49 lines
2.1 KiB
Plaintext
49 lines
2.1 KiB
Plaintext
|
CONFIGURING SELINUX FOR CONTAGGED
|
||
|
|
=================================
|
||
|
|
|
||
|
|
The contagged RPM package for Fedora Core 5 and later includes a policy module
|
||
|
|
that ensures that all files required by the application get the correct
|
||
|
|
SELinux file contexts.
|
||
|
|
|
||
|
|
However, there are a few SELinux booleans you need to set in order to use
|
||
|
|
contagged:
|
||
|
|
|
||
|
|
# setsebool -P httpd_builtin_scripting 1
|
||
|
|
# setsebool -P httpd_enable_cgi 1
|
||
|
|
# setsebool -P httpd_unified 1
|
||
|
|
|
||
|
|
It is necessary to set these booleans because contagged is a PHP application.
|
||
|
|
It is not necessary to set the httpd_can_network_connect boolean because the
|
||
|
|
web server is allowed to connect to LDAP servers by default.
|
||
|
|
|
||
|
|
If you are using an older distribution that does not support SELinux policy
|
||
|
|
modules, you will need to set the file contexts manually:
|
||
|
|
|
||
|
|
# chcon -R -t httpd_cache_t /var/cache/contagged
|
||
|
|
|
||
|
|
You will need to repeat this step if the filesystem is relabelled.
|
||
|
|
|
||
|
|
Once the configuration is set up as required, restart httpd:
|
||
|
|
|
||
|
|
# service httpd restart
|
||
|
|
|
||
|
|
ABOUT THE PACKAGE
|
||
|
|
=================
|
||
|
|
|
||
|
|
One of the reasons for building this package was to provide an example of how
|
||
|
|
to include a custom SELinux policy module with an RPM package. It's unfortunate
|
||
|
|
that the kludge of having to use restorecon in the post-install script is
|
||
|
|
required but updates to rpm will be necessary before that can be avoided - see:
|
||
|
|
http://www.redhat.com/archives/fedora-selinux-list/2006-May/msg00098.html
|
||
|
|
|
||
|
|
An alternative approach (instead of using a loadable policy module) that some
|
||
|
|
people have taken, particularly where the only required policy customisation is
|
||
|
|
for file contexts, is to use semanage to add additional fcontext objects to the
|
||
|
|
running policy. A significant disadvantage of this approach is that it's harder
|
||
|
|
to manage future changes to policy, since all later versions of a package must
|
||
|
|
be able to "undo" the policy fixes (e.g. remove fcontext objects) set up by all
|
||
|
|
earlier versions of the package if there are changes to policy in later
|
||
|
|
versions. Using policy modules makes this very easy, since semodule handles the
|
||
|
|
upgrades very neatly (modules have version numbers).
|
||
|
|
|