Re: httpd avc denied problem

[Daniel J Walsh <dwalsh@xxxxxxxxxx>]

Arthur Stephens wrote:

> I installed the policy sources on my fedora core 3. :)
> Got to step one
> Edit /etc/selinux/targeted/src/policy/file_contexts/file_contexts
>
> There is no such file  :(
> [root@webmail ~]# ls /etc/selinux/targeted/src/policy/file_contexts/
> distros.fc  misc  program  types.fc
> [root@webmail ~]#
>  
Ok create a file in the misc directory called custom.fc, file_context 
file is only created via the make file.

echo "/var/www/.*/logs(/.*)?            system_u:object_r:httpd_log_t" >> misc/customer.fc
Then rebuild policy

make load
Now restorecon



> Arthur Stephens
> Sales Technician
> Ptera Wireless Internet
> astephens@xxxxxxxxx
> 509-927-Ptera
>
> ----- Original Message ----- 
> From: "Karsten Wade" <kwade@xxxxxxxxxx>
> To: "Fedora SELinux support list for users & developers."
> <fedora-selinux-list@xxxxxxxxxx>
> Sent: Tuesday, November 30, 2004 2:01 PM
> Subject: Re: httpd avc denied problem
>
>
>  
>
> > On Tue, 2004-11-30 at 13:12, Karsten Wade wrote:
> >
> >    
> >
> > >  chcon -R -t httpd_log_t /var/www/*/logs/*
> > >  service httpd start
> > >      
> > BTW, if this works, you'll want to do something to make the change
> > permanent.  Otherwise, the next running of restorecon will hose your
> > configuration.
> >
> > Two options jump to mind:
> >
> > * Move the logs into a path that will receive httpd_log_t, i.e.,
> > /var/logs/httpd/
> >
> > * Install the policy sources (yum install
> > selinux-policy-targeted-sources), and do the following:
> >
> > 1. Edit /etc/selinux/targeted/src/policy/file_contexts/file_contexts
> >
> > 2. Add this line:
> > /var/www/.*/logs(/.*)?            system_u:object_r:httpd_log_t
> >
> > Feel free to correct my regexp, but I think it's right. :)
> >
> > 3. In /etc/selinux/targeted/src/policy rebuild the policy with 'make
> > load'.  This will build and load the new policy directly into memory.
> >
> > 4. If you now do restorecon, the /var/www/*/logs directories should get
> > the proper context.
> >
> > Be aware that if you make another change to SELinux, especially using
> > system-config-securitylevel, the file /.autorelabel may get created.
> > That triggers a relabeling on reboot, and may hose any manual
> > customizations not fixed in policy.
> >
> > - Karsten
> > --
> > Karsten Wade, RHCE, Tech Writer
> > a lemon is just a melon in disguise
> > http://people.redhat.com/kwade/
> > gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41
> >
> > --
> > fedora-selinux-list mailing list
> > fedora-selinux-list@xxxxxxxxxx
> > http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >    
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>