I have a Zend web application running on a CentOS server with SELinux running in permissive mode (i.e. access-control decisions are recorded in
/var/log/audit/audit.log but not enforced). The application allows people to upload files, which are saved in a directory structure outside
/var/acme/myapp/files). The application needs to write and delete files in that directory, as well as create, modify, and delete directories under that directory.
FWIW, httpd starts as
root, then spawns processes as a separate user named
I'd like to put SELinux into enforcing mode, but still narrowly allow the Zend application to perform the IO operations described above. I also want these SELinux settings to persist after restarts. How do I do this?