SELinux problem (was Re: Is httpd in FC3 chrooted???)

[Aleksandar Milivojevic]

D. D. Brierton wrote:
> On Tue, 2005-02-08 at 13:33 +0000, D. D. Brierton wrote:
> 
> 
>>Okay, it seems it's SELinux related. I'm currently reading my way
>>through
>>
>>http://fedora.redhat.com/docs/selinux-apache-fc3/
>>
>>but if anyone has some advice I'd be grateful. Thanks!
> 
> 
> One problem is that it seems that most of the files in my /home
> partition don't have *any* SELinux security context, only newly created
> files do.
> 
> Furthermore, the document above says that files in my home directory
> should have type "user_home_t", whereas in fact all of the newly created
> files in my home directory which do have a security context just have
> type "file_t". Sigh. I'm confused. This is a bit of a baptism by fire --
> all I wanted to do was get on with my work and instead I've spent the
> morning learning about SELinux.
> 
> I tried to use restorecon, but it segfaults:
> 
> $ /sbin/restorecon -R -v /home/darren
> /sbin/restorecon reset context /home/darren:->system_u:object_r:user_home_dir_t
> Segmentation fault
> 
> I need to use either
> 
> chcon -R -t httpd_sys_content_t public_html
> 
> or
> 
> chcon -R -t httpd_user_content_t public_html
> 
> I think, so that Apache can access the DocumentRoots of my VirtualHosts
> (they're all in ~/public_html/), but when I try either I get:
> 
> chcon: can't apply partial context to unlabeled file public_html/
> 
> which I take to mean that I also need to supply values for -u and -r,
> but I don't what values I should be using.
> 
> I'd really appreciate some help!

This is really strange.  You shouldn't be getting segfaults, and 
public_html should be assigned correct label when created.

Are you using targeted or strict policy?  In both cases, check if you 
have latest RPM installed (selinux-policy-targeted or 
selinux-policy-strict, depending which policy you are using).  I 
remember that after upgrading selinux-policy-targeted I had to relabel 
everything on the system (I was getting some strange errors on some 
parts of file system, so instead of hunting file by file what needs to 
be relabeled, I relabeled everything).  Who knows, maybe you are 
experiencing something similar.  Easiest way to do that is:

    # touch /.autorelabel
    # reboot

During boot, selinux will be temporarely disabled, all files assigned 
correct labels, and than selinux will be reenabled.  The /.autorelabel 
will be automatically removed after relabeling is done.  If you have 
only basic, minimalistic system installed, it will be relatively fast. 
If you installed bunch of files, or have huge /home, it may take a while 
to finish.

-- 
Aleksandar Milivojevic <amilivojevic at pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7