We are switching from a rhel7 webserver to Ubuntu 18.04. We currently have SELinux with file context set. We typically use this command in our rhel7 box:

chcon -R -t httpd_sys_rw_content_t /var/www/html/

I am trying to get file context setup in our Ubuntu server for AppArmor. When I run the above command in Ubuntu I get:

chcon: can't apply partial context to unlabeled file 'filename'

I have read MANY things online, and all I get is I need to change the context to unconfined_u:object_r:httpd_sys_content_t:s0, or many variations of that, but I ALWAYS get the same result. I have even switched to SELinux and got the same result too.

This is my last blocker for getting this project completed and I have spent HOURS on this one issue. Maybe I have the whole idea of AppArmor wrong, but file context should still apply - right? How can I apply the context properly?

  • Apparmor is not the same as selinux and personally I would not use selinux on Debian / Ubuntu. You can copy or TAR your files without selinux context , see access.redhat.com/documentation/en-us/red_hat_enterprise_linux/… . For apparmor, what problem are you having with apparmor ? – Panther Jun 15 '18 at 14:43
  • @Panther I have been approved to use either. I have seen that selinux hasn't had a lot of love for a while in Ubuntu. I would use either one if I could set the context of files. To my understanding, selinux sets the context of files and basically apache can only open files tagged as httpd files. I am doing this for a PCI environment, so it has to be done. I just basically follow the above command in rhel7 and if I don't the website does not work properly because it cannot access the files because they are not tagged. I need the same in Ubuntu. – alexander7567 Jun 15 '18 at 14:54
  • 1
    all the commands you posted are from selinux, not apparmor, and thus the command you are running probably will not work at all in debian or ubuntu nor will the fix any apparmor problem you might have. You are barking up the wrong tree. – Panther Jun 15 '18 at 15:15
  • 1
    It should work out of the box, but you would have to read up a bit on apparmor, the syntax is very easy, and modify the apache apparmor profile (back up the origional). You can put apparmor into complain mode. The advantage of apparmor is the syntax is easier to understand, the problem is if the default does not work you are sort of on your own. – Panther Jun 15 '18 at 15:29
  • 1
    If you get stuck with apparmor, post your profile and the messages in the logs – Panther Jun 15 '18 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.