Re: FC3, Apache and CGI web app

[Scott Cain <cain@cshl.org>]

Dan,

I did the relabel/reboot and was able to change the context, now my next
question: was changing the context of the GBrowse tmp directory supposed
to allow it to run with SELinux enabled for httpd? ie:

httpd_disable_trans=0
httpd_enable_cgi=1
httpd_enable_homedirs=1
httpd_ssi_exec=1
httpd_tty_comm=1
httpd_unified=1

Because it doesn't; I'm back to 500 errors.  Is what you meant instead
that I have to change the context and make it writable only by the owner
(ie, apache)?

Thanks for your patience,
Scott

On Thu, 2005-02-03 at 11:11 -0500, Daniel J Walsh wrote:
> Scott Cain wrote:
> 
> >OK, now I get this:
> >
> >[scott@localhost gbrowse]$ sudo chcon -R -t httpd_sys_content_t /var/www/html/gbrowse/tmp
> >/usr/bin/chcon: can't apply partial context to unlabeled file /var/www/html/gbrowse/tmp/yeast_chr1
> >
> >  
> >
> Has this machine been labeled or booted with selinux=0?  You need to 
> relabel the system.
> 
> touch /.autorelabel
> reboot
> 
> 
> >About my comment about the man page: I was just saying that it doesn't
> >say much about what options are available (like how would I know I need
> >to use 'httpd_sys_content_t'?)  I'm guessing this is further documented
> >somewhere else.
> >
> >Thanks,
> >Scott
> >
> >On Thu, 2005-02-03 at 10:59 -0500, Daniel J Walsh wrote:
> >  
> >
> >>Scott Cain wrote:
> >>
> >>    
> >>
> >>>On Thu, 2005-02-03 at 10:35 -0500, Daniel J Walsh wrote:
> >>> 
> >>>
> >>>      
> >>>
> >>>>No but you could just change the context of tmp to httpd_sys_content_t
> >>>>
> >>>>chcon -R httpd_sys_content_t /var/www/html/gbrowse/tmp
> >>>>
> >>>>Which should fix it. 
> >>>>
> >>>>   
> >>>>
> >>>>        
> >>>>
> >>>[scott@localhost gbrowse]$ sudo chcon -R httpd_sys_content_t /var/www/html/gbrowse/tmp
> >>>/usr/bin/chcon: invalid context: httpd_sys_content_t
> >>>
> >>>Is there a typo in there somewhere?  Also, is this documented somewhere?
> >>>`man` and `info` are particularly terse and not very helpful.
> >>>
> >>>Thanks,
> >>>Scott
> >>>
> >>>
> >>> 
> >>>
> >>>      
> >>>
> >>Oops
> >>chcon -R -t httpd_sys_content_t /var/www/html/gbrowse/tmp
> >>
> >>There should be a man page, there is one on my machine
> >>
> >>
> >>plain text document attachment (chcon)
> >>CHCON(1)			User Commands			     CHCON(1)
> >>
> >>
> >>
> >>NAME
> >>       chcon - change security context
> >>
> >>SYNOPSIS
> >>       chcon [OPTION]... CONTEXT FILE...
> >>       chcon [OPTION]... --reference=RFILE FILE...
> >>
> >>DESCRIPTION
> >>       Change the security context of each FILE to CONTEXT.
> >>
> >>       -c, --changes
> >>	      like verbose but report only when a change is made
> >>
> >>       -h, --no-dereference
> >>	      affect symbolic links instead of any referenced file (available
> >>	      only on systems with lchown system call)
> >>
> >>       -f, --silent, --quiet
> >>	      suppress most error messages
> >>
> >>       -l, --range
> >>	      set range RANGE in the target security context
> >>
> >>       --reference=RFILE
> >>	      use RFILE’s context instead of using a CONTEXT value
> >>
> >>       -R, --recursive
> >>	      change files and directories recursively
> >>
> >>       -r, --role
> >>	      set role ROLE in the target security context
> >>
> >>       -t, --type
> >>	      set type TYPE in the target security context
> >>
> >>       -u, --user
> >>	      set user USER in the target security context
> >>
> >>       -v, --verbose
> >>	      output a diagnostic for every file processed
> >>
> >>       --help display this help and exit
> >>
> >>       --version
> >>	      output version information and exit
> >>
> >>REPORTING BUGS
> >>       Report bugs to <email@host.com>.
> >>
> >>SEE ALSO
> >>       The full documentation for chcon is maintained as  a  Texinfo  manual.
> >>       If  the	info  and chcon programs are properly installed at your site,
> >>       the command
> >>
> >>	      info chcon
> >>
> >>       should give you access to the complete manual.
> >>
> >>
> >>
> >>chcon (coreutils) 5.0		  July 2003			     CHCON(1)
> >>    
> >>
> 
> 
-- 
------------------------------------------------------------------------
Scott Cain, Ph. D.                                         cain@cshl.org
GMOD Coordinator (http://www.gmod.org/)                     216-392-3087
Cold Spring Harbor Laboratory


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.