Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am running a CentOS machine. I want to serve user directories with Apache, so I configured httpd.conf to allow the public_html directory.

I have added the apache user to my usergroup and chmod g+xr the public_html and its toplevel directories. If I su apache, I can cd /home/nijansen/public_html without problems.

When requesting http://localhost/~nijansen however, I get a 403 Forbidden error. I was able to narrow it down to an SELinux issue - it works fine when I disable SELinux.

I have done /usr/sbin/restorecond ~/public_html and ls -Zd ~/public_html gives me

drwxr-x---. nijansen nijansen unconfined_u:object_r:httpd_user_content_t:s0 public_html

and /var/log/httpd/error just says

[Fri Oct 05 20:20:25 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /~nijansen denied

Now I am out of ideas and searching for this problem did not give me any so far. I would appreciate a hint in the right direction.

Update

For troubleshooting, I have set the SELinux mode to permissive, and it does give some logs, but I fail to interpret them:

Oct  5 20:50:18 localhost kernel: type=1400 audit(1349463018.930:95232): avc:  denied  { search } for  pid=10443 comm="httpd" name="nijansen" dev=dm-6 ino=12058625 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
Oct  5 20:50:18 localhost kernel: type=1400 audit(1349463018.938:95233): avc:  denied  { getattr } for  pid=10444 comm="httpd" path="/home/nijansen" dev=dm-6 ino=12058625 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
share|improve this question
    
This should help you considerably magazine.redhat.com/2007/08/21/… –  user163356 Oct 5 '12 at 19:15

1 Answer 1

By filtering the output using ausearch -m avc | audit2allow is easy to find the culprit:


$ echo "
 Oct  5 20:50:18 localhost kernel: type=1400 audit(1349463018.930:95232): avc:  denied  { search } for  pid=10443 comm="httpd" name="nijansen" dev=dm-6 ino=12058625 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
 Oct  5 20:50:18 localhost kernel: type=1400 audit(1349463018.938:95233): avc:  denied  { getattr } for  pid=10444 comm="httpd" path="/home/nijansen" dev=dm-6 ino=12058625 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
 " | audit2allow
 ============= httpd_t ==============
 !!!! This avc can be allowed using the boolean 'httpd_enable_homedirs'
allow httpd_t user_home_dir_t:dir { search getattr };

To solve this, run as root:


 # setsebool -P httpd_enable_homedirs=on

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.