Apache web files moved, now Apache's access to files is not correct

Basher52 · 05-31-2018, 04:28 PM

When I install Apache and MariaDB I always move the files to a new place. MariaDB files on one disk and the web files on another disk.
This time I did it the correct way, thus not disabling SELinux which I usually do cos I'm always in a hurry to set it up. This time I wanted to do it correct and googled how to fix SELinux for this. MariaDB works but Apache does not work as it should.

When I chmod files/dirs as the application says Apache still can't access them correctly. I always have to set files as 777 for Apache to for example, change the config file of the forum I'm installing. If not setting 777 I get SELinux-type error in the log.
So far the site is in test mode so I just used 777 but later I need this to work.

This is what I found and used:
(moving from /var/www/html/ to /webdata1/

Code:

chcon -R --reference=/var/www/html/ /webdata1
chcon -R -t httpd_sys_rw_content_t /webdata1/
semanage fcontext -a -t httpd_sys_rw_content_t "/webdata1(/.*)?"
setsebool -P httpd_enable_homedirs true
chmod 755 /webdata1
systemd restart httpd

Everything was OK when I did the above but the result is not as it should be.
Can anyone see what's wrong and how to fix it.
If it matters, I installed 'Let's Encrypt' but this itself seems to do it's job.

/Thanks In Advance

ttk · 05-31-2018, 06:07 PM

Did you edit httpd.conf to set DocumentRoot to /webdata1 ?

Or symlink /var/www/html to /webdata1 ?

Apache httpd will look for your documents at the DocumentRoot location, specified in /etc/httpd/httpd.conf (in most distributions).

scasey · 05-31-2018, 07:12 PM

In what way does "Apache does not work as it should"?

...and you seem to know this, but setting permies on any web-space file to 777 is asking for trouble...

Basher52 · 05-31-2018, 10:51 PM

@ttk, oh yes I did

@scasey, I know 777 is a bad bad thing, but as I wanted move on with the forum I installed, setting it up, testing etc I did set it to 777 to be able to even install it.
Now I need to know what I did wrong with SELinux so I can fix it, as of know I got in here on my own servers not letting anyone in there so it's safe for now.
When I install this at a web hosting this is not an issue but if I wanted to open this up to the public on my own server, I need to know what's wrong.
"not as it should", I described above, Apache has not enough access to in this particular example to changes files it need to be able to. The config file when installing or access directories for uploading, eg. extensions, emoticons etc. I have to use 777 for Apache to be able to do that, but 755 should work, but it doesn't

scasey · 06-01-2018, 01:59 PM

Ahh. Yes, for a web-based application to write to files, they either need to be owned by the apache user, or be in the apache user group and be qroup-writable (775 for directories 664 for files). That's not a SELinux issue.

What forum software are you using?

Basher52 · 06-01-2018, 02:09 PM

OK
... but long time ago I chatted with a Linux expert when I had, sort of this problems if I should make the files owned be Apache instead of root and he said, NO with capital letters.
He said that if Apache owns the files then it's much easier for the site to be hacked or something like this, can't recall the exact reason for this though so after that I never changed
the owner of the files to Apache and let root own them all and that has always worked, although I disabled SELinux and also moved the files.
Now I moved the files again but this time I USE SELinux and now it won't work, so it gotta be something with changing the context for SELinux that is incorrect.

scasey · 06-02-2018, 11:35 AM

That is certainly true, but if you have an application running as the apache user, then the files it wants to modify/create have to be writable to it.

Again: What forum software are you using?

Basher52 · 06-02-2018, 03:14 PM

There's a few, punBB, MyBB, Wordpress, Joomla, and just some testing of other 'web systems'. Also hacking my own code to see how that works.
All these have the same problem on this installation but on the old server where I just disabled SELinux, they all work.
The placement of web-files and DB-files are, not the same but very similar and this is why it just HAS to be SELinux and it's context settings that are wrong.
I'll see if I can find any logs where the error shows and post it...

oh, can YOU see anything wrong with the settings I used on SELinux? Check the first post for it.

scasey · 06-02-2018, 05:01 PM

The only thing I know to try is to put SELinux in permissive mode then review the logs to see what it would do if it were on...if one can't tell from the logs while it's enabled.

I usually disable SELinux on web servers.

Basher52 · 06-02-2018, 06:17 PM

Yeah, stupid me for not even thinking of that

I'll do that and see.
Right now having some other problems, can't login to my router so I can set NAT in it

If I do a reset then I got some work to do on that too