<b><i>Stephen Smalley <sds@tycho.nsa.gov></i></b> escribió:<blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"> [ snip ]<br>> <br>> How is the person uploading the files and where in the directory<br>> hierarchy are they uploading them to?<br><br>Note btw that user_u:system_r:httpd_t is a process context, not a<br>context for files. You likely want user_u:object_r:httpd_sys_content_t<br>instead.<br><br>By default, files should inherit their type from the parent directory,<br>so if you were copying files to /var/www/html, it should pick up the<br>right context automatically. But if you upload to a different directory<br>and then move the files into place, the file will inherit the context of<br>the directory in which it was originally created and mv will seek to<br>preserve the context.<br><br></blockquote>Thanks Stephen and Paul, <br><br>The person uploads the files in "/home2/web/" as the user
"web2"<br><br>These errors were generated before your advice (I could only reproduce the 2nd):<br>avc: denied { getattr } for pid=8244 comm="httpd" name="/" dev=hda5 ino=2 scontext=user_u:system_r:httpd_t tcontext=system_u:object_r:default_t tclass=dir<br> avc: denied { read } for pid=8247 comm="httpd" name="index.php" dev=hda5 ino=701772 scontext=user_u:system_r:httpd_t tcontext=system_u:object_r:default_t tclass=file<br><br>After your advice I labeled the files in "/etc/selinux/targeted/src/policy/file_contexts/file_contexts" as: <br> ...<br> /home2/web(/.*)? system_u:object_r:httpd_user_content_t<br> /home/httpd/html(/.*)? system_u:object_r:httpd_user_content_t<br><br>When I create a file (HM-TestFile-web2) in /home2/web/ as web2 (the web admin) it gets labeled as: <br>-rw-r--r-- web2
users user_u:object_r:httpd_sys_content_t HM-TestFile-web2<br>drwxr-xr-x web2 users system_u:object_r:httpd_user_content_t images<br>-rw-r--r-- web2 users system_u:object_r:httpd_user_content_t index.html<br>...<br>which is weird because the parent "/home2/web/" has "system_u:object_r:httpd_user_content_t"<br><br>I am assuming that labeling as "httpd_user_content_t" is more secure in this case than "httpd_sys_content_t", is that true?<br><br> Anyway, with those labels no denials have appeared on the logs so far. <br><br>Hugo Martin<br><p>
<hr size=1>
<b>Preguntá. Respondé. Descubrí.</b><br>
Todo lo que querías saber, y lo que ni imaginabas,<br>
está en <b>Yahoo! Respuestas</b> (Beta).<br>
<b><a href="http://ar.answers.yahoo.com">Probalo ya!</a></b>