1

I would like allow httpd to executed files from a user's home directory. From audit2allow I understand that this implies the following policy:

allow httpd_t user_home_t:file execute;

How do I turn this into a script that enables this policy on my CentOS servers? I already enabled booleans for httpd_read_user_content and httpd_enable_homedirs but that didn't help.

1
  • Try following command /bin/chcon -t httpd_user_script_exec_t $PATH_TO_THAT_FILE Jun 23, 2015 at 16:58

2 Answers 2

2

The common SELinux security policy for webservers provides a set of types that can be used by normal users to tell SELinux how the webserver can operate on specified files. Users can use the chcon command to associate these types with specified files and directories.

Each of these types have specific properties, designed for specific purposes.

The httpd_user_script_exec_t type is a type that your webserver is allowed to execute. In addition there are rules associated with that type that instruct SELinux to run the script process with what is called "automatic process type transition" from the webservers process type to a process type specificly designed for common user cgi script processes. This type is associated with a specific set of permissions common to most cgi script processes.

The httpd_user_rw_content_t type is a type that your webserver is allowed to read and write. (example ~/public_content/myblog/wp_content)

The httpd_user_content_t type is a type that your webserver is allowed to read (example ~/public_content)

The httpd_user_content_ra_t type is a type that your webserver is allowed to read and append (example ~/public_content/myblog/logs)

These types can generally be useful when you toggle the httpd_enable_homedirs boolean to on. This boolean is associated with rules that allow your webserver to traverse $HOME so that it can for example reach ~/public_content.

Using the types and boolean above should ensure pretty decent integrity. For example your webserver will not be able to read your ~/.ssh or your ~/Documents, but will be able to read your website.

The user cgi script process will be contained as well, So that if it gets compromised , the damage it can do is contained to a reasonable extend.

1
  • Using chcon together with the types specified in the post above will make files labeled with them semi-persistent using a concept called "customizable types". This basically means that relabeling them with the restorecon command will not reset their contexts unless you run restorecon with the -F option. Jun 23, 2015 at 17:25
1

Using chcon works, but you lose the selinux label when you reboot the server, the more clear way is to use semange and restorecon

example:

semanage fcontext -a -t httpd_user_script_exec_t '/home/pippo/file.bash'

restorecon -v /home/pippo/file.bash

restorecon reset /home/pippo/file.bash context unconfined_u:object_r:user_home_t:s0->unconfined_u:object_r:httpd_user_script_exec_t:s0

-rwxr-xr-x. root root unconfined_u:object_r:httpd_user_script_exec_t:s0 /home/pippo/file.bash

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .