1

I have an uploads folder for my web application: /disk2/app/uploads.

ls -Z returns:

drw-r--r--. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 uploads

ls -Z / returns:

drwxrwxrwx. root root system_u:object_r:file_t:s0      disk2

ls -Z /disk2 returns:

drwxr-xr-x. apache    apache    unconfined_u:object_r:file_t:s0  app

much of which I got from here

when I run is_writable('/disk2/app/uploads') in php it returns false

I have tried every possibility I can think of to figure it out.

Relevant audit logs:

type=AVC msg=audit(1510944045.012:202923): avc:  denied  { getattr } for  pid=14017 comm="httpd" path="/disk2/app/uploads/12222/206/1496103427-20170526_151922.jpg" dev=sdb ino=17826039 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:file_t:s0 tclass=file
type=AVC msg=audit(1510944045.012:202924): avc:  denied  { write } for  pid=14017 comm="httpd" name="uploads" dev=sdb ino=2097155 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:file_t:s0 tclass=dir
8
  • Are there any relevant 'AVC denied' messages in /var/log/audit/audit.log?
    – user9517
    Nov 17, 2017 at 22:14
  • And what about /disk2? Nov 17, 2017 at 22:15
  • @user430214 See my edits above.
    – ajon
    Nov 17, 2017 at 22:24
  • @IgnacioVazquez-Abrams I added the output of ls -Z above. Do the parent directories matter if the ownership etc. is good on the child? Thanks for the help.
    – ajon
    Nov 17, 2017 at 22:33
  • Looks like subdirectories are being created with the wrong file context. Did you have your policy match everything underneath that path? Nov 17, 2017 at 22:33

1 Answer 1

1

You need to configure SELinux file contexts so that they are correctly set when files are created. Files in general, inherit the fcontext of their parent directory so you need to specify that correctly. Something like

semanage fcontext -a -t httpd_sys_rw_content_t "/disk2/app/uploads(/.*)?"
restorecon -Rv /disk2/app/uploads

should to the trick.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .