On Mon, Apr 19, 2010 at 05:53:19PM -0500, Serge E. Hallyn wrote:
Quoting Another Sillyname (anothersname@googlemail.com):
Hi All
OK I've been playing with this for nearly two days now and cannot seem to get it working at all.
In a nutshell.
Standard Apache Server setup...
in /var/www/html I have a subdirectory called reststop and within that is a symbolic link to a directory at /mnt/anotherdrive/newpath/nearlythere/reststop
I have set the permissions chcon -R 775 /var/www/html/reststop I have set the permissions chcon -R 775 /mnt/anotherdrive/newpath/nearlythere/reststop
I have set the se permissions chcon -R -h -t httpd_sys_content_t /var/www/html/reststop I have set the se permissions chcon -R -h -t httpd_sys_content_t /mnt/anotherdrive/newpath/nearlythere/reststop
I have checked the settings using ls -Z and they are correct
I have set the http.conf to allow followsymlinks
If I set selinux to permissive I DO get an error message:-
Summary:
SELinux is preventing access to files with the label, file_t.
Detailed Description:
[SELinux is in permissive mode. This access was not denied.]
SELinux permission checks on files labeled file_t are being denied. file_t is the context the SELinux kernel gives to files that do not have a label. This indicates a serious labeling problem. No files on an SELinux box should ever be labeled file_t. If you have just added a disk drive to the system you can relabel it using the restorecon command. For example if you saved the home directory from a previous installation that did not use SELinux, 'restorecon -R -v /home' will fix the labels. Otherwise you should relabel the entire file system.
Allowing Access:
You can execute the following command as root to relabel your computer system: "touch /.autorelabel; reboot"
Additional Information:
Source Context unconfined_u:system_r:httpd_t:s0 Target Context unconfined_u:object_r:file_t:s0 Target Objects reststop [ dir ] Source httpd Source Path /usr/sbin/httpd Port <Unknown> Host secretsquirrel.com Source RPM Packages httpd-2.2.14-1.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.32-108.fc12 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Plugin Name file Host Name secretsquirrel.com Platform Linux secretsquirrel.com 2.6.32.11-99.fc12.x86_64 #1 SMP Mon Apr 5 19:59:38 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Mon 19 Apr 2010 03:45:40 PM BST Last Seen Mon 19 Apr 2010 03:45:40 PM BST Local ID yadayadayada Line Numbers
Raw Audit Messages
node=secretsquirrel.com type=AVC msg=audit(1288463622.694:23321): avc: denied { read } for pid=3605 comm="httpd" name="reststop" dev=dm-0 ino=340012822 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:file_t:s0 tclass=dir
node=secretsquirrel.com type=SYSCALL msg=audit(1288463622.694:23321): arch=c000003e syscall=2 success=yes exit=16 a0=7f2f691d91c0 a1=90800 a2=7f2f691d5198 a3=7f2f691da150 items=0 ppid=3600 pid=3605 auid=500 uid=48 gid=489 euid=48 suid=48 fsuid=48 egid=489 sgid=489 fsgid=489 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
Why is the error message telling me files are labelled file_t when they are labelled httpd_sys_content_t? To confirm that I ls -RZ | grep file_t in the two directories I get no files returned.
Presumably o follow the symbolic link you need permission to walk the link target's path. Is any directory in the path /mnt/anotherdrive/newpath/nearlythere/reststop of type file_t?
What am I missing here guys? and before anyone suggests it I don't just want to turn selinux off, I want to actually protect my system properly though.
Find the inode: find / -inum 340012822
You say you have mounted some partition in /mnt but the AVC denial says DM-0 I think that this may be related.
If you specified the contexts properly with semanage, then try restorecon -R -v /mnt
The avc denial takes about a dir with type file_t and name reststop on device DM-0 at inode 340012822.
Thanks in advance
selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux