2

My user can't add, modify or delete apache/php files without sudo.

My enviroment is:

  • CentOS Linux release 7.2.1511
  • SELinux status: enabled
  • Current mode: enforcing
  • Apache 2.4.23

My user is already on the group of apache:

$ id
uid=1000(lmeza) gid=1000(lmeza) groups=1000(lmeza),10(wheel),48(apache) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

The Webroot of Apache already have the label httpd_sys_content_t

$ ls -Z /var/www
drwxr-xr-x. root   root   system_u:object_r:httpd_sys_script_exec_t:s0 cgi-bin
drwxr-sr-x. apache apache unconfined_u:object_r:httpd_sys_content_t:s0 html

I have a directory with the label httpd_sys_rw_content_t but i can't write on him:

$ ls -lahZ /var/www/html
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 modules

$ touch /var/www/html/modules/abc.txt
touch: cannot touch ‘/var/www/html/modules/abc.txt’: Permission denied

Correct Get file access control lists:

$ getfacl /var/www/html
getfacl: Removing leading '/' from absolute path names
# file: var/www/html
# owner: apache
# group: apache
# flags: -s-
user::rwx
user:apache:rwx
group::r-x
group:apache:rwx
mask::rwx
other::r-x
default:user::rwx
default:user:apache:rwx
default:group::r-x
default:group:apache:rwx
default:mask::rwx
default:other::r-x
3
  • This has nothing to do with SELinux, it's just your plain old Unix permissions. See here for a solution. – Michael Hampton Dec 7 '16 at 17:59
  • @michael-hampton I've updated my question with the result of getfacl. It says "group::r-x" and it should be "group::rwx" it is right? – Lenin Meza Dec 7 '16 at 18:12
  • I am certain Michael is correct. That said; just for completeness sake, you would also want to include the output of grep deni /var/log/audit/audit.log if you suspect SELinux is denying something and assuming auditd is running. If there were any denies, you would want to pass them to audit2why or audit2allow to better understand your options. – Aaron Dec 7 '16 at 18:51
4

The correct way to establish SELinux and ACL permissions that work on CentOs 7 are:

# Restablish the SELInux context:
sudo restorecon -Rv /var/www/html
# Change the owner of the webroot:
sudo chown -R apache:apache /var/www/html
# Change basic permissiones:
sudo chmod -R g+w /var/www/html
sudo chmod g+s /var/www/html
# Establish SELinux permissions:
sudo chcon -Rt httpd_sys_content_t /var/www/html
sudo chcon -Rt httpd_sys_rw_content_t /var/www/html/modules
# Establish ACL permissions:
sudo setfacl -R -m u:apache:rwx /var/www/html
sudo setfacl -R -m d:u:apache:rwx /var/www/html
sudo setfacl -R -m g:apache:rwx /var/www/html
sudo setfacl -R -m d:g:apache:rwx /var/www/html

The full script for Drupal 8 is on the next Gist: https://gist.github.com/merolhack/854c3d371f31b21fb6cb538fe02a0444

1
  • This is a real life saver. I usually use all of them except the ACL ones, what are they for? – ronnyfm May 23 '19 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.