Benrwong at 18:08, 1 July 2019

2019-07-01T18:08:50Z

@@ Line 1: / Line 1: @@
-Some notes on selinux:
+SELinux is the bane of many administrators and yours truly is no exception.
-Usually if there is a problem with an selinux context, it’s usually the type.g
+When an SELinux denial occurs, it may not be obvious.  You may get a permission error but have perfectly fine Linux permissions.  The issue may reside in SELinux permissions which are called SELinux contexts.  To view an SELinux context, do an ls with the -Z flag.
 For http you want the types to match what’s in the /etc/httpd/ directory.  There are generally three types for http: content, logs and conf.  Here is how I got the wiki to work:
@@ Line 32: / Line 82: @@
   2097148404 1572864000 2097152000    1269939
-== on alpha ==
+=== on alpha ===
   cd /nfs/db4/dbraw/zinc
   chcon system_u:object_r:nfs_t:s0 ??
 rebuild, etc

Frodo: asdf

2017-06-28T19:31:56Z

asdf

← Older revision		Revision as of 19:31, 28 June 2017
Line 31:		Line 31:
	setsebool -P httpd_enable_homedirs on <br />		setsebool -P httpd_enable_homedirs on <br />
	2097148404 1572864000 2097152000 1269939		2097148404 1572864000 2097152000 1269939

			== on alpha ==
			cd /nfs/db4/dbraw/zinc
			chcon system_u:object_r:nfs_t:s0 ??
			rebuild, etc

Benrwong: Created page based on "Selinux and httpd" from Lab Manual

2016-06-30T18:57:46Z

Created page based on "Selinux and httpd" from Lab Manual

New page

Some notes on selinux:
To see the context of a file type ls -lZ
The contexts are listed like this: user:role:type

Usually if there is a problem with an selinux context, it’s usually the type.g
For http you want the types to match what’s in the /etc/httpd/ directory. There are generally three types for http: content, logs and conf. Here is how I got the wiki to work:

chcon -t httpd_config_t /domains/wiki.ucsf.bkslab.org/wiki.ucsf.bkslab.org.conf
chcon -R -t httpd_log_t /domains/wiki.ucsf.bkslab.org/logs
chcon -R -t httpd_user_content_t /domains/wiki.ucsf.bkslab.org/htdocs
chcon -R -t httpd_sys_script_rw_t /domains/wiki.ucsf.bkslab.org/htdocs/images
chcon -R -t httpd_sys_script_exec_t /domains/wiki.ucsf.bkslab.org/htdocs/extensions
chcon -R -t httpd_user_script_exec_t /usr/share/pear
chcon -R -t httpd_user_script_exec_t /usr/share/php
chcon -R -t httpd_user_script_exec_t /usr/share/mysql (?)
setsebool -P httpd_can_sendmail 1

Debugging:
sestatus
getsebool -a | grep httpd
HOW I GOT SELINUX WORKING RIGHT FOR USER WEBSITES:
chcon -R -t httpd_log_t logs
chcon -R -t httpd_user_content_t public_html
chcon -R -t httpd_config_t tdemers.ucsf.bkslab.org.conf
chcon -R -t httpd_user_script_exec_t /usr/share/pear
chcon -R -t httpd_user_script_exec_t /usr/share/php
chcon -R -t httpd_user_script_exec_t /usr/share/mysql (?)
setsebool -P httpd_can_sendmail 1
setsebool -P httpd_can_network_connect on
setsebool -P httpd_can_network_connect_db on
setsebool -P httpd_enable_homedirs on <br />
2097148404 1572864000 2097152000 1269939

SELinux notes - Revision history

Benrwong at 18:08, 1 July 2019

Frodo: asdf

Benrwong: Created page based on "Selinux and httpd" from Lab Manual