Product SiteDocumentation Site

13.4.3. Sharing files between services

Type Enforcement helps prevent processes from accessing files intended for use by another process. For example, by default, Samba cannot read files labeled with the httpd_sys_content_t type, which are intended for use by the Apache HTTP Server. Files can be shared between the Apache HTTP Server, FTP, rsync, and Samba, if the desired files are labeled with the public_content_t or public_content_rw_t type.
The following example creates a directory and files, and allows that directory and files to be shared (read only) through the Apache HTTP Server, FTP, rsync, and Samba:
  1. Use the mkdir utility as root to create a new top-level directory to share files between multiple services:
    ~]# mkdir /shares
  2. Files and directories that do not match a pattern in file-context configuration may be labeled with the default_t type. This type is inaccessible to confined services:
    ~]$ ls -dZ /shares
    drwxr-xr-x  root root unconfined_u:object_r:default_t:s0 /shares
  3. As root, create a /shares/index.html file. Copy and paste the following content into /shares/index.html:
  4. Labeling /shares/ with the public_content_t type allows read-only access by the Apache HTTP Server, FTP, rsync, and Samba. Run the following command as root to add the label change to file-context configuration:
    ~]# semanage fcontext -a -t public_content_t "/shares(/.*)?"
  5. Use the restorecon utility as root to apply the label changes:
    ~]# restorecon -R -v /shares/
    restorecon reset /shares context unconfined_u:object_r:default_t:s0->system_u:object_r:public_content_t:s0
    restorecon reset /shares/index.html context unconfined_u:object_r:default_t:s0->system_u:object_r:public_content_t:s0
To share /shares/ through Samba:
  1. Confirm the samba, samba-common, and samba-client packages are installed (version numbers may differ):
    ~]$ rpm -q samba samba-common samba-client
    If any of these packages are not installed, install them by running the following command as root:
    ~]# dnf install package-name
  2. Edit the /etc/samba/smb.conf file as root. Add the following entry to the bottom of this file to share the /shares/ directory through Samba:
    comment = Documents for Apache HTTP Server, FTP, rsync, and Samba
    path = /shares
    public = yes
    writeable = no
  3. A Samba account is required to mount a Samba file system. Run the following command as root to create a Samba account, where username is an existing Linux user. For example, smbpasswd -a testuser creates a Samba account for the Linux testuser user:
    ~]# smbpasswd -a testuser
    New SMB password: Enter a password
    Retype new SMB password: Enter the same password again
    Added user testuser.
    If you run the above command, specifying a user name of an account that does not exist on the system, it causes a Cannot locate Unix account for 'username'! error.
  4. Start the Samba service:
    ~]# systemctl start smb.service
  5. Run the following command to list the available shares, where username is the Samba account added in step 3. When prompted for a password, enter the password assigned to the Samba account in step 3 (version numbers may differ):
    ~]$ smbclient -U username -L localhost
    Enter username's password:
    Domain=[HOSTNAME] OS=[Unix] Server=[Samba 3.4.0-0.41.el6]
    Sharename       Type      Comment
    ---------       ----      -------
    shares          Disk      Documents for Apache HTTP Server, FTP, rsync, and Samba
    IPC$            IPC       IPC Service (Samba Server Version 3.4.0-0.41.el6)
    username        Disk      Home Directories
    Domain=[HOSTNAME] OS=[Unix] Server=[Samba 3.4.0-0.41.el6]
    Server               Comment
    ---------            -------
    Workgroup            Master
    ---------            -------
  6. User the mkdir utility to create a new directory. This directory will be used to mount the shares Samba share:
    ~]# mkdir /test/
  7. Run the following command as root to mount the shares Samba share to /test/, replacing username with the user name from step 3:
    ~]# mount //localhost/shares /test/ -o user=username
    Enter the password for username, which was configured in step 3.
  8. View the content of the file, which is being shared through Samba:
    ~]$ cat /test/index.html
To share /shares/ through the Apache HTTP Server:
  1. Confirm the httpd package is installed (version number may differ):
    ~]$ rpm -q httpd
    If this package is not installed, use the DNF utility as root to install it:
    ~]# dnf install httpd
  2. Change into the /var/www/html/ directory. Run the following command as root to create a link (named shares) to the /shares/ directory:
    html]# ln -s /shares/ shares
  3. Start the Apache HTTP Server:
    ~]# systemctl start httpd.service
  4. Use a web browser to navigate to http://localhost/shares. The /shares/index.html file is displayed.
By default, the Apache HTTP Server reads an index.html file if it exists. If /shares/ did not have index.html, and instead had file1, file2, and file3, a directory listing would occur when accessing http://localhost/shares:
  1. Remove the index.html file:
    ~]# rm -i /shares/index.html
  2. Use the touch utility as root to create three files in /shares/:
    ~]# touch /shares/file{1,2,3}
    ~]# ls -Z /shares/
    -rw-r--r--  root root system_u:object_r:public_content_t:s0 file1
    -rw-r--r--  root root unconfined_u:object_r:public_content_t:s0 file2
    -rw-r--r--  root root unconfined_u:object_r:public_content_t:s0 file3
  3. Run the following command as root to see the status of the Apache HTTP Server:
    ~]# systemctl status httpd.service
    httpd.service - The Apache HTTP Server
       Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled)
       Active: inactive (dead)
    If the server is stopped, start it:
    ~]# systemctl start httpd.service
  4. Use a web browser to navigate to http://localhost/shares. A directory listing is displayed: