Making SELinux allow access to certain directories

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Marko Vojinovic wrote:
> Greetings!
> 
> After my box has been rooted, I decided to put more security into it.
> After a brand new install and update of F7, I decided to leave SELinux on,
> and did the 'autorelabel&reboot' thing to make the whole filesystem work.
> 
> But now, I have problems running httpd and smb services. SELinux is
> denying access to httpd for the directory /www where html content is
> placed, and to smb for the directory /home/arhiva/ which should be shared.
> 
> The typical error in /var/log/messages says:
> 
> Oct 15 18:42:11 sith setroubleshoot:      SELinux is preventing
> /usr/sbin/smbd (swat_t) "getattr" to /home/arhiva (user_home_dir_t).     
> For complete SELinux messages. run sealert -l
> 0aa01162-47b3-4934-8687-c10f4f4ca8f3
> 
> After I ran the appropriate sealeart command, it told me to try
> 
> # restorecon -v /home/arhiva
> 
> which didn't solve the problem.
> 
> I am a newbie to SELinux, so would prefer not to create local policies
> etc. What should I do in order to allow access for a typical service to
> typical directory?
> 
> Best regards, :-)
> Marko
> 
> Marko Vojinovic
> Institute of Physics
> University of Belgrade
> ======================
> e-mail: vmarko at phy.bg.ac.yu
> 
> 
> 
You need to change the labeling on /www

Probably something like

# semanage fcontext -a -t httpd_sys_content_t '/www(/.*)?'
# restorecon -R -v /www

In order to allow httpd to read content in home directories
you need to turn on httpd_enable_homedirs

setsebool -P httpd_enable_homedirs 1
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHE75PrlYvE4MpobMRAgS/AKCOttPbW3087YhGAXvRdBW1HZsMogCcC/Rg
b+u0JOd7IeU06YFbHLc7AJg=
=yI5E
-----END PGP SIGNATURE-----