2850: rb-site fails to set SELinux security context on new files

pf**@talk2***** (Google Code) (Is this you? Claim this profile.)
Feb. 19, 2014
What version are you running?
1.7.1


What's the URL of the page containing the problem?
N/A


What steps will reproduce the problem?
1. rb-site install <path>
2. Visit new website, failures due to file ownership (expected)
3. Change ownership of files as suggested by Reviewboard
3. Visit website, failures still present due to SELinux constrains rather than traditional unix permissions (unexpected).

What is the expected output? What do you see instead?
Expected chown commands suggested by Reviewboard website would be sufficient, e.g.
$ sudo chown -R apache "/var/www/reviewboard/data"
$ sudo chown -R apache "/var/www/reviewboard/htdocs/media/ext"


What operating system are you using? What browser?
Linux (Fedora 18), Firefox 17

Please provide any additional information below.
The files created by rb-site need their security context adjusted.

Original context:
$ ls -ldZ /var/www/reviewboard/htdocs/media/ext/
drwxrwxr-x. apache pafee unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/reviewboard/htdocs/media/ext/
$ ls -ldZ /var/www/reviewboard/data
drwxrwxr-x. apache pafee unconfined_u:object_r:httpd_sys_content_t:s0 /var/www/reviewboard/data

Suggestion from SELinux Trouble shooter fixed the issue:
$ sudo restorecon -v /var/www/reviewboard/htdocs/media/ext
$ ls -ldZ /var/www/reviewboard/htdocs/media/ext/
drwxrwxr-x. apache pafee unconfined_u:object_r:httpd_sys_rw_content_t:s0 /var/www/reviewboard/htdocs/media/ext/

If rb-site could set "httpd_sys_rw_content_t" where necessary, this would avoid AVC denial messages and manual SELinux setup.
$ sudo restorecon -v /var/www/reviewboard/data/
$ ls -ldZ /var/www/reviewboard/data
drwxrwxr-x. apache pafee unconfined_u:object_r:httpd_sys_rw_content_t:s0 /var/www/reviewboard/data
david
#1 david
  • +Component-RB-Site
    +Component-Deployment
david
#2 david
Given the large variety of options that different Linux distros use for SELinux, there's no easy way for us to know what to set. I think the biggest user of SELinux (RHEL) handles this through its review board packaging.
  • +WontFix