15

SELinux is preventing the apache user from writing to a log file which it owns. When I do setenforce 0 it works. Otherwise it shows this error

IOError: [Errno 13] Permission denied: '/var/www/webapp/k/site/k.log'

The security context of the file:

$ ll -Z k.log 
-rw-r--r--. apache apache system_u:object_r:httpd_sys_content_t:s0 k.log

The file was created when the SELinux mode was set to permissive.

How to set the security context so the apache user can write in that directory? I did set that directory security context using chcon but I can't find a suitable file type.

From audit.log:

type=AVC msg=audit(1409945481.163:1561): avc:  denied  { append } for  pid=16862 comm="httpd" name="k.log" dev="dm-1" ino=201614333 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
type=SYSCALL msg=audit(1409945481.163:1561): arch=c000003e syscall=2 success=no exit=-13 a0=7fa8080847a0 a1=441 a2=1b6 a3=3 items=0 ppid=15256 pid=16862 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)

3 Answers 3

11

For files you want Apache to be able to write to, the type must be set to httpd_sys_rw_content_t.

1
  • The correct context-type for Apache to write logs is httpd_log_t, not anything content related. Sep 25, 2022 at 17:08
22

As already stated, you should instruct SELINUX to allow writing to that file. The right thing to do is to mark /var/www/webapp/k/site/ as of type httpd_sys_rw_content_t

To permanently mark that directory as httpd_sys_rw_content_t, you can use the command semanage fcontext -a -t httpd_sys_rw_content_t /var/www/webapp/k/site(/.*)?; restorecon -RF /var/www/webapp/k/site/ This will survive SELINUX binary policy updates and filesystem relabeling.

2
  • 4
    this should have been marked as the correct answer. and it is advised to permanently mark the directory (as stated in this answer).
    – skidadon
    Feb 10, 2016 at 15:38
  • 1
    You probably need to escape the parentheses from the shell. Nov 30, 2018 at 21:02
7

This will change the permissions:

chcon --type httpd_sys_rw_content_t /var/www/webapp/k/site/k.log
1
  • 1
    I get this error: -bash: syntax error near unexpected token `(' Nov 21, 2018 at 3:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.