How do you manage SELinux port bindings?

Use semanage port: -a adds a port to a type, -d deletes, -m modifies — e.g. semanage port -a -t http_port_t -p tcp 8080 is what lets Apache legally listen on 8080.

This is the fix for the classic "I changed my service's port and now it won't start under SELinux" problem: the daemon (httpd_t) is only allowed to bind ports labelled http_port_t, so you must add the new port to that type before the bind is permitted. -p selects the protocol (tcp/udp), and semanage port -l -C shows just your local additions versus the policy defaults, which is handy for auditing what you changed.

Add a port label:

semanage port -a -t http_port_t -p tcp 8080

Options:

• -a = add
• -t = type
• -p = protocol (tcp/udp)

View local changes only:

semanage port -l -C

Delete a port label:

semanage port -d -t gopher_port_t -p tcp 71

Modify existing port label:

semanage port -m -t http_port_t -p tcp 71

Example - Allow Apache on port 8443:

# Check current labels
semanage port -l | grep http

# Add new port
semanage port -a -t http_port_t -p tcp 8443

# Verify
semanage port -l -C

Find SELinux documentation:

dnf install selinux-policy-doc
man -k _selinux
man httpd_selinux

Go deeper:

• semanage-port(8) — -a/-t/-p — adding a port to a type (e.g. http_port_t) so a service can bind a non-standard port.