4

I have a problem with SELinux!

I have installed git on Red Hat Enterprise 6 with AD group control and SSL Cert . Everything works fine if I do setenforce 0 ( set SELinux in detection only mode ) or if I do semanage permissive -a httpd_t (Set httpd_t in detection only mode)

I do not want to use this on my git production server.

Is there anyone out there who can help we with SELinux?

Below is some info that you might need to be able to help me:

All help I can get would be apriciated:

This is the output of ls -lZa /preproduction/git/repositories/

ls -lZa /preproduction/git/repositories/
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 .
drwxr-xr-x. apache apache unconfined_u:object_r:file_t:s0  ..
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 playground
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 shamrock.git
drwxr-xr-x. apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0 test

Here is the out put of getsebool -a |grep -i httpd

getsebool -a |grep -i httpd
allow_httpd_anon_write --> off
allow_httpd_mod_auth_ntlm_winbind --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_sys_script_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_check_spam --> off
httpd_can_network_connect --> off
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
httpd_can_sendmail --> off
httpd_dbus_avahi --> on
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> off
httpd_execmem --> off
httpd_read_user_content --> off
httpd_setrlimit --> off
httpd_ssi_exec --> off
httpd_tmp_exec --> off
httpd_tty_comm --> on
httpd_unified --> on
httpd_use_cifs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off

Tis is the status of : sestatus

sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted
Improve this question
4
  • 2
    What does your /var/log/audit.log show?
    – jgoldschrafe
    Oct 5, 2012 at 15:07
  • I'll check when I am back at work!
    – Johan Sörell
    Oct 11, 2012 at 14:09
  • I gace up and disabled SELinux instead :-S
    – Johan Sörell
    Nov 5, 2012 at 9:35
  • @JohanSörell Is there any chance you might still be able to post the results of the audit logs? I'd be happy to help with this question.
    – Jeff Ferland
    Nov 30, 2012 at 0:52

1 Answer 1

Reset to default
1

Use audit2allow to parse audit.log and generate the correct rules. Also is very possible to be force to relabel the git repository.

Here you will find very good documentation for your problem: http://wiki.centos.org/HowTos/SELinux

Improve this answer
1
  • Thanx everyone for your support but I do not have time to fix so I could have SELinux enabled so I put it in Permissive mode and moved to the next server project. "I am only one Linux Admin and a hell of a lot of linux machines! :-S" @Jeff F i do not have time to do this but thank's anyways it's always nice to hear that people whanna help. Thanx Sacx for the tips I must read more about SELinux if I have some time over someday. // Johan out!!
    – Johan Sörell
    Dec 11, 2012 at 8:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .