For Red Hat Linux:
13.4.2. Sharing NFS and CIFS volumes
By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS volumes. In common policies, this default context uses the nfs_t type. Also, by default, Samba shares mounted on the client side are labeled with a default context defined by policy. In common policies, this default context uses the cifs_t type.
Depending on policy configuration, services may not be able to read files labeled with the nfs_t or cifs_t types. This may prevent file systems labeled with these types from being mounted and then read or exported by other services. Booleans can be enabled or disabled to control which services are allowed to access the nfs_t and cifs_t types.
Enable the httpd_use_nfs Boolean to allow httpd to access and share NFS volumes (labeled with the nfs_t type):
~]# setsebool -P httpd_use_nfs on
Enable the httpd_use_cifs Boolean to allow httpd to access and share CIFS volumes (labeled with the cifs_t type):
~]# setsebool -P httpd_use_cifs on
Do not use the -P option if you do not want setsebool changes to persist across reboots.
To view the current seLinux context settings for a directory (in the below example /shares/ directory):
ls -dZ /shares/
You can exclude the -d to view the context of the files and folders under the directory:
ls -Z /shares/
Labeling /shares/ with the public_content_t type allows read-only access by the Apache HTTP Server, FTP, rsync, and Samba. Enter the following command as root to add the label change to file-context configuration:
~]# semanage fcontext -a -t public_content_t "/shares(/.*)?"
Use the restorecon utility as root to apply the label changes:
~]# restorecon -R -v /shares/
NOTE: For me, I wasn't sure what the restorecon command was for and hadn't run it initially and was wondering why the semanage command changes didn't get applied after I ran it. The reference article states that the restorecon command applies the context changes from the semanage command.
After applying the changes, you can view the context settings by running:
ls -dZ /shares/