Saturday, March 2, 2013

Set selinux to allow Apache and Samba on the same folder



First off, you can view the context of something with ls using ls -Z
[root@servername www]# ls -dZ /var/www/html
drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t /var/www/html
 
Second, there are two options for giving Samba and Apache access to the same directory.
The simple way is to just allow samba read/write access everywhere with:


setsebool -P samba_export_all_rw 1
 
It's simple, easy, and doesn't mess with any weird properties of SELinux.
If you're concerned with Samba having full access to all directories and only want to change /var/www, try:

chcon -t public_content_rw_t /var/www/html
setsebool -P allow_smbd_anon_write 1
setsebool -P allow_httpd_anon_write 1
 
This will allow both Samba and Apache write access to any directories with the public_content_rw_t context. Note that chcon is only modifying /var/www/html. Any new directories created under /var/www will be public_content_rw_t, but not existing directories like /var/www/html or /var/www/manual. If you want to change everything, add an -R to chcon:

chcon -R -t public_content_rw_t /var/www/html

No comments:

Post a Comment