Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a CentOS machine. I want to serve user directories with Apache, so I configured httpd.conf to allow the public_html directory.

I have added the apache user to my usergroup and chmod g+xr the public_html and its toplevel directories. If I su apache, I can cd /home/nijansen/public_html without problems.

When requesting http://localhost/~nijansen however, I get a 403 Forbidden error. I was able to narrow it down to an SELinux issue - it works fine when I disable SELinux.

I have done /usr/sbin/restorecond ~/public_html and ls -Zd ~/public_html gives me

drwxr-x---. nijansen nijansen unconfined_u:object_r:httpd_user_content_t:s0 public_html

and /var/log/httpd/error just says

[Fri Oct 05 20:20:25 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /~nijansen denied

Now I am out of ideas and searching for this problem did not give me any so far. I would appreciate a hint in the right direction.

Update

For troubleshooting, I have set the SELinux mode to permissive, and it does give some logs, but I fail to interpret them:

Oct  5 20:50:18 localhost kernel: type=1400 audit(1349463018.930:95232): avc:  denied  { search } for  pid=10443 comm="httpd" name="nijansen" dev=dm-6 ino=12058625 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
Oct  5 20:50:18 localhost kernel: type=1400 audit(1349463018.938:95233): avc:  denied  { getattr } for  pid=10444 comm="httpd" path="/home/nijansen" dev=dm-6 ino=12058625 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
share|improve this question
    
This should help you considerably magazine.redhat.com/2007/08/21/… – user163356 Oct 5 '12 at 19:15

By filtering the output using ausearch -m avc | audit2allow is easy to find the culprit:


$ echo "
 Oct  5 20:50:18 localhost kernel: type=1400 audit(1349463018.930:95232): avc:  denied  { search } for  pid=10443 comm="httpd" name="nijansen" dev=dm-6 ino=12058625 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
 Oct  5 20:50:18 localhost kernel: type=1400 audit(1349463018.938:95233): avc:  denied  { getattr } for  pid=10444 comm="httpd" path="/home/nijansen" dev=dm-6 ino=12058625 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
 " | audit2allow
 ============= httpd_t ==============
 !!!! This avc can be allowed using the boolean 'httpd_enable_homedirs'
allow httpd_t user_home_dir_t:dir { search getattr };

To solve this, run as root:


 # setsebool -P httpd_enable_homedirs=on

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .