Red Hat Enterprise Linux 5 Administration Unleashed

Working with Security Contexts 471LISTING 23.2Security Context of Default DocumentRootdrwxr-xr-x root root system_u:object_r:httpd_sys_content_t /var/wwwdrwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t cgi-bindrwxr-xr-x root root system_u:object_r:httpd_sys_content_t errordrwxr-xr-x root root system_u:object_r:httpd_sys_content_t htmldrwxr-xr-x root root system_u:object_r:httpd_sys_content_t iconsTIPThe secon -f command can also be used to view the security context of afile.23If you change the DocumentRoot to /home/html/, after restarting httpd and trying toview the pages from the new DocumentRoot from a web browser, the service will start,but the website will default to the test page instead of the index page of your website. Themessage from Listing 23.3 appear in /var/log/messages.LISTING 23.3System Error Messages After Changing DocumentRootMar 6 14:54:07 localhost setroubleshoot: SELinux is preventingthe /usr/sbin/httpd from using potentially mislabeled files(/home/html/index.html).For complete SELinux messages. run sealert -l e2d75f44-7c89-4fc1-a06b-23603ab00af8If you have the Linux Auditing System enabled (the default), the/var/log/audit/audit.log file shows the SELinux AVC messages from Listing 23.4.LISTING 23.4Audit Error Messages After Changing DocumentRoottype=AVC msg=audit(1173211195.225:286487): avc: denied { getattr } forpid=19315 comm=”httpd” name=”index.html” dev=dm-1 ino=12845059scontext=user_u:system_r:httpd_t:s0 tcontext=user_u:object_r:user_home_t:s0tclass=filetype=SYSCALL msg=audit(1173211195.225:286487): arch=c000003e syscall=4success=no exit=-13 a0=5555cc034d50 a1=7fff0cb47140 a2=7fff0cb47140a3=5555cc034db8 items=0 ppid=19307 pid=19315 auid=501 uid=48 gid=48 euid=48suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm=”httpd”exe=”/usr/sbin/httpd” subj=user_u:system_r:httpd_t:s0 key=(null)type=AVC_PATH msg=audit(1173211195.225:286487): path=”/home/html/index.html”type=AVC msg=audit(1173211195.225:286488): avc: denied { getattr } forpid=19315 comm=”httpd” name=”index.html” dev=dm-1 ino=12845059 scontext=user_u:system_r:httpd_t:s0tcontext=user_u:object_r:user_home_t:s0tclass=filetype=SYSCALL msg=audit(1173211195.225:286488): arch=c000003e syscall=6success=no exit=-13 a0=5555cc034e18 a1=7fff0cb47140 a2=7fff0cb47140