16

I'm migrating to a new webserver which has SELinux set up (running Centos 5.5). I've got it set up so that it can execute CGI scripts with no problem, but some of the older Perl based scripts are failing to connect to remote webservices (RSS feeds and the like).

Running: grep perl /var/log/audit/audit.log gives:

type=SYSCALL msg=audit(1299612513.302:7650): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfb3eb90 a2=57c86c a3=10 items=0 ppid=22342 pid=22558 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=235 comm="index.cgi" exe="/usr/bin/perl" subj=root:system_r:httpd_sys_script_t:s0 key=(null)

As my crash course in SELinux goes, it looks like it is actively refusing the outbound connection, but how do I configure it to allow for CGI scripts to make outbound requests?

1 Answer 1

27

You probably need to enable the httpd_can_network_connect SELinux boolean:

Run as root:

# setsebool -P httpd_can_network_connect 1
2
  • Is there any way to restrict this? I.e. to only allow it to connect on certain ports, to certain hosts, or with other restrictions?
    – cazort
    Aug 3, 2021 at 19:07
  • 1
    Not really, despite this question being over 10 years old, SELinux still doesn’t know about hostnames or IPs, just that the httpd is making network connections. There is a httpd_can_network_connect_db boolean that limits it to just database connections, however. I’d suggest using a firewall (iptables) to restrict outbound connections. Look for the iptables -m owner linux.die.net/man/8/iptables
    – jsbillings
    Aug 3, 2021 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.