In the configuration I have setup I wish to allow samba and apache to access /var/www I am able to set a context to allow samba access, but then httpd doesn't have access. Using setenforce to 0 eliminates issues so I know that it is SELinux.

In addition: How can I view the context of a folder, and can a folder have multiple contexts?


  • Have you tried using the boolean option of system-config-selinux?
    – Steven
    Apr 9 '10 at 21:57

First off, you can view the context of something with ls using ls -Z

[root@servername www]# ls -dZ /var/www
drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t /var/www

Second, there are two options for giving Samba and Apache access to the same directory.

The simple way is to just allow samba read/write access everywhere with:

setsebool -P samba_export_all_rw 1

It's simple, easy, and doesn't mess with any weird properties of SELinux.

If you're concerned with Samba having full access to all directories and only want to change /var/www, try:

chcon -t public_content_rw_t /var/www
setsebool -P allow_smbd_anon_write 1
setsebool -P allow_httpd_anon_write 1

This will allow both Samba and Apache write access to any directories with the public_content_rw_t context. Note that chcon is only modifying /var/www. Any new directories created under /var/www will be public_content_rw_t, but not existing directories like /var/www/html or /var/www/manual. If you want to change everything, add an -R to chcon:

chcon -R -t public_content_rw_t /var/www

You can look through this CentOS wiki page to get hints on other SELinux booleans.

  • I tried this and it complains that a context is already defined. Apr 12 '10 at 20:28
  • You're right, it looks like things have changed since I last messed with SELinux. I'll update my answer with some other options.
    – David
    Apr 13 '10 at 0:03
  • 3
    @Dave you saved my butt. See you at work tomorrow. Jul 25 '13 at 2:30
  • I wanted to mention that if your webroot is nested in a samba share, you'll need to set the context on the parent directories as well. For example: chcon -t public_content_rw_t /mnt/share/webroot(/.*)? chcon -t public_content_rw_t /mnt/share Apr 8 '14 at 15:59
  • 1
    Thank you, I was struggling with something similar but with ftp, and everything works after doing setsebool -P ftpd_full_access=1
    – giorgiline
    Aug 26 '14 at 15:02
   If you want to share files with multiple domains (Apache,  FTP,  rsync,
   Samba),  you can set a file context of public_content_t and public_content_rw_t.
   These context allow any of the above domains  to  read  the
   content.   If  you want a particular domain to write to the public_con‐
   tent_rw_t   domain,   you   must   set   the    appropriate    boolean.
   allow_DOMAIN_anon_write.  So for samba you would execute:

       setsebool -P allow_smbd_anon_write=1

For example:

semanage fcontext -a -t public_content_rw_t '/var/www(/.*)?'
restorecon -R /var/www
setsebool -P allow_smbd_anon_write 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.