Problem in a nutshell: SELinux does not protect files and directories labeled as httpd_sys_content_t from being written, deleted or changed when new/custom document root is created.
I have reproduced this behavior twice on different server builds. Environment is clean, fresh install of CentOS 7. Patched completely via yum. epl repo installed. apache, php, mysql (mariadb), phpmyadmin installed.
SELinux is enabled by default on CentOS 7. getenforce and sestatus both confirm that SELinux is running.
I have created a plain virtualhost in apache with its document root set to: /web/sites/test1
At first, everything works as expected. SELinux will not allow apache to display that website until I did the following:
semanage fcontext --add --type httpd_sys_content_t "/web(/.*)?" semanage fcontext --add --type httpd_sys_content_t "/web/sites(/.*)?" restorecon -Rv /web
As expected, after doing that, the virtualhost worked.
However, the strange behavior is that upon installing wordpress in that virtualhost, I'm able to upload images and such via wordpress even though the httpd_sys_content_t context should not allow this (according to my understanding).
I have confirmed that all files in the wordpress directory are labeled correctly as type: httpd_sys_content_t
Yet wordpress is still able to write to the directory (so long as old-fashioned file permissions allow it).
I have come up with one solution: Typical/expected behavior is restored upon doing a full filesystem relabeling:
touch /.autorelabel reboot
Upon reboot, I must use the httpd_sys_rw_content_t context as I would expect. But I would like to more clearly understand why such a step is necessary since I've read that a full relabeling should rarely (if ever) be necessary. Is there some easier, less drastic means of getting SELinux to behave as expected?
To be more concise: Should I expect to have to do a "touch /.autorelabel" in a situation like this? Is there a better way? Should it just work without anything else done (and this is therefore a bug with CentOS 7 'out of the box')?