Bookmark this page

Guided Exercise: Practice: Changing SELinux Booleans

Apache can publish web content hosted in users' home directories, but SELinux prevents this by default. In this exercise, you will identify and change the SELinux Boolean that will permit Apache to access user home directories.

Resources
Files: /etc/httpd/conf.d/userdir.conf
Machines: serverX

Outcomes:

You will have a web server that publishes web content from users' home directories.

The Apache web server should already be installed and running on serverX.example.com.

  1. Log in as root on serverX. Enable the Apache feature that permits users to publish web content from their home directories. Edit the /etc/httpd/conf.d/userdir.conf configuration file and change two distinct lines with the UserDir directive to read as follows:

    #UserDir disabled
    UserDir public_html
    [root@serverX ~]# vi /etc/httpd/conf.d/userdir.conf
    [root@serverX ~]# grep '#UserDir' /etc/httpd/conf.d/userdir.conf
    #UserDir disabled
    [root@serverX ~]# grep '^ *UserDir' /etc/httpd/conf.d/userdir.conf
    UserDir public_html
  2. Restart the Apache web service to make the changes take effect.

    [root@serverX ~]# systemctl restart httpd
    
  3. Create some web content that is published from a user's home directory.

    1. Log in as student in another window and create a public_html directory.

      [student@serverX ~]$ mkdir ~/public_html
      
    2. Create some content in a index.html file.

      [student@serverX ~]$ echo 'This is student content on serverX.' > ~/public_html/index.html
      
    3. Change the permissions on student's home directory so Apache can access the public_html subdirectory.

      [student@serverX ~]$ chmod 711 ~
      
  4. Open a web browser on serverX and try to view the following URL: http://localhost/~student/index.html. You will get an error message that says you do not have permission to access the file.

  5. In your root window, use the getsebool command to see if there are any Booleans that restrict access to home directories.

    [root@serverX ~]# getsebool -a | grep home
    [... Output omitted ...]
    httpd_enable_homedirs --> off
    [... Output omitted ...]
    
  6. Use setsebool to enable home directory access persistently.

    [root@serverX ~]# setsebool -P httpd_enable_homedirs on
    
  7. Try to view http://localhost/~student/index.html again. You should see the message This is student content on serverX.

Revision: rh134-7-63a207e