add mod_selinux spec: I wanted to get rid of the policy module
add mod_selinux spec: I wanted to get rid of the policy module

Directives

The mod_selinux.so supports the following directives.

The selinuxServerDomain need to be a global configuration. Rest of directives can be placed on the discretional location. If we put the multiple directives in a single block, an earlier directive is evaluated earlier on run time, and the rest of directives are checked if the request is not matched to the prior directives.
selinuxServerDomain <domain/range pair>

It specifies the security context of daemon process when starting it up. The mod_selinux.pp policy module adds a range_transition rule to perform it with mcs_systemhigh which is extracted to all the available categories in the base policy. However, in most cases, it is too much for the apache/httpd daemon process.

The selinuxServerDomain directive gives us a chance to drop unnecessary categories during its starting up. The domain/range pair is a colon separatable text. The lefthand of the first colon is used as a domain, and the remaining part is used as a range. If the colon is omitted, whole of the given text is used as a domain. The * has a special meaning which indicates to keep the field as is.

If it is not available to change the security context specified, the mod_selinux.so raises an error and aborts the starting up process.

Example of the directive:

selinuxServerDomain     *:s0-s0:c0.c15

It keeps the domain as is, and set s0-s0:c0.c15 as range.
selinuxDomainMap <mapping file>

It specifies the path of the user/domain mapping file which describes the relationships between authenticated username and a domain/range pair. The mapping file

Example of the directive:

selinuxDomainMap        /var/www/mod_selinux.map

Example of mapping file:

foo                *:s0:c0
var                *:s0:c1
baz                *:s0:c2
__anonymous__      anon_webapp_t:s0
*                  user_webapp_t:s0

The format of the domain/range pair follows the notes in selinuxServerDomain. The __anonymous__ is a special term which matches all the unauthorized requests. The * is also a special term which matches all the authorized and unauthorized requests.
selinuxDomainEnv <environment variable>

It specifies an environment variable which gives a domain/range pair to be assigned on the web application contexts. Some of extra modules support to set up environment variables depending on the attributes of request. The format of the domain/range pair to be delivered follows the notes in selinuxServerDomain.

For example, SetEnvIf directive allows to set up a certain environment variable based on the remote address when it is matched to the given pattern.

Example:

SetEnvIf Remote_Addr "192.168.1.[0-9]+$" SELINUX_DOMAIN=*:s0:c1
SetEnvIf Remote_Addr "192.168.2.[0-9]+$" SELINUX_DOMAIN=*:s0:c2
selinuxDomainEnv    SELINUX_DOMAIN

This example shows a configuration which assigns "s0:c1" for the request come from 192.168.1.0/24, and "s0:c2" from 192.168.2.0/24, but does not anything for the request come from others.
selinuxDomainVal <domain/range pair>

It specifies a domain/range pair to be assigned to the contents handlers. The format of the domain/range pair to be delivered follows the notes in selinuxServerDomain.

In normal cases, it is placed on the tail of the series of configuration to perform as a fallback when the request did not match any prior selinuxDomainMap and selinuxDomainEnv rules.

Example:

SetEnvIf Remote_Addr "192.168.1.[0-9]+$" SELINUX_DOMAIN=*:s0:c1
SetEnvIf Remote_Addr "192.168.2.[0-9]+$" SELINUX_DOMAIN=*:s0:c2
selinuxDomainMap    /var/www/mod_selinux.map      ... (1)
selinuxDomainEnv    SELINUX_DOMAIN                ... (2)
selinuxDomainVal    anon_webapp_t:s0              ... (3)

In this example, the (1) is checked at first. If the given request is matched to any entries within the mapfile, the mod_selinux.so launches the contents handler with the domain/range pair specified. Then, the (2) is checked. The SELINUX_DOMAIN is set based on Remote_Addr, so it may has a valid value, if the request comes from certain networks. Otherwise, the (3) is applied for unmatched requests at (1) and (2). The requests will be launched with anon_webapp_t:s0.
selinuxAllowCaches (on|off)

As the apache/httpd official documentation noted, contents caches work prior to the authentication and domain transition. It means the facility allows users to bypass access controls. In the default, mod_selinux.so disables the content caches as fas as the selinuxAllowCaches is not set to on explicitly.

This directive allows to use the contents cahces, but please understand the risk to set it on before changing it.

Example:

selinuxAllowCaches      On

DefenSec/selinux-rpm-spec