Re: Relabeling PHP uploads when they are moved into place

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On Oct 4, 2011, at 9:57 AM, Scott Gifford wrote:

On Tue, Oct 4, 2011 at 7:00 AM, Vadym Chepkov <vchepkov@xxxxxxxxx> wrote:
[ ... ]
I think it's one of those cases where if a person asks how to shoot himself, he shouldn't be provided any recipes :)

The httpd_tmp_t does not provide any security advantage here, it is fully accessible by the Web server, just not accessible by other tools that we use in our development process (in particular Samba).

I'm moving the files into a directory labeled httpd_user_rw_content_t with these Apache options:

 Options None
 AllowOverride None
 RewriteEngine Off
 php_admin_flag engine off
 AddType text/plain .html .htm .shtml .php .js

The Apache options should prevent anything from being executed (though any suggestions on improving this are welcomed).

I understand where this requirement is coming from. Many current web engines nowadays allow you to install "extensions" or "plugins" via web interface.

No, these are just image files, not code.

Regarding the rules you mentioned in your next message: I have similar rules for my image directory, but SELinux does not apply them to this file.  Since the image is first uploaded to a temporary location, it has type httpd_tmp_t, and it is not relabeled according to my policy when it is moved into its final location.

-----Scott.

ok, then :)
But you saw all those different application don't have a problem with uploading a file and they do get a proper context. 
If files are copied and than deleted (not moved) it "should just work"

Vadym

--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux

[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux