Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using RHEL 6.1 and I would like to configure SELinux to authorize httpd to read all files in some folders (My goal is to make log files available via web access).

  • Is this possible without listing explicitely all files ?
  • Is this possible without disabling SELinux for httpd ?

I need solution which could be made persistent.

Thanks by advance.

share|improve this question

1 Answer 1

You can set up a rule to allow httpd_t to read the type of file your logfiles are labeled with.

For example, if I want httpd_t to be able to read your_log_file_type_t, you create a policy module like this (out of the back of my head). Call it apache_read_logs.te and put it in an empty directory:

policy_module(apache_read_logs, 1.0)

type httpd_t;
type your_log_file_type_t;
type your_log_dir_type_t;

allow httpd_t your_log_dir_type_t:dir list_dir_perms;
read_files_pattern(httpd_t, your_log_dir_type, your_log_file_type)
read_lnk_files_pattern(httpd_t, your_log_dir_type, your_log_file_type)

This allows httpd_t to read files labeled your_log_file_type_t and search through directories labeled your_log_dir_type_t. It uses macros for brevity. You can see how the macros look by downloading and examining the reference policy tarball.

Then, from the directory you created the file in, you run, as root:

# make -f /usr/share/selinux/devel/Makefile
# /usr/sbin/semodule -i apache_read_logs.pp

This assumes you have selinux-policy-devel and policycoreutils installed. Test this on a non-crucial machine first! I wrote this blind and haven't tested it myself!

share|improve this answer
    
Quick remark: The apache log files should already be labeled httpd_log_t by default. –  ikso Jun 28 '11 at 9:31
    
Yes, but nobody said it concerns Apache log files here :) –  wzzrd Jun 28 '11 at 9:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.