Using mod_fcgid with SELinux in Fedora Core 5 / RHEL 5 onwards
==============================================================
 
Versions of this package built for Fedora Core 5, 6, or 7 include an SELinux
policy module to support FastCGI applications. Later Fedora releases and Red
Hat Enterprise Linux 5.3 onwards include the policy in the main selinux-policy
package and do not require the separate module.
 
The module source (fastcgi.{fc,te}) is included for reference as documentation
in the package.
 
The module uses the same set of SELinux types for FastCGI applications as for
regular CGI scripts (or "system scripts" as they are known in SELinux), as
described in "man httpd_selinux".
 
 * httpd_sys_content_t
 - Set files with httpd_sys_content_t for content that is available
   from all FastCGI scripts and the daemon.
 
 * httpd_sys_script_exec_t
 - Set FastCGI scripts with httpd_sys_script_exec_t to allow them to run
   with access to all system script types.
 
 * httpd_sys_script_ro_t
 - Set files with httpd_sys_script_ro_t if you want httpd_sys_script_exec_t
   scripts to read but not write the data, and disallow other processes from
   access.
 
 * httpd_sys_script_rw_t
 - Set files with httpd_sys_script_rw_t if you want httpd_sys_script_exec_t
   scripts to read/write the data, and disallow other processes from access.
 
 * httpd_sys_script_ra_t
 - Set files with httpd_sys_script_ra_t if you want httpd_sys_script_exec_t
   scripts to read/append to the file, and disallow other processes from
   access.
 
So for the moin wiki layout described in README.RPM of the main mod_fcgid
package, the contexts would be set as follows:
 
    cd /var/www/mywiki
    chcon -t httpd_sys_content_t .
    chcon -R -t httpd_sys_script_exec_t cgi-bin
    chcon -R -t httpd_sys_script_rw_t data underlay
 
It is necessary to turn on the httpd_enable_cgi boolean to run either regular
or FastCGI scripts:
 
    setsebool -P httpd_enable_cgi 1
 
The httpd_can_sendmail boolean is used to specify whether any of your
web applications can make outbound SMTP connections (e.g. moin sending
notifications). By default it is off, but can be enabled as follows:
 
    setsebool -P httpd_can_sendmail 1
 
Only enable this functionality if you actually need it, since it increases the
chances that any vulnerability in any of your web applications could be
exploited by a spammer.
 
If you have any questions or issues regarding FastCGI and SELinux, please don't
hesitate to bring them up on fedora-selinux-list.