#!/bin/bash
################################################################################
# Configure ownership, permissions, ACLs, and SELinux for httpd. #
################################################################################
# Ensure we have root privileges.
if [ $EUID != 0 ]; then
sudo "$0" "$@"
exit $?
fi
# Variables.
HTML_DIR="/var/www/html"
HTTP_SERVER="apache"
# Configure ownership.
chown root:root -R "$HTML_DIR"
# Configure permissions.
find "$HTML_DIR" -type f -exec chmod 0640 {} \;
find "$HTML_DIR" -type d -exec chmod 0750 {} \;
# Configure access control lists; allow httpd to access web pages' directory and allow centos user to write for SFTP synchronize.
setfacl -bRm "u::rwX,u:${HTTP_SERVER}:rX,u:centos:rwX,g::rwX,o:-,m:rwX,d:u::rwX,d:u:${HTTP_SERVER}:rX,d:u:centos:rwX,d:g::rwX,d:o:-,d:m:rwX" "$HTML_DIR"
# Configure access control lists; allow httpd to write for file uploads and allow centos user to write for SFTP synchronize.
setfacl -bRm "u::rwX,u:${HTTP_SERVER}:rwX,u:centos:rwX,g::rwX,o:-,m:rwX,d:u::rwX,d:u:${HTTP_SERVER}:rwX,d:u:centos:rwX,d:g::rwX,d:o:-,d:m:rwX" "${HTML_DIR}/asset/upload"
# SELinux: Allow httpd to serve web pages.
chcon -R -t httpd_sys_content_t "$HTML_DIR"
# SELinux: Allow httpd to write to these directories.
chcon -R -t httpd_sys_rw_content_t "${HTML_DIR}/asset/upload"