Trying to get a hello-world Perl script to run in the standard cgi-bin location /var/www/cgi-bin/test.pl with RHEL 7. I get a permission denied in the httpd error log only when selinux set to enforcing

AH01215: (13)Permission denied: exec of '/var/www/cgi-bin/test.pl' failed  
End of script output before headers: test.pl

With selinux set to permissive the script is served fine and nothing is posted in the httpd error log.

In the audit log I get a long winded

type=PROCTITLE msg=audit(27482): proctitle=2F7573722F62696E2F7065726C002F7661722F7777772F6367692D62696E2F746573742E706C
type=PATH msg=audit(27482): item=2 name="/lib64/ld-linux-x86-64.so.2" inode=134467951 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:ld_so_t:s0 objtype=NORMAL
type=PATH msg=audit(27482): item=1 name="/usr/bin/perl" inode=67148821 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:bin_t:s0 objtype=NORMAL
type=PATH msg=audit(27482): item=0 name="/var/www/cgi-bin/test.pl" inode=269726961 dev=fd:07 mode=0100775 ouid=0 ogid=1007 rdev=00:00 obj=system_u:object_r:httpd_sys_script_exec_t:s0 objtype=NORMAL
type=CWD msg=audit(27482):  cwd="/var/www/cgi-bin"
type=EXECVE msg=audit(27482): argc=2 a0="/usr/bin/perl" a1="/var/www/cgi-bin/test.pl"
type=SYSCALL msg=audit(27482): arch=c000003e syscall=59 success=yes exit=0 a0=561ae60b3cd0 a1=561ae60ad370 a2=561ae60ad388 a3=7ffe850d64a0 items=3 ppid=23749 pid=24488 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="test.pl" exe="/usr/bin/perl" subj=system_u:system_r:httpd_t:s0 key=(null)
type=SELINUX_ERR msg=audit(27482): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:httpd_t:s0 newcontext=system_u:system_r:httpd_sys_script_t:s0

The final line seems interesting "SELINUX_ERR op=security_bounded_transition seresult=denied oldcontext=... newcontext=..." but can't find much on that.

Finally, file context and permission are set correct.

drwxrwxr-x. root   webdev system_u:object_r:httpd_sys_script_exec_t:s0 /var/www/cgi-bin
-rwxrwxr-x. root webdev system_u:object_r:httpd_sys_script_exec_t:s0 /var/www/cgi-bin/test.pl

And every thing is set correct in http.conf

<Directory "/var/www/cgi-bin">
   AllowOverride None
   Options +ExecCGI
   Require all granted 
AddHandler cgi-script .pl

Having to turning off selinux until I figure out what's up.

  • What does getsebool httpd_enable_cgi say? If it's httpd_enable_cgi --> off then setting it on should fix it. Use setsebool httpd_enable_cgi on and you can pass it -P to make it persistent across reboots setsebool -P httpd_enable_cgi on. – filbranden Mar 30 '18 at 5:20
  • Yeah looked into that and... httpd_enable_cgi is on. Before I installed httpd I installed httpd24-httpd from the software collection. I did erase the httpd24 from the system but I think it has left something in selinux that I can't resolve at this time. – user2225403 Apr 2 '18 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.