Re: httpd and httpd_sys_content_t

On 8/2/20 5:27 PM, [email protected] wrote:
> Hello,
> 
> I have setted httpd_unified boolean to on. And httpd files market as
> httpd_sys_content_t. But when i create files by php fpm - files is
> created as httpd_sys_rw_content_t. Why is not httpd_sys_content_t if I
> have this boolean enabled?
> 

Hi,

This behavior is expected. When you allowed httpd_sys_unified boolean,
you allowed to create files(with label httpd_sys_rw_content_t) in
directory labeled as httpd_sys_content_t.

Here is the transition rule:

$ sesearch -T -s httpd_t -c file | grep httpd_sys_content
type_transition httpd_t httpd_sys_content_t:file httpd_sys_rw_content_t;
[ ( httpd_builtin_scripting && httpd_unified && httpd_enable_cgi ) ]:True

-T -> Looking for transition rules
-s -> source context (in your case label of php fpm)
-c -> class in this case file

Output says: When one of the booleans is in true state, any process
labeled as httpd_t can create files with label httpd_sys_rw_content_t in
any directory labeled as httpd_sys_content_t.

I hope this helped.

Thanks,
Lukas.


> It's on CentOS 8 box fully updated.
> 
> Thanks,
> Filip Bartmann
> _______________________________________________
> selinux mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
> 


-- 
Lukas Vrabec
SELinux Evangelist,
Senior Software Engineer, Security Technologies
Red Hat, Inc.

_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE3wrP3ArXoyYgAS7LRyAaxC8pzgYFAl8oZqIACgkQRyAaxC8p
zgYW5AgAk7dsP2P2rlHbm7fpRNjFOnXT+NTWiASO+T3fSJ5PDMpj2tfoJnN3Vs/P
u+seUP3FAL5PMNq+z+MQOfhwfaOoERuAUMz3GjhemqKyvHTDyRdiG7tvrgW3s7/B
OlyPNCyqUU5lCChG3x/lQvKJeHVkAbje7Pif4CtQvU4U7QFl8pf2jDJHfyaHOZJw
b7r4nwfsRQ9LukxdXtMuXAUbVwjpTJo+Qsth0fBCh4/3cWZPSY/5IMMdG+9f9ulg
Q84MHVjqS2PVxnFVjzuzvh6Rt4V01pXV8o4nAwXsS07eHkpUhLV1k1kClYXLteBl
lWRt7C1AmnOmsPr7gkgCbxipNQD8kg==
=G5y9
-----END PGP SIGNATURE-----