2

I have a CentOS7/Apache multi-user (userdir) setup with SELinux enabled and the following directory structure:

/home/USER/public_html/resources/css

The whole /home/USER directory and everything underneath is owned by USER. All files and directories have a SELinux context of httpd_user_content_t except the aforementioned directory which I've set to httpd_user_rw_content_t. The apache server runs under the user apache and the apache user is member of the USER group. Everything under /home/USER has 0775 permissions (group writable). One of my scripts uses php's file_put_contents to create a file named test_fpc.txt in the /home/USER/public_html/resources/css directory but only if the directory is owned by apache:apache will the file_put_contents succeed. If the directory is owned by USER:USER the file_put_contents fails with failed to open stream: Permission denied warning. The audit log reads:

type=SYSCALL msg=audit(1483602823.639:155208): arch=c000003e syscall=2 success=no exit=-13 a0=7f0e5d9f1478 a1=241 a2=1b6 a3=73656372756f7365 items=2 ppid=855 pid=992 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key="apache_user_access"
type=CWD msg=audit(1483602823.639:155208):  cwd="/home/USER/public_html"
type=PATH msg=audit(1483602823.639:155208): item=0 name="/home/USER/public_html/resources/css/" inode=65290545 dev=08:12 mode=040775 ouid=1002 ogid=1002 rdev=00:00 obj=system_u:object_r:httpd_user_rw_content_t:s0 objtype=PARENT
type=PATH msg=audit(1483602823.639:155208): item=1 name="/home/USER/public_html/resources/css/test_fpc.txt" objtype=CREATE

When I login with the apache user with sudo -u apache bash and execute echo "test" > /home/USER/public_html/resources/css/test_bash.txt it works and the audit log output is:

type=SYSCALL msg=audit(1483602552.156:155207): arch=c000003e syscall=2 success=yes exit=3 a0=f607c0 a1=241 a2=1b6 a3=0 items=2 ppid=13539 pid=13540 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=pts0 ses=207 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="apache_user_access"
type=CWD msg=audit(1483602552.156:155207):  cwd="/home/USER/public_html"
type=PATH msg=audit(1483602552.156:155207): item=0 name="/home/USER/public_html/resources/css/" inode=65290545 dev=08:12 mode=040775 ouid=1002 ogid=1002 rdev=00:00 obj=system_u:object_r:httpd_user_rw_content_t:s0 objtype=PARENT
type=PATH msg=audit(1483602552.156:155207): item=1 name="test_bash.txt" inode=65273889 dev=08:12 mode=0100644 ouid=48 ogid=48 rdev=00:00 obj=unconfined_u:object_r:httpd_user_rw_content_t:s0 objtype=CREATE

I've also tried setting the context of the /home/USER/public_html/resources/css directory to httpd_sys_rw_content_t but it makes no difference.

I haven't tried setting setsebool -P httpd_unified 1 as I'd really like to keep the current restrictive SELinux configuration and I feel like SELinux is not the real problem here. What could be the cause of the group writable directory not being writable by the apache user which IS a member of the USER group?

1 Answer 1

0

I needed to logout and log back in or restart the system. Found the clue here Linux Group Permissions not being enforced correctly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .