Problem with Apache permissions acting up.

sepoto · #1 8th February 2011, 06:38 PM

I have a file called askthedatesaver.png. When I open my browser to http://localhost/askthedatesaver.png I get a permission denied. Here are the permissions of all the files. I see no reason for this permission denied error.

Code:

[root@localhost conf]# cd /var/www/html
[root@localhost html]# ls -la
total 628
drwxr-xr-x. 2 root     root   4096 Oct 27 03:04 .
drwxr-xr-x. 6 root     root   4096 Feb  8 10:33 ..
-rwxrwxrwx. 1 joecamel root   1308 Feb  8 10:14 about.jpg
-rwxrwxrwx. 1 joecamel root   1234 Feb  8 10:05 archives.jpg
-rwxrwxrwx. 1 joecamel root   9064 Feb  8 10:20 askthedatesaver.png
-rwxrwxrwx. 1 joecamel root 234858 Feb  7 22:32 background.png
-rwxrwxrwx. 1 joecamel root   3005 Feb  7 22:15 clickme.png
-rwxrwxrwx. 1 joecamel root   1426 Feb  8 10:10 community.jpg
-rwxrwxrwx. 1 joecamel root   1093 Feb  8 10:13 contents.jpg
-rwxrwxrwx. 1 joecamel root  31123 Feb  7 19:17 cupidiscrazy.png
-rwxrwxrwx. 1 joecamel root   3184 Feb  7 22:34 filletrec.png
-rwxrwxrwx. 1 joecamel root   1942 Feb  8 10:18 index.html
-rwxrwxrwx. 1 joecamel root 276517 Feb  7 22:21 manandwoman.png
-rwxrwxrwx. 1 joecamel root   5134 Feb  7 19:22 manshead.gif
-rwxrwxrwx. 1 joecamel root   1210 Feb  8 10:02 news.jpg
-rwxrwxrwx. 1 joecamel root   1204 Feb  8 10:12 search.jpg
-rwxrwxrwx. 1 joecamel root  23877 Feb  8 09:55 toc.png
-rwxrwxrwx. 1 joecamel root   1772 Feb  8 10:09 viewervids.jpg
[root@localhost html]#

Thank you.

pete_1967 · #2 8th February 2011, 06:44 PM

Do 'ls -lZ' to same directory. If you have SELinux enabled, you need to label the files to correct context. To avoid relabelling them. copy the files instead of moving them into the server dirs.

In addition,. the root:root permissions are set by default for a very good reason: security, and another thing, never chmod anything to 777 unless absolutely necessary, things like images should be 644 at most.

sepoto · #3 8th February 2011, 06:47 PM

This is what I see the problem is is that I'm not sure how to repair it.

Code:

[root@localhost html]# ls -lZ
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 about.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 archives.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:user_home_t:s0 askthedatesaver.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 background.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 clickme.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 community.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 contents.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 cupidiscrazy.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 filletrec.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 index.html
-rwxrwxrwx. joecamel root unconfined_u:object_r:user_home_t:s0 manandwoman.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:user_home_t:s0 manshead.gif
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 news.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 search.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 toc.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 viewervids.jpg
[root@localhost html]#

pete_1967 · #4 8th February 2011, 10:16 PM

Quote:

Originally Posted by sepoto

This is what I see the problem is is that I'm not sure how to repair it.

Code:

[root@localhost html]# ls -lZ
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 about.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 archives.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:user_home_t:s0 askthedatesaver.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 background.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 clickme.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 community.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 contents.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 cupidiscrazy.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 filletrec.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 index.html
-rwxrwxrwx. joecamel root unconfined_u:object_r:user_home_t:s0 manandwoman.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:user_home_t:s0 manshead.gif
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 news.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 search.jpg
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 toc.png
-rwxrwxrwx. joecamel root unconfined_u:object_r:httpd_sys_content_t:s0 viewervids.jpg
[root@localhost html]#

And there is your problem, files with "unconfined_u:object_r:user_home_t:s0" are wrongly labelled. How to fix it: install SELinux Troubleshooter and read the error messages it gives you, then start reading Fedora manuals on the project site.

jpollard · #5 8th February 2011, 10:43 PM

If the files are intended to be read only, they can be set using

chcon -R -t httpd_sys_content_t <files/directories>

Making thing world writable is just asking to be hacked.