How do I go about troubleshooting the following error below:

type=AVC msg=audit(1365523330.609:4846): avc:  denied  { append } for  pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file

Was caused by:
    Unknown - would be allowed by active policy
    Possible mismatch between this policy and the one under which the audit message was generated.

    Possible mismatch between current in-memory boolean settings vs. permanent ones.

There wasn't much documentation on this particular error.

  • Please specify the steps that lead to this situation, e.g. custom modules, custom booleans, commands you issued, specially setsebool, semodule, and friends. – dawud Apr 9 '13 at 18:16
  • This is not necessarily a solution, but a suggestion so that you can familiarize yourself with selinux, policy creation, etc... Install setroubleshoot. It will issue verbatim instructions for using tools like audit2allow to generate policies that mitigate issues on an individual basis. On new server installs I always run selinux in permissive mode until I have everything installed and tested. After which I check the /var/log/audit/audit.log and update the policy using audit2allow. – burf Jul 21 '15 at 18:31
  • You can also pipe your avc denial, or the log itself into audit2why and see if there is a boolean that will address the issue. In which case, you can use setsebool to fix it. – burf Jul 21 '15 at 18:37

Check the apache logs for the actual file causing the problem (for me it was mod_jk.so). hopefully you'll find a line in the error log like

Cannot load /opt/coldfusion10/config/wsconfig/1/mod_jk.so into server: /opt/coldfusion10/config/wsconfig/1/mod_jk.so: failed to map segment from shared object: Permission denied

then compare the selinux permissions of that file with the permissions of the http executable. for me they were

# ls -ldZ /opt/coldfusion10/config/wsconfig/1/mod_jk.so
-rwxr-xr-x. nobody nobody unconfined_u:object_r:httpd_log_t:s0 /opt/coldfusion10/config/wsconfig/1/mod_jk.so
# ls -ldZ /usr/sbin/httpd
-rwxr-xr-x. root root system_u:object_r:httpd_exec_t:s0 /usr/sbin/httpd

You can see the mod_jk.so has different permissions to the httpd binary. To fix it, simply make them the same

# sudo chcon -R -u system_u -r object_r -t httpd_exec_t /opt/coldfusion10/config/wsconfig/1/mod_jk.so 

Now they match, and for me apache started up again (without compromising my server security)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.