Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In the configuration I have setup I wish to allow samba and apache to access /var/www I am able to set a context to allow samba access, but then httpd doesn't have access. Using setenforce to 0 eliminates issues so I know that it is SELinux.

In addition: How can I view the context of a folder, and can a folder have multiple contexts?

(CentOS)

Thank you, Josh

share|improve this question

3 Answers 3

up vote 13 down vote accepted

First off, you can view the context of something with ls using ls -Z

[root@servername www]# ls -dZ /var/www
drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t /var/www

Second, there are two options for giving Samba and Apache access to the same directory.

The simple way is to just allow samba read/write access everywhere with:

setsebool -P samba_export_all_rw 1

It's simple, easy, and doesn't mess with any weird properties of SELinux.

If you're concerned with Samba having full access to all directories and only want to change /var/www, try:

chcon -t public_content_rw_t /var/www
setsebool -P allow_smbd_anon_write 1
setsebool -P allow_httpd_anon_write 1

This will allow both Samba and Apache write access to any directories with the public_content_rw_t context. Note that chcon is only modifying /var/www. Any new directories created under /var/www will be public_content_rw_t, but not existing directories like /var/www/html or /var/www/manual. If you want to change everything, add an -R to chcon:

chcon -R -t public_content_rw_t /var/www

You can look through this CentOS wiki page to get hints on other SELinux booleans.

share|improve this answer
    
I tried this and it complains that a context is already defined. –  Joshua Enfield Apr 12 '10 at 20:28
    
You're right, it looks like things have changed since I last messed with SELinux. I'll update my answer with some other options. –  Dave Apr 13 '10 at 0:03
2  
@Dave you saved my butt. See you at work tomorrow. –  Joel E Salas Jul 25 '13 at 2:30
    
I wanted to mention that if your webroot is nested in a samba share, you'll need to set the context on the parent directories as well. For example: chcon -t public_content_rw_t /mnt/share/webroot(/.*)? chcon -t public_content_rw_t /mnt/share –  Greg Sheremeta Apr 8 at 15:59
    
Thank you, I was struggling with something similar but with ftp, and everything works after doing setsebool -P ftpd_full_access=1 –  giorgiline Aug 26 at 15:02
SHARING FILES
   If you want to share files with multiple domains (Apache,  FTP,  rsync,
   Samba),  you can set a file context of public_content_t and public_content_rw_t.
   These context allow any of the above domains  to  read  the
   content.   If  you want a particular domain to write to the public_con‐
   tent_rw_t   domain,   you   must   set   the    appropriate    boolean.
   allow_DOMAIN_anon_write.  So for samba you would execute:

       setsebool -P allow_smbd_anon_write=1

For example:

semanage fcontext -a -t public_content_rw_t '/var/www(/.*)?'
restorecon -R /var/www
setsebool -P allow_smbd_anon_write 1
share|improve this answer

Have you tried using the boolean option of system-config-selinux?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.