apache erros vHosts and selinux...

Apache Errors

Error
    ur server dont serve css files
 fix
    AddHandler application/x-httpd-php .css   /* To each virtualhost */

directory listing or browsing

if the welcome page shows up whenever  u try to access ur site or default virtualhost(u removed index.html and u want to view directory listning)
fix
/etc/httpd/conf.d/welcome.conf.”
I opend the welcome.conf file.

I found following lines in welcome.conf file.
<LocationMatch “^/+$”>
Options -Indexes
ErrorDocument 403 /error/noindex.html
</LocationMatch>

I changed that to as follows:

<LocationMatch “^/+$”>
Options Indexes
ErrorDocument 403 /error/noindex.html
</LocationMatch>

or

In httpd.conf: 

<Directory /path/to/virtual/host>
Options Indexes FollowSymLinks
</Directory>

of course That is, if your apache has the mod_autoindex module installed.
---------------------------------------------------------------------------------------------------------
That solve my problem. Some time your selinux will cause the issue so you need to deactivate the selinux.
Some time File permission will also cause the issue.
You can change the file permission using following command, go to that directory and run following command.
#chmod 777 *

home dir vhost

make sure the use home dir is chmod a+x /home/username

hone dir listing

to prevent users from listing other home dirs add apache to all users groups and allow the group for list and read

Selinux

SELinux is preventing /usr/sbin/httpd from search access on the directory /home/..

fix
 getsebool -a | grep httpd    return the current selinux status for httpd

setsebool -P httpd_read_user_content 1
setsebool -P httpd_enable_homedirs 1


chcon -R -t httpd_user_content_t ~user/public_html (optional: label public_html folder hhtpd content which will allow  httpd to access it content)

use chcon -R -t   whene u edit user Home data like  /home/moud/sites
use semanage fcontext -a -t  and restorecon -R -v  when u edit general sys dirs like /var/www/webapp

more info: 
http://wiki.centos.org/HowTos/SELinux
http://beginlinux.com/server_training/web-server/976-apache-and-selinux

selinux and hhtpd

for CMS web sever set those booleans:
 setsebool -P httpd_enable_homedirs 1                   if the site is in home directory
 setsebool -P httpd_read_user_content 1
 setsebool -P httpd_can_network_connect 1
 setsebool -P httpd_can_sendmail 1
 setsebool -P ftp_home_dir 1

selinux httpd labels

httpd_sys_content_t (system content (var/www) read only to apache)
httpd_sys_content_rw_t (system content (var/www) read write to apache)
httpd_sys_script_exec_t (system content (var/www) executable by apache)

httpd_user_content_t (user content ($HOME/public_html) read only to apache)
httpd_user_content_rw_t (user content ($HOME/public_html) read write to apache)
httpd_user_script_exec_t (user content ($HOME/public_html) executable by apache)

proper labelling is the best was to solve your issues, but can sometimes be a bit complicated.

for example:

webapp want to write content in /var/www/webapp/write
semanage fcontext -a -t httpd_sys_content_rw_t "/var/www/webapp/write(/.*)?"
restorecon -R -v /var/www/webapp/write

apache wants to execute /var/www/webapp/webapp.php
semanage fcontext -a -t httpd_sys_script_exec_t /var/www/webapp/webapp.php
restorecon -R -v /var/www/webapp/webapp.php

apache wants to write to /home/joe/public_html/webapp/write
chcon -R -t httpd_user_content_rw_t /home/joe/public_html/webapp/write

apache wants to execute a webapp in /home/joe/public_html/webapp/webapp.php
chcon -t httpd_user_script_exec_t /home/joe/webapp/webapp.php

The fact that PHP has to run as httpd makes PHP in my view a less interesting language to use.
CGI, python, perl, shell can be restricted. these script can run in their own environment and so they can be contained.

But even with PHP, SELinux help a lot with security. because the PHP webapps are confined to the httpd "sandbox" (domain)

The problem is that if you run several webapps in the same domain then the webapps can affect eachother. (the have the same permission and they can access eachothers resources (files)
So if you have two webapps, and have httpd_unified set, and one of the two webapps gets compromised, then the compromised webapp can write to the other webapp (affect it)

selinux labeling vs hhtpd_unified

The httpd_unified policy allows httpd FULL access to ALL http sys content.

example:

httpd_t CAN write to httpd_sys_content_t

normally httpd cannot do this (normally httpd can only write to httpd_sys_content_rw_t and httpd_user_content_rw_t)

The httpd_unified is NOT the best way to handle these issues in some cases.

when httpd_unified might be helpful:

If you only have one PHP webapp on your server. (apache is dedicated for a single (php) webapp

when httpd_unified is not helpful:

if run several different webapps/sites on your server. (apache runs different types of webapps)

If you run several PHP webapp on your httpd server then you should just label the location that apache needs to write to with type httpd_sys_content_rw_t. and you should label content that apache needs to be able to execute with type httpd_sys_script_exec_t.

This, unlike httpd_unified, allow apache to ONLY write/execute those locations and NOT to ALL httpd content.

httpd_unified was designed for scripting languages like PHP that act different then CGI.

PHP scripts get run with httpds privileges.
CGI, like for example perl, can run with their own privileges.

So to sum this all up.

The httpd_unified solution works but is very coarse grained. In many cases its not the preferred solution.

selinux troubleshooting

By default SELinux log messages are written to /var/log/audit/audit.log,              via the Linux Auditing System auditd,
which is started by default. If the auditd daemon is not running, then messages are written to /var/log/messages.
SELinux log messages are labeled with the "AVC" keyword so that they might be easily filtered from other messages, as with grep. 
on X server envirement:
setroubleshoot package:The tool consists of a GUI tool for displaying messages in human-readable format and possible solutions, a desktop notification icon alerting of new issues and a daemon process, setroubleshootd, that checks for new SELinux AVC alerts and feeds the notification icon. Email notifications may also be configured, as for those not running an X server. The SELinux Troubleshooting tool is provided by the setroubleshoot package. The tool may be launched from the X Window GUI manager System menu or from the command line:
sealert -b 

on command line:
sealert -a /var/log/audit/audit.log > /path/to/mylogfile.txt 
may generate human-readable reports from the command line

ref:
http://wiki.centos.org/HowTos/SELinux

selinux write access

SELinux is preventing /usr/sbin/httpd from write to log files
fix

In summary, SELinux only allows write acces for httpd on files and directories labeled 'httpd_sys_rw_content_t'.
Your files have another label, so SELinux complains. You can check the label with the command 'ls -lZ'.

So, you have to set the label to your files to fix the problem:
Code:
chcon -t httpd_sys_rw_content_t <the files/folder>

preferably try to make your webapp work without using the httpd_unified boolean. use proper labelling instead