1

I have a CGI script called index.cgi

It is trying to read a log file called 10.128.0.242.2012.sep.20.downloaded.txt under the path /var/log/trafcount/

It appears that it is being blocked by selinux.

The audit log shows something like

type=AVC msg=audit(1348158321.873:1472116): avc: denied { read } for pid=11620 comm="index.cgi" name="10.128.0.242.2012.sep.20.downloaded.txt" dev=dm-0 ino=395264 scontext=unconfined_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file

How can I allow this script full access to all files under /var/log/trafcount ?

migrated from stackoverflow.com Sep 22 '12 at 20:45

This question came from our site for professional and enthusiast programmers.

  • this looks like an apache config issue – nobody Sep 21 '12 at 0:29
  • Thanks, I will try over at Server Fault. I am pretty sure its not an apache config as the script is running and doing everything its supposed to expect being able to open and read the log file. – Steed Sep 21 '12 at 13:52
2

One way is with the 'chcon' command with the following:

chcon -Rv --type=httpd_sys_content_t /var/log/trafcount

This will get you access across reboots, but not across SELinux relabelings. In the long run, I'd suggest creating a custom type and creating a rule for that in SELinux so that both /var/log and Apache can happily continue to use it.

Source: http://wiki.centos.org/HowTos/SELinux (Lots of great stuff on SELinux under CentOS in there)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.