Hide Forgot
+++ This bug was initially created as a clone of Bug #723258 +++ The errata package mentioned in bug #723258 adds the workaround which I originally proposed, but did not fully resolve the issue, because the rule /var/www(/.*)?/logs(/.*)? system_u:object_r:httpd_log_t:s0 was not removed from /etc/selinux/targeted/contexts/files, the solution I proposed in comment 5 of bug #723258. Comment 6 replies only to the possibility to have a boolean for this, but does not say anything about the reason why this rule even exists. Description of the remaining problem: The current SELinux "targeted" policy blocks web access to files in directories named "logs" in hierarchies below /var/www/ other than /var/www/html/. This is caused by the following entry in /etc/selinux/targeted/contexts/files/file_contexts: /var/www(/.*)?/logs(/.*)? system_u:object_r:httpd_log_t:s0 We frequently mount additional disk space for web servers on various directories below of /var/www/, The above rule blocks access to parts of the additional web space, without any good reason, because the default setup has the Apache log files in /var/log/httpd/, which does not match this rule. Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-126.el6.noarch How reproducible: Always Steps to Reproduce: 1. Install Apache httpd and selinux-policy-targeted on RHEL-6. 2. Create directory /var/www/vweb1 and configure Apache with a VirtualHost which has /var/www/vweb1 as its DocumentRoot. 3. Create directory /var/www/vweb1/logs/ and some files in it. 4. Try to access the files with a web browser. Actual results: The access fails. Expected results: The files should be processed like any other content in /var/www/vweb1/. Additional info:
One minor correction: The RHEL-6.2 package is selinux-policy-targeted-3.7.19-126.el6_2.3.noarch, but still contains the rule that I'd like to get removed.
I think we should remove these. If there are real world cases where a user needs httpd_log_t under this directory we should setup the labeling for it.
Yeah, thank you.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0780.html