Using source address mapping to decide on contexts
The mod_selinux Apache module has access to other information than just the username (in case of authenticated users). It can access environment variables (which are used in the Apache web configuration through the SetEnvIf directives), allowing a very flexible approach on SELinux context handling within the application.
In this recipe, we will use this to change the context of request handlers based on the remote IP address of the client.
How to do it…
Alongside web users, we can also use source address information to decide on the context. This is done by completing the following steps:
- First, we define the
TARGETDOMAINenvironment variable based on the remote IP address in the web server configuration ...
Get SELinux Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
