Tweaking the policy with semanage

As we introduced earlier, the targeted policy contains some configurations that are enforced for the services it has defined, allowing the protection of those services while not interfering with the ones it does not know about.

Still, sometimes we need to tweak a number of settings, such as allowing http or the ssh daemon to listen on alternate ports or accessing some other file types, but without losing the additional layer of protection provided by SELinux.

First, let's ensure that policycoreutils and policycoreutils-python-utils are installed in our system with dnf –y install policycoreutils-python-utils policycoreutils as they provide the tools we will use in this and the next sections of this chapter.

Let's learn with the help of an example. Let's see which ports httpd_t can access with semanage port -l|grep http:

http_cache_port_t             &...