Hi,
This is on CentOS but it's a SELinux question.
I have a filesystem which I need to make available under ftp ( vsftpd ) httpd ( apache ) and NFS. It contains our local mirrors.
What should the permissions and the SELInux context be on the filesystem and how can I relabel it so that it can be available under all three.
The current permissions/SELinux context are
drwxr-xr-x root root system_u:object_r:default_t mirrors
and I want something like
drwxr-xr-x root root root:object_r:public_content_t TEST
Thanks,
Tony
On Thursday 28 June 2007 03:55:15 am Tony Molloy wrote:
Hi,
This is on CentOS but it's a SELinux question.
I have a filesystem which I need to make available under ftp ( vsftpd ) httpd ( apache ) and NFS. It contains our local mirrors.
What should the permissions and the SELInux context be on the filesystem and how can I relabel it so that it can be available under all three.
The current permissions/SELinux context are
drwxr-xr-x root root system_u:object_r:default_t mirrors
and I want something like
drwxr-xr-x root root root:object_r:public_content_t TEST
you do want the public_content_t (or perhaps the public_content_rw_t if it's not read only).
you may also need to check booleans to allow the different daemons to write to the pubilc_content_t areas:
allow_ftpd_anon_write --> off allow_httpd_anon_write --> off allow_httpd_apcupsd_cgi_script_anon_write --> off allow_httpd_bugzilla_script_anon_write --> off allow_httpd_squid_script_anon_write --> off allow_httpd_sys_script_anon_write --> off allow_nfsd_anon_write --> on allow_rsync_anon_write --> off allow_smbd_anon_write --> on
On Thursday 28 June 2007 12:23, Anthony Messina wrote:
On Thursday 28 June 2007 03:55:15 am Tony Molloy wrote:
Hi,
This is on CentOS but it's a SELinux question.
I have a filesystem which I need to make available under ftp ( vsftpd ) httpd ( apache ) and NFS. It contains our local mirrors.
What should the permissions and the SELInux context be on the filesystem and how can I relabel it so that it can be available under all three.
The current permissions/SELinux context are
drwxr-xr-x root root system_u:object_r:default_t mirrors
and I want something like
drwxr-xr-x root root root:object_r:public_content_t TEST
you do want the public_content_t (or perhaps the public_content_rw_t if it's not read only).
This is a read only mirror site so public_content_t should be enough. How do I do that.
you may also need to check booleans to allow the different daemons to write to the pubilc_content_t areas:
allow_ftpd_anon_write --> off allow_httpd_anon_write --> off allow_httpd_apcupsd_cgi_script_anon_write --> off allow_httpd_bugzilla_script_anon_write --> off allow_httpd_squid_script_anon_write --> off allow_httpd_sys_script_anon_write --> off allow_nfsd_anon_write --> on allow_rsync_anon_write --> off allow_smbd_anon_write --> on
I looked at the booleans with system-config-selinux and set those I thought I needed.
Thanks,
Tony
On Friday 29 June 2007 03:41:37 am Tony Molloy wrote:
On Thursday 28 June 2007 12:23, Anthony Messina wrote:
On Thursday 28 June 2007 03:55:15 am Tony Molloy wrote:
I have a filesystem which I need to make available under ftp ( vsftpd ) httpd ( apache ) and NFS. It contains our local mirrors.
What should the permissions and the SELInux context be on the filesystem and how can I relabel it so that it can be available under all three.
The current permissions/SELinux context are
drwxr-xr-x root root system_u:object_r:default_t mirrors
and I want something like
drwxr-xr-x root root root:object_r:public_content_t TEST
you do want the public_content_t (or perhaps the public_content_rw_t if it's not read only).
This is a read only mirror site so public_content_t should be enough. How do I do that.
to change the context of files, you can use the chcon utility. man chcon. it should be something like:
"chcon -R -t public_content_t TEST"
which will recursively relabel TEST directory everything under it with the right context.
you should also create a file as /etc/selinux/targeted/contexts/files/file_contexts.local which contains a line like
/TEST(/.*)? system_u:object_r:public_content_rw_t:s0
that way, that directory will have a "default" context
On Friday 29 June 2007 13:39, Anthony Messina wrote:
On Friday 29 June 2007 03:41:37 am Tony Molloy wrote:
On Thursday 28 June 2007 12:23, Anthony Messina wrote:
On Thursday 28 June 2007 03:55:15 am Tony Molloy wrote:
I have a filesystem which I need to make available under ftp ( vsftpd ) httpd ( apache ) and NFS. It contains our local mirrors.
What should the permissions and the SELInux context be on the filesystem and how can I relabel it so that it can be available under all three.
The current permissions/SELinux context are
drwxr-xr-x root root system_u:object_r:default_t mirrors
and I want something like
drwxr-xr-x root root root:object_r:public_content_t TEST
you do want the public_content_t (or perhaps the public_content_rw_t if it's not read only).
This is a read only mirror site so public_content_t should be enough. How do I do that.
to change the context of files, you can use the chcon utility. man chcon. it should be something like:
"chcon -R -t public_content_t TEST"
which will recursively relabel TEST directory everything under it with the right context.
you should also create a file as /etc/selinux/targeted/contexts/files/file_contexts.local which contains a line like
/TEST(/.*)? system_u:object_r:public_content_rw_t:s0
that way, that directory will have a "default" context
Thanks, I'll give that a try. I'm doing a install on that server at the moment.
Tony
On Fri, Jun 29, 2007 at 07:39:02 -0500, Anthony Messina amessina@messinet.com wrote:
you should also create a file as /etc/selinux/targeted/contexts/files/file_contexts.local which contains a line like
The new way is to do this using semanage. If you edit those files the changes don't take effect immediately.
selinux@lists.fedoraproject.org