LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 01-15-2013, 07:49 AM   #16
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594

Quote:
Originally Posted by chrism01 View Post
I think you're going to need
Code:
chcon -t public_content_rw_t <target_dir>
Running the provided AVC messages through audit2allow does suggest that, yes:
Code:
#============= ftpd_t ==============
allow ftpd_t httpd_sys_content_t:dir write;
allow ftpd_t httpd_sys_content_t:file append;
However that doesn't automagically mean one should. Best check for any related booleans first IMHO:
Code:
getsebool -a | grep ftp
 
Old 01-15-2013, 10:29 AM   #17
Kustom42
Senior Member
 
Registered: Mar 2012
Distribution: Red Hat
Posts: 1,604

Rep: Reputation: 415Reputation: 415Reputation: 415Reputation: 415Reputation: 415
I thought about what chris suggested but that will cause issues with apache having access to the files due to selinux being enforeced. If it was in permissive mode or disabled it would work with the public_content_rw_t

Enable the boolean i suggested and it will work. No need to modify the context of the directories or files here.
 
Old 01-15-2013, 10:53 AM   #18
fakefake
LQ Newbie
 
Registered: Jan 2013
Posts: 11

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by chrism01 View Post
Don't use < & > chars; that's just a typing format to show you that you should substitute your value there; in other words
Code:
chcon -t public_content_rw_t /var/www/html
You will also need to turn on at least one of those booleans eg post #8.
This may also be useful Chap 44 http://www.linuxtopia.org/online_boo...ion/index.html
Perfect chrism01! Once you pointed out I didn't need the <> and I referenced Chap 44, your suggestion worked in conjunction with the change to the booleans from post #8 (as you also suggested). No reboot needed.

For others in a similar situation, I'll summarize what I did in the end:

Code:
[root@localhost ~]# chcon -t public_content_rw_t /var/www/html 
[root@localhost ~]# setsebool -P allow_ftpd_full_access=1
I then I was able to drag and drop in FileZilla from my remote local to my server's /var/www/html without the 553 error which started all of this. Afterwards, I checked

Code:
[root@localhost ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted
which told me my upload was sucessful while still having SELinux enabled.

Lastly, per unSpawns request here are the resulting booleans:

Code:
[root@localhost ~]# getsebool -a | grep ftp
allow_ftpd_anon_write --> off
allow_ftpd_full_access --> on
allow_ftpd_use_cifs --> off
allow_ftpd_use_nfs --> off
ftp_home_dir --> on
ftpd_connect_db --> off
ftpd_use_passive_mode --> off
httpd_enable_ftp_server --> off
tftp_anon_write --> off
I take it that these are typical and satisfactory?
 
Old 01-15-2013, 11:07 AM   #19
Kustom42
Senior Member
 
Registered: Mar 2012
Distribution: Red Hat
Posts: 1,604

Rep: Reputation: 415Reputation: 415Reputation: 415Reputation: 415Reputation: 415
Yes that looks satisfactory. Is apache still able to serve your web files now that you have modified the directory selinux context? from my past experience it shouldnt work if selinux is in enforcing mode. just want to double check
 
Old 01-15-2013, 04:13 PM   #20
fakefake
LQ Newbie
 
Registered: Jan 2013
Posts: 11

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Kustom42 View Post
Yes that looks satisfactory. Is apache still able to serve your web files now that you have modified the directory selinux context? from my past experience it shouldnt work if selinux is in enforcing mode. just want to double check
Just checked and with sestatus reporting that SELinux is enabled / enforcing, I can still successfully access:
  • the Apache test page
  • a test index.php that I uploaded /var/www/html/
  • and phpMySQL

I've did a lot of monkeying around trying to solve my initial problem before posting my initial question, so perhaps I did something that I haven't described that makes my system is behaving differently than what you expected. Now that I've installed LAMP once, I have half a mind to so a completely fresh install to help set the process in my mind.

Thanks to everyone for getting me over this hump. What a great community.

Before I close the thread as solved, I've been researching how to give the same rw access to not just /var/www/html/ but all subsequent dir I put into it as any additional dir I've made such as /var/www/html/testdir/ all report the original 553 ftp error when I try to upload into it.

I've tried variations of:

Code:
[root@localhost ~]# chcon -R -t public_content_rw_t /var/www/html
as I thought the -R would give me recursive access to all child dirs of html, but that hasn't been the case.
 
Old 01-15-2013, 04:24 PM   #21
Kustom42
Senior Member
 
Registered: Mar 2012
Distribution: Red Hat
Posts: 1,604

Rep: Reputation: 415Reputation: 415Reputation: 415Reputation: 415Reputation: 415
The -R is a recursive option, but remember that there are multiple attributes in selinux. The -t is the type context, you also have user and role which play a factor. Do an ls -Z on the new directory and compare to the the others
 
Old 01-16-2013, 07:23 AM   #22
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Quote:
Originally Posted by fakefake View Post
here are the resulting booleans: (..) I take it that these are typical and satisfactory?
You can actually check them yourself against what nfo 'man ftpd_selinux' offers.


Quote:
Originally Posted by fakefake View Post
I've did a lot of monkeying around trying to solve my initial problem before posting my initial question, so perhaps I did something that I haven't described that makes my system is behaving differently than what you expected.
I use a log file to jot down changes by date. When a problem occurs it's easier to look for clues in a file than having to rely on memory alone. Plus revision control makes it easy to revert configuration should it be necessary.


Quote:
Originally Posted by fakefake View Post
Now that I've installed LAMP once, I have half a mind to so a completely fresh install to help set the process in my mind.
If learning to do things properly and verifying what you learned is applicable as a standard procedure then I can only applaud that.


Quote:
Originally Posted by fakefake View Post
Before I close the thread as solved, I've been researching how to give the same rw access to not just /var/www/html/ but all subsequent dir I put into it as any additional dir I've made such as /var/www/html/testdir/ all report the original 553 ftp error when I try to upload into it. I've tried variations of:
Code:
[root@localhost ~]# chcon -R -t public_content_rw_t /var/www/html
as I thought the -R would give me recursive access to all child dirs of html, but that hasn't been the case.
The easiest way would be to apply the 'semanage fcontext' command chrism01 mentioned in post #11 (also in 'man ftpd_selinux' BTW) first. That adds a permanent record (to /etc/selinux/${POLICYNAME}/contexts/files/file_contexts.local) so that when you create a file or directory it starts out with the right context and that when the 'restorecond' service comes across it it won't revert the context back to what it knows it is.
 
Old 01-16-2013, 03:21 PM   #23
fakefake
LQ Newbie
 
Registered: Jan 2013
Posts: 11

Original Poster
Rep: Reputation: Disabled
Thanks. I also just realized that anytime I create new directories within /var/www/html/ I also need to change the GROUP to apache and set the permissions to 755 if I want the FTP via httpd to be able to read/write to them. I'm currently doing this by:

# chown -R MYUSERNAME:apache /var/www/html/

# chmod 755 -R /var/www/html/

I still need to figure out how to set the "Folder Access" to read and write via the command line, but as I can currently do that via GNOME by right clicking a folder and clicking PERMISSIONS->and changing the GROUPS folder access to CREATE & DELETE manualy, I'll consider my problem solved and work on the rest by myself.

Thanks again for your help guys!
 
Old 01-16-2013, 03:43 PM   #24
Kustom42
Senior Member
 
Registered: Mar 2012
Distribution: Red Hat
Posts: 1,604

Rep: Reputation: 415Reputation: 415Reputation: 415Reputation: 415Reputation: 415
Your chmod command changes your permissions here is how the chmod goes.

There are actually 4 numeric permission digits, when you only specify 3 as is the usual case a leading 0 is appended.

Ignore the first digit for now, its used for special permissions such as a sitcky bit

Your numerical permissions are as follows:

4 = read
2 = write
1 = execute

So if you do the math.

7 = 4+2+1 = read+write+execute
5 = 4+1 = read+execute
6 = 4+2 = read+write


The location of the numeric digit indicates which set of permissions to apply.

So you have

chmod 755

The first digit is your owner the second digit is your group and the last digit is everyone else that is not a the owner of the file or a member of the group on the file.
 
Old 01-17-2013, 01:31 AM   #25
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 7.7 (?), Centos 8.1
Posts: 17,790

Rep: Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538Reputation: 2538
Actually, in my RH manual it says to try chcon first, then test it, then semanage to fix it in place.
Basically, chcon will last until an SELinux relabel occurs. semanage (as explained by unSpawn) actually alters the SELinux Policy, so that the change will even survive an SELinux relabel.
 
Old 10-13-2017, 09:10 AM   #26
panga
LQ Newbie
 
Registered: Oct 2017
Posts: 1

Rep: Reputation: Disabled
Wink

This solution works for me:

Code:
[root@prodserver output]# getsebool -a | grep ftp
ftpd_anon_write --> off
ftpd_connect_all_unreserved --> on
ftpd_connect_db --> off
ftpd_full_access --> on
ftpd_use_cifs --> off
ftpd_use_fusefs --> off
ftpd_use_nfs --> off
ftpd_use_passive_mode --> off
httpd_can_connect_ftp --> off
httpd_enable_ftp_server --> off
tftp_anon_write --> off
tftp_home_dir --> on
[root@prodserver output]#
With that 3 parameters everything is working.
 
Old 10-13-2017, 08:16 PM   #27
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 17,502

Rep: Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617
a 5 year old nekro post panga

5 years later - today -
the SElinux kernel almost never gives me issues except for a NEW system install on new hardware and the initial set up of NON standard software
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How do I allow ftp uploads via windows explorer? NirvanaBaby Linux - Server 1 08-31-2011 01:32 AM
FTP uploads hang moodah Linux - Server 4 02-27-2011 11:16 PM
Email Alert for ftp uploads amol0009in_7 Linux - Server 1 09-16-2010 05:57 AM
Is there an ftp program that allows for multi-thread ftp uploads ? Want faster upload brjoon1021 Linux - Software 4 02-04-2009 06:28 PM
ftp guest uploads simon Linux - Networking 2 08-09-2001 03:50 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 03:54 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration