5

I have problem with SELinux. setroubleshoot suggested to enable mypol.pp with semodule -i mypol.pp so apache could run.

after I run the suggested command, I'm keep getting:

type=AVC msg=audit(1388119964.806:11): avc:  denied  { execute } for  pid=2174 comm="httpd" path="/etc/httpd/lib/libaprutil-1.so.0.5.3" dev=md0 ino=2228931 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=file

**** Invalid AVC allowed in current policy ***

type=AVC msg=audit(1388120085.792:29): avc:  denied  { execute } for  pid=2298 comm="httpd" path="/etc/httpd/lib/libaprutil-1.so.0.5.3" dev=md0 ino=2228931 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=file

**** Invalid AVC allowed in current policy ***

type=AVC msg=audit(1388120159.57:37): avc:  denied  { execute } for  pid=2330 comm="httpd" path="/etc/httpd/lib/libaprutil-1.so.0.5.3" dev=md0 ino=2228931 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=file

**** Invalid AVC allowed in current policy ***

type=AVC msg=audit(1388121088.955:65): avc:  denied  { name_connect } for  pid=2331 comm="httpd" dest=8080 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket

**** Invalid AVC allowed in current policy ***

found 0 alerts in /var/log/audit/audit.log
0

2 Answers 2

6

The below indicates to me you have a relabelling problem.

type=AVC msg=audit(1388119964.806:11): avc: denied { execute } for pid=2174 comm="httpd" path="/etc/httpd/lib/libaprutil-1.so.0.5.3" dev=md0 ino=2228931 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=file

Is /etc/httpd/lib a symlink to somewhere else? Normally you wouldn't put your libraries here, but only as a symlink. If so running restorecon -Rv /usr/lib{,64} might be beneficial here.

For the second issue reported below to work you need to ensure SELinux is aware what kind of behaviour you expect from your httpd service.

type=AVC msg=audit(1388121088.955:65): avc: denied { name_connect } for pid=2331 comm="httpd" dest=8080 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket

Enable the boolean httpd_can_network_relay by running setsebool -P httpd_can_network_relay 1.

2

I don't know about the **** Invalid AVC allowed in current policy *** message but we have a Q&A about it here already

Running the text you provide through audit2allow suggests

#============= httpd_t ==============

allow httpd_t http_cache_port_t:tcp_socket name_connect;
allow httpd_t httpd_config_t:file execute;

so you could try using grep to pull out the relevant AVC denied messages to a temporary file then pass it to audit2allow

grep denied: audit.log | grep httpd >temp.log

cat temp.log | audit2allow -M myHTTPD
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i myHTTPD.pp

After installing the myHTTPD.pp you may still find that SElinux stops httpd from starting. This is because earlier (now allowed) denies are no longer masking the later ones. Just repeat the process above each time.

1
  • 3
    It's easier and faster to set SELinux to permissive, collect all the AVC denials at once, and only have to generate the policy once. Dec 27, 2013 at 19:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .