I'm in the process of enabling SELinux on my CentOS 7.3 server. I have it set in permissive mode and monitoring the audit log for denials. I'm looking to implement the minimal set of rules that will allow all that is needed on the server and no more.
So this morning I noticed that httpd would have been blocked from connecting to the network when I used WordPress's FTP update feature last night. audit2why recommends setting either httpd_can_network_relay or httpd_can_network_connect.
I just want to make sure I'm understanding the difference between these two correctly. Would it be accurate to say that httpd_can_network_connect allows httpd to make any outgoing network connection it wishes, whereas httpd_can_network_relay allows only the FTP port and ephemeral ports?
audit2why says:
# setsebool -P httpd_can_network_connect 1
Description: Allow httpd to act as a relay
# setsebool -P httpd_can_network_relay 1
Description: Allow httpd to act as a FTP client connecting to the ftp port and ephemeral ports
If so, how would it go about defining what the ephemeral ports are, or would it just allow anything over 1024?
Is there some more detailed reference on all this that I'm missing?
Update
I misread the order of comments to commands, the above should read:
Description: Allow HTTPD scripts and modules to connect to the network using TCP.
# setsebool -P httpd_can_network_connect 1
Description: Allow httpd to act as a relay
# setsebool -P httpd_can_network_relay 1
--
If so, how would it go about defining what the ephemeral ports are, or would it just allow anything over 1024?
Is there some more detailed reference on all this that I'm missing?