SELinux: allow Zend webapp to read/write to tree outside htdocs

Question

I have a Zend web application running on a CentOS server with SELinux running in permissive mode (i.e. access-control decisions are recorded in /var/log/audit/audit.log but not enforced). The application allows people to upload files, which are saved in a directory structure outside htdocs (e.g. /var/acme/myapp/files). The application needs to write and delete files in that directory, as well as create, modify, and delete directories under that directory.

FWIW, httpd starts as root, then spawns processes as a separate user named apache.

I'd like to put SELinux into enforcing mode, but still narrowly allow the Zend application to perform the IO operations described above. I also want these SELinux settings to persist after restarts. How do I do this?

Answer 1

You need to relabel the folder to be writable by httpd.

If http is the only thing (and say ftp or ssh) that will be writing to it then this should work.

semanage fcontext -a -t httpd_sys_rw_content_t '/var/acme/myapp/files(/.*)?' fixfiles restore /var/acme/myapp/files 

Try writing into the folder then, it should work.