From Debian package 0.0.20080702-6 Let apache read httpd_*_content_t files wihtout httpd_builtin_scripting tunable Index: policy/modules/services/apache.if =================================================================== --- policy/modules/services/apache.if.orig +++ policy/modules/services/apache.if @@ -108,6 +108,10 @@ seutil_dontaudit_search_config(httpd_$1_script_t) + allow httpd_t httpd_$1_content_t:dir list_dir_perms; + read_files_pattern(httpd_t,httpd_$1_content_t,httpd_$1_content_t) + read_lnk_files_pattern(httpd_t,httpd_$1_content_t,httpd_$1_content_t) + tunable_policy(`httpd_enable_cgi && httpd_unified',` allow httpd_$1_script_t httpdcontent:file entrypoint; @@ -121,7 +125,7 @@ miscfiles_manage_public_files(httpd_$1_script_t) ') - # Allow the web server to run scripts and serve pages + # Allow the web server to run scripts tunable_policy(`httpd_builtin_scripting',` manage_dirs_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t) manage_files_pattern(httpd_t, httpd_$1_rw_content_t, httpd_$1_rw_content_t)