How to set Apache-accessible SELinux policy for EFS mounted user directories?

Question

When I mount my EFS to a user directory, the directory policy becomes `system_u:object_r:nfs_t:s0`, which is too restrictive - I need it to behave more like a typical user directory, which is `unconfined_u:object_r:user_home_dir_t:s0`. How do I change this?

Accepted Answer

I was able to fix this by [defining the context while mounting the directories](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-working_with_selinux-mounting_file_systems#sect-Security-Enhanced_Linux-Mounting_File_Systems-Multiple_NFS_Mounts). I also had to [define it in my `fstab` configuration to](https://docs.aws.amazon.com/efs/latest/ug/nfs-automount-efs.html) ensure the definition persisted after reboot. Additionally, I needed to set domain policy to `httpd_sys_content_t`, which allowed apache to access the content.

How to set Apache-accessible SELinux policy for EFS mounted user directories?

相關內容