Samba – Allowing multiple types in the type field of a folder label in SELinux

apache-2.2file-sharingsambaselinux

I'm an Ubuntu/Debian guy but I had trouble installing Ubuntu on a softraid/fakeraid system, so I went with CentOS 5.6.

I'm also at a small web development firm where we need to share our test server's html/httpd files via samba/smb but also allow apache to host them.

So I'm wondering if I can set our files to the samba and httpd type?

Something like,

/usr/sbin/semanage fcontext -a -t samba_share_t,httpd_sys_content_t "/var/www/html(/.*)?"

Or else I'm going to have to turn SELinux into permissive mode, which is not something I want to do.

Best Answer

I just realized I completely misread your question :)

If you want to allow Samba to read /var/www/html, which is httpd_sys_content_t, you should not have a problem. I am not a Samba expert, but afaik samba runs in the smbd_t domain, so you should be fine:

 # sesearch -s smbd_t --allow | grep httpd_sys_content
 allow smbd_t httpd_sys_content_t : file { ioctl read getattr lock }; 
 allow smbd_t httpd_sys_content_t : file { ioctl read write create getattr setattr lock append unlink link rename }; 
 allow smbd_t httpd_sys_content_t : file { ioctl read write create getattr setattr lock append unlink link rename }; 
 allow smbd_t httpd_sys_content_t : dir { ioctl read getattr lock search }; 
 allow smbd_t httpd_sys_content_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir }; 
 allow smbd_t httpd_sys_content_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir };

That says that Samba is allowed to read httpd_sys_content_t directories and files. The /var/www/html tree is httpd_sys_content_t. Have you tried this already?

Related Topic