Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up an NFS share between 2 CentOS servers (filesrv & websrv) for a folder that needs to be readable & writeable by the Apache process. I'm having trouble with the writeable side of this, which I've narrowed down to SELinux configuration: Apache can write to the share if I setenforce 0 on the NFS client.

The relevant line in the exports file for the NFS server is:

/data/files/sitefiles websrv(rw,sync,no_root_squash)


The SELinux context for the shared folder on the NFS server is:

system_u:object_r:httpd_sys_rw_content_t:s0


The entry in my fstab on the NFS client is:

filesrv:/data/files/sitefiles /var/www/html/webroot/files nfs context="system_u:object_r:httpd_sys_rw_content_t:s0" 0 0


As far as I can tell, this should mount the NFS share with the httpd_sys_rw_content_t context, but when I check it, it's actually:

system_u:object_r:httpd_sys_content_t:s0


What could be causing it to apply the stricter context to the share?

share|improve this question

2 Answers 2

This problem was occurring because I was mounting multiple NFS shares from the same server, not all of which had the same context.

As per the RedHat documentation on multiple NFS mounts, I needed to add nosharecache to my fstab line for the mounts. The correct SELinux context is then applied on a mount-by-mount basis.

The working line in my fstab is as follows:

filesrv:/data/files/sitefiles /var/www/html/webroot/files nfs nosharecache,context="system_u:object_r:httpd_sys_rw_content_t:s0" 0 0
share|improve this answer

The simple solution should be to use the SELinux boolean httpd_use_nfs to allow your webserver to display and write content stored on a NFS share:

setsebool -P httpd_use_nfs=1 
share|improve this answer
    
I've tried setting this, but it doesn't seem to help. NB Apache is able to read from the share regardless of whether the boolean's on or off. –  lyserge Nov 13 '13 at 11:51
    
What denials are you actually getting? ausearch -m avc -c httpd –  HBruijn Nov 13 '13 at 12:18
    
They're all in the form: avc: denied { associate } for pid=2202 comm="httpd" name="js" scontext=system_u:object_r:httpd_sys_rw_content_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=filesystem –  lyserge Nov 13 '13 at 12:58
    
I don't believe a boolean exists that will allow httpd to write to an NFS share - at least not until the SELinux extensions for NFS are generally available. You've got a couple of years to wait for that, though... –  Michael Hampton Nov 13 '13 at 16:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.