10:55 a.m.
I'm trying to get apache2 to allow me to list files and directories on
my netbook for use as a public repo to let my kids copy them if they
want them.
The problem is, no matter what I do, I get an access denied error. By
default apache2 has INDEXES enabled for DOCROOT, but to be on the safe
side I added a new directory directive for <DOCROOT/pics> and set
INDEXES. Still nothing.
Then it occurred to me that selinux might be screwing with me, so I hit
the troubleshooter and followed the directions for setting up a new
policy for enabling directory access and used semodule to enable it.
Still no go. Anything else I can do to fix this? There's nothing really
in the access or error logs that help. The apache user is owner and the
perms are correct.
--
Mark Haney
Software Developer/Consultant
AB Emblem
markh(a)abemblem.com
Linux marius.homelinux 3.4.4-4.fc16.x86_64 GNU/Linux
6:19 a.m.
On Mon, 2012-07-30 at 11:38 -0500, Steven Stern wrote:
It would be nice if there were a cp option to adopt the context of
the target.
If you copy, the files get the right context based on the filepath for
where they're copied to. i.e. If you cp homepage.html /var/www/html/
the homepage.html file will be given normal contexts for /var/www/html/
(which are the right ones to webserve your files).
If you move it, then the original contexts of the file go with the copy.
If you created the file outside of the webserving directory tree, it
will keep those non-webserving contexts. But a move of a working
webservable file between places within /var/www/html won't be a problem,
as it'll already have the right contexts, whether that be moving between
directories, or just moving the file for a rename.
--
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
1:40 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/30/2012 11:06 AM, Mark Haney wrote:
On 07/30/2012 10:46 AM, Steven Stern wrote:
> On 07/30/2012 08:41 AM, Mark Haney wrote:
>> On 07/27/2012 01:22 PM, David Quigley wrote:
>> Everything I've tried seems to end up with an SELinux error. I've got
>> it disabled now, but haven't rebooted to see if that fixes it. It's
>> strange, the troubleshooter offers a couple of commands to set SELinux
>> correctly for what I want, but it still chokes on it.
>>
>>
>>
> If you copied files from some other directory into pics, then they
> probably brought along their existing context. Go back to /var/www/html
> and try "sudo restorecon -r *".
>
I've attached the full output of the troubleshooter just in case I managed
not to include everything needed.
I blogged about your problem.
http://danwalsh.livejournal.com/56534.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAlAW1TUACgkQrlYvE4MpobNBGACcDVi9aQgO8CcWNqZAbcHdZwNh
WGEAn1nxnkknQ71Z2hfKbj80ovZWEBD8
=jcI2
-----END PGP SIGNATURE-----
11:48 a.m.
On 07/30/2012 09:38 AM, Steven Stern issued this missive::
On 07/30/2012 11:06 AM, Mark Haney wrote:
> On 07/30/2012 11:26 AM, Steven Stern wrote:
>>>> If you copied files from some other directory into pics, then they
>>>>>> probably brought along their existing context. Go back to
>>>> /var/www/html
>>>>>> and try "sudo restorecon -r *".
>>>>>>
>>>>
>>>> I've attached the full output of the troubleshooter just in case I
>>>> managed not to include everything needed.
>>>>
>>>>
>>>>
>>>>
>> Run restorecon as suggested by the troubleshooter.
>
> Yep, that did it. Sometimes I wonder if the devs of SELinux are sane.
They're sane. You have to understand just what they're trying to
accomplish and there's a lot of stuff to try to protect from. Try
looking at a grsec'd system if you want some "least privilege"
complexity.
It would be nice if there were a cp option to adopt the context of
the
target. Currently, -Z requires that you set the context. I suppose it's
a good idea to keep you from shooting yourself in the foot by coping a
file that shouldn't be visible on a web site.
You can use "--preserve=context" to maintain the SELinux context of the
source file. You can't adopt the context of the target since you're
overwriting it. Makes sense if you think about it.
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, AllDigital ricks(a)alldigital.com -
- AIM/Skype: therps2 ICQ: 22643734 Yahoo: origrps2 -
- -
- Any sufficiently advanced technology is indistinguishable from a -
- rigged demo. -
----------------------------------------------------------------------
11:38 a.m.
On 07/30/2012 11:06 AM, Mark Haney wrote:
On 07/30/2012 11:26 AM, Steven Stern wrote:
>>> If you copied files from some other directory into pics, then they
>>> >>probably brought along their existing context. Go back to
>>> /var/www/html
>>> >>and try "sudo restorecon -r *".
>>> >>
>> >
>> >I've attached the full output of the troubleshooter just in case I
>> >managed not to include everything needed.
>> >
>> >
>> >
>> >
> Run restorecon as suggested by the troubleshooter.
Yep, that did it. Sometimes I wonder if the devs of SELinux are sane.
It would be nice if there were a cp option to adopt the context of the
target. Currently, -Z requires that you set the context. I suppose it's
a good idea to keep you from shooting yourself in the foot by coping a
file that shouldn't be visible on a web site.
--
-- Steve
11:06 a.m.
On 07/30/2012 11:26 AM, Steven Stern wrote:
>> If you copied files from some other directory into pics, then
they
>> >>probably brought along their existing context. Go back to /var/www/html
>> >>and try "sudo restorecon -r *".
>> >>
> >
> >I've attached the full output of the troubleshooter just in case I
> >managed not to include everything needed.
> >
> >
> >
> >
Run restorecon as suggested by the troubleshooter.
Yep, that did it. Sometimes I wonder if the devs of SELinux are sane.
--
Mark Haney
Software Developer/Consultant
AB Emblem
markh(a)abemblem.com
Linux marius.homelinux 3.4.4-4.fc16.x86_64 GNU/Linux
10:26 a.m.
On 07/30/2012 10:06 AM, Mark Haney wrote:
On 07/30/2012 10:46 AM, Steven Stern wrote:
> On 07/30/2012 08:41 AM, Mark Haney wrote:
>> On 07/27/2012 01:22 PM, David Quigley wrote:
>> Everything I've tried seems to end up with an SELinux error. I've got
>> it disabled now, but haven't rebooted to see if that fixes it. It's
>> strange, the troubleshooter offers a couple of commands to set SELinux
>> correctly for what I want, but it still chokes on it.
>>
>>
>>
> If you copied files from some other directory into pics, then they
> probably brought along their existing context. Go back to /var/www/html
> and try "sudo restorecon -r *".
>
I've attached the full output of the troubleshooter just in case I
managed not to include everything needed.
Run restorecon as suggested by the troubleshooter.
--
-- Steve
10:06 a.m.
On 07/30/2012 10:46 AM, Steven Stern wrote:
On 07/30/2012 08:41 AM, Mark Haney wrote:
> On 07/27/2012 01:22 PM, David Quigley wrote:
> Everything I've tried seems to end up with an SELinux error.
I've got
> it disabled now, but haven't rebooted to see if that fixes it. It's
> strange, the troubleshooter offers a couple of commands to set SELinux
> correctly for what I want, but it still chokes on it.
>
>
>
If you copied files from some other directory into pics, then they
probably brought along their existing context. Go back to /var/www/html
and try "sudo restorecon -r *".
I've attached the full output of the troubleshooter just in case I
managed not to include everything needed.
--
Mark Haney
Software Developer/Consultant
AB Emblem
markh(a)abemblem.com
Linux marius.homelinux 3.4.4-4.fc16.x86_64 GNU/Linux
9:46 a.m.
On 07/30/2012 08:41 AM, Mark Haney wrote:
On 07/27/2012 01:22 PM, David Quigley wrote:
> On 07/27/2012 12:46, Tim wrote:
>> On Fri, 2012-07-27 at 11:55 -0400, Mark Haney wrote:
>>> The problem is, no matter what I do, I get an access denied error. By
>>> default apache2 has INDEXES enabled for DOCROOT, but to be on the safe
>>> side I added a new directory directive for <DOCROOT/pics> and set
>>> INDEXES. Still nothing.
>>
>> Is your access denied error just for trying to view an index, or does it
>> happen when trying to view anything?
It happens when I try to view anything.
>>
>> Did you set that directive /after/ any opposing rules, were set? And is
>> your filepath inside the usual docroot, or outside of it? (It goes
>> inside <Directory> clauses.)
>>
>> The files, and all the directories back to the Linux /, all need to be
>> world-readable, and the directories also need to be world executable.
>>
>> e.g. /var/
>> /var/www/
>> /var/www/html/
>> /var/www/html/whatever-else/
>>
>> All need to have at least -------r-x directory permissions, and
>> -------r-- file permissions.
This is okay.
>>
>> --
>> [tim@localhost ~]$ uname -r
>> 2.6.27.25-78.2.56.fc9.i686
>>
>> Don't send private replies to my address, the mailbox is ignored. I
>> read messages from the public lists.
>
> If he is serving from an unusual path he should use the semanage
The Apache2 setup is the default setup. DOCROOT is /var/www/html and I
simply added a new directory /var/www/html/pics to it. I tinkered with
setting a new DIRECTORY directive with the new directory and +Indexes,
allow from all just to see if it worked.
Everything I've tried seems to end up with an SELinux error. I've got
it disabled now, but haven't rebooted to see if that fixes it. It's
strange, the troubleshooter offers a couple of commands to set SELinux
correctly for what I want, but it still chokes on it.
If you copied files from some other directory into pics, then they
probably brought along their existing context. Go back to /var/www/html
and try "sudo restorecon -r *".
--
-- Steve
9:08 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/30/2012 09:41 AM, Mark Haney wrote:
On 07/27/2012 01:22 PM, David Quigley wrote:
> On 07/27/2012 12:46, Tim wrote:
>> On Fri, 2012-07-27 at 11:55 -0400, Mark Haney wrote:
>>> The problem is, no matter what I do, I get an access denied error.
>>> By default apache2 has INDEXES enabled for DOCROOT, but to be on the
>>> safe side I added a new directory directive for <DOCROOT/pics> and
>>> set INDEXES. Still nothing.
>>
>> Is your access denied error just for trying to view an index, or does
>> it happen when trying to view anything?
It happens when I try to view anything.
>>
>> Did you set that directive /after/ any opposing rules, were set? And
>> is your filepath inside the usual docroot, or outside of it? (It goes
>> inside <Directory> clauses.)
>>
>> The files, and all the directories back to the Linux /, all need to be
>> world-readable, and the directories also need to be world executable.
>>
>> e.g. /var/ /var/www/ /var/www/html/ /var/www/html/whatever-else/
>>
>> All need to have at least -------r-x directory permissions, and
>> -------r-- file permissions.
This is okay.
>>
>> -- [tim@localhost ~]$ uname -r 2.6.27.25-78.2.56.fc9.i686
>>
>> Don't send private replies to my address, the mailbox is ignored. I
>> read messages from the public lists.
>
> If he is serving from an unusual path he should use the semanage
The Apache2 setup is the default setup. DOCROOT is /var/www/html and I
simply added a new directory /var/www/html/pics to it. I tinkered with
setting a new DIRECTORY directive with the new directory and +Indexes,
allow from all just to see if it worked.
Everything I've tried seems to end up with an SELinux error. I've got it
disabled now, but haven't rebooted to see if that fixes it. It's strange,
the troubleshooter offers a couple of commands to set SELinux correctly for
what I want, but it still chokes on it.
What avc's are you seeing?
ausearch -m avc -ts recent
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAlAWlWsACgkQrlYvE4MpobOZ+ACfZhNxzZrYXg3eIRDsx8PAezex
5M4AoKCPJHPi7+BEpQfFV2y0ko9Y79w/
=9krB
-----END PGP SIGNATURE-----
8:41 a.m.
On 07/27/2012 01:22 PM, David Quigley wrote:
On 07/27/2012 12:46, Tim wrote:
> On Fri, 2012-07-27 at 11:55 -0400, Mark Haney wrote:
>> The problem is, no matter what I do, I get an access denied error. By
>> default apache2 has INDEXES enabled for DOCROOT, but to be on the safe
>> side I added a new directory directive for <DOCROOT/pics> and set
>> INDEXES. Still nothing.
>
> Is your access denied error just for trying to view an index, or does it
> happen when trying to view anything?
It happens when I try to view anything.
>
> Did you set that directive /after/ any opposing rules, were set? And is
> your filepath inside the usual docroot, or outside of it? (It goes
> inside <Directory> clauses.)
>
> The files, and all the directories back to the Linux /, all need to be
> world-readable, and the directories also need to be world executable.
>
> e.g. /var/
> /var/www/
> /var/www/html/
> /var/www/html/whatever-else/
>
> All need to have at least -------r-x directory permissions, and
> -------r-- file permissions.
This is okay.
>
> --
> [tim@localhost ~]$ uname -r
> 2.6.27.25-78.2.56.fc9.i686
>
> Don't send private replies to my address, the mailbox is ignored. I
> read messages from the public lists.
If he is serving from an unusual path he should use the semanage
The Apache2 setup is the default setup. DOCROOT is /var/www/html and I
simply added a new directory /var/www/html/pics to it. I tinkered with
setting a new DIRECTORY directive with the new directory and +Indexes,
allow from all just to see if it worked.
Everything I've tried seems to end up with an SELinux error. I've got
it disabled now, but haven't rebooted to see if that fixes it. It's
strange, the troubleshooter offers a couple of commands to set SELinux
correctly for what I want, but it still chokes on it.
--
Mark Haney
Software Developer/Consultant
AB Emblem
markh(a)abemblem.com
Linux marius.homelinux 3.4.4-4.fc16.x86_64 GNU/Linux
2:27 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/27/2012 11:55 AM, Mark Haney wrote:
I'm trying to get apache2 to allow me to list files and
directories on my
netbook for use as a public repo to let my kids copy them if they want
them.
The problem is, no matter what I do, I get an access denied error. By
default apache2 has INDEXES enabled for DOCROOT, but to be on the safe side
I added a new directory directive for <DOCROOT/pics> and set INDEXES.
Still nothing.
Then it occurred to me that selinux might be screwing with me, so I hit
the troubleshooter and followed the directions for setting up a new policy
for enabling directory access and used semodule to enable it.
Still no go. Anything else I can do to fix this? There's nothing really in
the access or error logs that help. The apache user is owner and the perms
are correct.
What directory are you sharing? What is DOCROOT?
If you set permissive mode "#setenforce 0" does it work?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAlAS64sACgkQrlYvE4MpobOmgQCaA7PdGAeJvbP+zAwh6uWP34UZ
pREAn0i1ZhejpGieCGa6xijI7Ru6LywQ
=vT3r
-----END PGP SIGNATURE-----
12:22 p.m.
On 07/27/2012 12:46, Tim wrote:
On Fri, 2012-07-27 at 11:55 -0400, Mark Haney wrote:
> The problem is, no matter what I do, I get an access denied error.
> By
> default apache2 has INDEXES enabled for DOCROOT, but to be on the
> safe
> side I added a new directory directive for <DOCROOT/pics> and set
> INDEXES. Still nothing.
Is your access denied error just for trying to view an index, or does
it
happen when trying to view anything?
Did you set that directive /after/ any opposing rules, were set? And
is
your filepath inside the usual docroot, or outside of it? (It goes
inside <Directory> clauses.)
The files, and all the directories back to the Linux /, all need to
be
world-readable, and the directories also need to be world executable.
e.g. /var/
/var/www/
/var/www/html/
/var/www/html/whatever-else/
All need to have at least -------r-x directory permissions, and
-------r-- file permissions.
Likewise, if you're serving from /home/your-username/public_html/
If SELinux is enforcing, then there needs to be a "httpd_sys_content"
or
"httpd_user_content" context to the file and directories, too.
That'll
be set, by default, if you create or copy files in the usual web
serving
filepaths; but not if you created them elsewhere, and moved them
over.
If you're serving from an unusual filepath, then you'll need to
manually
apply file contexts. And you'll need to re-apply them anytime
there's a
relabelling of the file system, or, you'd create a rule for your
serving
filespace, so it gets labelled automatically.
You may also need to tick some options on inside a SELinux
configurator,
regarding local webserving, too.
--
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
If he is serving from an unusual path he should use the semanage
fcontext command to add the proper labeling and then just relabel that
location. That way he doesn't have to worry about relabeling operations.
Dave
11:46 a.m.
On Fri, 2012-07-27 at 11:55 -0400, Mark Haney wrote:
The problem is, no matter what I do, I get an access denied error.
By
default apache2 has INDEXES enabled for DOCROOT, but to be on the safe
side I added a new directory directive for <DOCROOT/pics> and set
INDEXES. Still nothing.
Is your access denied error just for trying to view an index, or does it
happen when trying to view anything?
Did you set that directive /after/ any opposing rules, were set? And is
your filepath inside the usual docroot, or outside of it? (It goes
inside <Directory> clauses.)
The files, and all the directories back to the Linux /, all need to be
world-readable, and the directories also need to be world executable.
e.g. /var/
/var/www/
/var/www/html/
/var/www/html/whatever-else/
All need to have at least -------r-x directory permissions, and
-------r-- file permissions.
Likewise, if you're serving from /home/your-username/public_html/
If SELinux is enforcing, then there needs to be a "httpd_sys_content" or
"httpd_user_content" context to the file and directories, too. That'll
be set, by default, if you create or copy files in the usual web serving
filepaths; but not if you created them elsewhere, and moved them over.
If you're serving from an unusual filepath, then you'll need to manually
apply file contexts. And you'll need to re-apply them anytime there's a
relabelling of the file system, or, you'd create a rule for your serving
filespace, so it gets labelled automatically.
You may also need to tick some options on inside a SELinux configurator,
regarding local webserving, too.
--
[tim@localhost ~]$ uname -r
2.6.27.25-78.2.56.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
11:12 a.m.
The problem is, no matter what I do, I get an access denied error.
Here is what I have on my desktop at work to allow everyone to
get to a directory where I have ISO images for various
linux distros installed, seems to work for me (but I do have
selinux disabled):
# And throw in /caliban/install-iso as well
#
Alias /install-iso /caliban/install-iso
<Directory /caliban/install-iso>
Order allow,deny
Allow from all
Options +Indexes
</Directory>
I seem to recall there is also some mysterious setting
somewhere I had to dig up at home because certain files
are hidden by default (with names like README - no idea
why you'd want to hide all README files).
4287
days inactive
4291
days old
14 comments
7 participants
participants (7)
-
Daniel J Walsh -
David Quigley -
Mark Haney -
Rick Stevens -
SternData -
Tim -
Tom Horsley