Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My apache DocumentRoot /var/www is a symbolic link to another path. The target has the appropriate file context label (httpd_sys_content_t) so that apache can read it with SELinux enabled. However, the symbolic link itself is labeled with var_t.

[root@localhost var]# ls -lZ
lrwxrwxrwx. root root unconfined_u:object_r:var_t:s0 www -> /srv/www

I need to relabel the symbolic link with httpd_sys_content_t.

Running chcon with the -h option initially seems to work:

[root@localhost var]# chcon -h -t httpd_sys_content_t /var/www
[root@localhost var]# ls -lZ
lrwxrwxrwx. root root unconfined_u:object_r:httpd_sys_content_t:s0 www -> /srv/www

However this does not survive a relabel:

[root@localhost var]# restorecon -Rv .
restorecon reset /var/www context system_u:object_r:httpd_sys_content_t:s0->syst
em_u:object_r:var_t:s0

Using semanage does not relabel the link itself; just the target:

[root@localhost var]# semanage fcontext -a -t httpd_sys_content_t /var/www
[root@localhost var]# restorecon -Rv .
[root@localhost var]# ls -lZ
lrwxrwxrwx. root root unconfined_u:object_r:var_t:s0 www -> /srv/www

semanage does not have the -h option.

How can I get semanage to set the label of the link itself so it remains as httpd_sys_content_t after a relabel?

share|improve this question
    
Wow, I got the Popular Question badge for this one, and no votes? –  Series8217 Apr 19 '12 at 18:26

1 Answer 1

up vote 3 down vote accepted

I figured it out:

semanage has an option -f which allows you to specify a file type as shown in the mode field by ls (-d for directories, -- for regular files, -l for links). When -f -l is used, the link itself is targeted.

[root@localhost var]# semanage fcontext -f -l -a -t httpd_sys_content_t /var/www
[root@localhost var]# restorecon -Rv .
restorecon reset /var/www context system_u:object_r:var_t:s0->system_u:object_r:httpd_sys_content_t:s0
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.