I am using the gallery2 tar ball from http://codex.gallery2.org/Downloads ; it stays more up to date. They have a policy for selinux, but the log still had AVCs in it and denials that prevented gallery2 and specifically the watermark plugin from working. File and directory permissions were an issue. One of the directories is shared by samba so it has the context of public_content_rw_t.
I used audit2allow to get things working, but I would like someone more knowledgeable than me to take a look as see if I have opened any gaping holes and if so, how to best address the issue.
policy_module(gallery, 1.0)
require { type unlabeled_t; type httpd_t; type httpd_tmp_t; type httpd_sys_script_t; type public_content_rw_t; class file { read write unlink }; class dir { write remove_name add_name }; }
#============= httpd_sys_script_t ============== allow httpd_sys_script_t unlabeled_t:file { read write }; allow httpd_sys_script_t httpd_tmp_t:file { getattr read };
#============= httpd_t ============== allow httpd_t public_content_rw_t:dir { write remove_name add_name }; allow httpd_t public_content_rw_t:file unlink;
Thanks, John Griffiths