How to disable SELinux for Apache httpd only on my Fedora 14?

Converting my earlier comment into an answer, to popular demand ;)

From the you-learn-something-everyday department: I saw Dan Walsh give a presentation yesterday, in which he explained the new way of disabling confinement for applications in newer releases of Fedora and EL6. You no longer set a boolean to disable transition (which sometimes causes a cascade in booleans that need to be set for everything to work), but you put a certain type in permissive mode. You do this by running the 'semanage permissive -a TYPE' command (in your case 'semanage permissive -a httpd_t'). This leaves SELinux on for httpd_t, but in permissive mode. – wzzrd May 20 '11 at 8:45

For Fedora 14, like in el6, I think you can just unload the http SELinux module, by running

semodule -r httpd

That'll probably make httpd run as initrc_t or unconfined_t.

If that doesn't work for F14, you can turn off the SELinux boolean (the 'old' way, from el5), like this:

setsebool httpd_disable_trans 1

and use

setsebool -P httpd_disable_trans 1

to make it permanent

The qustion is not entirely clear - what exactly is your intent?
I'll assume that you are not trying to open the HTTP port, as that would be done with the firewall instead of Selinux itself.
So, perhaps you are looking to allow the httpd daemon to write to some directory that is not under the usual document root?
If so, then you need to read up on the Selinux permissions and set them for the directories you want to access.
Here is a place to read about it:
http://wiki.centos.org/HowTos/SELinux

It is relevant because both Fedora and Centos are related to Red Hat, so this will likely help.

[Edit]
Please try this:
chcon -t textrel_shlib_t ThePathToTheFile

That was suggested by PabloTwo in this post:
http://www.fedoraforum.org/forum/showthread.php?t=252552

It was also suggested by IBM in this post:
https://www-304.ibm.com/support/docview.wss?uid=swg21454550

I'm not sure how you turn off SELinux for a single service - I suspect you can't.

But what you can do is use runcon to set the apache process to run in an unconstrained context.

You can sort of think of runcon as sudoers for selinux. It lets you specify what context to run a process in.

You'd need to modify your apache startup script by adding something like:

runcon unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Into the portion of the httpd startup script that actually invokes apache.

On my Fedora FC14 host I would change this line:

LANG=$HTTPD_LANG daemon --pidfile=${pidfile} $httpd $OPTIONS

To read something like:

LANG=$HTTPD_LANG daemon --pidfile=${pidfile} runcon unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 $httpd $OPTIONS

PS I haven't actually tested this in my apache start up script, so the above isa guess as to exactly where I'd need to put it, but I have definitely used runcon to allow processes to run unconstrained before, so it will work, you just need to find the right place.

There is no boolean to globally disable SELinux for httpd. Having said that, you should read the httpd_selinux(8) man page for the relevant file contexts you should use; in your case you want httpd_sys_script_exec_t or httpd_unconfined_script_exec_t, and can use chcon to set it temporarily to test, and semanage to set it permanently.

I also had the same problem when I was using GBrowse2. GBrowse2 saves temporary files in non-webroot locations and sets locks on sessions outside the webroot. Since GBrowse2 runs on Apache, SELinux dint allow httpd to access/modify directories outside webroot. I followed the link provided in the previous post:

" Here is a place to read about it: http://wiki.centos.org/HowTos/SELinux "

Although it doesn't give the complete instructions on how solve the problem, it helped me a lot (Section 4: SELinux Access Control). It gave me an idea about how SELinux distinguishes between webroot and non-webroot files. You need to change the type of the non-webroot folder/file to the one which is compatible with the httpd process type. This type can be set using the commands given in the SELinux error details (semanage and restorecon commands). After fixing the type of non-webroot folder, the GBrowse2 could smoothly create new files in the non-webroot folder whose type was changed.