Apache forbidden by SELinux and access permissions
This post is a very trivial one, but it's just that I've found myself ignoring these things time and again. Every time I need to setup a new system for development in PHP or Drupal, I've ran into almost all of these small "issues". I would always prefer to have the working copy of the code somewhere in my home directory, and maybe have it symlinked from the directory which is set as my "Document Root" in Apache.
Assuming, everything is set up and will work, I go ahead to access the application in my browser, just to find out that all I can get is a big "Forbidden" message. Now, this happens because, in linux, to be able to access the contents of a directory, you should have the 'x' permission. But, unfortunately, home directories are by default set not to be accessible by anyone other than the designated user.
Hence, first of all, we need to give that 'x' permission to apache and since apache is neither the owner of the directory nor does it belong to the group of the directory, we need to give that 'x' permission to all other users.
drwx-----x. 37 ausmarton ausmarton 4096 Aug 25 17:08 ausmarton
This solves the problem of permissions on the home directory. Yet, again when you try to reload the page in your browser you might not see any change if you have SELinux enabled. If you don't have SELinux on your system or if you have it disabled, you might not face any of the things mentioned further on. You might see a notification which says something like this:
SELinux is preventing /usr/sbin/httpd from search access on the directory /home/ausmarton.
A easy solution to this would be to disable SElinux, but if you want to keep SElinux running, you would have to instruct it to allow Apache to access your code files. The following command should fix the problem as long as you don't want Apache to be writing to any file/directory.
However, if you want Apache to write to certain directories, you would need to run additional commands. The good thing about SELinux is, that every time it blocks access to something, it will show you notifications which will also contain a section on how to fix the problem for you.
# cd /var/www/html# ln -s ~ausmarton/Public/website/drupal-7.7 drupalAssuming, everything is set up and will work, I go ahead to access the application in my browser, just to find out that all I can get is a big "Forbidden" message. Now, this happens because, in linux, to be able to access the contents of a directory, you should have the 'x' permission. But, unfortunately, home directories are by default set not to be accessible by anyone other than the designated user.
drwx------. 37 ausmarton ausmarton 4096 Aug 25 17:08 ausmartonHence, first of all, we need to give that 'x' permission to apache and since apache is neither the owner of the directory nor does it belong to the group of the directory, we need to give that 'x' permission to all other users.
# cd /home# chmod o+x ausmarton# lldrwx-----x. 37 ausmarton ausmarton 4096 Aug 25 17:08 ausmarton
This solves the problem of permissions on the home directory. Yet, again when you try to reload the page in your browser you might not see any change if you have SELinux enabled. If you don't have SELinux on your system or if you have it disabled, you might not face any of the things mentioned further on. You might see a notification which says something like this:
SELinux is preventing /usr/sbin/httpd from search access on the directory /home/ausmarton.
A easy solution to this would be to disable SElinux, but if you want to keep SElinux running, you would have to instruct it to allow Apache to access your code files. The following command should fix the problem as long as you don't want Apache to be writing to any file/directory.
# setsebool -P httpd_read_user_content 1However, if you want Apache to write to certain directories, you would need to run additional commands. The good thing about SELinux is, that every time it blocks access to something, it will show you notifications which will also contain a section on how to fix the problem for you.
Comments
Post a Comment