|
 |
b4781f |
Using mod_fcgid with SELinux in Fedora Core 5 / RHEL 5 onwards
|
|
|
b4781f |
==============================================================
|
|
|
b4781f |
|
|
|
b4781f |
The module uses the same set of SELinux types for FastCGI applications as for
|
|
|
b4781f |
regular CGI scripts (or "system scripts" as they are known in SELinux), as
|
|
|
b4781f |
described in "man httpd_selinux".
|
|
|
b4781f |
|
|
|
b4781f |
* httpd_sys_content_t
|
|
|
b4781f |
- Set files with httpd_sys_content_t for content that is available to read
|
|
|
b4781f |
from all FastCGI scripts and the daemon.
|
|
|
b4781f |
|
|
|
b4781f |
* httpd_sys_rw_content_t
|
|
|
b4781f |
- Set files with httpd_sys_rw_content_t if you want httpd_sys_script_exec_t
|
|
|
b4781f |
scripts to read/write the data, and disallow other processes from access.
|
|
|
b4781f |
|
|
|
b4781f |
* httpd_sys_script_exec_t
|
|
|
b4781f |
- Set FastCGI scripts with httpd_sys_script_exec_t to allow them to run
|
|
|
b4781f |
with access to all system script types.
|
|
|
b4781f |
|
|
|
b4781f |
So for the moin wiki layout described in README.RPM of the main mod_fcgid
|
|
|
b4781f |
package, the contexts would be set as follows:
|
|
|
b4781f |
|
|
|
b4781f |
cd /var/www/mywiki
|
|
|
b4781f |
chcon -t httpd_sys_content_t .
|
|
|
b4781f |
chcon -R -t httpd_sys_script_exec_t cgi-bin
|
|
|
b4781f |
chcon -R -t httpd_sys_rw_content_t data underlay
|
|
|
b4781f |
|
|
|
b4781f |
It is necessary to turn on the httpd_enable_cgi boolean to run either regular
|
|
|
b4781f |
or FastCGI scripts:
|
|
|
b4781f |
|
|
|
b4781f |
setsebool -P httpd_enable_cgi 1
|
|
|
b4781f |
|
|
|
b4781f |
The httpd_can_sendmail boolean is used to specify whether any of your
|
|
|
b4781f |
web applications can make outbound SMTP connections (e.g. moin sending
|
|
|
b4781f |
notifications). By default it is off, but can be enabled as follows:
|
|
|
b4781f |
|
|
|
b4781f |
setsebool -P httpd_can_sendmail 1
|
|
|
b4781f |
|
|
|
b4781f |
Only enable this functionality if you actually need it, since it increases the
|
|
|
b4781f |
chances that any vulnerability in any of your web applications could be
|
|
|
b4781f |
exploited by a spammer.
|
|
|
b4781f |
|
|
|
b4781f |
If you have any questions or issues regarding FastCGI and SELinux, please don't
|
|
|
b4781f |
hesitate to bring them up on Fedora's selinux-list.
|
|
|
b4781f |
|