Fedora SE linux

Fedora SE linux

setsebool -P httpd_enable_homedirs true
chcon -R -t httpd_sys_content_t /home/testuser/public_html


setsebool -P httpd_can_network_connect 1


$ sudo setsebool -P httpd_read_user_content on
$ sudo setsebool -P httpd_sys_script_anon_write on
$ sudo chcon -R -t public_content_rw_t cache/
$ sudo chcon -R -t public_content_rw_t logfile.log 
$ sudo chcon -R -h -t httpd_sys_script_rw_t cache/
$ sudo chcon -R -h -t httpd_sys_script_rw_t logfile.log 

Nice summary. In Fedora I needed to run the following in order to allow Nginx to act as a reverse-proxy and connect to a local TCP server:

# Allow http server to reverse-proxy and connect to local server
setsebool -P httpd_can_network_connect on

Then to allow Nginx to read from the webroot:

# This will allow reading everything in /srv.
chcon -R -t httpd_sys_content_t /srv

To check the type of something you can use ls -lZ. For web server root it should say httpd_sys_content_t not unconfined.

# Check SE Linux type
ls -lZ /srv/  

To check audit logs for blocks and how to unblock you can use ausearch and audit2allow:

# See denies
ausearch -m avc -ts today
# See how to allow
ausearch -m avc -ts today | audit2allow