Re: Relabeling PHP uploads when they are moved into place

[Vadym Chepkov <vchepkov@xxxxxxxxx>]

On Oct 4, 2011, at 9:57 AM, Scott Gifford wrote:

On Tue, Oct 4, 2011 at 7:00 AM, Vadym Chepkov <vchepkov@xxxxxxxxx> wrote:

[ ... ]

I think it's one of those cases where if a person asks how to shoot himself, he shouldn't be provided any recipes :)

The httpd_tmp_t does not provide any security advantage here, it is fully accessible by the Web server, just not accessible by other tools that we use in our development process (in particular Samba).

I'm moving the files into a directory labeled httpd_user_rw_content_t with these Apache options:

 Options None

 AllowOverride None

 RewriteEngine Off

 php_admin_flag engine off

 AddType text/plain .html .htm .shtml .php .js

The Apache options should prevent anything from being executed (though any suggestions on improving this are welcomed).

I understand where this requirement is coming from. Many current web engines nowadays allow you to install "extensions" or "plugins" via web interface.

No, these are just image files, not code.

Regarding the rules you mentioned in your next message: I have similar rules for my image directory, but SELinux does not apply them to this file.  Since the image is first uploaded to a temporary location, it has type httpd_tmp_t, and it is not relabeled according to my policy when it is moved into its final location.

-----Scott.

ok, then :)

But you saw all those different application don't have a problem with uploading a file and they do get a proper context. 

If files are copied and than deleted (not moved) it "should just work"

Vadym

--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux