulate SELinux policies. Specifically, it deals with port labeling, which essentially associates network ports with SELinux types, allowing system administrators to manage access controls and enhance the security of services running on these ports. By setting persistent rules, semanage port permits you to customize and secure your network service configurations. Below, we explore four very practical use cases of this command that demonstrate its versatility and necessity in managing SELinux environments.

Use case 1: Listing All Port Labeling Rules

Code:

sudo semanage port -l

Motivation:

One might want to list all port labeling rules to review the existing configurations and understand the current SELinux port settings. It’s crucial for system audits, troubleshooting, or when applying changes to the system. Having visibility into port configurations helps system administrators ensure that ports are appropriately labeled and controlled according to security policies.

Explanation:

• sudo: Run the command with elevated privileges required to manage SELinux policies.
• semanage port: Invokes the SELinux management tool focusing on ports.
• -l|--list: Option to list all defined rules. This includes both system-defined and user-defined rules.

Example Output:

When you run this command, the terminal lists all SELinux port rules, showing which ports are associated with which SELinux types (e.g., ssh_port_t for SSH).

SELinux Port Type              Proto    Port Number
------------------------------------------------------
http_port_t                    tcp      80, 443
ssh_port_t                     tcp      22
dns_port_t                     udp      53

Use case 2: Listing User-Defined Port Labeling Rules without Headings

Code:

sudo semanage port -l -C -n

Motivation:

Sometimes, you may want to focus solely on the custom rules that have been added by the local user. This is particularly valuable during system adjustments or upgrades, where it’s crucial to understand the non-default modifications for export or replication on another system.

Explanation:

• sudo: Executes the command with root permissions.
• semanage port: Initiates the management command for port operations.
• -l|--list: Lists defined rules, similar to the previous example.
• -C|--locallist: Filters the output to only show user-defined rules, bypassing default system entries.
• -n|--noheading: Removes headings from the output, providing a minimalist view that’s cleaner for straightforward reviewing or scripting.

Example Output:

By employing this command, you receive a list of user-added configurations, crucial for tracking custom settings without the distraction of defaults:

some_service_port_t            tcp      22000
another_service_port_t         udp      11940

Use case 3: Adding a User-Defined Rule Assigning a Label to a Protocol-Port Pair

Code:

sudo semanage port -a -t ssh_port_t -p tcp 22000

Motivation:

A prevalent scenario for adding rules arises when new applications require specific SELinux security contexts. For example, adjusting the default SSH port from 22 to 22000 for heightened security demands adding a corresponding SELinux rule so that the SELinux policy permits operations on this non-standard port.

Explanation:

• sudo: Provides administrative access to modify system-level configurations.
• semanage port: Accesses port management functions within SELinux.
• -a|--add: Command to add a new rule or configuration.
• -t|--type ssh_port_t: Specifies the SELinux type; in this case, ssh_port_t for SSH traffic.
• -p|--proto tcp: Designates the protocol in focus, such as TCP or UDP.
• 22000: Indicates the specific port number you’re configuring.

Example Output:

Execution completion without an error message usually confirms successful addition. Following this rule, if you were to list your current rules, you’d see the new port:

Port 22000 added with type ssh_port_t.

Use case 4: Deleting a User-Defined Rule using its Protocol-Port Pair

Code:

sudo semanage port -d -p udp 11940

Motivation:

Removing a user-defined rule becomes essential when certain ports are no longer in use or have changed, ensuring your SELinux policy is aligned with current system requirements. Neglecting to clean up unused port rules can lead to security holes and system vulnerabilities.

Explanation:

• sudo: Grants administrative privilege to modify the configuration.
• semanage port: Targets port management within the SELinux suite.
• -d|--delete: Directive to remove an existing rule from configurations.
• -p|--proto udp: Specifies the protocol applicable to the rule being deleted.
• 11940: The port number that you intend to remove from SELinux assignments.

Example Output:

Successful execution doesn’t typically yield extensive outputs but removes the rule silently. Confirmations follow these via listing commands:

Port 11940 removed.

Conclusion:

The semanage port command is essential for maintaining optimal SELinux functionality by manipulating port labels. Whether you’re listing all rules for a comprehensive view, filtering user additions, adding new assignments for applications, or cleaning configurations, mastery of this command is indispensable for maintaining a secure and efficient SELinux deployment. Each example here provides a practical scenario, ensuring administrators can tailor their systems to exact specifications and maintain robust security.