Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a new folder at /modevasive to hold my mod_evasive scripts and for the Log Directory. I'm trying to change the context type to httpd_sys_content_t so Apache can write to the folder. I did semanage fcontext -a -t "httpd_sys_content_t" /modevasive to change the context and then restorecon -v /modevasive to enable the change, but restorecon didn't do anything. So I used chcon to change it manually, did the restorecon to see what would happen and it changed it back to default_t.

semanage fcontext -l gives:

/modevasive/          all files          system_u:object_r:httpd_sys_content_t:s0`

And looking at /etc/selinux/targeted/contexts/files/file_contexts.local gives

 /modevasive/    system_u:object_r:httpd_sys_content_t:s0

So why does restorecon keep setting it back to default_t?

share|improve this question
    
FWIW I can't get this to happen, for me it works as expected. What does matchpathcon /modevasive say ? – Iain Nov 8 '13 at 20:40
    
/modevasive system_u:object_r:default_t:s0 – Safado Nov 8 '13 at 21:03
    
That explains why it's being reset to default_t by restorecon, hopefully @michaelhampton will cruise by and explain why there is a difference soon. – Iain Nov 8 '13 at 21:47
up vote 4 down vote accepted

Well, I reached out to RedHat support and this was the answer I got.

He had me do the same steps, except for in the first semanage command, he has me do "/modevasive(/.*)?" instead of just "/modevasive". I haven't got an explanation why, but that solved the problem for me.

share|improve this answer
2  
The pattern given is not a directory, but a regex match for a pathname. So /modevasive would never match anything. – Michael Hampton Nov 9 '13 at 4:13
    
When you use the restorecon command you need to put a slash and asterisk after the directory name to effect the files within it. I had to do restorecon -v /mydir to effect the directory and restorecon -v /mydir/* to effect its contents (not sure if that's recursive though). – BuvinJ Jun 3 at 14:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.