Hi,
I wanted to create my own web directory to serve pages from for obvious reasons. I edited the httpd.conf file appropriately using the UserDir defaults. I then changed the permissions on my home folder (chmod 711) and then on my web directory as root (chmod 755). On most distros this is more than enough, on Fedora I had to deal with SELinux.
I used the system-config-selinux command as root to enable all the apache restrictions and some others as well. Thanks due to this website: http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/selinux.htm...http://optics.csufresno.edu/%7Ekriehn/fedora/fedora_files/f9/howto/selinux.html
SELinux still prevented the apache from serving from the directory. I then used the command: # chcon -R -h -t httpd_sys_content_t my_web_dir
And finally, I could serve pages alongside SELinux.
However, I've run into a strange problem.
http://localhost/~user/ OKAY http://localhost/~user/newdirX OKAY http://localhost/~user/newdirX/newdirY NOT OKAY
The newdirY is hidden. Is there some directory depth restriction used by apache? I don't think this is an SELinux problem because no warning is issued, I might be wrong.
I'd like to be able to create limitless directories in my webdir and have their contents served without issue.
On Mon, Apr 20, 2009 at 4:22 PM, anonymous bitskrieg@gmail.com wrote:
Hi,
I wanted to create my own web directory to serve pages from for obvious reasons. I edited the httpd.conf file appropriately using the UserDir defaults. I then changed the permissions on my home folder (chmod 711) and then on my web directory as root (chmod 755). On most distros this is more than enough, on Fedora I had to deal with SELinux.
I used the system-config-selinux command as root to enable all the apache restrictions and some others as well. Thanks due to this website: http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/selinux.htm...
SELinux still prevented the apache from serving from the directory. I then used the command: # chcon -R -h -t httpd_sys_content_t my_web_dir
And finally, I could serve pages alongside SELinux.
However, I've run into a strange problem.
http://localhost/~user/ OKAY http://localhost/~user/newdirX OKAY http://localhost/~user/newdirX/newdirY NOT OKAY
The newdirY is hidden. Is there some directory depth restriction used by apache? I don't think this is an SELinux problem because no warning is issued, I might be wrong.
I'd like to be able to create limitless directories in my webdir and have their contents served without issue.
Have you checked the apache logs?
It seems that problem stems from using compressed files downloaded from the internet.
I can create any number of directories and files I want, and they will all be labeled as such: unconfined_u:object_r:httpd_sys_content_t:s which I'm allowed to serve. However, when I uncompress a gzipped file into the web directory, it doesn't work. I have no idea why because it has the same label as the others: unconfined_u:object_r:httpd_sys_content_t:s
You really want to use semanage or the next relabel will undo your changes
I'm not sure what you mean by relabel. Is that done automatically?
Have you checked the apache logs?
There aren't any errors in the logs.
On Mon, Apr 20, 2009 at 5:40 PM, anonymous bitskrieg@gmail.com wrote:
It seems that problem stems from using compressed files downloaded from the internet.
I can create any number of directories and files I want, and they will all be labeled as such: unconfined_u:object_r:httpd_sys_content_t:s which I'm allowed to serve. However, when I uncompress a gzipped file into the web directory, it doesn't work. I have no idea why because it has the same label as the others: unconfined_u:object_r:httpd_sys_content_t:s
You really want to use semanage or the next relabel will undo your changes
I'm not sure what you mean by relabel. Is that done automatically?
No, if you're using paths other than the apache default, you have to use the system-config-selinux tool to tell Selinux about it.
Have you checked the apache logs?
There aren't any errors in the logs.
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
Sorry folks, my fault. The logs did show that there was an .htaccess file I was unaware of in the directory. I went ahead and set AllowOverride to ALL, please tell me if this is a bad thing.
No, if you're using paths other than the apache default, you have to use the system-config-selinux tool to tell Selinux about it.
I went back used semanage as per the fedora selinux manual.
/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?" /sbin/restorecon -R -v /web
Thanks for the suggestions.
BTW, this seems like an awful lot to accomplish what I would think is a common task. Isn't it normal to need a per-user web directory? Or is there some other easier way like changing the permissions for a directory in the server root?
On Mon, Apr 20, 2009 at 7:13 PM, anonymous bitskrieg@gmail.com wrote:
Sorry folks, my fault. The logs did show that there was an .htaccess file I was unaware of in the directory. I went ahead and set AllowOverride to ALL, please tell me if this is a bad thing.
No, if you're using paths other than the apache default, you have to use the system-config-selinux tool to tell Selinux about it.
I went back used semanage as per the fedora selinux manual.
/usr/sbin/semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?" /sbin/restorecon -R -v /web
Thanks for the suggestions.
BTW, this seems like an awful lot to accomplish what I would think is a common task. Isn't it normal to need a per-user web directory?
No not really... but that depends on who you're referring to. For people like yourself and I, that's pretty normal.
For everyone else that would be the set of people that user linux, use apache, have user accounts on their apache box, and want their users to have person web spaces that are actually on the filesystem as opposed to in a blog. That's a quickly shrinking number.
Or is there some other easier way like changing the permissions for a directory in the server root?
Directories in /var/www and /home/*/public_html would have been ready. But you, like myself, used a dir name other than public_html.
On Mon, Apr 20, 2009 at 17:40:50 -0500, anonymous bitskrieg@gmail.com wrote:
You really want to use semanage or the next relabel will undo your changes
I'm not sure what you mean by relabel. Is that done automatically?
If you do something that might have run with selinux disabled (such as using your system is rescue mode) or possibly after a major selinux policy change you should relabel your system. Each file's context is checked against a set of patterns and reset if it isn't the proper one. restorecon also checks file's contexts against thos patterns but is generally used for minor changes where only a small part of your file system is known to need changes. The patterns are not used when creating new files. There the context is either set by the application creating it to something specific or it gets a default based on the context of the application and the context of the directory it is being created in. The most common default is that the context of the file is the same as the context as the directory it is being created in, but that isn't universal.
On Mon, Apr 20, 2009 at 16:22:18 -0500, anonymous bitskrieg@gmail.com wrote:
I then used the command: # chcon -R -h -t httpd_sys_content_t my_web_dir
You really want to use semanage or the next relabel will undo your changes.
However, I've run into a strange problem.
http://localhost/~user/ OKAY http://localhost/~user/newdirX OKAY http://localhost/~user/newdirX/newdirY NOT OKAY
The newdirY is hidden. Is there some directory depth restriction used by apache? I don't think this is an SELinux problem because no warning is issued, I might be wrong.
Did you check the context of newdirY?