Bug 143490
| Summary: | SELinux FAQ - mention chcon, use apache as example? | ||
|---|---|---|---|
| Product: | [Retired] Fedora Documentation | Reporter: | Idcmp <redhat> |
| Component: | selinux-faq | Assignee: | Karsten Wade <kwade> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Tammy Fox <tammy.c.fox> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | devel | Keywords: | FutureFeature |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://people.redhat.com/kwade/fedora-docs/selinux-faq-en/ | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Enhancement | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2004-12-31 17:56:34 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 118757 | ||
|
Description
Idcmp
2004-12-21 16:57:12 UTC
Set to block tracker bug#118757. I'll include this addition in the next round of updates. Included in 1.3-5, coming live soon. Forgot to include the text as it appears in the FAQ. ## begin new Q/A Q: How do I make a user public_html directory work under SELinux? A: This process presumes that you have enabled user public HTML directories in Apache HTTP configuration (/etc/httpd/conf/httpd.conf). This process only covers serving static Web content. For more information about Apache HTTP and SELinux, refer to http://fedora.redhat.com/docs/selinux-apache-fc3/. 1. If you do not already have one, you will need to create the public_html directory and populate it with the files and folders to be served. cd ~ mkdir public_html cp /path/to/content ~/public_html 2. At this point, httpd is configured to serve the contents, but you will still receive a 403 forbidden error. This is because httpd is not allowed to read the security type for the directory and files as they are created in the user's home directory. To solve this, change the security context of the folder and its contents recursively using the -R option: ls -Z -d drwxrwxr-x auser auser user_u:object_r:user_home_t public_html chcon -R -t httpd_user_content_t ls -Z -d public_html/ drwxrwxr-x auser auser user_u:object_r:httpd_user_content_t public_html/ ls -Z public_html/ -rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t bar.html -rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t baz.html -rw-rw-r-- auser auser user_u:object_r:httpd_user_content_t foo.html You may notice at a later date that the user field, set here to user_u, is changed to system_u. This does not affect how the targeted policy works; the field that matters is the type field. 3. You should now be able to serve the static webpages. If you continueto have errors, check to see that the Boolean that enables user home directories is enabled. This can be set using system-config-securitylevel, under the SELinux tab within the Modify SELinux Policy area, enabling Allow HTTPD to read home directories. The changes take effect immediately. ## 30 ## |