10

I'm migrating to a new webserver which has SELinux set up (running Centos 5.5). I've got it set up so that it can execute CGI scripts with no problem, but some of the older Perl based scripts are failing to connect to remote webservices (RSS feeds and the like).

Running: grep perl /var/log/audit/audit.log gives:

type=SYSCALL msg=audit(1299612513.302:7650): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfb3eb90 a2=57c86c a3=10 items=0 ppid=22342 pid=22558 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=235 comm="index.cgi" exe="/usr/bin/perl" subj=root:system_r:httpd_sys_script_t:s0 key=(null)

As my crash course in SELinux goes, it looks like it is actively refusing the outbound connection, but how do I configure it to allow for CGI scripts to make outbound requests?

19

You probably need to enable the httpd_can_network_connect SELinux boolean:

Run as root:

# setsebool -P httpd_can_network_connect 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.