Re: Trying again: why am I getting denials in a directory that has been labeled..

Date: Sat, 30 Jun 2018 11:22:43 +0200
From: Lukas Vrabec <[email protected]>
>
> On 06/29/2018 10:15 PM, mark wrote:
>
>> As Lukas suggested, I tried to relabel the file. It didn't work, and
>> the reason is this: we have the web under our own root directory, not
>> under /var/www. We had done an semanage fcontext -e /var/www <ourpath>.
>> When I tried to relabel, it suggested I try to relabel using the
> /var/www path,  which won't work.
>>
>> Is there any way around this?
>> /<ourpath>/htdocs/<website>/cgi-bin/data/<the probelematic file>
>
> Could you attach complete outputs from semanage/ls (-Z)/ matchpathcon
> commands? I would like to reproduce it to help you find issue.

Sorry I couldn't get back to this sooner.

semanage fcontext --modify -t httpd_sys_rw_content_t
/<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat
ValueError: File spec
/<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat conflicts
with equivalency rule '/<actual>/<path>/htdocs /var/www/html'; Try adding
'/var/www/html/<website>/cgi-bin/Counter/data/image.dat' instead

ll -Z:
-rw-rw-r--. apache imagej unconfined_u:object_r:httpd_sys_script_exec_t:s0
/<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat

matchpathcon:
/<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat	system_u:object_r:httpd_sys_script_exec_t:s0

Amd pf course there's no <website> under /var/www/html/

    mark
_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]/message/SDCQW46HZMAZNA6COWGOMOVQWTKC7MSF/