3

I have been trying to setup my project on localhost as symlink into /var/www/html, I can access normal files or directories placed inside html but when I create a symlink to some/other/path, it gives 403 Forbidden and error_log says AH00037: Symbolic link not allowed or link target not accessible: /var/www/html/path/to/project.

Now I have searched quite extensively here and on other StackExchange sites, but no answer work. I read about httpd.conf Directory tag having Indexes FollowSymlinks which I too have for my default configuration under /var/www/html. I also updated permission and tried with root, apache and my own user as symlink owner and actual directory or file owner but nothing seems to work.

I have also placed a .htaccess file inside my actual project directory which has this in it

    Options Indexes

I don't understand if its necessary, its only part of solutions I tried.

If there are any other options I need to do please tell me because I think this could be marked duplicated but I have searched answers for this very question and followed different suggestions.

Thanks

System

I have Fedora 32 with default apache httpd running as service

EDIT:

As mentioned in comment I should check for SELinux, I set it to Permissive mode but doesn't change anything its still 403 Forbidden.

ateebahmed
  • 123
  • 1
    Does Fedora use SELinux? If so, you're going to need to allow the apache user access to the target directory tree. (I don't run SELinux so I can't give you the instructions to do that, but you should get some hits with [tag:selinux] here.) – Chris Davies Jul 18 '20 at 13:22
  • oh okay thanks, I'll look if this can hurdle and yes it is running by default. – ateebahmed Jul 18 '20 at 13:23
  • @roaima tried with SELinux permissive, but same thing happened, so set it back to enforcing – ateebahmed Jul 18 '20 at 13:45
  • You said "symlink into /var/www/html". It this a link to /var/www/html or a like from /var/www/html to somewhere else? – ctrl-alt-delor Jul 18 '20 at 13:48
  • I made a symlink in /var/www/html to /home/user/Documents/project. – ateebahmed Jul 18 '20 at 13:57
  • ls -l /var/www/html

    lrwxrwxrwx. 1 user user project -> /home/user/Documents/project

     – ateebahmed Jul 18 '20 at 13:58
  • Do you have a .htaccess in /var/www/html/ which overrides the Options directive of your <Directory> in your vhost? – Freddy Jul 18 '20 at 14:22
  • no I placed one in only project directory – ateebahmed Jul 18 '20 at 14:23
  • 1
    Check the permissions of /home/user/Documents/project and its parent directories. The directories need to be executable for the Apache process. – Freddy Jul 18 '20 at 17:44
  • okay I checked for these and all directories have x for all except /home where its only rwx to owner – ateebahmed Jul 18 '20 at 18:10
  • okay I made /home +x for all and now I'm getting SELinux alerts saying "httpd tried to access getattr on index.php file" – ateebahmed Jul 18 '20 at 18:15
  • SELinux has given me 4 suggestions, I think the one "if you want to allow httpd to have getattr acces on the index.php file" is my resolution? – ateebahmed Jul 18 '20 at 18:17
  • the solution says I need to execute # semanage fcontext -a -t FILE_TYPE '/home/user/Documents/project/index.php' and the FILE_TYPE has a long list that I don't know which to choose? – ateebahmed Jul 18 '20 at 18:29

1 Answers1

5

Okay, so thanks to all people who commented and helped me find the answer, first thing to check is make sure all directories have execute x bit on for others as well from where you're pointing your symlink to, like I had this structure /var/www/html/project -> /home/user/Documents/project and I did not had permission on /home/user for execute on others, when you do

ls -l /home

your output should be

drwx--x--x. user user 4.0K user

and same for all directories all the way to the directory you're symlinking in /var/www/html.

After checking permissions and httpd.conf check if you're using SELinux and its enabled in Enforcing mode.

sestatus

This will tell if SELinux is running or not and in which mode

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      32

This is the status on my machine if its not installed maybe command won't be found?

Then mostly its a SELinux problem. Once you have correct permissions set you will receive alerts on localhost requests that somebody is accessing that they shouldn't and then you should apply whatever policies are needed, for me I had to allow httpd to read from project directory. I got the solution from here. But its for creating a file, so I modified commands by first checking what is applied on /var/www/html by

ls -lZ /var/www
drwxr-xr-x. 3 root root system_u:object_r:httpd_sys_content_t:s0 00:00 html

so you need httpd_sys_content_t this on your directory.

sudo semanage fcontext -a -t httpd_sys_content_t "/home/user/Documents/project(/.*)?"

(/.*)? means anything after this path should also be applied this label.

After that I applied new configuration to SELinux with

sudo restorecon -R project/

and then check it with

ls -lZ /var/www/html/project/
total 4
-rwxr-xr-x. 1 user user unconfined_u:object_r:httpd_sys_content_t:s0 35 00:00 index.php

You'll see that change is reflected and now if you request, it should give you back response.

Hope this helps someone in the future and if I ever stumble upon this again, this should guide me to the steps.

Thanks everyone who contributed in this.

ateebahmed
  • 123