How to adjust SELinux to allow not so large file downloads in Apache?

de flag

I have a centos 7 server running Apache 2.4 that will happily allow users to download files until they get to a certain size. I've noticed the problem with mp4 video files; I host both low and full resolution files on the site. The low res files are usually less than 5 MB but the full res files can exceed 30 MB. The same script processes and copies them to the website and I can verify all the file permissions are the same. If I change SELinux to setenforce=0 the files will download without issue. While SELinux is enforcing, apache returns a Forbidden error instead.

Any thoughts on what SELinux policy I need to adjust?

tilleyc avatar
us flag
Look into using audit2allow to see what recommendations it has - it analyzes the actual failures in the audit log to suggest a fix.
de flag

Thanks for the suggestion to use audit2allow, tilleyc. It turns out the video file was 'mislabeled' on my system and the base type was listed as an 'unlabeld_t'. After using the restorecon command, the files were accessible through the webserver. I'll have to do a little more testing to see why the error initially happened but audit2allow pointed me in the right direction. Thanks!

Matthew Ife avatar
jo flag
I'm going with the idea here that when the file is below a certain file size, it is stored in memory. At a certain limit, the file upload code switches to storing the data in a tmp file on disk somewhere -- this is where it gets mislabeled.

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.