SELinux: restorecon wont change context to httpd_sys_content_t

Question

I need to use Puppeteer on a Centos 7.4.1708 system but when I have SELinux set to Enforcing I'm getting AVC errors.

If I run sudo cat /var/log/messages I get:

SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome from search access on the directory /sys/fs/cgroup/cpuset.

*****  Plugin restorecon_source (99.5 confidence) suggests   *****************

If you want to fix the label.
/var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome default label should be httpd_sys_content_t.    
Then you can run restorecon.    
Do    
# /sbin/restorecon -v /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome

This same message appears maybe 6 or 7 times.

When I try to do the above though, restorecon won't set the context of the file.

Set policy (as root):
semanage fcontext -a -t httpd_sys_content_t '/var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome'

Check policy:
matchpathcon /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome
Shows:
/var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome system_u:object_r:httpd_sys_content_t:s0

That looks good, but then...
Set new context to file:
/sbin/restorecon -v /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome

restorecon fails to work. I don't get any errors from it even if I use -vv. I have also tried to force restorecon with -F but that doesn't work either.

Here's the files current context:
ls -Z /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome Shows:
-rwxrwxrwx. root root system_u:object_r:nfs_t:s0 /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome

The current context is nfs_t because I use synced folders with nfs in Vagrant running virtual box. I can't change to smb because it doesn't sync both ways using a Windows host.

Any ideas on how I can fix this issue? I've been at it for nearly two days now.

Note: If I set SELinux to Permissive then Puppeteer/Chromium runs without issue.

Thanks :)

Edit: I also should mention I have httpd_use_nfs set to on.

Here's a pastebin of all my SELinux booleans.

SELinux booleans

Edit 2:

Using the advice of @HBruijn I try to mount with defined context, but receive error.

AS root command:
mount 10.0.0.1:/C/Users/Lee/Desktop/www /var/www -o context="system_u:object_r:httpd_sys_content_t:s0"

Error:
mount.nfs: requested NFS version or transport protocol is not supported

Server 10.0.0.1 is my private server setup in vagrantfile.
config.vm.network "private_network", ip: "10.0.0.0"

The export path is the same path Vagrant uses when it mounts a folder on vagrant up e.g 10.0.0.1:/C/path/to/directory.

Any ideas??

Answer 1

I think you're trying to solve the problem from the wrong end, have you considered giving your webserver access to NFS shares instead with:

setsebool -P httpd_use_nfs=1 

EDIT Based on your comment that you running VirtualBox on Windows:

I think that your Windows host does not support labeling and then the client (your CentOS) assigns a default security policy as nfs_t.

You may need to set your preferred security context as a mount option to override that default (in the mount command or /etc/fstab) :

# mount server:/export /var/www/html -o  context="system_u:object_r:httpd_sys_content_t:s0" 

See the RHEL 6 manual