httpd_selinux(8)

1httpd_selinux(8)             SELinux Policy httpd             httpd_selinux(8)
2
3
4

NAME

6       httpd_selinux - Security Enhanced Linux Policy for the httpd processes
7

DESCRIPTION

9       Security-Enhanced Linux secures the httpd processes via flexible manda‐
10       tory access control.
11
12       The httpd processes execute with the  httpd_t  SELinux  type.  You  can
13       check  if  you have these processes running by executing the ps command
14       with the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep httpd_t
19
20
21

ENTRYPOINTS

23       The httpd_t SELinux type can be entered via the httpd_exec_t file type.
24
25       The default entrypoint paths for the httpd_t domain are the following:
26
27       /usr/sbin/httpd(.worker)?,    /usr/sbin/apache(2)?,    /usr/lib/apache-
28       ssl/.+,  /usr/sbin/apache-ssl(2)?,  /usr/sbin/nginx,  /usr/sbin/thttpd,
29       /usr/sbin/php-fpm,       /usr/sbin/cherokee,        /usr/sbin/lighttpd,
30       /usr/sbin/apachectl,   /usr/sbin/httpd.event,   /usr/bin/mongrel_rails,
31       /usr/sbin/htcacheclean
32

PROCESS TYPES

34       SELinux defines process types (domains) for each process running on the
35       system
36
37       You can see the context of a process using the -Z option to ps
38
39       Policy  governs  the  access confined processes have to files.  SELinux
40       httpd policy is very flexible allowing users to setup their httpd  pro‐
41       cesses in as secure a method as possible.
42
43       The following process types are defined for httpd:
44
45       httpd_t, httpd_helper_t, httpd_php_t, httpd_rotatelogs_t, httpd_suexec_t, httpd_sys_script_t, httpd_user_script_t, httpd_passwd_t, httpd_unconfined_script_t
46
47       Note:  semanage  permissive  -a httpd_t can be used to make the process
48       type httpd_t permissive. SELinux does not  deny  access  to  permissive
49       process  types, but the AVC (SELinux denials) messages are still gener‐
50       ated.
51
52

BOOLEANS

54       SELinux policy is customizable based on least access  required.   httpd
55       policy is extremely flexible and has several booleans that allow you to
56       manipulate the policy and run httpd with the tightest access possible.
57
58
59
60       If you want to allow httpd to use built in scripting (usually php), you
61       must turn on the httpd_builtin_scripting boolean. Enabled by default.
62
63       setsebool -P httpd_builtin_scripting 1
64
65
66
67       If  you  want  to allow http daemon to check spam, you must turn on the
68       httpd_can_check_spam boolean. Disabled by default.
69
70       setsebool -P httpd_can_check_spam 1
71
72
73
74       If you want to allow httpd to act as a FTP client connecting to the ftp
75       port  and  ephemeral  ports, you must turn on the httpd_can_connect_ftp
76       boolean. Disabled by default.
77
78       setsebool -P httpd_can_connect_ftp 1
79
80
81
82       If you want to allow httpd to connect to the ldap port, you  must  turn
83       on the httpd_can_connect_ldap boolean. Disabled by default.
84
85       setsebool -P httpd_can_connect_ldap 1
86
87
88
89       If you want to allow http daemon to connect to mythtv, you must turn on
90       the httpd_can_connect_mythtv boolean. Disabled by default.
91
92       setsebool -P httpd_can_connect_mythtv 1
93
94
95
96       If you want to allow http daemon to connect to zabbix, you must turn on
97       the httpd_can_connect_zabbix boolean. Disabled by default.
98
99       setsebool -P httpd_can_connect_zabbix 1
100
101
102
103       If  you  want to allow HTTPD scripts and modules to connect to the net‐
104       work using TCP, you must turn on the httpd_can_network_connect boolean.
105       Disabled by default.
106
107       setsebool -P httpd_can_network_connect 1
108
109
110
111       If  you  want  to allow HTTPD scripts and modules to connect to cobbler
112       over the network, you must turn on  the  httpd_can_network_connect_cob‐
113       bler boolean. Disabled by default.
114
115       setsebool -P httpd_can_network_connect_cobbler 1
116
117
118
119       If  you want to allow HTTPD scripts and modules to connect to databases
120       over the network, you must  turn  on  the  httpd_can_network_connect_db
121       boolean. Disabled by default.
122
123       setsebool -P httpd_can_network_connect_db 1
124
125
126
127       If you want to allow httpd to connect to memcache server, you must turn
128       on the httpd_can_network_memcache boolean. Disabled by default.
129
130       setsebool -P httpd_can_network_memcache 1
131
132
133
134       If you want to allow httpd to connect to redis, you must  turn  on  the
135       httpd_can_network_redis boolean. Disabled by default.
136
137       setsebool -P httpd_can_network_redis 1
138
139
140
141       If  you  want  to  allow  httpd to act as a relay, you must turn on the
142       httpd_can_network_relay boolean. Disabled by default.
143
144       setsebool -P httpd_can_network_relay 1
145
146
147
148       If you want to allow http daemon to send mail, you  must  turn  on  the
149       httpd_can_sendmail boolean. Disabled by default.
150
151       setsebool -P httpd_can_sendmail 1
152
153
154
155       If you want to allow Apache to communicate with avahi service via dbus,
156       you must turn on the httpd_dbus_avahi boolean. Disabled by default.
157
158       setsebool -P httpd_dbus_avahi 1
159
160
161
162       If you want to allow Apache to communicate with sssd service via  dbus,
163       you must turn on the httpd_dbus_sssd boolean. Disabled by default.
164
165       setsebool -P httpd_dbus_sssd 1
166
167
168
169       If  you  want  to dontaudit Apache to search dirs, you must turn on the
170       httpd_dontaudit_search_dirs boolean. Disabled by default.
171
172       setsebool -P httpd_dontaudit_search_dirs 1
173
174
175
176       If you want to allow httpd cgi support, you must turn on the  httpd_en‐
177       able_cgi boolean. Enabled by default.
178
179       setsebool -P httpd_enable_cgi 1
180
181
182
183       If  you  want to allow httpd to act as a FTP server by listening on the
184       ftp port, you must turn on the  httpd_enable_ftp_server  boolean.  Dis‐
185       abled by default.
186
187       setsebool -P httpd_enable_ftp_server 1
188
189
190
191       If  you  want to allow httpd to read home directories, you must turn on
192       the httpd_enable_homedirs boolean. Disabled by default.
193
194       setsebool -P httpd_enable_homedirs 1
195
196
197
198       If you want to allow httpd scripts and modules  execmem/execstack,  you
199       must turn on the httpd_execmem boolean. Disabled by default.
200
201       setsebool -P httpd_execmem 1
202
203
204
205       If you want to allow HTTPD to connect to port 80 for graceful shutdown,
206       you must turn on the httpd_graceful_shutdown boolean. Disabled  by  de‐
207       fault.
208
209       setsebool -P httpd_graceful_shutdown 1
210
211
212
213       If  you  want  to allow httpd processes to manage IPA content, you must
214       turn on the httpd_manage_ipa boolean. Disabled by default.
215
216       setsebool -P httpd_manage_ipa 1
217
218
219
220       If you want to allow Apache to use mod_auth_ntlm_winbind, you must turn
221       on the httpd_mod_auth_ntlm_winbind boolean. Disabled by default.
222
223       setsebool -P httpd_mod_auth_ntlm_winbind 1
224
225
226
227       If  you  want to allow Apache to use mod_auth_pam, you must turn on the
228       httpd_mod_auth_pam boolean. Disabled by default.
229
230       setsebool -P httpd_mod_auth_pam 1
231
232
233
234       If you want to allow httpd to read user content, you must turn  on  the
235       httpd_read_user_content boolean. Disabled by default.
236
237       setsebool -P httpd_read_user_content 1
238
239
240
241       If  you  want  to  allow Apache to run preupgrade, you must turn on the
242       httpd_run_preupgrade boolean. Disabled by default.
243
244       setsebool -P httpd_run_preupgrade 1
245
246
247
248       If you want to allow Apache to run in stickshift mode,  not  transition
249       to  passenger,  you must turn on the httpd_run_stickshift boolean. Dis‐
250       abled by default.
251
252       setsebool -P httpd_run_stickshift 1
253
254
255
256       If you want to allow HTTPD scripts and modules to server cobbler files,
257       you must turn on the httpd_serve_cobbler_files boolean. Disabled by de‐
258       fault.
259
260       setsebool -P httpd_serve_cobbler_files 1
261
262
263
264       If you want to allow httpd daemon to change its  resource  limits,  you
265       must turn on the httpd_setrlimit boolean. Disabled by default.
266
267       setsebool -P httpd_setrlimit 1
268
269
270
271       If you want to allow HTTPD to run SSI executables in the same domain as
272       system CGI scripts, you must turn on the httpd_ssi_exec  boolean.  Dis‐
273       abled by default.
274
275       setsebool -P httpd_ssi_exec 1
276
277
278
279       If  you  want  to allow Apache to execute tmp content, you must turn on
280       the httpd_tmp_exec boolean. Disabled by default.
281
282       setsebool -P httpd_tmp_exec 1
283
284
285
286       If you want to unify HTTPD to communicate with the terminal. Needed for
287       entering the passphrase for certificates at the terminal, you must turn
288       on the httpd_tty_comm boolean. Disabled by default.
289
290       setsebool -P httpd_tty_comm 1
291
292
293
294       If you want to unify HTTPD handling of all content files, you must turn
295       on the httpd_unified boolean. Disabled by default.
296
297       setsebool -P httpd_unified 1
298
299
300
301       If  you  want to allow httpd to access cifs file systems, you must turn
302       on the httpd_use_cifs boolean. Disabled by default.
303
304       setsebool -P httpd_use_cifs 1
305
306
307
308       If you want to allow httpd to access FUSE file systems, you  must  turn
309       on the httpd_use_fusefs boolean. Disabled by default.
310
311       setsebool -P httpd_use_fusefs 1
312
313
314
315       If  you  want  to  allow  httpd  to  run  gpg,  you  must  turn  on the
316       httpd_use_gpg boolean. Disabled by default.
317
318       setsebool -P httpd_use_gpg 1
319
320
321
322       If you want to allow httpd to access nfs file systems, you must turn on
323       the httpd_use_nfs boolean. Disabled by default.
324
325       setsebool -P httpd_use_nfs 1
326
327
328
329       If  you  want  to allow httpd to use opencryptoki, you must turn on the
330       httpd_use_opencryptoki boolean. Disabled by default.
331
332       setsebool -P httpd_use_opencryptoki 1
333
334
335
336       If you want to allow httpd to access openstack ports, you must turn  on
337       the httpd_use_openstack boolean. Disabled by default.
338
339       setsebool -P httpd_use_openstack 1
340
341
342
343       If  you  want  to allow httpd to connect to  sasl, you must turn on the
344       httpd_use_sasl boolean. Disabled by default.
345
346       setsebool -P httpd_use_sasl 1
347
348
349
350       If you want to allow Apache to query NS records, you must turn  on  the
351       httpd_verify_dns boolean. Disabled by default.
352
353       setsebool -P httpd_verify_dns 1
354
355
356
357       If  you  want  to  dontaudit all daemons scheduling requests (setsched,
358       sys_nice), you must turn on the  daemons_dontaudit_scheduling  boolean.
359       Enabled by default.
360
361       setsebool -P daemons_dontaudit_scheduling 1
362
363
364
365       If  you  want  to deny any process from ptracing or debugging any other
366       processes, you must turn on the deny_ptrace boolean.  Disabled  by  de‐
367       fault.
368
369       setsebool -P deny_ptrace 1
370
371
372
373       If you want to allow all domains to execute in fips_mode, you must turn
374       on the fips_mode boolean. Enabled by default.
375
376       setsebool -P fips_mode 1
377
378
379
380       If you want to determine whether Git system daemon can access cifs file
381       systems,  you must turn on the git_system_use_cifs boolean. Disabled by
382       default.
383
384       setsebool -P git_system_use_cifs 1
385
386
387
388       If you want to determine whether Git system daemon can access nfs  file
389       systems,  you  must turn on the git_system_use_nfs boolean. Disabled by
390       default.
391
392       setsebool -P git_system_use_nfs 1
393
394
395
396       If you want to allow confined applications to run  with  kerberos,  you
397       must turn on the kerberos_enabled boolean. Enabled by default.
398
399       setsebool -P kerberos_enabled 1
400
401
402
403       If  you  want  to  allow  system  to run with NIS, you must turn on the
404       nis_enabled boolean. Disabled by default.
405
406       setsebool -P nis_enabled 1
407
408
409
410       If you want to support NFS home  directories,  you  must  turn  on  the
411       use_nfs_home_dirs boolean. Disabled by default.
412
413       setsebool -P use_nfs_home_dirs 1
414
415
416
417       If  you  want  to  support SAMBA home directories, you must turn on the
418       use_samba_home_dirs boolean. Disabled by default.
419
420       setsebool -P use_samba_home_dirs 1
421
422
423

NSSWITCH DOMAIN

425       If you want to allow users to resolve user passwd entries directly from
426       ldap  rather then using a sssd server for the httpd_t, you must turn on
427       the authlogin_nsswitch_use_ldap boolean.
428
429       setsebool -P authlogin_nsswitch_use_ldap 1
430
431
432       If you want to allow confined applications to run with kerberos for the
433       httpd_t, you must turn on the kerberos_enabled boolean.
434
435       setsebool -P kerberos_enabled 1
436
437

PORT TYPES

439       SELinux defines port types to represent TCP and UDP ports.
440
441       You  can  see  the  types associated with a port by using the following
442       command:
443
444       semanage port -l
445
446
447       Policy governs the access  confined  processes  have  to  these  ports.
448       SELinux  httpd  policy  is  very flexible allowing users to setup their
449       httpd processes in as secure a method as possible.
450
451       The following port types are defined for httpd:
452
453
454       http_cache_port_t
455
456
457
458       Default Defined Ports:
459                 tcp 8080,8118,8123,10001-10010
460                 udp 3130
461
462
463       http_port_t
464
465
466
467       Default Defined Ports:
468                 tcp 80,81,443,488,8008,8009,8443,9000
469

MANAGED FILES

471       The SELinux process type httpd_t can manage files labeled with the fol‐
472       lowing  file  types.   The paths listed are the default paths for these
473       file types.  Note the processes UID still need to have DAC permissions.
474
475       abrt_retrace_spool_t
476
477            /var/spool/faf(/.*)?
478            /var/spool/abrt-retrace(/.*)?
479            /var/spool/retrace-server(/.*)?
480
481       cifs_t
482
483
484       cluster_conf_t
485
486            /etc/cluster(/.*)?
487
488       cluster_var_lib_t
489
490            /var/lib/pcsd(/.*)?
491            /var/lib/cluster(/.*)?
492            /var/lib/openais(/.*)?
493            /var/lib/pengine(/.*)?
494            /var/lib/corosync(/.*)?
495            /usr/lib/heartbeat(/.*)?
496            /var/lib/heartbeat(/.*)?
497            /var/lib/pacemaker(/.*)?
498
499       cluster_var_run_t
500
501            /var/run/crm(/.*)?
502            /var/run/cman_.*
503            /var/run/rsctmp(/.*)?
504            /var/run/aisexec.*
505            /var/run/heartbeat(/.*)?
506            /var/run/pcsd-ruby.socket
507            /var/run/corosync-qnetd(/.*)?
508            /var/run/corosync-qdevice(/.*)?
509            /var/run/corosync.pid
510            /var/run/cpglockd.pid
511            /var/run/rgmanager.pid
512            /var/run/cluster/rgmanager.sk
513
514       cobbler_var_lib_t
515
516            /var/lib/cobbler(/.*)?
517            /var/www/cobbler(/.*)?
518            /var/cache/cobbler(/.*)?
519            /var/lib/tftpboot/etc(/.*)?
520            /var/lib/tftpboot/ppc(/.*)?
521            /var/lib/tftpboot/boot(/.*)?
522            /var/lib/tftpboot/grub(/.*)?
523            /var/lib/tftpboot/s390x(/.*)?
524            /var/lib/tftpboot/images(/.*)?
525            /var/lib/tftpboot/aarch64(/.*)?
526            /var/lib/tftpboot/images2(/.*)?
527            /var/lib/tftpboot/pxelinux.cfg(/.*)?
528            /var/lib/tftpboot/yaboot
529            /var/lib/tftpboot/memdisk
530            /var/lib/tftpboot/menu.c32
531            /var/lib/tftpboot/pxelinux.0
532
533       dirsrv_config_t
534
535            /etc/dirsrv(/.*)?
536
537       dirsrv_var_log_t
538
539            /var/log/dirsrv(/.*)?
540
541       dirsrv_var_run_t
542
543            /var/run/slapd.*
544            /var/run/dirsrv(/.*)?
545
546       dirsrvadmin_config_t
547
548            /etc/dirsrv/dsgw(/.*)?
549            /etc/dirsrv/admin-serv(/.*)?
550
551       dirsrvadmin_tmp_t
552
553
554       fusefs_t
555
556            /var/run/user/[0-9]+/gvfs
557
558       httpd_cache_t
559
560            /var/cache/rt(3|4)(/.*)?
561            /var/cache/ssl.*.sem
562            /var/cache/mod_.*
563            /var/cache/php-.*
564            /var/cache/httpd(/.*)?
565            /var/cache/mason(/.*)?
566            /var/cache/nginx(/.*)?
567            /var/cache/mod_ssl(/.*)?
568            /var/cache/lighttpd(/.*)?
569            /var/cache/mediawiki(/.*)?
570            /var/cache/mod_proxy(/.*)?
571            /var/cache/mod_gnutls(/.*)?
572            /var/cache/php-mmcache(/.*)?
573            /var/cache/php-eaccelerator(/.*)?
574
575       httpd_lock_t
576
577
578       httpd_squirrelmail_t
579
580            /var/lib/squirrelmail/prefs(/.*)?
581
582       httpd_tmp_t
583
584            /var/run/user/apache(/.*)?
585            /var/www/openshift/console/tmp(/.*)?
586
587       httpd_tmpfs_t
588
589
590       httpd_user_rw_content_t
591
592
593       httpd_var_lib_t
594
595            /var/lib/rt(3|4)/data/RT-Shredder(/.*)?
596            /var/lib/dav(/.*)?
597            /var/lib/php(/.*)?
598            /var/lib/glpi(/.*)?
599            /var/lib/httpd(/.*)?
600            /var/lib/nginx(/.*)?
601            /var/lib/z-push(/.*)?
602            /var/lib/ganglia(/.*)?
603            /var/lib/ipsilon(/.*)?
604            /var/lib/cherokee(/.*)?
605            /var/lib/lighttpd(/.*)?
606            /var/lib/mod_security(/.*)?
607            /var/lib/roundcubemail(/.*)?
608            /var/opt/rh/rh-nginx18/lib/nginx(/.*)?
609
610       httpd_var_run_t
611
612            /var/run/mod_.*
613            /var/run/wsgi.*
614            /var/run/httpd.*
615            /var/run/nginx.*
616            /var/run/apache.*
617            /var/run/php-fpm(/.*)?
618            /var/run/fcgiwrap(/.*)?
619            /var/run/lighttpd(/.*)?
620            /var/lib/php/session(/.*)?
621            /var/lib/php/wsdlcache(/.*)?
622            /var/run/dirsrv/admin-serv.*
623            /var/opt/rh/rh-nginx18/run/nginx(/.*)?
624            /var/www/openshift/broker/httpd/run(/.*)?
625            /var/www/openshift/console/httpd/run(/.*)?
626            /opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)?
627            /var/run/thttpd.pid
628            /var/run/gcache_port
629            /var/run/cherokee.pid
630
631       httpdcontent
632
633
634       hugetlbfs_t
635
636            /dev/hugepages
637            /usr/lib/udev/devices/hugepages
638
639       insights_client_tmp_t
640
641            /var/tmp/insights-client(/.*)?
642            /tmp/insights-client.ppid
643            /var/tmp/insights-client.ppid
644
645       jetty_cache_t
646
647            /var/cache/jetty(/.*)?
648
649       jetty_log_t
650
651            /var/log/jetty(/.*)?
652
653       jetty_tmp_t
654
655
656       jetty_unit_file_t
657
658            /usr/lib/systemd/system/jetty.service
659
660       jetty_var_lib_t
661
662            /var/lib/jetty(/.*)?
663
664       jetty_var_run_t
665
666            /var/run/jetty(/.*)?
667
668       krb5_host_rcache_t
669
670            /var/tmp/krb5_0.rcache2
671            /var/cache/krb5rcache(/.*)?
672            /var/tmp/nfs_0
673            /var/tmp/DNS_25
674            /var/tmp/host_0
675            /var/tmp/imap_0
676            /var/tmp/HTTP_23
677            /var/tmp/HTTP_48
678            /var/tmp/ldap_55
679            /var/tmp/ldap_487
680            /var/tmp/ldapmap1_0
681
682       memcached_var_run_t
683
684            /var/run/memcached(/.*)?
685            /var/run/ipa_memcached(/.*)?
686
687       mirrormanager_var_run_t
688
689            /var/run/mirrormanager(/.*)?
690
691       named_cache_t
692
693            /var/named/data(/.*)?
694            /var/lib/softhsm(/.*)?
695            /var/lib/unbound(/.*)?
696            /var/named/slaves(/.*)?
697            /var/named/dynamic(/.*)?
698            /var/named/chroot/var/tmp(/.*)?
699            /var/named/chroot/var/named/data(/.*)?
700            /var/named/chroot/var/named/slaves(/.*)?
701            /var/named/chroot/var/named/dynamic(/.*)?
702
703       nfs_t
704
705
706       passenger_tmp_t
707
708
709       passenger_var_lib_t
710
711            /var/lib/passenger(/.*)?
712
713       passenger_var_run_t
714
715            /var/run/passenger(/.*)?
716
717       pkcs_slotd_lock_t
718
719            /var/lock/opencryptoki(/.*)?
720
721       pkcs_slotd_tmpfs_t
722
723            /dev/shm/var.lib.opencryptoki.*
724
725       pkcs_slotd_var_lib_t
726
727            /var/lib/opencryptoki(/.*)?
728
729       pki_apache_config
730
731
732       pki_apache_var_lib
733
734
735       pki_apache_var_log
736
737
738       postfix_spool_t
739
740            /var/spool/postfix.*
741            /var/spool/postfix/defer(/.*)?
742            /var/spool/postfix/flush(/.*)?
743            /var/spool/postfix/deferred(/.*)?
744            /var/spool/postfix/maildrop(/.*)?
745
746       preupgrade_data_t
747
748            /var/lib/preupgrade(/.*)?
749            /var/log/preupgrade(/.*)?
750
751       root_t
752
753            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
754            /
755            /initrd
756
757       security_t
758
759            /selinux
760
761       squirrelmail_spool_t
762
763            /var/spool/squirrelmail(/.*)?
764
765       systemd_passwd_var_run_t
766
767            /var/run/systemd/ask-password(/.*)?
768            /var/run/systemd/ask-password-block(/.*)?
769
770       zarafa_var_lib_t
771
772            /var/lib/zarafa(/.*)?
773            /var/lib/zarafa-webapp(/.*)?
774            /var/lib/zarafa-webaccess(/.*)?
775
776       zoneminder_var_lib_t
777
778            /var/lib/zoneminder(/.*)?
779
780

FILE CONTEXTS

782       SELinux requires files to have an extended attribute to define the file
783       type.
784
785       You can see the context of a file using the -Z option to ls
786
787       Policy  governs  the  access  confined  processes  have to these files.
788       SELinux httpd policy is very flexible allowing  users  to  setup  their
789       httpd processes in as secure a method as possible.
790
791       EQUIVALENCE DIRECTORIES
792
793
794       httpd policy stores data with multiple different file context types un‐
795       der the /var/lib/httpd directory.  If you would like to store the  data
796       in  a different directory you can use the semanage command to create an
797       equivalence mapping.  If you wanted to store this data under  the  /srv
798       directory you would execute the following command:
799
800       semanage fcontext -a -e /var/lib/httpd /srv/httpd
801       restorecon -R -v /srv/httpd
802
803       httpd policy stores data with multiple different file context types un‐
804       der the /var/lib/php directory.  If you would like to store the data in
805       a  different  directory  you  can use the semanage command to create an
806       equivalence mapping.  If you wanted to store this data under  the  /srv
807       directory you would execute the following command:
808
809       semanage fcontext -a -e /var/lib/php /srv/php
810       restorecon -R -v /srv/php
811
812       httpd policy stores data with multiple different file context types un‐
813       der the /var/www directory.  If you would like to store the data  in  a
814       different  directory  you  can  use  the  semanage command to create an
815       equivalence mapping.  If you wanted to store this data under  the  /srv
816       directory you would execute the following command:
817
818       semanage fcontext -a -e /var/www /srv/www
819       restorecon -R -v /srv/www
820
821       STANDARD FILE CONTEXT
822
823       SELinux  defines the file context types for the httpd, if you wanted to
824       store files with these types in a different paths, you need to  execute
825       the  semanage  command  to  specify alternate labeling and then use re‐
826       storecon to put the labels on disk.
827
828       semanage fcontext -a -t httpd_exec_t '/srv/httpd/content(/.*)?'
829       restorecon -R -v /srv/myhttpd_content
830
831       Note: SELinux often uses regular expressions  to  specify  labels  that
832       match multiple files.
833
834       The following file types are defined for httpd:
835
836
837
838       httpd_cache_t
839
840       - Set files with the httpd_cache_t type, if you want to store the files
841       under the /var/cache directory.
842
843
844       Paths:
845            /var/cache/rt(3|4)(/.*)?, /var/cache/ssl.*.sem, /var/cache/mod_.*,
846            /var/cache/php-.*, /var/cache/httpd(/.*)?, /var/cache/mason(/.*)?,
847            /var/cache/nginx(/.*)?,                  /var/cache/mod_ssl(/.*)?,
848            /var/cache/lighttpd(/.*)?,             /var/cache/mediawiki(/.*)?,
849            /var/cache/mod_proxy(/.*)?,           /var/cache/mod_gnutls(/.*)?,
850            /var/cache/php-mmcache(/.*)?, /var/cache/php-eaccelerator(/.*)?
851
852
853       httpd_config_t
854
855       -  Set  files  with  the  httpd_config_t type, if you want to treat the
856       files as httpd configuration data, usually stored under the /etc direc‐
857       tory.
858
859
860       Paths:
861            /etc/httpd(/.*)?,     /etc/nginx(/.*)?,     /etc/apache(2)?(/.*)?,
862            /etc/cherokee(/.*)?,       /etc/lighttpd(/.*)?,       /etc/apache-
863            ssl(2)?(/.*)?,  /var/lib/openshift/.httpd.d(/.*)?, /etc/opt/rh/rh-
864            nginx18/nginx(/.*)?,           /var/lib/stickshift/.httpd.d(/.*)?,
865            /etc/vhosts, /etc/thttpd.conf
866
867
868       httpd_exec_t
869
870       -  Set  files  with the httpd_exec_t type, if you want to transition an
871       executable to the httpd_t domain.
872
873
874       Paths:
875            /usr/sbin/httpd(.worker)?, /usr/sbin/apache(2)?,  /usr/lib/apache-
876            ssl/.+,         /usr/sbin/apache-ssl(2)?,         /usr/sbin/nginx,
877            /usr/sbin/thttpd,      /usr/sbin/php-fpm,      /usr/sbin/cherokee,
878            /usr/sbin/lighttpd,   /usr/sbin/apachectl,  /usr/sbin/httpd.event,
879            /usr/bin/mongrel_rails, /usr/sbin/htcacheclean
880
881
882       httpd_helper_exec_t
883
884       - Set files with the httpd_helper_exec_t type, if you want  to  transi‐
885       tion an executable to the httpd_helper_t domain.
886
887
888
889       httpd_initrc_exec_t
890
891       -  Set  files with the httpd_initrc_exec_t type, if you want to transi‐
892       tion an executable to the httpd_initrc_t domain.
893
894
895       Paths:
896            /etc/init.d/cherokee,                      /etc/rc.d/init.d/httpd,
897            /etc/rc.d/init.d/lighttpd
898
899
900       httpd_keytab_t
901
902       -  Set  files  with  the  httpd_keytab_t type, if you want to treat the
903       files as kerberos keytab files.
904
905
906
907       httpd_lock_t
908
909       - Set files with the httpd_lock_t type, if you want to treat the  files
910       as httpd lock data, stored under the /var/lock directory
911
912
913
914       httpd_log_t
915
916       - Set files with the httpd_log_t type, if you want to treat the data as
917       httpd log data, usually stored under the /var/log directory.
918
919
920       Paths:
921            /srv/([^/]*/)?www/logs(/.*)?,           /var/www(/.*)?/logs(/.*)?,
922            /var/log/glpi(/.*)?,  /var/log/cacti(/.*)?,  /var/log/httpd(/.*)?,
923            /var/log/nginx(/.*)?,  /var/log/apache(2)?(/.*)?,   /var/log/hori‐
924            zon(/.*)?,     /var/log/php-fpm(/.*)?,    /var/log/cherokee(/.*)?,
925            /var/log/lighttpd(/.*)?,                     /var/log/suphp.log.*,
926            /var/log/thttpd.log.*,              /var/log/apache-ssl(2)?(/.*)?,
927            /var/log/cgiwrap.log.*,       /var/www/stickshift/[^/]*/log(/.*)?,
928            /var/log/graphite-web(/.*)?,          /var/www/miq/vmdb/log(/.*)?,
929            /var/log/roundcubemail(/.*)?,           /var/log/php_errors.log.*,
930            /var/log/dirsrv/admin-serv(/.*)?,               /var/opt/rh/rh-ng‐
931            inx18/log(/.*)?,              /var/lib/openshift/.log/httpd(/.*)?,
932            /var/www/openshift/console/log(/.*)?,      /var/www/openshift/bro‐
933            ker/httpd/logs(/.*)?, /var/www/openshift/console/httpd/logs(/.*)?
934
935
936       httpd_modules_t
937
938       - Set files with the httpd_modules_t type, if you  want  to  treat  the
939       files as httpd modules.
940
941
942       Paths:
943            /usr/lib/httpd(/.*)?,    /usr/lib/apache(/.*)?,    /usr/lib/chero‐
944            kee(/.*)?, /usr/lib/lighttpd(/.*)?, /usr/lib/apache2/modules(/.*)?
945
946
947       httpd_passwd_exec_t
948
949       - Set files with the httpd_passwd_exec_t type, if you want  to  transi‐
950       tion an executable to the httpd_passwd_t domain.
951
952
953
954       httpd_php_exec_t
955
956       -  Set  files with the httpd_php_exec_t type, if you want to transition
957       an executable to the httpd_php_t domain.
958
959
960
961       httpd_php_tmp_t
962
963       - Set files with the httpd_php_tmp_t type, if you want to  store  httpd
964       php temporary files in the /tmp directories.
965
966
967
968       httpd_rotatelogs_exec_t
969
970       - Set files with the httpd_rotatelogs_exec_t type, if you want to tran‐
971       sition an executable to the httpd_rotatelogs_t domain.
972
973
974
975       httpd_squirrelmail_t
976
977       - Set files with the httpd_squirrelmail_t type, if you  want  to  treat
978       the files as httpd squirrelmail data.
979
980
981
982       httpd_suexec_exec_t
983
984       -  Set  files with the httpd_suexec_exec_t type, if you want to transi‐
985       tion an executable to the httpd_suexec_t domain.
986
987
988       Paths:
989            /usr/lib/apache(2)?/suexec(2)?,       /usr/lib/cgi-bin/(nph-)?cgi‐
990            wrap(d)?, /usr/sbin/suexec
991
992
993       httpd_suexec_tmp_t
994
995       -  Set  files  with  the  httpd_suexec_tmp_t type, if you want to store
996       httpd suexec temporary files in the /tmp directories.
997
998
999
1000       httpd_sys_content_t
1001
1002       - Set files with the httpd_sys_content_t type, if you want to treat the
1003       files as httpd sys content.
1004
1005
1006       Paths:
1007            /srv/([^/]*/)?www(/.*)?,     /var/www(/.*)?,     /etc/htdig(/.*)?,
1008            /srv/gallery2(/.*)?,  /var/lib/trac(/.*)?,   /var/lib/htdig(/.*)?,
1009            /var/www/icons(/.*)?,     /usr/share/glpi(/.*)?,    /usr/share/ht‐
1010            dig(/.*)?,      /usr/share/drupal.*,      /usr/share/z-push(/.*)?,
1011            /var/www/svn/conf(/.*)?,                 /usr/share/icecast(/.*)?,
1012            /var/lib/cacti/rra(/.*)?,              /usr/share/ntop/html(/.*)?,
1013            /usr/share/nginx/html(/.*)?,        /usr/share/doc/ghc/html(/.*)?,
1014            /usr/share/openca/htdocs(/.*)?,            /usr/share/selinux-pol‐
1015            icy[^/]*/html(/.*)?
1016
1017
1018       httpd_sys_htaccess_t
1019
1020       -  Set  files  with the httpd_sys_htaccess_t type, if you want to treat
1021       the file as a httpd sys access file.
1022
1023
1024
1025       httpd_sys_ra_content_t
1026
1027       - Set files with the httpd_sys_ra_content_t type, if you want to  treat
1028       the files as httpd sys read/append content.
1029
1030
1031
1032       httpd_sys_rw_content_t
1033
1034       -  Set files with the httpd_sys_rw_content_t type, if you want to treat
1035       the files as httpd sys read/write content.
1036
1037
1038       Paths:
1039            /etc/rt(/.*)?, /etc/glpi(/.*)?,  /etc/horde(/.*)?,  /etc/drupal.*,
1040            /etc/z-push(/.*)?,     /var/lib/svn(/.*)?,     /var/www/svn(/.*)?,
1041            /etc/owncloud(/.*)?,            /var/www/html(/.*)?/uploads(/.*)?,
1042            /var/www/html(/.*)?/wp-content(/.*)?, /var/www/html(/.*)?/wp_back‐
1043            ups(/.*)?,          /var/www/html(/.*)?/sites/default/files(/.*)?,
1044            /var/www/html(/.*)?/sites/default/settings.php,
1045            /etc/mock/koji(/.*)?,   /etc/nextcloud(/.*)?,   /var/lib/drupal.*,
1046            /etc/zabbix/web(/.*)?,      /var/lib/moodle(/.*)?,     /var/log/z-
1047            push(/.*)?,     /var/spool/gosa(/.*)?,     /etc/WebCalendar(/.*)?,
1048            /usr/share/joomla(/.*)?,                  /var/lib/dokuwiki(/.*)?,
1049            /var/lib/httpd/md(/.*)?,                  /var/lib/owncloud(/.*)?,
1050            /var/spool/viewvc(/.*)?,  /var/lib/nextcloud(/.*)?,  /var/lib/poo‐
1051            tle/po(/.*)?,     /var/lib/phpMyAdmin(/.*)?,      /var/www/moodle‐
1052            data(/.*)?,        /srv/gallery2/smarty(/.*)?,       /var/www/moo‐
1053            dle/data(/.*)?, /var/lib/graphite-web(/.*)?,  /var/log/shibboleth-
1054            www(/.*)?,    /var/www/gallery/albums(/.*)?,    /var/www/html/own‐
1055            cloud/data(/.*)?,              /var/www/html/nextcloud/data(/.*)?,
1056            /usr/share/wordpress-mu/wp-content(/.*)?, /usr/share/wordpress/wp-
1057            content/upgrade(/.*)?,         /usr/share/wordpress/wp-content/up‐
1058            loads(/.*)?, /var/www/html/configuration.php
1059
1060
1061       httpd_sys_script_exec_t
1062
1063       - Set files with the httpd_sys_script_exec_t type, if you want to tran‐
1064       sition an executable to the httpd_sys_script_t domain.
1065
1066
1067       Paths:
1068            /opt/.*.cgi,      /usr/.*.cgi,       /var/www/[^/]*/cgi-bin(/.*)?,
1069            /var/www/perl(/.*)?,            /var/www/html/[^/]*/cgi-bin(/.*)?,
1070            /usr/lib/cgi-bin(/.*)?,                    /var/www/cgi-bin(/.*)?,
1071            /var/www/svn/hooks(/.*)?,   /usr/share/wordpress/.*.php,  /usr/lo‐
1072            cal/nagios/sbin(/.*)?,    /usr/share/wordpress/wp-includes/.*.php,
1073            /usr/share/wordpress-mu/wp-config.php
1074
1075
1076       httpd_tmp_t
1077
1078       -  Set files with the httpd_tmp_t type, if you want to store httpd tem‐
1079       porary files in the /tmp directories.
1080
1081
1082       Paths:
1083            /var/run/user/apache(/.*)?, /var/www/openshift/console/tmp(/.*)?
1084
1085
1086       httpd_tmpfs_t
1087
1088       - Set files with the httpd_tmpfs_t type, if you  want  to  store  httpd
1089       files on a tmpfs file system.
1090
1091
1092
1093       httpd_unconfined_script_exec_t
1094
1095       -  Set  files with the httpd_unconfined_script_exec_t type, if you want
1096       to transition an executable to the httpd_unconfined_script_t domain.
1097
1098
1099
1100       httpd_unit_file_t
1101
1102       - Set files with the httpd_unit_file_t type, if you want to  treat  the
1103       files as httpd unit content.
1104
1105
1106       Paths:
1107            /usr/lib/systemd/system/httpd.*,  /usr/lib/systemd/system/nginx.*,
1108            /usr/lib/systemd/system/thttpd.*,     /usr/lib/systemd/system/php-
1109            fpm.*
1110
1111
1112       httpd_user_content_t
1113
1114       -  Set  files  with the httpd_user_content_t type, if you want to treat
1115       the files as httpd user content.
1116
1117
1118
1119       httpd_user_htaccess_t
1120
1121       - Set files with the httpd_user_htaccess_t type, if you want  to  treat
1122       the file as a httpd user access file.
1123
1124
1125
1126       httpd_user_ra_content_t
1127
1128       - Set files with the httpd_user_ra_content_t type, if you want to treat
1129       the files as httpd user read/append content.
1130
1131
1132
1133       httpd_user_rw_content_t
1134
1135       - Set files with the httpd_user_rw_content_t type, if you want to treat
1136       the files as httpd user read/write content.
1137
1138
1139
1140       httpd_user_script_exec_t
1141
1142       -  Set  files  with  the  httpd_user_script_exec_t type, if you want to
1143       transition an executable to the httpd_user_script_t domain.
1144
1145
1146
1147       httpd_var_lib_t
1148
1149       - Set files with the httpd_var_lib_t type, if you  want  to  store  the
1150       httpd files under the /var/lib directory.
1151
1152
1153       Paths:
1154            /var/lib/rt(3|4)/data/RT-Shredder(/.*)?,       /var/lib/dav(/.*)?,
1155            /var/lib/php(/.*)?,   /var/lib/glpi(/.*)?,   /var/lib/httpd(/.*)?,
1156            /var/lib/nginx(/.*)?,     /var/lib/z-push(/.*)?,     /var/lib/gan‐
1157            glia(/.*)?,    /var/lib/ipsilon(/.*)?,    /var/lib/cherokee(/.*)?,
1158            /var/lib/lighttpd(/.*)?,              /var/lib/mod_security(/.*)?,
1159            /var/lib/roundcubemail(/.*)?,       /var/opt/rh/rh-nginx18/lib/ng‐
1160            inx(/.*)?
1161
1162
1163       httpd_var_run_t
1164
1165       -  Set  files  with  the httpd_var_run_t type, if you want to store the
1166       httpd files under the /run or /var/run directory.
1167
1168
1169       Paths:
1170            /var/run/mod_.*, /var/run/wsgi.*,  /var/run/httpd.*,  /var/run/ng‐
1171            inx.*,  /var/run/apache.*,  /var/run/php-fpm(/.*)?, /var/run/fcgi‐
1172            wrap(/.*)?,  /var/run/lighttpd(/.*)?,  /var/lib/php/session(/.*)?,
1173            /var/lib/php/wsdlcache(/.*)?,        /var/run/dirsrv/admin-serv.*,
1174            /var/opt/rh/rh-nginx18/run/nginx(/.*)?,    /var/www/openshift/bro‐
1175            ker/httpd/run(/.*)?,   /var/www/openshift/console/httpd/run(/.*)?,
1176            /opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)?,
1177            /var/run/thttpd.pid, /var/run/gcache_port, /var/run/cherokee.pid
1178
1179
1180       Note:  File context can be temporarily modified with the chcon command.
1181       If you want to permanently change the file context you need to use  the
1182       semanage fcontext command.  This will modify the SELinux labeling data‐
1183       base.  You will need to use restorecon to apply the labels.
1184
1185

SHARING FILES

1187       If you want to share files with multiple domains (Apache,  FTP,  rsync,
1188       Samba),  you can set a file context of public_content_t and public_con‐
1189       tent_rw_t.  These context allow any of the above domains  to  read  the
1190       content.   If  you want a particular domain to write to the public_con‐
1191       tent_rw_t domain, you must set the appropriate boolean.
1192
1193       Allow httpd servers to read the /var/httpd directory by adding the pub‐
1194       lic_content_t  file  type  to  the  directory and by restoring the file
1195       type.
1196
1197       semanage fcontext -a -t public_content_t "/var/httpd(/.*)?"
1198       restorecon -F -R -v /var/httpd
1199
1200       Allow httpd servers to read and write /var/httpd/incoming by adding the
1201       public_content_rw_t  type  to  the  directory and by restoring the file
1202       type.  You also need to turn on the httpd_anon_write boolean.
1203
1204       semanage fcontext -a -t public_content_rw_t "/var/httpd/incoming(/.*)?"
1205       restorecon -F -R -v /var/httpd/incoming
1206       setsebool -P httpd_anon_write 1
1207
1208
1209       If you want to allow Apache to modify public files used for public file
1210       transfer   services.  Directories/Files  must  be  labeled  public_con‐
1211       tent_rw_t., you must turn on the httpd_anon_write boolean.
1212
1213       setsebool -P httpd_anon_write 1
1214
1215

COMMANDS

1217       semanage fcontext can also be used to manipulate default  file  context
1218       mappings.
1219
1220       semanage  permissive  can  also  be used to manipulate whether or not a
1221       process type is permissive.
1222
1223       semanage module can also be used to enable/disable/install/remove  pol‐
1224       icy modules.
1225
1226       semanage port can also be used to manipulate the port definitions
1227
1228       semanage boolean can also be used to manipulate the booleans
1229
1230
1231       system-config-selinux is a GUI tool available to customize SELinux pol‐
1232       icy settings.
1233
1234

AUTHOR

1236       This manual page was auto-generated using sepolicy manpage .
1237
1238