Version 2 (modified by 19 years ago) ( diff ) | ,
---|
SELinux Hints
Trac won't work out of the box with SELinux enabled systems, since even if you chown the Trac environment to apache it still won't be allowed to write there. These steps should help you get a working install without having to disable SELinux. I was using the targeted policy on an installation of Fedora Core 4 Test 3, so paths might be specific to this configuration, YMMV.
I found that using /var/www/svn
for the base dir for subversion repositories (as per comments in /etc/httpd.d/subversion.conf
) eliminated the need for any extra configuration as far as access to the subversion repository goes.
Configure the Trac access rules
This will set up SELinux so that the server can read and modify the trac environment. Currently only mod_python and cgi setups are defined.
Put the following in a new file /etc/selinux/targeted/src/policy/domains/program/trac.te
:
# trac domains type trac_var_t, file_type, sysadmfile; # enable trac under mod_python bool trac_mod_python true; # enable trac as cgi bool trac_cgi true; # grant apache appropriate permissions ifdef(`apache.te', ` # mod_python permissions if (trac_mod_python) { create_dir_file(httpd_t, trac_var_t) } # cgi permissions if (trac_cgi) { create_dir_file(httpd_sys_script_t, trac_var_t) } ')
This configuration
- Declares trac_var_t as a type of file
- Defines confiuration variable to enable various trac setups
- Checks that the apache policy is available
- If trac_mod_python is true, allows
httpd_t
(the apache security context) to- Create, read, and write
trac_var_t
files/directories
- Create, read, and write
- If trac_cgi is true, allows
httpd_sys_script_t
(the apache cgi security context) to- Create, read, and write
trac_var_t
files/directories
- Create, read, and write
You can use setsebool -P trac_cgi <true/false>
or setsebool -P trac_mod_python <true/false>
as appropriate to enable only the configuration you are using, though there is little harm in leaving them both active.
Configure the Trac file contexts
This defines which files are considered to be trac_var_t
and
should be placed in /etc/selinux/targeted/src/policy/file_contexts/program/trac.fc
. I used /var/trac to store my Trac environments, change that path
as appropriate.
/var/trac(/.*)? system_u:object_r:trac_var_t .*/lib/python[0-9].[0-9]/site-packages/neo_cgi.so system_u:object_r:texrel_shlib_t
This does the following:
- Anything underneath
/var/trac
(including/var/trac
itself) is of type trac_var_t neo_cgi.so
is labeled as having text relocations which is necessary for the clearsilver module to be loaded
Load the new policy
To load the new policy switch to the /etc/selinux/targeted/src/policy
directory and run make load
followed by make install
. You will then need to apply the file contexts by running fixfiles restore /var/trac
and fixfiles restore /usr/lib/python2.4/site-packages/neo_cgi.so
(replace the path with where ever the site-packages for the version of python you are using is).
Troubleshooting
If you still have problems after doing all this there are a few things you can check.
- Apache cannot access the trac environments
ls -lZR /var/trac
will tell you the file contexts for Trac's environments. If they are notsystem_u:object_r:trac_var_t
you may need to run the fixfiles bit again.- Make sure the files are readable by the apache user according to classic unix permissions, SELinux augments, not replaces this. (i.e.
chown -R apache /var/trac
)
- Apache cannot access the subversion repository
- This isn't covered here, the subversion documentation (the FAQ for sure) has some information on setting up subversion with SELinux for access with apache