cis-apache-11-2

name	cis-apache-11.2
description	Ensure Apache Processes Run in the httpd_t Confined Context
category	cis-apache
version	3.6.0
author	cyberstrike-official
tags	["cis","apache","linux","selinux","mandatory-access-control","mac"]
cis_id	11.2
cis_benchmark	CIS Apache HTTP Server 2.2 Benchmark v3.6.0
tech_stack	["linux","apache"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure Apache Processes Run in the httpd_t Confined Context

Description

SELinux includes customizable targeted policies that may be used to confine the Apache httpd server to enforce least privileges so the httpd server has only the minimal access to specified directories, files, and network ports. Access is controlled by process types (domains) defined for the httpd process. There are over a hundred individual httpd related types defined in a default Apache SELinux policy, which includes many of the common Apache add-ons and applications such as php, nagios, and smokeping. The default SELinux policies work well for a default Apache installation, but implementation of SELinux targeted policies on a complex or highly customized web server requires a rather significant development and testing effort which comprehends both the workings of SELinux and the detailed operations and requirements of the web application.

All directories and files to be accessed by the web server process must have security labels with appropriate types. The following types are a sample of the most commonly used:

• http_port_t - Network ports allowed for listening
• httpd_sys_content_t - Read access to directories and files with web content
• httpd_log_t - Directories and files to be used for writable log data
• httpd_sys_script_exec_t - Directories and files for executable content.

Rationale

With the proper implementation of SELinux, vulnerabilities in the web application may be prevented from being exploited due to the additional restrictions. For example, a vulnerability that allows an attacker to read inappropriate system files may be prevented from execution by SELinux because the inappropriate files are not labeled as httpd_sys_content_t. Likewise, writing to an unexpected directory or execution of unexpected content can be prevented by similar mandatory security labels enforced by SELinux.

Impact

None documented

Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

Check that all of the Apache httpd processes are confined to the httpd_t SELinux context. The type (the third colon separated field) for each process should be httpd_t. Note that on some platforms, such as Ubuntu, the Apache executable is named apache2 instead of httpd.

$ ps -eZ | grep httpd
unconfined_u:system_r:httpd_t:s0 1366 ? 00:00:00 httpd
unconfined_u:system_r:httpd_t:s0 1368 ? 00:00:00 httpd
. . .

Remediation

Perform the following to implement the recommended state:

If the running httpd processes are not confined to the SELinux context, check the context for the httpd binary and the binary, and set the httpd binary to have a context of and the executable to have a context of , as shown below. Also note that on some platforms, such as Ubuntu, the Apache executable is named apache2 instead of httpd.