mirrors/nextcloud-documentation
3
0
Fork 0
mirror of https://github.com/nextcloud/documentation.git synced 2025-10-26 11:18:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

refined SELinux Settings for ownCloud 9.1

Browse Source 
Tested on CentOS7
This commit is contained in:
Arne Fahrenwalde 2016-10-24 10:07:44 +02:00 committed by Morris Jobke
parent 35b27f568d
commit ab77949e1b
1 changed files with 43 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
admin_manual/installation/selinux_configuration.rst
View File

@ -12,22 +12,24 @@ The following settings should work for most SELinux systems that use the
default distro profiles. Run these commands as root, and remember to adjust the filepaths
in these examples for your installation::
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/data'
restorecon '/var/www/html/nextcloud/data'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/config'
restorecon '/var/www/html/nextcloud/config'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/apps'
restorecon '/var/www/html/nextcloud/apps'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/data(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/config(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/apps(/.*)?'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.htaccess'
semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/nextcloud/.user.ini'
restorecon -Rv '/var/www/html/nextcloud/'
If you uninstall Nextcloud you need to remove the Nextcloud directory labels. To do
this execute the following commands as root after uninstalling Nextcloud::
semanage fcontext -d -t httpd_sys_rw_content_t '/var/www/html/nextcloud/data'
restorecon '/var/www/html/nextcloud/data'
semanage fcontext -d -t httpd_sys_rw_content_t '/var/www/html/nextcloud/config'
restorecon '/var/www/html/nextcloud/config'
semanage fcontext -d -t httpd_sys_rw_content_t '/var/www/html/nextcloud/apps'
restorecon '/var/www/html/nextcloud/apps'
semanage fcontext -d '/var/www/html/nextcloud/data(/.*)?'
semanage fcontext -d '/var/www/html/nextcloud/config(/.*)?'
semanage fcontext -d '/var/www/html/nextcloud/apps(/.*)?'
semanage fcontext -d '/var/www/html/nextcloud/.htaccess'
semanage fcontext -d '/var/www/html/nextcloud/.user.ini'
restorecon -Rv '/var/www/html/nextcloud/'
If you have customized SELinux policies and these examples do not work, you must give the
HTTP server write access to these directories::
@ -36,6 +38,13 @@ HTTP server write access to these directories::
/var/www/html/nextcloud/config
/var/www/html/nextcloud/apps
Disallow write access to the whole web directory
------------------------------------------------
For security reasons it's suggested to disable write access to all folders in /var/www/ (default):
setsebool -P httpd_unified off
Allow access to a remote database
---------------------------------
@ -49,7 +58,7 @@ Allow access to LDAP server
Use this setting to allow LDAP connections::
setsebool -P httpd_can_connect_ldap on
Allow access to remote network
------------------------------
@ -58,6 +67,13 @@ the app store. To allow this access use the following setting::
setsebool -P httpd_can_network_connect on
Allow access to network memcache
--------------------------------
This setting is not required if httpd_can_network_connect is already on
setsebool -P httpd_can_network_memcache on
Allow access to SMTP/sendmail
-----------------------------
@ -73,6 +89,20 @@ If you have placed your datadir on a CIFS/SMB share use the following setting::
setsebool -P httpd_use_cifs on
Allow access to FuseFS
----------------------
If your owncloud data folder resides on a Fuse Filesystem (e.g. EncFS etc), this setting is required as well:
setsebool -P httpd_use_fusefs on
Allow access to GPG for Rainloop
--------------------------------
If you use a the rainloop webmail client app which supports GPG/PGP, you might need this:
setsebool -P httpd_use_gpg on
Troubleshooting
---------------