2

I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log:

type=AVC msg=audit(1488922911.038:6188): avc: denied { write } for pid=11773 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_t:s0 tclass=dir

type=SYSCALL msg=audit(1488922911.038:6188): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76142c0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11773 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)

It seems the source and target contexts are mismatched. But, it still won't work after I made it unified.

type=AVC msg=audit(1488923356.905:6384): avc: denied { write } for pid=11709 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=dir

type=SYSCALL msg=audit(1488923356.905:6384): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76122b0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11709 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)

Update

I did a restore of permission by using the restorecon command. But it didn't work. I'm using the virtual host, I leave everything default:

<VirtualHost *:80>
ServerName www.hometest.com
DocumentRoot /var/www/web1
</VirtualHost>

Here is the SeLinux permissions of my files.

# ls -Z /var/www/web1
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 admin
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 core
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 download
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 extensions
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 image
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 index.php
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 license.txt
-rwxr-x---. apache root   system_u:object_r:httpd_sys_content_t:s0 list.bak
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 php.ini
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 resources
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 robots.txt
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 static_pages
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 storefront
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 system
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 task.php
# ls -dZ web1/system/cache/
drwxr-x---. apache apache system_u:system_r:httpd_t:s0     web1/system/cache

Any suggestion?

1
  • 1
    Show some information about your DocumentRoot and the permissions in there ls -lZ /var/www/html . Have you tried restorecon -vvFR /var/www/html ? Mar 7, 2017 at 21:59

1 Answer 1

3

I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).

http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/

Try

# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache
3
  • Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.
    – NeilWang
    Mar 9, 2017 at 1:24
  • (Which it says is for mod_cache, whereas I assumed the system/cache directory was being used by some PHP code).
    – sourcejedi
    Mar 9, 2017 at 12:39
  • I agree with you.
    – NeilWang
    Mar 10, 2017 at 9:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .