SELinux rsync and apache

[CyberNerd]

I need to get rsync to read files from /var/www

SELinux is preventing this.

If I change the context to

 

  chcon -R -t public_content_t /var/www/ 

 

then rsync is happy - but httpd wont start :-(

 

 [root@www ~]# ls -Z /var/www/
drwxr-xr-x. apache root   system_u:object_r:public_content_t:s0 cgi-bin
drwxr-xr-x. apache root   system_u:object_r:public_content_t:s0 error
drwxr-xr-x. apache root   system_u:object_r:public_content_t:s0 html
drwxr-xr-x. apache root   system_u:object_r:public_content_t:s0 icons
drwx------. apache root   system_u:object_r:public_content_t:s0 lost+found
drwxr-xr-x. apache root   system_u:object_r:public_content_t:s0 manual
drwxr-xr-x. apache root   system_u:object_r:public_content_t:s0 usage
drwxr-xr-x. vhost  apache system_u:object_r:public_content_t:s0 vhosts

 

If I change to

 

chcon -R -t httpd_sys_content_t /var/www/ 

 

 [root@www ~]# ls -Z /var/www/
drwxr-xr-x. apache root   system_u:object_r:httpd_sys_content_t:s0 cgi-bin
drwxr-xr-x. apache root   system_u:object_r:httpd_sys_content_t:s0 error
drwxr-xr-x. apache root   system_u:object_r:httpd_sys_content_t:s0 html
drwxr-xr-x. apache root   system_u:object_r:httpd_sys_content_t:s0 icons
drwx------. apache root   system_u:object_r:httpd_sys_content_t:s0 lost+found
drwxr-xr-x. apache root   system_u:object_r:httpd_sys_content_t:s0 manual
drwxr-xr-x. apache root   system_u:object_r:httpd_sys_content_t:s0 usage
drwxr-xr-x. vhost  apache system_u:object_r:httpd_sys_content_t:s0 vhosts

 

Then httpd is happy - but rsync won't run

 

type=AVC msg=audit(1296653954.564:901): avc:  denied  { search } for  pid=2110 comm="rsync" name="/" dev=dm-2 ino=2 scontext=system_u:system_r:rsync_t:s0-s0:c0.c1023 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
type=SYSCALL msg=audit(1296653954.564:901): arch=c000003e syscall=161 success=no exit=-13 a0=235cd40 a1=235cca0 a2=4519e6 a3=8 items=0 ppid=1679 pid=2110 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rsync" exe="/usr/bin/rsync" subj=system_u:system_r:rsync_t:s0-s0:c0.c1023 key=(null)

 

How do I change the context so that both processes can read /var/www ?

[CyberNerd]

I think I got it.

I needed to do:

setsebool -P allow_httpd_anon_write on 

 

and the files needed to be read/write as well for moodle/cms

 

to finalise I did:

semanage fcontext -a -t public_content_rw_t "/var/www/(/.*)?"

restorecon -R -v /var/www/

 

If anyone else struggles with SELinux (it is an uphill struggle) this is a good resource

Managing Confined Services