10

I'm using a server to write into a NFS type mount-point via NGINX using php-fpm. At the very first step, it shows me the following error:

2017/01/16 11:32:59 [error] 55463#0: *22 FastCGI sent in stderr: "PHP message: PHP Warning:  mkdir(): Permission denied in /var/www/html/x/x.php on line 75
PHP message: PHP Warning:  mkdir(): Permission denied in /x/x/x/x/x.php on line 79
PHP message: PHP Warning:  mkdir(): Permission denied in /x/x/x/x/x.php on line 83
PHP message: PHP Warning:  mkdir(): Permission denied in /x/x/x/x/x.php on line 87
PHP message: PHP Warning:  mkdir(): Permission denied in /x/x/x/x/x.php on line 91
PHP message: PHP Warning:  mkdir(): Permission denied in /x/x/x/x/x.php on line 95
PHP message: PHP Warning:  move_uploaded_file(/mnt/x/x/x/x/x/x.z): failed to open stream: No such file or directory in /var/www/html/x/x.php on line 104
PHP message: PHP Warning:  move_uploaded_file(): Unable to move '/tmp/x' to '/mnt/x/x/x/x/x/x.z' in /var/www/html/x/x.php on line 104" while reading response header from upstream, client: IPADDR, server: _, request: "POST /convert/uploadFile HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm/php-fpm.sock:", host: "IPADDR", referrer: "http://IPADDR/xjob"

Error 104 is utterly fine since it couldn't mkdir, and so cannot move anything to the directory.

Anyway, after that, I thought by myself it might be occurring due to SELinux, so checked /var/log/message but nothing was displayed. So gussed it may be logged in audit.log, and so it was. Here is the Logs of /var/log/audit.d/audit.log :

type=AVC msg=audit(1484554859.698:1415): avc:  denied  { add_name } for  pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1415): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=4 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1484554859.698:1416): avc:  denied  { add_name } for  pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1416): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1484554859.698:1417): avc:  denied  { add_name } for  pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1417): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1484554859.698:1418): avc:  denied  { add_name } for  pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1418): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1484554859.698:1419): avc:  denied  { add_name } for  pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1419): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1484554859.698:1420): avc:  denied  { add_name } for  pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1420): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)

I would be really cheerful if anyone can guide me through this problem. By the way, I'm not willing to disable SELinux at all since I've done many things with it.

UPDATE 1

As @Dimitar said, here is the out put of getsebool -a | grep -i http :

$ getsebool -a | grep -i http

httpd_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_check_spam --> off
httpd_can_connect_ftp --> off
httpd_can_connect_ldap --> off
httpd_can_connect_mythtv --> off
httpd_can_connect_zabbix --> off
httpd_can_network_connect --> off
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
httpd_can_sendmail --> off
httpd_dbus_avahi --> off
httpd_dbus_sssd --> off
httpd_dontaudit_search_dirs --> off
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> off
httpd_execmem --> off
httpd_graceful_shutdown --> on
httpd_manage_ipa --> off
httpd_mod_auth_ntlm_winbind --> off
httpd_mod_auth_pam --> off
httpd_read_user_content --> off
httpd_run_ipa --> off
httpd_run_preupgrade --> off
httpd_run_stickshift --> off
httpd_serve_cobbler_files --> off
httpd_setrlimit --> off
httpd_ssi_exec --> off
httpd_sys_script_anon_write --> off
httpd_tmp_exec --> off
httpd_tty_comm --> off
httpd_unified --> off
httpd_use_cifs --> off
httpd_use_fusefs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off
httpd_use_openstack --> off
httpd_use_sasl --> off
httpd_verify_dns --> off
named_tcp_bind_http_port --> off
prosody_bind_http_port --> off

And the context of files are the same as www directory shown below:

drwxr-xr-x. nginx nginx system_u:object_r:httpd_sys_content_t:s0 www

UPDATE 2

After using the command setsebool -P httpd_can_network_connect on as @Dimitar provided as an answer, my audit.log looks like below :

enter image description here

UPDATE 3

The answer provided by @FarazX solved my problem, but as @Dimitar asked, here is the result of sealert -a /var/log/audit.d/audit.log > somefile.txt :

*****  Plugin catchall (1.41 confidence) suggests   **************************

If you believe that php-fpm should be allowed setattr access on the 1395_10_27_jsAdminLog.txt file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'php-fpm' --raw | audit2allow -M my-phpfpm
# semodule -i my-phpfpm.pp


Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:httpd_sys_content_t:s0
Target Objects                1395_10_27_jsAdminLog.txt [ file ]
Source                        php-fpm
Source Path                   /usr/sbin/php-fpm
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           php-fpm-5.4.16-42.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-102.el7_3.7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     SETB0
Platform                      Linux SETB0 3.10.0-327.el7.x86_64 #1 SMP Thu Nov
                              19 22:10:57 UTC 2015 x86_64 x86_64
Alert Count                   1
First Seen                    2017-01-16 12:42:55 IRST
Last Seen                     2017-01-16 12:42:55 IRST
Local ID                      0076ec8b-214b-4379-b9f3-1523f46d6b36

Raw Audit Messages
type=AVC msg=audit(1484557975.199:1436): avc:  denied  { setattr } for  pid=55476 comm="php-fpm" name="1395_10_27_jsAdminLog.txt" dev="dm-0" ino=963720 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file


type=SYSCALL msg=audit(1484557975.199:1436): arch=x86_64 syscall=chmod success=yes exit=0 a0=7f36808c6cb8 a1=1ed a2=7f367b331100 a3=7f367b3080f0 items=0 ppid=55471 pid=55476 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm=php-fpm exe=/usr/sbin/php-fpm subj=system_u:system_r:httpd_t:s0 key=(null)

Hash: php-fpm,httpd_t,httpd_sys_content_t,file,setattr

Thank you so much everyone.

Improve this question
2
  • 1
    What is the context of /var/www/html/ and subdirs? Also, please add the output of getsebool -a | grep -i http
    – 13dimitar
    Jan 16, 2017 at 9:17
  • Make sure to mark FarazX answer as correct, as you indicated that it solved your problem.
    – SB Ph.D.
    Dec 8, 2017 at 20:03

2 Answers 2

Reset to default
10

setsebool -P httpd_can_network_connect on will permanently enable the flag which should solve your problem.

Improve this answer
5
  • Thank you so much for the quick respond, but it didn't work :( Any other guess?
    – Parsa Samet
    Jan 16, 2017 at 10:31
  • Updated my question for another time.
    – Parsa Samet
    Jan 16, 2017 at 10:40
  • please provide a text of your audit.log file, OR - run sealert -a /var/log/audit.d/audit.log > somefile.txt, and then provide the contents for that file
    – 13dimitar
    Jan 16, 2017 at 11:07
  • 1
    sealert is provided by setroubleshoot-server, so install it if you don't have it on your system.
    – 13dimitar
    Jan 16, 2017 at 11:18
  • This worked for me. My guess is selinux views the connection from nginx to php-fpm as a network connection, even if they are on the same machine.
    – jxmallett
    Nov 3, 2017 at 11:04
7

I recommend you download the following packages via yum so you'll be able to find your problems with more ease:

$ yum -y install setroubleshoot-server setools-console

You can take a look at this Official Link for further information on SELinux packages.

On the other hand, the value of httpd_use_nfs is set to off on your system, and I guess that would be the reason of why you're getting errors. Please enable it by using the following command since you are using nfs, and if it didn't fix your problem, please do as @Dimitar said and update your question with sealert -a /var/log/audit.d/audit.log :

$ setsebool -P httpd_use_nfs
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.