Red Hat Enterprise Linux 5 Administration Unleashed

Working with Security Contexts 475If you need to share the files in the DocumentRoot using another file sharing protocolsuch as FTP or NFS, the security context of the files need to be public_content_t orpublic_content_rw_t, depending on whether you need to give write access to users. Referto the “Security Context for Multiple File Sharing Protocols” for details on using them.Security Context for Multiple File Sharing ProtocolsIf more than one file sharing protocol (FTP, HTTP, NFS, rsync, and Samba) is used to sharethe same set of files, the security context must be set to public_content_t or public_content_rw_t instead of the security context specific to the protocol such assamba_share_t for Samba.The public_content_t context only allows read access to the files. Thepublic_content_rw_t context allows read and write access. To allow read and write access,you must also enable the allow__anon_write boolean, where isone of ftpd, httpd, nfsd, rsync, or smbd. For example, to allow FTP and the Apache HTTPServer to share the same files, execute the following commands as root:23setsebool -P allow_ftpd_anon_write=1setsebool -P allow_httpd_anon_write=1CAUTIONIf the filesystem is relabeled for SELinux, the security context changes you make willbe overwritten. To make your changes permanent even through a relabel, refer to the“Making Security Context Changes Permanent” section.Making Security Context Changes PermanentModifying the security context of files such as discussed in the previous section persistsbetween reboots unless the filesystem is relabeled. A filesystem is relabeled for a variety ofreasons including changing the SELinux policy. To make sure the security context of yourfiles are not changed, you must set the default security context of the files by adding thefile specification, file type, and SELinux security context to the /etc/selinux//contexts/files/file_contexts.local file. Do not create or modify this file manually.Use the SELinux Management Tool or the semanage command.After starting the SELinux Management Tool as previously described, click on FileLabeling in the list on the left. Click the Add button and enter the following informationas shown in Figure 23.5:. File Specification: Enter /home/html(/.*)? to represent the /home/html/ directoryand all the files and directories in it.. File Type: Leave as the default, all files.. SELinux Type: Enter httpd_sys_content_t as the security context.. MLS: Leave as default if you are not using the MLS policy.