Apache 2.4 does not follow symlink and gives 403 Forbidden?

Question

I have been trying to setup my project on localhost as symlink into /var/www/html, I can access normal files or directories placed inside html but when I create a symlink to some/other/path, it gives 403 Forbidden and error_log says AH00037: Symbolic link not allowed or link target not accessible: /var/www/html/path/to/project.

Now I have searched quite extensively here and on other StackExchange sites, but no answer work. I read about httpd.conf Directory tag having Indexes FollowSymlinks which I too have for my default configuration under /var/www/html. I also updated permission and tried with root, apache and my own user as symlink owner and actual directory or file owner but nothing seems to work.

I have also placed a .htaccess file inside my actual project directory which has this in it

    Options Indexes

I don't understand if its necessary, its only part of solutions I tried.

If there are any other options I need to do please tell me because I think this could be marked duplicated but I have searched answers for this very question and followed different suggestions.

Thanks

System

I have Fedora 32 with default apache httpd running as service

EDIT:

As mentioned in comment I should check for SELinux, I set it to Permissive mode but doesn't change anything its still 403 Forbidden.

Answer 1

Okay, so thanks to all people who commented and helped me find the answer, first thing to check is make sure all directories have execute x bit on for others as well from where you're pointing your symlink to, like I had this structure /var/www/html/project -> /home/user/Documents/project and I did not had permission on /home/user for execute on others, when you do

ls -l /home

your output should be

drwx--x--x. user user 4.0K user

and same for all directories all the way to the directory you're symlinking in /var/www/html.

After checking permissions and httpd.conf check if you're using SELinux and its enabled in Enforcing mode.

sestatus

This will tell if SELinux is running or not and in which mode

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      32

This is the status on my machine if its not installed maybe command won't be found?

Then mostly its a SELinux problem. Once you have correct permissions set you will receive alerts on localhost requests that somebody is accessing that they shouldn't and then you should apply whatever policies are needed, for me I had to allow httpd to read from project directory. I got the solution from here. But its for creating a file, so I modified commands by first checking what is applied on /var/www/html by

ls -lZ /var/www
drwxr-xr-x. 3 root root system_u:object_r:httpd_sys_content_t:s0 00:00 html

so you need httpd_sys_content_t this on your directory.

sudo semanage fcontext -a -t httpd_sys_content_t "/home/user/Documents/project(/.*)?"

(/.*)? means anything after this path should also be applied this label.

After that I applied new configuration to SELinux with

sudo restorecon -R project/

and then check it with

ls -lZ /var/www/html/project/
total 4
-rwxr-xr-x. 1 user user unconfined_u:object_r:httpd_sys_content_t:s0 35 00:00 index.php

You'll see that change is reflected and now if you request, it should give you back response.

Hope this helps someone in the future and if I ever stumble upon this again, this should guide me to the steps.

Thanks everyone who contributed in this.