1

On my Fedora 20, I've learned that to allow write access to files by processes like PHP via Apache, the process owner, which is in my case apache, must have write permissions to the files. Also, since SELinux is enabled, the files must have the httpd_system_rw_content_t context.

It also looks like an SELinux policy prevents httpd from accessing any files under /home. Just about everyone agrees that to remedy this, the files you want accessed must have security context httpd_user_content_t or httpd_user_rw_content_t. I've been sure to do this, yet Apache still says it does not have permission to access the directories. When those files don't have the user_content context, I indeed get SELinux warnings. When the context is set, I don't get the warnings, but Apache still can't access the files. Everything under /home/me/game has the following user permissions and security context:

$ sudo chcon -Rv --type=httpd_user_rw_content_t game
$ sudo setsebool -P httpd_read_user_content 1
$ sudo chown -R :apache game
$ ll -Zd game
drwxrwxr-x. me apache unconfined_u:object_r:httpd_user_rw_content_t:s0 game

Yet Apache tells me:

Forbidden

You don't have permission to access /game on this server.

Might anyone know what else I could check?

  • According to selinuxproject.org/page/ApacheRecipes, contexts should be correct if you use public_html as folder name. Try a restorecon -Rv /home. If you still have issues, take a look at /var/log/audit/audit.log. – jornane Jun 21 '14 at 17:47
  • 1
    What do the permissions to your home directory look like? Are you sure that apache can read the file according to the UNIX permissions? apache needs at least eXecute on /, /home, /home/me and the directory itself. – jornane Jun 21 '14 at 17:54
  • Run the test again then run ausearch -ts recent -m avc and provide the output. – Matthew Ife Jun 21 '14 at 17:58
  • Everything under my home directory is owned by me, but I'm not sure about explicitly giving apache read or write permissions to all of / or /home because I can host things under /var/www/ without issue. From what I see, the files need not be associated with apache at all for read access, but apache must have write permission on anything a server script wants to edit. Everything there is labeled httpd_sys_content_t, but that same context in my home directory isn't making a difference... – Spencer Williams Jun 21 '14 at 18:16
  • 1
    Could you please add the relevant portions of your apache configuration? (WRT mod_userdir, UserDir directive, ...), anything useful in the apache logs? What's the output of getsebool httpd_read_user_content? – dawud Jun 21 '14 at 20:58
0

Sigh... always check your permissions, people. Even though the SELinux settings were good, there was a directory on the way down to the path I wanted apache to reach that was not allowing that user to read/execute it.

First of all, I should have looked at /var/log/httpd/error_log which plainly said:

(13)Permission denied: [client 127.0.0.1:38628] AH00035: access to /game/ denied (filesystem >path '/home/me/game') because search permissions are missing on a component of the path

Looking up the error on Google, I found this page that also spells out the issue. Since it had no problem serving things from /var/www I checked the directory permissions all the way down:

$ ll -d /
drwxr-xr-x. 18 root root 4096 Jun 22 18:52 /
$ ll -d /var
drwxr-xr-x. 21 root root 4096 Jun 22 12:51 /var
$ ll -d /var/www
drwxr-xr-x. 8 root root 4096 Jun 21 09:19 /var/www

I did the same all the way down my home dirs:

$ ll -d /home
drwxr-xr-x. 4 root root 4096 Jun 13 21:31 /home
$ ll -d /home/me
drwx------. 35 me me 4096 Jun 22 19:05 /home/me

Yep... a simple sudo chmod o=rx /home/me got me up and going. I couldn't have done it without checking everything you guys asked me to, and I thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.