httpd、vsftpd、そして迷惑なselinux
httpdを実行してvsftpdでCentOS6.3をインストールしていますが、ftp経由でアップロードできるユーザーとWebサイトが機能しているユーザーの間で権限のバランスをとることができません。
私がやること：
I create a user with their home directory as `/home/username`
I create a sub folder called `html` for their website
I chown their directory `chown -R username:Apache /home/username`
I chmod their directory `chmod -R 750 /home/username`
I chcon their directory `chcon -R -t httpd_sys_rw_content_t /home/username`
そして彼らのウェブサイトは正常にロードされますが、ftpできませんが、私が次のことをすると、彼らはftpできますが、彼らのWebサイトはロードされません：
chcon -R -t user_home_dir_t /home/username
Selinuxを無効にすると、ユーザーはftpを実行でき、Webサイトが読み込まれます。では、selinuxを維持するための答えは何ですか？
[〜＃〜]編集[〜＃〜]
興味深いことに、私は以下のMichaelのコメントに従い、restoreconを実行しただけで機能しました。しかし、再起動すると、vsftpは正常になり、httpdは正常に読み取ることができますが、httpdは書き込むことができません。
これは私の ls -Z応答
drwxr-x---. itmanx Apache unconfined_u:object_r:user_home_dir_t:s0 itmanx
これらはセットブール値です
allow_console_login on
allow_daemons_dump_core on
allow_daemons_use_tty on
allow_domain_fd_use on
allow_execmem on
allow_execmod on
allow_execstack on
allow_gssd_read_tmp on
allow_kerberos on
allow_mount_anyfile on
allow_nsplugin_execmem on
allow_postfix_local_write_mail_spool on
allow_staff_exec_content on
allow_sysadm_exec_content on
allow_user_exec_content on
allow_zebra_write_config on
ftp_home_dir on
httpd_builtin_scripting on
httpd_can_network_connect_db on
httpd_can_sendmail on
httpd_dbus_avahi on
httpd_enable_cgi on
httpd_enable_homedirs on
httpd_tty_comm on
httpd_unified on
init_upstart on
nscd_use_shm on
nsplugin_can_network on
openvpn_enable_homedirs on
privoxy_connect_any on
qemu_full_network on
qemu_use_cifs on
qemu_use_nfs on
qemu_use_usb on
sepgsql_enable_users_ddl on
sepgsql_unconfined_dbadm on
spamd_enable_home_dirs on
squid_connect_any on
unconfined_login on
use_nfs_home_dirs on
user_direct_dri on
user_ping on
user_rw_noexattrfile on
user_setrlimit on
virt_use_sysfs on
virt_use_usb on
xguest_connect_network on
xguest_mount_media on
xguest_use_bluetooth on
監査ログ
type=SYSCALL msg=audit(1350111166.254:3204): Arch=40000003 syscall=4 success=yes exit=2 a0=1 a1=b778e000 a2=2 a3=2 items=0 ppid=4114 pid=4119 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=96 comm="bash" exe="/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1350111180.584:3205): avc: denied { write } for pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.584:3205): Arch=40000003 syscall=10 success=no exit=-13 a0=b5ef0e64 a1=3234 a2=b776cad8 a3=b5ef0e64 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.584:3206): avc: denied { write } for pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.584:3206): Arch=40000003 syscall=5 success=no exit=-13 a0=b5e6fcfc a1=442 a2=1b6 a3=b5e6fcfc items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.586:3207): avc: denied { write } for pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.586:3207): Arch=40000003 syscall=10 success=no exit=-13 a0=b5ef0e64 a1=3234 a2=b776cad8 a3=b5ef0e64 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.586:3208): avc: denied { write } for pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.586:3208): Arch=40000003 syscall=5 success=no exit=-13 a0=b5e6b9a0 a1=442 a2=1b6 a3=b5e6b9a0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.586:3209): avc: denied { write } for pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.586:3209): Arch=40000003 syscall=5 success=no exit=-13 a0=b5f05f5c a1=241 a2=1b6 a3=b5f05f5c items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.587:3210): avc: denied { write } for pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.587:3210): Arch=40000003 syscall=5 success=no exit=-13 a0=b5e6d9d0 a1=442 a2=1b6 a3=b5e6d9d0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.587:3211): avc: denied { write } for pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.587:3211): Arch=40000003 syscall=5 success=no exit=-13 a0=b5e6d9d0 a1=442 a2=1b6 a3=b5e6d9d0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.587:3212): avc: denied { write } for pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.587:3212): Arch=40000003 syscall=5 success=no exit=-13 a0=b5e6d9d0 a1=442 a2=1b6 a3=b5e6d9d0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.588:3213): avc: denied { write } for pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.588:3213): Arch=40000003 syscall=10 success=no exit=-13 a0=b5ef0e64 a1=3430 a2=b776cad8 a3=b5ef0e64 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.588:3214): avc: denied { write } for pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.588:3214): Arch=40000003 syscall=5 success=no exit=-13 a0=b5e6d9d0 a1=442 a2=1b6 a3=b5e6d9d0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.592:3215): avc: denied { write } for pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.592:3215): Arch=40000003 syscall=10 success=no exit=-13 a0=b5ef0e64 a1=3234 a2=b776cad8 a3=b5ef0e64 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.592:3216): avc: denied { write } for pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.592:3216): Arch=40000003 syscall=5 success=no exit=-13 a0=b5e6af14 a1=442 a2=1b6 a3=b5e6af14 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.593:3217): avc: denied { write } for pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.593:3217): Arch=40000003 syscall=10 success=no exit=-13 a0=b5ef0e64 a1=3234 a2=b776cad8 a3=b5ef0e64 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.593:3218): avc: denied { write } for pid=2376 comm="httpd" name="logs" dev=dm-2 ino=11012903 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.593:3218): Arch=40000003 syscall=5 success=no exit=-13 a0=b5e6aaf0 a1=442 a2=1b6 a3=b5e6aaf0 items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1350111180.594:3219): avc: denied { write } for pid=2376 comm="httpd" name="cache" dev=dm-2 ino=11012856 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir
type=SYSCALL msg=audit(1350111180.594:3219): Arch=40000003 syscall=5 success=no exit=-13 a0=b5f05f5c a1=241 a2=1b6 a3=b5f05f5c items=0 ppid=2372 pid=2376 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
上記のどれでもない。
あなた SELinuxブール値を設定 これにより、httpdとvsftpdがユーザーのホームディレクトリにアクセスできるようになります。
setsebool -P httpd_enable_homedirs on
setsebool -P ftp_home_dir on
そして、すべての混乱の後、おそらく混乱したセキュリティコンテキストを修正する必要があります：
restorecon -r -v /home