Cannot FTP to /var/www/don/html with SELinux enabled

[Donsoloway]

Hi,
I have two problems which I think they are similar.


1) I have a directory /var/www/don/html which is owned by don. I want to ftp some web pages, but I cannot cd to /var/www/don/html when SELinux is enabled. When I turn SELinux off it works. What do I need to set to allow this.


2) If I ftp to my home dir some html files and copy them to /var/www/don/html they cannot be read by the browser while SELinux is enabled.


Thanks in advance,
Don

[SlowJet]

One of the security features of SELinux is that each process runs in it's own username space.
For targeted policy, these are listed in the Security / Firewall gui.
For Strict policy, it get very complex as every tak is running in a seperate usernam space.

The httpd user has a context of http_t, don would have user_t, root has system_t

user don can not put anything into http - access denied.
(Since you did, this means /www/don dir is reality owned by don. - not allowed in httpd space.)

When the mv command is used the destination retains the context of the files.
If cp is used the files take on the context of the destination.
So http, don, and anyother regular user can not access the others files, change permissions or security context.

So how do you get files into other user names space.

SU -
password
root@domain
This is the guy that owns everything and via using a cp the files take on the context of the destination.
What is NOT seen is that in targeted policy switching to root is like an implied ROLE of admin AND Webadin.
In strick mode policy one may automatically be defined to be one of the several roles in the policy.
Or, for example, the main guy, i.e. = you, can be root, change to the role of admin, or go lower and change to the role of webadmin.
When one person is responsible for many functions, it's a matter of trusted policy and the one person following good security practice, i.e. change to webadmin before cp in root so (S)he doesn't screw up too much.

For you problem, make www/don and sub dir's owned by httpd
and cp with root (implied ROLE webadmin)
chown -R httpd:httpd /www/don
chmod as needed after the cp from /home/don

There is a provision for using html in a user dir but it is much less secure and puts both users (httpd and don) at risk.

Same type of thing for cgi scripts - only cp with root into www/cgi (And PHP)

SJ

[fredm6463]

I am having similar problem.

With SELinux enabled, I cannot ftp as a user on the system. Error message is: cannot open /home/user.
I turn off SELinux security and all is fine.
How do I get vsftp to work with SELinux security enabled?

Thanks.

[landoncz]

Perhaps you need to modify your SELinux policy... type (as root):

system-config-securitylevel

And select the SELinux tab. If the mode is set to enforcing, browse down to the FTP service options, and check the box that says "Allow FTP to read/write to user's home directory" or something like that. Then, all should be well...

[pacifico]

I'm having the same problem, but it is on a server with no GUI installed. How do I change the context to system_u:object_r:httpd_sys_content_t for my directory?

ls -Z currently yields

-rw-r--r-- root root user_u:object_r:var_t index.html
drwxr-xr-x root root user_u:object_r:var_t yum

Thanks.
-al

[pacifico]

Figured it out...
chcon -c -R --reference=/var/www /srv/www/html/
relabeled the directory and its contents.