Allowing multiple types in the type field of a folder label in SELinux

Question

I'm an Ubuntu/Debian guy but I had trouble installing Ubuntu on a softraid/fakeraid system, so I went with CentOS 5.6.

I'm also at a small web development firm where we need to share our test server's html/httpd files via samba/smb but also allow apache to host them.

So I'm wondering if I can set our files to the samba and httpd type?

Something like,

/usr/sbin/semanage fcontext -a -t samba_share_t,httpd_sys_content_t "/var/www/html(/.*)?"

Or else I'm going to have to turn SELinux into permissive mode, which is not something I want to do.

Answer 1

I just realized I completely misread your question :)

If you want to allow Samba to read /var/www/html, which is httpd_sys_content_t, you should not have a problem. I am not a Samba expert, but afaik samba runs in the smbd_t domain, so you should be fine:

 # sesearch -s smbd_t --allow | grep httpd_sys_content
 allow smbd_t httpd_sys_content_t : file { ioctl read getattr lock }; 
 allow smbd_t httpd_sys_content_t : file { ioctl read write create getattr setattr lock append unlink link rename }; 
 allow smbd_t httpd_sys_content_t : file { ioctl read write create getattr setattr lock append unlink link rename }; 
 allow smbd_t httpd_sys_content_t : dir { ioctl read getattr lock search }; 
 allow smbd_t httpd_sys_content_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir }; 
 allow smbd_t httpd_sys_content_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir }; 

That says that Samba is allowed to read httpd_sys_content_t directories and files. The /var/www/html tree is httpd_sys_content_t. Have you tried this already?

Answer 2

SHARING FILES
   If you want to share files with multiple domains (Apache,  FTP,  rsync,
   Samba),  you can set a file context of public_content_t and public_content_rw_t.
   These context allow any of the above domains  to  read  the
   content.   If  you want a particular domain to write to the public_con‐
   tent_rw_t   domain,   you   must   set   the    appropriate    boolean.
   allow_DOMAIN_anon_write.  So for samba you would execute:

       setsebool -P allow_smbd_anon_write=1

• http://fedoraproject.org/wiki/SELinux/samba

For example:

semanage fcontext -a -t public_content_rw_t '/var/www/html(/.*)?'
restorecon -R /var/www/html
setsebool -P allow_smbd_anon_write 1

And for httpd:

setsebool -P allow_httpd_anon_write=1

See: http://fedoraproject.org/wiki/SELinux/apache