前言:本文主要介紹了因為SELinux對網站目錄權限控制的不當而引起網站無法正常操作和訪問的問題。
正文開始:今天下午閒著沒有事做於是突然興起想嘗試安裝下Drupal。以前用Wordpress做博客久了,總想著嘗嘗新。
按照Installtion Guide提示的安裝步驟進行操作如下:
- wget http://drupal.org/files/projects/drupal-7.12.tar.gz
- tar -zxvf drupal-7.12.tar.gz
- mv drupal-7.12 /var/www/html/home_start
- cd /var/www/html/home_start
- cp sites/default/default.settings.php sites/default/settings.php
- chmod a+w sites/default/settings.php
- chmod a+w sites/default
- mysqladmin -u username -p create databasename #用正確的字符串代替username和databasename
一切准備就緒!就等著進網站目錄進行下一步配置了!
不幸的是,在浏覽器中打開網站的目錄後就遭遇了httpd的403拒絕訪問提示。
這很顯然,根據以往的經驗可以判斷是目錄權限存在問題。
為了驗證這一說法,我們可以檢查httpd的錯誤日志。默認情況下日志就存在在/var/log/httpd/目錄中。
- [root@localhost ~]# grep Permission /var/log/httpd/error_log
- [Tue Apr 10 09:07:04 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /start denied
- [Tue Apr 10 09:07:50 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /start/ denied
- [Tue Apr 10 09:08:07 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /start/ denied
- [Tue Apr 10 09:10:06 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /start/ denied
- [Tue Apr 10 09:11:08 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /start/ denied
- [Tue Apr 10 09:11:17 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /start denied
- [Tue Apr 10 09:11:34 2012] [error] [client ::1] (13)Permission denied: access to /start denied
- [Tue Apr 10 09:13:35 2012] [error] [client ::1] (13)Permission denied: access to /start denied
- [Tue Apr 10 09:13:51 2012] [error] [client ::1] (13)Permission denied: access to /start/site/default/ denied
- [Tue Apr 10 09:13:57 2012] [error] [client ::1] (13)Permission denied: access to /start/sites denied
- [Tue Apr 10 09:14:51 2012] [error] [client ::1] (13)Permission denied: access to /start/install.php denied
- [Tue Apr 10 09:18:57 2012] [error] [client ::1] (13)Permission denied: access to /start/install.php denied
- [Tue Apr 10 09:19:01 2012] [error] [client ::1] (13)Permission denied: access to /start/ denied
- [Tue Apr 10 09:22:03 2012] [error] [client ::1] (13)Permission denied: access to /start denied
- [Tue Apr 10 09:22:21 2012] [error] [client ::1] (13)Permission denied: access to /start denied
- [Tue Apr 10 09:22:24 2012] [error] [client ::1] (13)Permission denied: access to /start denied
- [Tue Apr 10 09:22:27 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /start denied
- [Tue Apr 10 09:27:02 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /start denied
- [Tue Apr 10 09:27:05 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /start denied
- [Tue Apr 10 09:27:07 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /start denied
- [Tue Apr 10 12:09:58 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /home_start denied
- [Tue Apr 10 12:42:38 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /home_start denied
- [Tue Apr 10 12:42:40 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /home_start denied
- [Tue Apr 10 12:44:15 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /home_start denied
- [Tue Apr 10 12:44:20 2012] [error] [client 127.0.0.1] (13)Permission denied: access to /home_start denied
- [Tue Apr 10 20:53:21 2012] [error] [client ::1] (13)Permission denied: access to /home_start denied
- [Tue Apr 10 21:07:21 2012] [error] [client ::1] (13)Permission denied: access to /home_start denied
- [Tue Apr 10 21:14:48 2012] [error] [client ::1] (13)Permission denied: access to /home_start denied
- [root@localhost ~]#
再檢查網站目錄和文件的權限。為方便起見直接用-lZ選項。用於顯示詳細信息和SELinux權限信息
- [root@localhost html]# ls -lZ
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 archive.html
- drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 blog
- drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 blog_backup
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 blog.htm
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 blog.html
- drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 css
- drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 home_page
- drwxr-xr-x. root root unconfined_u:object_r:admin_home_t:s0 home_start #問題行
- drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 images
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 index.htm
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 index.html
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 info_php.php
- drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 js
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 log
- drwxr-xr-x. root root unconfined_u:object_r:admin_home_t:s0 php #以前的遺留問題
- drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 phpMyAdmin-3.4.10.1-all-languages
- drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 PSDs
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 readme.txt
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 style.htm
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 style.html
- drwxr-xr-x. root root unconfined_u:object_r:httpd_sys_content_t:s0 wiki
顯然上面顯示的結果中的09、16兩行的權限與其他網站目錄不同。
再查看selinx的工作狀態,判斷是不是SELinux引起的。
- [root@localhost httpd]# sestatus
- SELinux status: enabled
- SELinuxfs mount: /selinux
- Current mode: enforcing
- Mode from config file: enforcing
- Policy version: 24
- Policy from config file: targeted
這就是導致網站權限不正確的原因。
我猜測可能是在selinux啟用時對目錄或文件進行操作導致的。因為最近我對SELinux進行了升級(以前沒有遇到)。
所以使用chcon更改SELinux權限以及顯示結果如下:
setenforce 0 #必須暫時停止SELinux,否則可能導致操作失敗。
chcon -t httpd_sys_content_t -R /var/www/html/home_start/ #R參數是遞歸操作的意思
經過修改就會發現SELinux的對應權限已經和其他目錄相同了!都是httpd_sys_content_t。
- [root@localhost html]# setenforce --help
- usage: setenforce [ Enforcing | Permissive | 1 | 0 ]
- [root@localhost html]# setenforce 0
- [root@localhost html]# cd
- [root@localhost ~]# ls /var/www/html/ -Z
- ……
- drwxr-xr-x. root root unconfined_u:object_r:admin_home_t:s0 home_start
- ……
- [root@localhost ~]# chcon -t httpd_sys_content_t -R /var/www/html/home_start/
- [root@localhost ~]# ls /var/www/html/home_start/ -Z
- ……
- -rw-r--r--. root root unconfined_u:object_r:httpd_sys_content_t:s0 authorize.php
- ……
然後,再次打開浏覽器輸入地址,驗證能否訪問,如果可以訪問就可以進行下一步配置了!
最後,還是那句話,遇到問題一定要仔細分析,盡可能的通過自己的努力和分析發現問題所在,這樣才能體會到解決問題的快樂!