Hi Samuel,
Thanks for the reply. What you provided doesn't seem to mesh with other sites I've seen. Take a look at these sites and if you feel up to it, get back to me with comments!!!
https://www.digitalocean.com/community/tutorials/an-introduction-to-selinux-on-centos-7-part-1-basic-concepts
https://www.lisenet.com/2016/advanced-apache-configuration-with-selinux-on-rhel-7/
https://www.lisenet.com/2016/advanced-apache-configuration-with-selinux-on-rhel-7/
thanks
On Tue, Apr 14, 2020 at 2:45 PM Samuel Sieb <samuel@xxxxxxxx> wrote:
On 4/14/20 11:01 AM, bruce wrote:
> My use case:
> To create a test local VM
> To fire up httpd/mysql on the VM
> To create a couple of test users on the VM
> Create a test static website under /var/www/html/cat
> using index.html
> aa.php
>
> I've already got the VM, test users, httpd, etc.. And things run with
> selinux disabled.
Why and how would you install Fedora with selinux disabled? That's
going to cause you trouble later. Do you mean not enabled or just not
enforcing. Either way, it should not be necessary.
> My selinux needs:
> to setup selinux attributes/security to allow apache/httpd
> to run correctly
> to allow the httpd to handle/process the index.html
> to allow the httpd to handle/process the aa.php
You rarely have to "setup" selinux. The default policies are designed
to just work under normal configurations.
> also, say I create test user 'bob'
> 'bob' will have a dir /home/bob
>
> I want 'bob' to be able to create/edit files,
> and to be able to copy files, to read/write/delete
> files into the /var/www/html/cat dir structure
If it's only bob that's doing the editing, then change the owner of
those files to him.
> So:
> I'm trying to figure out what I need to do for selinux for the
> user 'bob'
Nothing.
> I'm trying to figure out what I need to do for selinux for the
> apache/httpd process
Nothing.
> Trying to understand what I need to do to allow user 'bob'
> access to change the /var/www/html/cat dirs..
That's just file permissions, not selinux. You're making this way more
complicated than it needs to be. Unless you're doing something unusual,
you're unlikely to even notice selinux. (Although you will have to flip
some booleans if you're going to access a database from the web server.)
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
_______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
