EPrints and SELinux - Revision history

Drn@ecs.soton.ac.uk: /* eprints.te */

2025-07-31T17:44:18Z

‎eprints.te

Drn@ecs.soton.ac.uk: /* eprints.te */

2025-07-31T17:43:18Z

‎eprints.te

Drn@ecs.soton.ac.uk: /* eprints.te */

2025-07-31T17:40:31Z

‎eprints.te

Drn@ecs.soton.ac.uk: /* eprints.te */

2025-07-31T17:40:13Z

‎eprints.te

Drn@ecs.soton.ac.uk: /* eprints.fc */

2025-07-31T17:28:26Z

‎eprints.fc

Drn@ecs.soton.ac.uk: /* Apache Configuration */

2025-07-31T17:27:17Z

‎Apache Configuration

Drn@ecs.soton.ac.uk: Added noted about either or for settings or policy file

2025-07-31T17:25:05Z

Added noted about either or for settings or policy file

Drn@ecs.soton.ac.uk: /* Policy file */

2025-07-31T17:19:59Z

‎Policy file

Drn@ecs.soton.ac.uk: /* Setting SELinux Booleans */

2025-07-31T17:18:30Z

‎Setting SELinux Booleans

Drn@ecs.soton.ac.uk: /* System Users and Groups */

2025-07-31T17:15:15Z

‎System Users and Groups

@@ Line 136: / Line 136: @@
           type shadow_t;
           type unconfined_service_t;
           type usr_t;
           type var_run_t;

@@ Line 131: / Line 131: @@
           type httpd_t;
           type ldap_port_t;
           type init_t;
           type mysqld_t;
           type shadow_t;
           type unconfined_service_t;
           type var_run_t;
           class dir { add_name remove_name setattr };

@@ Line 143: / Line 143: @@
           class unix_stream_socket { connectto };
+  }
-−
   # Required by the HTTP webserver
   allow init_t httpd_sys_content_t:file { create execute execute_no_trans ioctl open read };
@@ Line 149: / Line 149: @@
   allow init_t httpd_sys_rw_content_t:file { create ioctl open read unlink write };
   allow init_t mysqld_t:unix_stream_socket { connectto };
-−
   # Required by init processes
   allow init_t httpd_sys_content_t:file { create execute execute_no_trans ioctl open read };
@@ Line 155: / Line 155: @@
   allow init_t httpd_sys_rw_content_t:file { create ioctl open read unlink write };
   allow init_t mysqld_t:unix_stream_socket { connectto };
-−
   # Only needed for coversheets, considering commenting out otherwise.
   allow httpd_t lib_t:dir { setattr };
@@ Line 164: / Line 164: @@
   allow init_t httpd_sys_rw_content_t:file { create };
   allow init_t httpd_sys_rw_content_t:lnk_file { read };
-−
   # Only needed for Shibboleth authentication, consider commenting out otherwise.
   allow httpd_t var_run_t:sock_file { write };
   allow httpd_t unconfined_service_t:unix_stream_socket { connectto };
-−
   # Only need for LDAP authentication, consider commenting out otherwise.
   allow httpd_t ldap_port_t:tcp_socket { name_connect };

@@ Line 122: / Line 122: @@
 === eprints.te ===
-  module eprints 1.2;
+  module eprints 1.4;
   require {
           type httpd_sys_content_t;
           type httpd_sys_rw_content_t;
@@ Line 133: / Line 130: @@
           type httpd_sys_script_t;
           type httpd_t;
           type init_t;
           type mysqld_t;
           type shadow_t;
           type unconfined_service_t;
           type var_run_t;
-          class dir { add_name create getattr open read remove_name rmdir search setattr write };
+          class dir { add_name remove_name setattr };
-          class file { create execute execute_no_trans getattr ioctl map open read rename unlink write };
+          class file { create execute execute_no_trans getattr ioctl open read unlink write };
-          class lnk_file { getattr read };
+          class lnk_file { read };
           class sock_file { write };
           class tcp_socket{ name_connect };
@@ Line 153: / Line 145: @@
   # Required by the HTTP webserver
   allow init_t httpd_sys_content_t:file { create execute execute_no_trans ioctl open read };
   allow init_t httpd_sys_rw_content_t:dir { add_name remove_name };
-  allow init_t httpd_sys_rw_content_t:file { ioctl open read unlink write };
+  allow init_t httpd_sys_rw_content_t:file { create ioctl open read unlink write };
   allow init_t mysqld_t:unix_stream_socket { connectto };
-−
   # Only needed for coversheets, considering commenting out otherwise.
   allow httpd_t shadow_t:file { getattr open read };
+  allow httpd_t usr_t:file { write };
   # Only needed for Shibboleth authentication, consider commenting out otherwise.
   allow httpd_t var_run_t:sock_file { write };
+  allow httpd_t unconfined_service_t:unix_stream_socket { connectto };
-  # Only needed for SSH FuseFS, consider commeting out otherwise.
-  allow httpd_t fusefs_t:dir { add_name create read remove_name rmdir setattr write };
+  # Only need for LDAP authentication, consider commenting out otherwise.
- allow httpd_t fusefs_t:file { create getattr ioctl map open read rename unlink write };
+  allow httpd_t ldap_port_t:tcp_socket { name_connect };
 === redeploy_policy.sh ===

@@ Line 119: / Line 119: @@
   /opt/eprints3/tmp(/.*)?                         unconfined_u:object_r:httpd_sys_rw_content_t:s0
   /opt/eprints3/var(/.*)?                         unconfined_u:object_r:httpd_sys_rw_content_t:s0
 === eprints.te ===

@@ Line 6: / Line 6: @@
 == Apache Configuration ==
-* Set the httpd user and group to <tt>apache</tt> in '''/etc/httpd/conf/httpd.conf'''.  (If you are running SELinux on a Debian/Ubuntu flavour of Linux, then the user and group will need to be set to <tt>www-data</tt>).
+* Set the httpd user and group to <tt>apache</tt> in '''/etc/httpd/conf/httpd.conf'''.  (If you are running SELinux on a Debian/Ubuntu flavour of Linux, then the user and group will need to be set to <tt>www-data</tt> and the file you will need to edit is ''/etc/apache2/apache2.conf'').
   User apache
   Group apache

← Older revision		Revision as of 17:25, 31 July 2025
Line 1:		Line 1:
−	This page is intended to write a rough set of instructions for how to get a CentOS 7 system setup with SELinux enforcing so EPrints 3.4 (with site_lib) runs without any issues. ~~This guidance will~~ be ~~applicable to other versions of CentOS as well as RHEL~~ and ~~Fedora~~. ~~Furthermore, it may~~ be ~~applicable for enabling~~ SELinux ~~on other Linux operatings ystems~~.	+	This page is intended to write a rough set of instructions for how to get a RHEL / Fedora / CentOS / Rocky Linux system setup with SELinux enforcing so EPrints 3.4 (with site_lib) runs without any issues.
		+
		+	It should be noted that the '''Changing Directory Permissions and SELinux Contexts''', '''Setting SELinux Booleans''' and '''Extra settings for...''' sections can be ignored if you deploy the [[#Policy file\|EPrints SELinux policy file]] instead.

	'''N.B. All commands described below need to be run as the root user or using sudo.'''		'''N.B. All commands described below need to be run as the root user or using sudo.'''

@@ Line 91: / Line 91: @@
 == Policy file ==
 First install the following packages:
   yum install checkpolicy policycoreutils-python

@@ Line 34: / Line 34: @@
 == Setting SELinux Booleans ==
 You will definitely need to modify the SELinux boolean so that Apache (httpd) to be able to send email:
   setsebool -P httpd_can_sendmail 1

@@ Line 9: / Line 9: @@
 == System Users and Groups ==
-* Add eprints to the apache group and apache to the eprints group (so that '''/etc/group''' for these looks something like the following, order does not matter):
+* Add <tt>eprints</tt> to the <tt>apache</tt> group and <tt>apache</tt> to the <tt>eprints</tt> group (so that '''/etc/group''' for these looks something like the following, order does not matter):
   apache:x:48:eprints
   eprints:x:1000:apache
 == Changing Directory Permissions and SELinux Contexts ==