mirrors/nextcloud-documentation
3
0
Fork 0
mirror of https://github.com/nextcloud/documentation.git synced 2025-10-26 11:18:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

corrections to selinux page; troubleshooting and correct rules to use

Browse Source
This commit is contained in:
Carla Schroder 2016-10-27 14:23:45 -07:00 committed by Morris Jobke
parent ab77949e1b
commit 2d3d8fe587
1 changed files with 38 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
admin_manual/installation/selinux_configuration.rst
View File

@ -4,12 +4,12 @@
SELinux Configuration
=====================
When you have SELinux enabled on your Linux distribution, you may run into
permissions problems after a new Nextcloud installation, and see ``permission
denied`` errors in your Nextcloud logs.
When you have SELinux enabled on your Linux distribution, you may run into
permissions problems after a new Nextcloud installation, and see ``permission
denied`` errors in your Nextcloud logs.
The following settings should work for most SELinux systems that use the
default distro profiles. Run these commands as root, and remember to adjust the filepaths
The following settings should work for most SELinux systems that use the
default distro profiles. Run these commands as root, and remember to adjust the filepaths
in these examples for your installation::
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/data(/.*)?'
@ -19,8 +19,8 @@ in these examples for your installation::
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.user.ini'
restorecon -Rv '/var/www/html/nextcloud/'
If you uninstall Nextcloud you need to remove the Nextcloud directory labels. To do
If you uninstall Nextcloud you need to remove the Nextcloud directory labels. To do
this execute the following commands as root after uninstalling Nextcloud::
semanage fcontext -d '/var/www/html/nextcloud/data(/.*)?'
@ -31,17 +31,28 @@ this execute the following commands as root after uninstalling Nextcloud::
restorecon -Rv '/var/www/html/nextcloud/'
If you have customized SELinux policies and these examples do not work, you must give the
If you have customized SELinux policies and these examples do not work, you must give the
HTTP server write access to these directories::
/var/www/html/nextcloud/data
/var/www/html/nextcloud/config
/var/www/html/nextcloud/apps
Enable updates via the web interface
------------------------------------
To enable updates via the web interface, you may need this to enable writing to the directories::
setsebool httpd_unified on
When the update is completed, disable write access::
setsebool -P httpd_unified off
Disallow write access to the whole web directory
------------------------------------------------
For security reasons it's suggested to disable write access to all folders in /var/www/ (default):
For security reasons it's suggested to disable write access to all folders in /var/www/ (default)::
setsebool -P httpd_unified off
@ -51,7 +62,7 @@ Allow access to a remote database
An additional setting is needed if your installation is connecting to a remote database::
setsebool -P httpd_can_network_connect_db on
Allow access to LDAP server
---------------------------
@ -70,7 +81,7 @@ the app store. To allow this access use the following setting::
Allow access to network memcache
--------------------------------
This setting is not required if httpd_can_network_connect is already on
This setting is not required if ``httpd_can_network_connect`` is already on::
setsebool -P httpd_can_network_memcache on
@ -92,22 +103,34 @@ If you have placed your datadir on a CIFS/SMB share use the following setting::
Allow access to FuseFS
----------------------
If your owncloud data folder resides on a Fuse Filesystem (e.g. EncFS etc), this setting is required as well:
If your data folder resides on a Fuse Filesystem (e.g. EncFS etc), this setting is required as well::
setsebool -P httpd_use_fusefs on
Allow access to GPG for Rainloop
--------------------------------
If you use a the rainloop webmail client app which supports GPG/PGP, you might need this:
If you use a the rainloop webmail client app which supports GPG/PGP, you might need this::
setsebool -P httpd_use_gpg on
Troubleshooting
---------------
For general Troubleshooting of SELinux and its profiles try to install the package ``setroubleshoot`` and run::
For general Troubleshooting of SELinux and its profiles try to install the
package ``setroubleshoot`` and run::
sealert -a /var/log/audit/audit.log > /path/to/mylogfile.txt
to get a report which helps you configuring your SELinux profiles.
to get a report which helps you configuring your SELinux profiles.
Another tool for troubleshooting is to enable a single ruleset for your
Nextcloud directory::
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud(/.*)?'
restorecon -RF /var/www/html/nextcloud
It is much stronger security to have a more fine-grained ruleset as in the
examples at the beginning, so use this only for testing and troubleshooting. It
has a similar effect to disabling SELinux, so don't use it on production
systems.