Using mod_fcgid with SELinux in Fedora Core 5 onwards
=====================================================

Versions of this package built for Fedora Core 5 or later include an SELinux
policy module to support FastCGI applications. This has only been tested so far
with moin, so feedback from other applications is welcome. The intention is for
this module to be included in the SELinux reference policy eventually.

The module source (fastcgi.{fc,te}) is included for reference as documentation
in the package.

The module introduces a new set of SELinux types for FastCGI applications,
comparable with the types described in "man httpd_selinux" for regular CGI
scripts (or "system scripts" as they are known in SELinux):

 * httpd_fastcgi_content_t (equivalent to httpd_sys_content_t)
 - Set files with httpd_fastcgi_content_t for content that is available
   from all FastCGI scripts and the daemon.

 * httpd_fastcgi_script_exec_t (equivalent to httpd_sys_script_exec_t)
 - Set FastCGI scripts with httpd_fastcgi_script_exec_t to allow them to run
   with access to all fastcgi types.

 * httpd_fastcgi_script_ro_t (equivalent to httpd_sys_script_ro_t)
 - Set files with httpd_fastcgi_script_ro_t if you want
   httpd_fastcgi_script_exec_t scripts to read the data, and disallow other
   non-fastcgi scripts from access.

 * httpd_fastcgi_script_rw_t (equivalent to httpd_sys_script_rw_t)
 - Set files with httpd_fastcgi_script_rw_t if you want
   httpd_fastcgi_script_exec_t scripts to read/write the data, and disallow
   other non-fastcgi scripts from access.

 * httpd_fastcgi_script_ra_t (equivalent to httpd_sys_script_ra_t)
 - Set files with httpd_fastcgi_script_ra_t if you want
   httpd_fastcgi_script_exec_t scripts to read/append to the file, and
   disallow other non-fastcgi scripts from access.

So for the moin wiki layout described in README.Fedora of the main mod_fcgid
package, the contexts would be set as follows:

    cd /var/www/mywiki
    chcon -t httpd_fastcgi_content_t .
    chcon -R -t httpd_fastcgi_script_exec_t cgi-bin
    chcon -R -t httpd_fastcgi_script_rw_t data underlay

It is necessary to turn on the httpd_enable_cgi boolean to run either regular
or FastCGI scripts:

    setsebool -P httpd_enable_cgi 1

If the httpd_unified boolean is set, "sys" and "fastcgi" scripts can access
each other's data. This means that you only need to set the actual FastCGI
scripts themselves to httpd_fastcgi_script_exec_t and can leave the file
contexts for everything else set to the "sys" types if you prefer. This is
useful if you have a mixture of CGI and FastCGI applications accessing the
same data.

If you have any questions or issues regarding FastCGI and SELinux, please don't
hesitate to bring them up on fedora-selinux-list.