Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a stock RHEL6 installation and have pointed my httpd DocumentRoot to /path/does/exist (it exists!). I've granted permission to the apache user and added what I thought should be the necessary label via:

chcon -R  -t httpd_sys_content_t /path/does

but no dice.

audit2why shows a missing type enforcement allow rule for a request that looks like

avc:  denied  { search } for  pid=4793
   comm="httpd" name="/"  
   scontext=unconfined_u:system_r:httpd_t:s0 
   tcontext=system_u:object_r:file_t:s0 
   tclass=dir

Can someone help me interpret? Please note that I'm not looking for the answer "disable selinux" :-)

Thanks!

-B

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You will need to apply the following (assuming that path is /www)

chcon -R -u system_u /www
chcon -R -t httpd_sys_content_t /www

And then make it survive a label:

semanage fcontext -a -s system_u -t httpd_sys_content_t /www

What I find it is easier to use another directory as a template when apply SELinux context to a directory:

drwxr-xr-x. root root unconfined_u:object_r:default_t:s0 www
[root@kvm0001 /]# chcon --reference=/var/www www
[root@kvm0001 /]# ls -laZ
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 www
[root@kvm0001 /]#
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.