1

This is what happens when SELinux is enforced:

[root@shadmin ~]# elinks --dump 127.0.0.1/ASP-Portal/index.aspx


                        Service Temporarily Unavailable
   The server is temporarily unable to service your request due to
   maintenance downtime or capacity problems. Please try again later.

   --------------------------------------------------------------------------

    Apache/2.2.15 (Red Hat) Server at 127.0.0.1 Port 80

[root@shadmin ~]# tail /var/log/httpd/error_log

[Tue Aug 09 17:27:00 2016] [notice] caught SIGTERM, shutting down
[Tue Aug 09 17:27:00 2016] [alert] (13)Permission denied: Failed to acquire dashboard lock before destroying the dashboard
[Tue Aug 09 17:27:00 2016] [alert] (13)Permission denied: Failed to acquire dashboard lock before destroying the dashboard
[Tue Aug 09 17:27:00 2016] [alert] (13)Permission denied: Failed to acquire dashboard lock before destroying the dashboard
[Tue Aug 09 17:27:01 2016] [notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
[Tue Aug 09 17:27:01 2016] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Tue Aug 09 17:27:01 2016] [notice] Digest: generating secret for digest authentication ...
[Tue Aug 09 17:27:01 2016] [notice] Digest: done
[Tue Aug 09 17:27:01 2016] [notice] Apache/2.2.15 (Unix) DAV/2 mod_mono/2.10 configured -- resuming normal operations
[Tue Aug 09 17:27:38 2016] [error] Failed to connect to mod-mono-server after several attempts to spawn the process.

[root@shadmin ~]# tail /var/log/messages

Aug  9 17:27:02 shadmin abrtd: Corrupted or bad crash /var/spool/abrt/ccpp-1470743821-2987 (res:4), deleting
Aug  9 17:27:32 shadmin kernel: mono[3006]: segfault at 0 ip 081035fd sp bfb49470 error 6 in mono[8048000+29d000]
Aug  9 17:27:32 shadmin abrt[3007]: saved core dump of pid 3006 (/opt/mono/bin/mono) to /var/spool/abrt/ccpp-1470743852-3006.new/coredump (495616 bytes)
Aug  9 17:27:32 shadmin abrtd: Directory 'ccpp-1470743852-3006' creation detected
Aug  9 17:27:32 shadmin abrtd: Executable '/opt/mono/bin/mono' doesn't belong to any package
Aug  9 17:27:32 shadmin abrtd: Corrupted or bad crash /var/spool/abrt/ccpp-1470743852-3006 (res:4), deleting
Aug  9 17:27:34 shadmin kernel: mono[3009]: segfault at 0 ip 081035fd sp bfc46580 error 6 in mono[8048000+29d000]
Aug  9 17:27:34 shadmin abrt[3010]: not dumping repeating crash in '/opt/mono/bin/mono'
Aug  9 17:27:36 shadmin kernel: mono[3012]: segfault at 0 ip 081035fd sp bfe50c60 error 6 in mono[8048000+29d000]
Aug  9 17:27:36 shadmin abrt[3013]: not dumping repeating crash in '/opt/mono/bin/mono'

A glance at my httpd.conf (I have commented few lines, maybe need later)
I followed : 1)Manual Mod_Mono Configuration
2)To troubleshoot : 503 Service Temporarily Unavailable

# httpd.conf :
ServerTokens OS
ServerRoot "/etc/httpd"
PidFile run/httpd.pid
Timeout 60
KeepAlive Off
MaxKeepAliveRequests 100
KeepAliveTimeout 2
Listen 80
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_alias_module modules/mod_authn_alias.so
LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule include_module modules/mod_include.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule env_module modules/mod_env.so
LoadModule ext_filter_module modules/mod_ext_filter.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule expires_module modules/mod_expires.so
LoadModule deflate_module modules/mod_deflate.so
LoadModule headers_module modules/mod_headers.so
LoadModule usertrack_module modules/mod_usertrack.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule info_module modules/mod_info.so
LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule substitute_module modules/mod_substitute.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule cache_module modules/mod_cache.so
LoadModule suexec_module modules/mod_suexec.so
LoadModule disk_cache_module modules/mod_disk_cache.so
LoadModule cgi_module modules/mod_cgi.so
LoadModule version_module modules/mod_version.so
#Manual Load of Mono:
LoadModule mono_module modules/mod_mono.so
User apache
Group apache
#Note : mod_mono.conf is in /etc/httpd/conf.d/
Include conf.d/*.conf
ServerAdmin root@localhost
UseCanonicalName Off
DocumentRoot "/var/www/html"
UserDir disabled
HostnameLookups Off
<VirtualHost 192.168.***.***:80>  ## Note : ***.*** can be any random static IP I'm using
    ServerAdmin [email protected]
    DocumentRoot /var/www/html/
    ServerName shadmin.shahu.com
    ServerAlias *.shahu.com
    ErrorLog logs/shadmin.shahu.com-error_log
    CustomLog logs/shadmin.shahu.com-access_log common
    HostnameLookups off
#   Note : Used 'UseCanonicalName off' above but 'on' below (I think it acts differently for VirtualHost; Correct me if I'm wrong in this case)
    UseCanonicalName on
#   MonoPath default "/opt/mono/bin/mono"
#   MonoServerPath default "/opt/mono/bin/mod-mono-server2"
    MonoAutoApplication disabled
    AddHandler   mono    .aspx .ascx .asax .ashx .config .cs .asmx .axd
    Alias /ASP-Portal "/var/www/html/ASP-Portal"
    MonoApplications "/ASP-Portal:/var/www/html/ASP-Portal"
    <Location /ASP-Portal>
#       MonoSetServerAlias default
        SetHandler mono
    </Location>
#   <Directory /var/www/html/ASP-Portal>
#       Options Indexes FollowSymLinks
#       AllowOverride None
#       Order allow,deny
#       Allow from all
#   </Directory>
</VirtualHost>

.aspx accessed when SELinux disabled; To allow mono server while SELinux is enforcing, I followed links below:

1)[SELinux Policies for Mono (.NET) Web Applications ]
www.brendanwhelan.net/2013/selinux-policies-for-mono-web-applications
Followed steps according to above link; got this :

[root@shadmin /]# cat /var/log/messages | audit2allow

#============= ifconfig_t ==============
allow ifconfig_t self:capability sys_module;

then, this:

make /usr/share/selinux/devel/mod_mono.pp
make: *** No rule to make target `/usr/share/selinux/devel/mod_mono.pp'.  Stop.

2) Then, tried another [link to configure SELinux policies]
www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/
Following above link, i got: (Note : I stored ASP.NET apps in '/var/www/html/ASP-Portal')

[root@shadmin /]# semanage fcontext -a -t http_sys_content_t "/var/www/html/ASP-Portal(/.*)?"
libsepol.context_from_record: type http_sys_content_t is not defined (No such file or directory).
libsepol.context_from_record: could not create context structure (Invalid argument).
libsemanage.validate_handler: invalid context system_u:object_r:http_sys_content_t:s0 specified for /var/www/html/ASP-Portal(/.*)? [all files] (Invalid argument).
libsemanage.dbase_llist_iterate: could not iterate over records (Invalid argument).
/usr/sbin/semanage: Could not commit semanage transaction

I can't make policies either, I tried to make this post very short but also explained whatever I've done so far.. How may i allow SELinux to run mono server flawlessly? Any help?
P.S.: I'm using Redhat 6.1 on VirtualBox 5.1 on windows host

4
  • 2
    Read the documentation, fix your typos, and bring your system up to date. Aug 10, 2016 at 7:59
  • okay, reading... Aug 10, 2016 at 8:08
  • Read the documentation, so i have to set boolian enabled of few services. but one question arises.. What services mono server uses? and how can i get rid of error : "Failed to connect to mod-mono-server after several attempts to spawn the process." Aug 10, 2016 at 12:07
  • Well, to get rid of "Failed to connect to mod-mono-server after several attempts to spawn the process" error, I had to enable seboolean of httpd_execmem. At least error 503 : Service temporarily unavailable is gone. I'm sure that mono-server can launch now. :) Thanks @Michael , I read the documentation, problem was concerned with SELinux. Aug 12, 2016 at 7:08

1 Answer 1

0

This is not exact solution for overall problem, but at least Error 503 : Service temporarily unavailable is gone.
Here i've done something:

# setsebool httpd_execmem on
# getsebool -a | grep httpd_execmem
httpd_execmem --> on

To check SELinux status:

# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

Now, mono server is running while SELinux is enforced, but with another error (Yeiks!):

# elinks --dump 127.0.0.1/ASP-Portal/index.aspx
   Failed to create shadow copy (CopyFile).
   Description: HTTP 500. Error processing request.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .