On 04/04/2012 01:05 AM, Mike Chan wrote:
> *From:* Tam Nguyen:
Mike,
the link provided some clues, but you got to put them together. For
example, in your vhost configuration, you need to have this parameter,
which mentioned in the discussion:
Options FollowSymLinks
but that alone is not enough. If the original file is on your local
server, then you need to validate its SELinux security context type to
match your vhost's SELinux security context type.
This is what you need:
httpd_sys_content_t
>
> Hi Tam,
> I m sorry the discussion in the link did not mention SELinux. How do I
> find this SELinux type? I am not familiar with SELinux.
Mike,
This depends on where your document root is for your vhost. If your html
files are in /var/www/html someplace then you should be OK with the
normal SELinux settings. If your html files are in
/home/yourname/public-html or some place like that you will need to
change the SELinux context for the directory tree that the html files
are in *and* you will need to set some SELinux booleans that give Apache
permission to see outside of /var/www.
A quick rundown on SELinux permissions:
An "SELinux context" is just like another type of file permission, but
it is more detailed. Normal Unix file permissions look like this (using
the command "ls -l"):
[ceverett@taco www]$ ls -l
drwxr-xr-x. 4 root root 4096 Mar 19 15:37 stat
drwxr-xr-x. 2 root root 4096 Apr 3 00:07 wsgi-sc
The "drwxr-xr-x" part is the normal permissions like you're probably
used to seeing already, along with the owner of the directories in my
/var/www directory.
SELinux contexts are additional permissions that act sort of like
permission zones. You can see them by using the "ls -Z" command:
[ceverett@taco www]$ ls -Z
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 stat
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 wsgi-sc
Now look at the difference between these permissions and a directory in
my home folder:
[ceverett@taco ~]$ ls -Z
drwxrwxr-x. ceverett ceverett unconfined_u:object_r:home_bin_t:s0 bin
drwxrwxr-x. ceverett ceverett unconfined_u:object_r:user_home_t:s0 Code
You see that there are a few different context types listed. This the
kind of thing that must change for Apache to see into a place other than
/var/www.
To set Unix permissions you use the command "chmod", but to change
SELinux permissions you use the command "chcon".
I suggest reading "man chcon" a little to understand what is going on
before you just start goin crazy chconning everything.
-z
