2

I have a CentOS 6 server and I'm trying to get the apache web server to run git pull in a directory.

The php file is simply:

<?php
    shellexec('cd /var/www/vhosts/domain;git pull');

However, the git pull command is not run when the file is requested via a browser.

Temporarily turning off SELinux by running setenforce 0 allows it to run, but this is not a safe solution.

/var/log/audit shows the following error when the file is requested.

type=AVC msg=audit(1401182476.567:363184): avc:  denied  { read } for  pid=11082 comm="ssh" name="known_hosts" dev=dm-0 ino=11272197 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file

1 Answer 1

4

Run your system temporarily wit SELinux in Permissive mode (setenforce 0). Carry out your normal operations so that errors are logged to audit.log.

You can then use audit2why to get an explanation of the issue(s). You can use audit2allow to generate a loadable policy module. So for example

audit2allow <wyred.log
type=AVC msg=audit(1401182476.567:363184): avc:  denied  { read } for  pid=11082 comm="ssh" name="known_hosts" dev=dm-0 ino=11272197 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file

    Was caused by:
            Missing type enforcement (TE) allow rule.

            You can use audit2allow to generate a loadable module to allow this 
            access.

then

audit2allow -M wyred <wyred.log
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i wyred.pp

will generate a .pp file and a readable.te file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .