On 6/14/2012 6:26 AM, PS = Pete Stieber wrote:
PS>> Dan, how do I undo the original semanage command?
On 6/14/2012 7:37 AM, DW = Daniel J Walsh wrote:
DW> # semanage fcontext -d "/home/git(/.*)?"
Thanks for the help. I seem to be stuck using the original solution
suggestion made by audit2why. Here's what I tried.
I removed all of my previous semanage commands to restored the original
contexts for /home/git. ssh access to the repos worked. The
/home/git/repos selinux context was set to
unconfined_u:object_r:user_home_t:s0.
I'm guessing the suggested system_u:object_r:git_system_content_t:s0 is
for the git protocol because I didn't need to use this to get the ssh
protocol to work.
Now I was in my original state where the ssh protocol worked, but not
http. I looked through man httpd_selinux for clues and found
httpd_git_content_t. I tried the following
# semanage fcontext -a -t httpd_git_content_t "/home/git/repos(/.*)?"
# restorecon -R -v /home/git/repos
but the http protocol didn't work. Here's the audit2why explanation:
type=AVC msg=audit(1339689105.354:33404): avc: denied { getattr } for
pid=14427 comm="httpd" path="/home/git" dev="dm-2" ino=34340865
scontext=system_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
Was caused by:
One of the following booleans was set incorrectly.
Description:
Allow httpd to read user content
Allow access by executing:
# setsebool -P httpd_read_user_content 1
Description:
Allow httpd to read home directories
Allow access by executing:
# setsebool -P httpd_enable_homedirs 1
Apache still can't access something marked as user_home_dir_t.
So I manually changed /home/git...
# chcon -t httpd_git_content_t /home/git
Now the http protocol works, but the ssh protocol stopped working.
Here's the audit2why output:
type=AVC msg=audit(1339689307.117:33409): avc: denied { search } for
pid=14598 comm="sshd" name="git" dev="dm-2" ino=34340865
scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:httpd_git_content_t:s0 tclass=dir
Was caused by:
Missing type enforcement (TE) allow rule.
You can use audit2allow to generate a loadable module
to allow this access.
This isn't very clear, but the problem is the selinux type context on
home/hit.
I'm going to temporarily go back to default context settings for
/home/git and the original solution of
# setsebool -P httpd_read_user_content 1
# setsebool -P httpd_enable_homedirs 1
but I'm willing to try other, more secure solutions.
Patience is a virtue when dealing with selinux ;-)
Again, thanks for your help,
Pete
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
