Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm an Ubuntu/Debian guy but I had trouble installing Ubuntu on a softraid/fakeraid system, so I went with CentOS 5.6.

I'm also at a small web development firm where we need to share our test server's html/httpd files via samba/smb but also allow apache to host them.

So I'm wondering if I can set our files to the samba and httpd type?

Something like,

/usr/sbin/semanage fcontext -a -t samba_share_t,httpd_sys_content_t "/var/www/html(/.*)?"

Or else I'm going to have to turn SELinux into permissive mode, which is not something I want to do.

share|improve this question

2 Answers 2

I just realized I completely misread your question :)

If you want to allow Samba to read /var/www/html, which is httpd_sys_content_t, you should not have a problem. I am not a Samba expert, but afaik samba runs in the smbd_t domain, so you should be fine:

 # sesearch -s smbd_t --allow | grep httpd_sys_content
 allow smbd_t httpd_sys_content_t : file { ioctl read getattr lock }; 
 allow smbd_t httpd_sys_content_t : file { ioctl read write create getattr setattr lock append unlink link rename }; 
 allow smbd_t httpd_sys_content_t : file { ioctl read write create getattr setattr lock append unlink link rename }; 
 allow smbd_t httpd_sys_content_t : dir { ioctl read getattr lock search }; 
 allow smbd_t httpd_sys_content_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir }; 
 allow smbd_t httpd_sys_content_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir }; 

That says that Samba is allowed to read httpd_sys_content_t directories and files. The /var/www/html tree is httpd_sys_content_t. Have you tried this already?

share|improve this answer
SHARING FILES
   If you want to share files with multiple domains (Apache,  FTP,  rsync,
   Samba),  you can set a file context of public_content_t and public_content_rw_t.
   These context allow any of the above domains  to  read  the
   content.   If  you want a particular domain to write to the public_con‐
   tent_rw_t   domain,   you   must   set   the    appropriate    boolean.
   allow_DOMAIN_anon_write.  So for samba you would execute:

       setsebool -P allow_smbd_anon_write=1

For example:

semanage fcontext -a -t public_content_rw_t '/var/www/html(/.*)?'
restorecon -R /var/www/html
setsebool -P allow_smbd_anon_write 1

And for httpd:

setsebool -P allow_httpd_anon_write=1

See: http://fedoraproject.org/wiki/SELinux/apache

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.