Setfacl - samba - apache access failed

Rocky Linux General
1

Need to show pdf (that saved/created in directory by samba remote user) in browser

The working directory is /workdir/test, so 
$cd /workdir

The test directory is created by user:"user" remotely through samba and the ACL as below
$ls -l | grep test
drwxrwx---+	user:samba test

Then setfacl
$sudo setfacl -R -m d:g:apache:rwx test

$getfacl test
# file: test
# owner: user
# group: samba
user::rwx
group::rwx
other::---
default:user::rwx
default:user:apache:rwx
default:group::rwx
default:group:apache:rwx
default:mask::rwx
default:other::---

Save the tst.pdf in directory test through remote windows client by user:"user"

$ls -l test/tst.pdf
-rw-rw----+	user:samba tst.pdf

$getfacl test/tst.pdf
# file: test/tst.pdf
# owner: user
# group: samba
user::rw-
user:apache:rwx                 #effective:rw-
group::rwx                      #effective:rw-
group:apache:rwx                #effective:rw-
mask::rw-
other::---

My understanding is (which proofed wrong) the browser can (through apache; disregard the default ACL set by samba) access tst.pdf and shown in browser. But the file is failed to load. Am I misunderstand the function of setfacl?
Hope that someone can help me out. Thanks.

2

Its protected by SElinux. Use this as a pointer to reconfigure your local selinux policies …

3

Thanks Ritov for the hint.
Tried to set below

sudo semanage fcontext -a -t httpd_sys_rw_content_t "/workdir/test(/.*)?"
sudo restorecon -R /workdir/test
sudo chcon -R -t httpd_sys_rw_content_t /workdir/test

Failed. Set SELunix to permissive by

sudo setenforce 0

Failed.
Then set it back to enforcing. Try access the file through browser hope to trigger failure record by SELunix. Then

sudo grep -E 'sealert' /var/log/messages

Return empty result.

sudo grep -E 'setroubleshoot|preventing|sealert' /var/log/messages

Didn’t return result relate to httpd
Any further hints?

4

What does ausearch -m avc shows?

5

The problem is due to my knowledge about setfacl is not good enough. The solution is

sudo setfacl -d -R -m u:apache:r-x,g:apache:r-x /workdir

Make apace the default user and group of the workdir.
Thanks everyone!

6