Bug 987590

Summary:	Apache startup fails with misleading error if DocumentRoot has context type user_home_t
Product:	Red Hat Enterprise Linux 6	Reporter:	Joe Thompson <jthompso>
Component:	httpd	Assignee:	Luboš Uhliarik <luhliari>
Status:	CLOSED ERRATA	QA Contact:	Filip Holec <fholec>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.4	CC:	dkutalek, gcheng, jkaluza, jorton, jthompso, psplicha
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	httpd-2.2.15-40.el6	Doc Type:	Bug Fix
Doc Text:	If "DocumentRoot" was a directory with the context type of "user_home_t", the httpd service failed to start with an incorrect error message "DocumentRoot must be a directory". As a consequence, the error message was misleading because the "DocumentRoot" was a directory but not readable because of SELinux context. The misleading error message has been altered, and httpd now shows a more informative error message "DocumentRoot is not a directory, or is not readable" in this scenario.	Story Points:	---
Clone Of:
Clones:	1170220 1207093 1209547 (view as bug list)		Environment:
Last Closed:	2015-07-22 05:52:46 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1170220, 1207093, 1209547

Description Joe Thompson 2013-07-23 18:09:57 UTC

Description of problem:

If DocumentRoot is a directory with the context type user_home_t, the httpd service fails to start up with the error "DocumentRoot must be a directory". This is different from its behavior in other incorrect-context-type cases where it starts up successfully (but access to the content in question is still correctly denied).

Version-Release number of selected component (if applicable): 2.2.15-28

How reproducible: 100%

Steps to Reproduce:

1. Create a directory in a user homedir or otherwise assign it a context as though it had been so created.
2. Move the directory to /
3. Configure Apache's DocumentRoot to point to this directory.
4. [Re]start httpd.

Actual results: httpd startup fails with a misleading error.

Expected results: httpd startup succeeds (matching its behavior in other such cases), or fails with an error that gives correct information.

Additional info:

It would be better if Apache just gave a generic but correct error message like "can't access DocumentRoot". It would be better still if Apache considered the current enforcement status, and if SELinux is enforcing, reported something like "DocumentRoot is not a directory or SELinux is blocking access". Best would be if it considered enforcement status, looked at the directory context and reported something like "DocumentRoot is inaccessible because of bad SELinux context: type is [foo] but must be [bar]".

I understand Fedora's FriendlyEPERM effort has a similar goal:

https://fedoraproject.org/wiki/Features/FriendlyEPERM

However, for RHEL 6 it is probably better to address this case-by-case without reliance on FriendlyEPERM.

Comment 1 Joe Orton 2013-07-24 09:53:17 UTC

Thanks for the report, seems reasonable.  

http://svn.apache.org/viewvc?view=revision&revision=1506474

Comment 10 errata-xmlrpc 2015-07-22 05:52:46 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-1249.html