On 04/21/2009 07:31 AM, Tony Molloy wrote:
Hi,
If I have a top level non default directory say for argument called /data. This directory contains various scripts and text files which should be available to everyone. Now when I do an install it gets the default selinux context file_t. But this generates lots of AVC's if I set selinux to enforcing. What should I label this directory as.
Regards,
Tony
You should never get a file/directory labeled file_t. These should only be able to be created on machines without SELInux. file_t means no label at all. If you run restorecon on /data it will get assigned default_t.
restorecon -R -v /data
This label should be available to the unconfined user and not available to any confined domain. That will probably fix most of your avc's If you wanted to label it like a home directory you could set it's labeling to user_home_t.
# semanage fcontext -a -t user_home_t '/data(/.*)?' # restorecon -R -v /data
This would allow all confined domains that have access to the home directory access to these files. If you want to give access to apache, you might need to assign a different context.