msgbartop
A chronological documentation test project, nothing serious, really!
msgbarbottom

22 Jan 2007 How do I make a user public_html directory work under SELinux?

Posted by

This process presumes that you have enabled user public HTML directories in your Apache configuration file, /etc/httpd/conf/httpd.conf. This process only covers serving static Web content. For more information about Apache HTTP and SELinux, refer to http://fedora.redhat.com/docs/selinux-apache-fc3/.

If you do not already have a ~/public_html directory, create it and populate it with the files and folders to be served.

# cd ~
# mkdir public_html
# cp /path/to/content ~/public_html

At this point, httpd is configured to serve the contents, but you still receive a 403 forbidden error. This is because httpd is not allowed to read the security type for the directory and files as they are created in the user’s home directory. Change the security context of the folder and its contents recursively using the -R option:

#ls -Z -d public_html/

drwxrwxr-x  auser    auser    user_u:object_r:user_home_t      public_html

# chcon -R -t httpd_user_content_t public_html/
# ls -Z -d public_html/

drwxrwxr-x  auser    auser    user_u:object_r:httpd_user_content_t public_html/

# ls -Z public_html/
-rw-rw-r--  auser    auser    user_u:object_r:httpd_user_content_t bar.html
-rw-rw-r--  auser    auser    user_u:object_r:httpd_user_content_t baz.html
-rw-rw-r--  auser    auser    user_u:object_r:httpd_user_content_t foo.html

You may notice at a later date that the user field, set here to user_u, is changed to system_u. This does not affect how the targeted policy works. The field that matters is the type field.
Your static webpages should now be served correctly. If you continue to have errors, ensure that the Boolean which enables user home directories is enabled. You can set it using system-config-securitylevel. Select the SELinux tab, and then select the Modify SELinux Policy area. Select Allow HTTPD to read home directories. The changes take effect immediately.

Tags: , , , , ,

Comments are closed.