v.34.5_fix_systemd

docs/WEB_SERVER.md

@@ -13,6 +13,14 @@ The built-in Web Server serves local files and, optionally, passes PHP scripts t
 
 A Web Service can be shared across several Vhosts. A Vhost may also use ordinary Reverse Proxy as its default and a Web Service for `/assets` or another custom location. Web Server and HTTP reverse proxy use the normal frontend TLS, access, logging and eligible cache pipeline.
 
+**Linux DEB/RPM paths:** With the updated package unit, `/home/user/public_html`,
+`/var/www/site` and `/srv/site` are readable using an appropriately scoped
+service-user group or POSIX ACL; no `systemctl edit` or
+`ReadOnlyPaths=` exception is needed. The filesystem remains read-only to the
+service outside its private state/log/config paths. Grant execute/traversal
+on each parent directory and read permission on served files; see
+[Installation: external paths](INSTALL.md#linux-debrpm-read-only-access-to-external-paths).
+
 ## File serving options
 
 | Feature | Behavior / caution |
@@ -58,7 +66,7 @@ Vhosts can intercept selected application error bodies in **Pages** and return a
 
 A Web Service's dashboard shows request rate, status/error counts, response-header timing, delivered bytes and PHP permit usage (when PHP is configured). These are application observations, not proof of external PHP worker count or final compressed network bytes.
 
-- **403 / unexpected block:** inspect document-root permissions, symlink policy, hardening and inherited ACLs.
+- **403 / unexpected block:** inspect document-root permissions (including parent traversal), symlink policy, hardening, inherited ACLs and any SELinux/AppArmor denial; verify the active systemd unit is the updated one.
 - **404 / unwanted SPA rewrite:** check actual files, index list, `try_files`, location matching and rewrite order.
 - **Wrong Content-Type/download:** check MIME override and attachment extensions.
 - **PHP script downloaded instead of executed:** check PHP enablement, script extension and FPM endpoint.