SELinux and VBOXSF Headaches...

[zeitgeist]

Here is my situation:

HOST: Windows 7
GUEST: Scientific Linux 6.1 (RedHat Clone)

I do Web Application Development. For the most part, I like to edit source files in Windows, using something like Eclipse or Zend Studio. I like to link my source directories with the Guest OS, via shared folders. In the past, I have set this up -- mounting the shared directories directly in my /var/www/html directory. This allows me to edit content and windows and see the changes instantly in my Linux Guest.

The problem: When the shared folder is mounted using VBOXSF, the security context is wrong (and apache is not allowed access). Under normal circumstances, I would just update the security context using chcon, for example:

chcon -R -t httpd_sys_content_t /var/www/html/helloworld

However, this does not work in this situation. The other option is to change the security context during the mount operation. For example,

# mount -t vboxsf helloworld /var/www/html/helloworld -o context="system_u:object_r:httpd_sys_content_t:s0"

Unfortunately, mount.vboxsf does not seem to support "context" as an option.

How are other folks changing the default context of virtualbox shared folders? I would like to leave SELinux on.


http://docs.redhat.com/docs/en-US/Red_H ... stems.html

[Rob230]

Is this still unsupported?

I have a CentOS 6 host and a CentOS 5 guest. I would like to have the files on the host so that I can edit them from there, and have the guest apache be able to access them.

I put the following in the fstab:

Code: Select all

example                   /var/www/example          vboxsf  uid=500,gid=48,context="system_u:object_r:ht tpd_sys_content_t:s0"  0 0

(the extra space is because it is telling me I can't post URLs)

This appears to work. The files appear as belonging to the chosen user (500=me) and group (48=apache) and the permissions are inherited, which is what I want (it means I can control which files apache has write access to).

However, when I do

Code: Select all

ls -Z 

it shows "user_u:object_r:htt pd_sys_content_t". In other words, it correctly applied the role and type, but not the user.

When I try to start apache I get "Warning: DocumentRoot [/var/www/example] does not exist".

I tried loggin in as apache using

Code: Select all

su -s /bin/sh apache

and then trying to ls the /var/www/example directory, and it is indeed empty. But if I am logged in as myself or root then I can see the files fine.

Any ideas? For now I've disabled SELinux, which makes it work, but I would like there to be a solution that doesn't involve disabling it. Seems like I was very close.