`#!!!! This avc can be allowed using one of the these booleans:` `# httpd_read_user_content, httpd_enable_homedirs` `allow httpd_t user_home_t:file read;` `allow httpd_t var_lib_t:file unlink;` If I isolate the messages then the read errors produces
`#============= httpd_t ==============`
`#!!!! This avc can be allowed using one of the these booleans:` `# httpd_read_user_content, httpd_enable_homedirs` `allow httpd_t user_home_t:file read;`
#!!!! This avc can be allowed using one of the these booleans: # httpd_can_network_connect, httpd_can_network_connect_db allow httpd_t mysqld_port_t:tcp_socket name_connect;
#!!!! This avc can be allowed using one of the these booleans: # httpd_can_sendmail, allow_ypbind, httpd_can_network_connect allow httpd_t smtp_port_t:tcp_socket name_connect;
#!!!! This avc can be allowed using one of the these booleans: # httpd_read_user_content, httpd_enable_homedirs
I'm a bit confused about what goes inside /srv and looking for good practices about its usage on Debian.
Acording to the FHS: "/srv contains site-specific data which is served by this system."
However I'm not sure if things like MySQL data files, munin's rrd files and stuff like that can/should...
It is part of the reference policy as installed by default. You can check it in a live system under grep -R www /etc/selinux/targeted/contexts/ , or using semanage fcontext -l | grep www
the labelling should occur on creation time, i.e., whenever a file/dir is created (`mkdir` `touch` `cp`, but not `mv` ) in a location known in the policy, it gets labeled accordingly
when you `mv` a file, it keeps its original SELinux label. It is a common pitfall.
ok I have just spun up a new CentOS 6.4 system to test it and that's not happening I created /srv/www/iain and it didn't get labelled as httpd_sys_content_t instead it's var_t
My current understanding is that you have to manually use restorecon to apply the desired context to a newly created file or directory unless you are happy with the context that it inherits from its parent directory.
I am wondering if it is possible to automatically apply a context on creation b...
I have always thought labeling occurs on creation. I don't even recall relabeling when moving from /var/www to /srv/www. But, then, I also have the restorecond service running by default.
I have just tried it in my Fedora 19, and /srv/www does not get properly labeled on creation
I'm a bit confused about what goes inside /srv and looking for good practices about its usage on Debian.
Acording to the FHS: "/srv contains site-specific data which is served by this system."
However I'm not sure if things like MySQL data files, munin's rrd files and stuff like that can/should...
