Re: trying to set a context

[mark]

Well, I'm slowly beating this into submission. However, an error I'm
seeing now is that selinux doesn't like svn via apache looking at the
repositories. Here's my situation:
/<mybase>/<export dir>/
                        repoa
                        repob
                        lost+found
                        anotherdir

I don't think that /<mybase>/<export dir>, which is owned root:root,
should have a context of httpd_sys_content_t, but that seems to be what
sealert is telling me.

Is there a clean way to resolve this?

        mark

trying to set a context

[Moray Henderson]

>  -----Original Message-----
>  From: selinux-bounces(a)lists.fedoraproject.org [mailto:selinux-
>  bounces(a)lists.fedoraproject.org] On Behalf Of m.roth(a)5-cent.us
>  Sent: 17 August 2012 16:52
>  
>  Well, I'm slowly beating this into submission. However, an error I'm
>  seeing now is that selinux doesn't like svn via apache looking at the
>  repositories. Here's my situation:
>  /<mybase>/<export dir>/
>                          repoa
>                          repob
>                          lost+found
>                          anotherdir
>  
>  I don't think that /<mybase>/<export dir>, which is owned root:root,
>  should have a context of httpd_sys_content_t, but that seems to be what
>  sealert is telling me.
>  
>  Is there a clean way to resolve this? 
See if there's anything useful for you in "man httpd_selinux" (or is it
selinux_httpd - I can never remember which way round those go).  There are a number of
options for giving access to different types.


Moray.
“To err is human; to purr, feline.”

trying to set a context

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/17/2012 11:52 AM, m.roth(a)5-cent.us wrote:
>  Well, I'm slowly beating this into submission. However, an error
> I'm seeing
>  now is that selinux doesn't like svn via apache looking at the 
>  repositories. Here's my situation: /<mybase>/<export dir>/ repoa repob 
>  lost+found anotherdir
>  
>  I don't think that /<mybase>/<export dir>, which is owned root:root,
> should
>  have a context of httpd_sys_content_t, but that seems to be what sealert is
>  telling me.
>  
>  Is there a clean way to resolve this?
>  
>  mark
>  
>  -- selinux mailing list selinux(a)lists.fedoraproject.org 
>  https://admin.fedoraproject.org/mailman/listinfo/selinux
>   
Does /<mybase> contain apache content?  Or does httpd just need to search
through it?


> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAlAyCKQACgkQrlYvE4MpobP1UwCgvknTCb2em+wTod/kfhOVYHQW
> or0An16i9whbxU+y++Au11IY45zX6K5i
> =vaVX
> -----END PGP SIGNATURE-----

trying to set a context

[Paul Howarth]

On 08/17/2012 04:52 PM, m.roth(a)5-cent.us wrote:
>  Well, I'm slowly beating this into submission. However, an error
> I'm
>  seeing now is that selinux doesn't like svn via apache looking at the
>  repositories. Here's my situation:
>  /<mybase>/<export dir>/
>                           repoa
>                           repob
>                           lost+found
>                           anotherdir
>
>  I don't think that /<mybase>/<export dir>, which is owned root:root,
>  should have a context of httpd_sys_content_t, but that seems to be what
>  sealert is telling me.
>
>  Is there a clean way to resolve this? 
For my own svn server, I use:

/srv/subversion(/.*)?      		httpd_sys_content_rw_t

/srv/subversion/repos/[^/]*/hooks(/.*)?	httpd_sys_script_exec_t

Paul.