With the directory structure:
/www/live/website1/app/
/www/live/website1/files/
/www/live/website1/logs/
Where Apache needs at least the following access:
app: read-only access, but read-write is fine (files already chmod 0644)
files: read-write access
logs: read-write access
Where the following two rules have been setup via:
/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/www/live/.*/.*";
/usr/sbin/semanage fcontext -a -t httpd_log_t "/www/live/.*/logs(/.*)?";
/sbin/restorecon -vr "/www";
Which are applied, and seem to be working fine... however LogRotate isn't happy.
The LogRotate config is currently:
/www/live/*/logs/*access_log /www/live/*/logs/*access_log_443 {
weekly
rotate 52
missingok
notifempty
nodateext
sharedscripts
postrotate
/usr/sbin/apachectl graceful > /dev/null
endscript
}
However, this seems to be blocked by SELinux, with entries appearing in the audit.log when its trying to hit the inode related to the /www/live
folder (262146 in the example below)... as its presumably trying to list the folders in /www/live/.
type=AVC msg=audit(1396579563.324:316060): avc: denied { read } for pid=12336 comm="logrotate" name="live" dev=dm-0 ino=262146 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:default_t:s0 tclass=dir
type=SYSCALL msg=audit(1396579563.324:316060): arch=c000003e syscall=2 success=no exit=-13 a0=7fff2cef68b0 a1=90800 a2=7fff2cef6b5a a3=8 items=0 ppid=12334 pid=12336 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=35531 comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)
So what context should I set this parent directory?
/usr/sbin/semanage fcontext -a -t default_t "/www(/.*)";
Where I know default_t
doesn't work, nor does var_t
... and for reference I don't really care what can see these folders, as they are already chmod 0755.
And for bonus points... is there an easy way to see the full list of permissions a program has? I know LogRotate must be able to access httpd_log_t
and var_log_t
.
The annoying thing is that running LogRotate manually seems to bypass these restrictions, as I assume that its inheriting the users permissions (unlike when it runs via cron).