Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two documents in my root directory. One is served up fine, the other always returns a 403.

Here's the output from the access_log:

xx.xx.xx.xx - - [22/Nov/2012:09:53:21 -0500] "GET /index.html HTTP/1.1" 200 6 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"
xx.xx.xx.xx - - [22/Nov/2012:09:53:22 -0500] "GET /sales.html HTTP/1.1" 403 309 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"

Here's what the error_log has to say:

[Thu Nov 22 09:53:22 2012] [error] [client xx.xx.xx.xx] (13)Permission denied: file permissions deny server access: /var/www/html/sales.html

Here's a directory listing:

09:55:52 myhost /var/www/html> ls -la
total 104
drwxr-xr-x. 2 root   root    4096 Nov 21 16:05 .
drwxr-xr-x. 6 root   root    4096 Nov 21 11:06 ..
-rwxrwxrwx. 1 apache apache     6 Nov 22 09:47 index.html
-rwxrwxrwx. 1 apache apache 91196 Nov 21 16:05 sales.html

And finally the settings in httpd.conf

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

This is really baking my noodle. I've tried a variety of file/directory permissions, and restarted apache many times, but to no avail. Any ideas? Why is one file served up, but not another?

share|improve this question
add comment

2 Answers 2

up vote 2 down vote accepted

Well, I don't understand a lot about SELinux or security contexts, but that seems to be what's at play here.

12:10:24 myhost /var/www/html> ls -laZ
drwxr-xr-x. root   root   system_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x. root   root   system_u:object_r:httpd_sys_content_t:s0 ..
-rwxrwxrwx. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 index.html
-rwxrwxrwx. apache apache unconfined_u:object_r:user_home_t:s0 sales.html

Executing the following command seems to fix the permissions problem with Apache.

12:10:28 iceberg /var/www/html> sudo restorecon -r sales.html

And as a double-check, we can see that the security context of the misbehaving file is now different.

12:10:34 myhost /var/www/html> ls -laZ
drwxr-xr-x. root   root   system_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x. root   root   system_u:object_r:httpd_sys_content_t:s0 ..
-rwxrwxrwx. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 index.html
-rwxrwxrwx. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 sales.html
share|improve this answer
1  
this is why I HATE SELinux. It's so unbelievably stupid to implement something like that without giving applications any form of notice except "permission denied". –  pauska Nov 22 '12 at 17:20
1  
SELinux is not really that difficult. You do have to be more disciplined about how you handle your services and files. I'd be willing to bet that @Monkey-boson mv'd his sales.html file in from his home directory as the root user instead of copying it, which changes the destination file to the proper context. –  Magellan Nov 22 '12 at 18:57
    
Right. In future, cp files to their destination to ensure that they get the desired SELinux contexts, instead of mv. –  Michael Hampton Nov 23 '12 at 0:03
    
Cool! Thanks for the tip. That's exactly what I did. Unfortunate, though, that my typing is doubled (cp then rm). I wonder if there a flag on mv to fix the context in the same way that cp does? –  Monkey Boson Nov 29 '12 at 16:10
add comment

I think you should have a look at what Monkey Boso says. But if it doesn't then you can try to temporarily SELinux. Don't do this on a production server on the public internet though, really.. DON'T:

sudo setenforce 0

After you checked..

sudo setenforce 1

And of course don't forget to switch it back on..

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.