4.3. Finding the correct SELinux type for managing access to non-standard directories

Procedure

1. List all SELinux-related topics and limit the results to a component you want to configure. For example:

   # man -k selinux | grep samba
   samba_net_selinux (8) - Security Enhanced Linux Policy for the samba_net processes
   samba_selinux (8)    - Security Enhanced Linux Policy for the smbd processes
   …

   In the man page that corresponds to your scenario, find the related SELinux booleans, port types, and file types.

   Note that the man -k selinux or apropos selinux commands are available only after you install the selinux-policy-doc package.

2. Optional: You can display the default mapping of processes on default locations by using the semanage fcontext -l command, for example:

   # semanage fcontext -l | grep samba
   …
   /var/cache/samba(/.*)?                             all files          system_u:object_r:samba_var_t:s0
   …
   /var/spool/samba(/.*)?                             all files          system_u:object_r:samba_spool_t:s0
   …

3. Use the sesearch command to display rules in the default SELinux policy. You can find the type and boolean to use by listing the corresponding rule, for example:

   $ sesearch -A | grep samba | grep httpd
   …
   allow httpd_t cifs_t:dir { getattr open search }; [ use_samba_home_dirs && httpd_enable_homedirs ]:True
   …

4. An SELinux boolean might be the most straightforward solution for your configuration problem. You can display all available booleans and their values by using the getsebool -a command, for example:

   $ getsebool -a | grep homedirs
   git_cgi_enable_homedirs --> off
   git_system_enable_homedirs --> off
   httpd_enable_homedirs --> off
   mock_enable_homedirs --> off
   mpd_enable_homedirs --> off
   openvpn_enable_homedirs --> on
   ssh_chroot_rw_homedirs --> off

5. You can verify that the selected boolean does exactly what you want by using the sesearch command, for example:

   $ sesearch -A | grep httpd_enable_homedirs
   …
   allow httpd_suexec_t autofs_t:dir { getattr open search }; [ use_nfs_home_dirs && httpd_enable_homedirs ]:True
   allow httpd_suexec_t autofs_t:dir { getattr open search }; [ use_samba_home_dirs && httpd_enable_homedirs ]:True
   …

6. If no boolean matches your scenario, find an SELinux type that suits your case. You can find a type for your files by querying a corresponding rule from the default policy by using sesearch, for example:

   $ sesearch -A -s httpd_t -c file -p read
   …
   allow httpd_t httpd_t:file { append getattr ioctl lock open read write };
   allow httpd_t httpd_tmp_t:file { append create getattr ioctl link lock map open read rename setattr unlink write };
   …

7. If none of the previous solutions cover your scenario, you can add a custom rule to the SELinux policy. See the Creating a local SELinux policy module section for more information.