Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to make a screenshot using PhantomJS on my CentOS 5 machine, but I can't get it to work together with SELinux. It works on an identical machine with SELinux disabled, so I really suspect that SELinux is responsible for this.

Here's what I've tried (all commands were run as root), and the errors that I got:

$ ls -Z /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin

-rwxr-xr-x  myusername myusername system_u:object_r:bin_t          phantomjs

Tried screenshot - failed

$ cat /var/log/messages | grep avc

Sep 13 12:21:18 myserver kernel: type=1400 audit(1347531678.014:398): avc:  denied  { getattr } for  pid=6842 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=3097762 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
Sep 13 12:21:18 myserver kernel: type=1400 audit(1347531678.014:399): avc:  denied  { getattr } for  pid=6842 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=3097762 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
Sep 13 12:21:18 myserver kernel: type=1400 audit(1347531678.054:400): avc:  denied  { getattr } for  pid=6852 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=3097762 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
Sep 13 12:21:18 myserver kernel: type=1400 audit(1347531678.054:401): avc:  denied  { getattr } for  pid=6852 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=3097762 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
Sep 13 12:21:19 myserver kernel: type=1400 audit(1347531679.866:402): avc:  denied  { getattr } for  pid=6864 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=3097762 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
Sep 13 12:21:19 myserver kernel: type=1400 audit(1347531679.867:403): avc:  denied  { getattr } for  pid=6864 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=3097762 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
Sep 13 12:21:19 myserver kernel: type=1400 audit(1347531679.920:404): avc:  denied  { getattr } for  pid=6874 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=3097762 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
Sep 13 12:21:19 myserver kernel: type=1400 audit(1347531679.920:405): avc:  denied  { getattr } for  pid=6874 comm="sh" path="/sbin/ldconfig" dev=dm-0 ino=3097762 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file
Sep 13 12:21:27 myserver kernel: type=1400 audit(1347531687.025:406): avc:  denied  { read } for  pid=6890 comm="phantomjs" name="3830d5c3ddfd5cd38a049b759396e72e-x86-64.cache-2" dev=dm-0 ino=2021753 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
Sep 13 12:21:27 myserver kernel: type=1400 audit(1347531687.035:407): avc:  denied  { write } for  pid=6890 comm="phantomjs" name="myusername" dev=dm-0 ino=619658 scontext=system_u:system_r:httpd_t:s0 tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir
Sep 13 12:21:27 myserver kernel: type=1400 audit(1347531687.061:408): avc:  denied  { read } for  pid=6890 comm="phantomjs" name="e3ead4b767b8819993a6fa3ae306afa9-x86-64.cache-2" dev=dm-0 ino=2021752 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
Sep 13 12:21:28 myserver kernel: type=1400 audit(1347531688.720:410): avc:  denied  { execmem } for  pid=6890 comm="phantomjs" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=process

Tried changing type of phantomjs to httpd_sys_script_exec_t

$ chcon -v -t httpd_sys_script_exec_t /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin/phantomjs

$ ls -Z /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin

-rwxr-xr-x  myusername myusername system_u:object_r:httpd_sys_script_exec_t phantomjs

Retried screenshot - failed

$ cat /var/log/messages | grep avc

Sep 13 12:26:05 myserver kernel: type=1400 audit(1347531965.891:414): avc:  denied  { read } for  pid=6962 comm="phantomjs" path="eventpoll:[9737788]" dev=eventpollfs ino=9737788 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=file
Sep 13 12:26:05 myserver kernel: type=1400 audit(1347531965.892:415): avc:  denied  { write } for  pid=6962 comm="phantomjs" path=2F7661722F72756E2F777367692E363535352E302E312E6C6F636B202864656C6574656429 dev=dm-0 ino=2022252 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_var_run_t:s0 tclass=file
Sep 13 12:26:05 myserver kernel: type=1400 audit(1347531965.892:416): avc:  denied  { write } for  pid=6962 comm="phantomjs" path=2F7661722F72756E2F777367692E363535352E302E322E6C6F636B202864656C6574656429 dev=dm-0 ino=2022255 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_var_run_t:s0 tclass=file
Sep 13 12:26:05 myserver kernel: type=1400 audit(1347531965.892:417): avc:  denied  { write } for  pid=6962 comm="phantomjs" path=2F7661722F72756E2F777367692E363535352E302E332E6C6F636B202864656C6574656429 dev=dm-0 ino=2022257 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_var_run_t:s0 tclass=file
Sep 13 12:26:05 myserver kernel: type=1400 audit(1347531965.893:418): avc:  denied  { write } for  pid=6962 comm="phantomjs" path=2F7661722F72756E2F777367692E363535352E302E342E6C6F636B202864656C6574656429 dev=dm-0 ino=2022266 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_var_run_t:s0 tclass=file

Tried changing type of phantomjs to httpd_t

$ chcon -v -t httpd_t /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin/phantomjs

failed to change context of /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin/phantomjs to system_u:object_r:httpd_t
chcon: failed to change context of /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin/phantomjs to system_u:object_r:httpd_t: Permission denied

Tried changing type of phantomjs to httpd_var_run_t

$ chcon -v -t httpd_var_run_t /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin/phantomjs

$ ls -Z /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin

-rwxr-xr-x  myusername myusername system_u:object_r:httpd_var_run_t phantomjs

Retried screenshot - failed

$ cat /var/log/messages | grep avc

Sep 13 12:29:36 myserver kernel: type=1400 audit(1347532176.754:420): avc:  denied  { execute } for  pid=7002 comm="httpd" name="phantomjs" dev=dm-0 ino=3032985 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_var_run_t:s0 tclass=file

Tried changing type of phantomjs to httpd_sys_script_t

$ chcon -v -t httpd_sys_script_t /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin/phantomjs

failed to change context of /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin/phantomjs to system_u:object_r:httpd_sys_script_t
chcon: failed to change context of /usr/local/phantomjs/phantomjs-1.6.2-linux-x86_64-dynamic/bin/phantomjs to system_u:object_r:httpd_sys_script_t: Permission denied

Here's some more information regarding my SELinux setup:

$ sestatus

SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted

...

$ getsebool -a | grep http

allow_httpd_anon_write --> off
allow_httpd_bugzilla_script_anon_write --> off
allow_httpd_cvs_script_anon_write --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_nagios_script_anon_write --> off
allow_httpd_prewikka_script_anon_write --> off
allow_httpd_squid_script_anon_write --> off
allow_httpd_sys_script_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
httpd_can_network_relay --> off
httpd_can_sendmail --> on
httpd_disable_trans --> off
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> on
httpd_execmem --> off
httpd_read_user_content --> off
httpd_rotatelogs_disable_trans --> off
httpd_setrlimit --> off
httpd_ssi_exec --> off
httpd_suexec_disable_trans --> off
httpd_tty_comm --> on
httpd_unified --> on
httpd_use_cifs --> off
httpd_use_nfs --> off

...

$ uname -r

2.6.18-308.1.1.el5

Does anyone with SELinux / httpd experience know if there is a context that's a good match for what I'm trying to do? Or maybe I should bite the bullet and build some custom policy for this?

share|improve this question
    
Disable selinux? –  coincoin Sep 13 '12 at 13:35
    
That doesn't sound like a very constructive solution. That way I would throw out the baby with the bath water don't you think? –  Dennis Bunskoek Sep 13 '12 at 14:00
    
"so I really suspect that SELinux is responsible for this" -> You would make sure about that by disabling selinux. –  coincoin Sep 13 '12 at 14:10
    
Ah, that's what you meant :) I'll try that –  Dennis Bunskoek Sep 13 '12 at 14:39
1  
I tried disabling SELinux using 'setenforce 0', and then it works, so SELinux is definitely the cause –  Dennis Bunskoek Sep 13 '12 at 14:50

1 Answer 1

Here's some snippets from http://wiki.centos.org/HowTos/SELinux#7 on how to create a custom policy module with allow2audit.

Try it

setenforce 0
grep phantomjs /var/log/audit/audit.log | audit2allow -m httpd_phantomjs > httpd_phantomjs.te
cat httpd_phantomjs.te

Install it

grep phantomjs /var/log/audit/audit.log | audit2allow -M httpd_phantomjs
semodule -i httpd_phantomjs.pp
ls /etc/selinux/targeted/modules/active/modules/ | grep httpd

Test it

setenforce 1
tail -f /var/log/audit/audit.log

This is untested so please update as necessary. Hope it works for you

share|improve this answer
    
And if you don't have audit2allow, you might need to install it. –  bishop Nov 11 at 21:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.