On 4/14/20 11:01 AM, bruce wrote:
My use case:
To create a test local VM
To fire up httpd/mysql on the VM
To create a couple of test users on the VM
Create a test static website under /var/www/html/cat
using index.html
aa.php
I've already got the VM, test users, httpd, etc.. And things run with
selinux disabled.
Why and how would you install Fedora with selinux disabled? That's
going to cause you trouble later. Do you mean not enabled or just not
enforcing. Either way, it should not be necessary.
My selinux needs:
to setup selinux attributes/security to allow apache/httpd
to run correctly
to allow the httpd to handle/process the index.html
to allow the httpd to handle/process the aa.php
You rarely have to "setup" selinux. The default policies are designed
to just work under normal configurations.
also, say I create test user 'bob'
'bob' will have a dir /home/bob
I want 'bob' to be able to create/edit files,
and to be able to copy files, to read/write/delete
files into the /var/www/html/cat dir structure
If it's only bob that's doing the editing, then change the owner of
those files to him.
So:
I'm trying to figure out what I need to do for selinux for the
user 'bob'
Nothing.
I'm trying to figure out what I need to do for selinux for the
apache/httpd process
Nothing.
Trying to understand what I need to do to allow user 'bob'
access to change the /var/www/html/cat dirs..
That's just file permissions, not selinux. You're making this way more
complicated than it needs to be. Unless you're doing something unusual,
you're unlikely to even notice selinux. (Although you will have to flip
some booleans if you're going to access a database from the web server.)
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
