1

This is what happens when SELinux is enforced:

[root@shadmin ~]# elinks --dump 127.0.0.1/ASP-Portal/index.aspx


                        Service Temporarily Unavailable
   The server is temporarily unable to service your request due to
   maintenance downtime or capacity problems. Please try again later.

   --------------------------------------------------------------------------

    Apache/2.2.15 (Red Hat) Server at 127.0.0.1 Port 80

[root@shadmin ~]# tail /var/log/httpd/error_log

[Tue Aug 09 17:27:00 2016] [notice] caught SIGTERM, shutting down
[Tue Aug 09 17:27:00 2016] [alert] (13)Permission denied: Failed to acquire dashboard lock before destroying the dashboard
[Tue Aug 09 17:27:00 2016] [alert] (13)Permission denied: Failed to acquire dashboard lock before destroying the dashboard
[Tue Aug 09 17:27:00 2016] [alert] (13)Permission denied: Failed to acquire dashboard lock before destroying the dashboard
[Tue Aug 09 17:27:01 2016] [notice] SELinux policy enabled; httpd running as context unconfined_u:system_r:httpd_t:s0
[Tue Aug 09 17:27:01 2016] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Tue Aug 09 17:27:01 2016] [notice] Digest: generating secret for digest authentication ...
[Tue Aug 09 17:27:01 2016] [notice] Digest: done
[Tue Aug 09 17:27:01 2016] [notice] Apache/2.2.15 (Unix) DAV/2 mod_mono/2.10 configured -- resuming normal operations
[Tue Aug 09 17:27:38 2016] [error] Failed to connect to mod-mono-server after several attempts to spawn the process.

[root@shadmin ~]# tail /var/log/messages

Aug  9 17:27:02 shadmin abrtd: Corrupted or bad crash /var/spool/abrt/ccpp-1470743821-2987 (res:4), deleting
Aug  9 17:27:32 shadmin kernel: mono[3006]: segfault at 0 ip 081035fd sp bfb49470 error 6 in mono[8048000+29d000]
Aug  9 17:27:32 shadmin abrt[3007]: saved core dump of pid 3006 (/opt/mono/bin/mono) to /var/spool/abrt/ccpp-1470743852-3006.new/coredump (495616 bytes)
Aug  9 17:27:32 shadmin abrtd: Directory 'ccpp-1470743852-3006' creation detected
Aug  9 17:27:32 shadmin abrtd: Executable '/opt/mono/bin/mono' doesn't belong to any package
Aug  9 17:27:32 shadmin abrtd: Corrupted or bad crash /var/spool/abrt/ccpp-1470743852-3006 (res:4), deleting
Aug  9 17:27:34 shadmin kernel: mono[3009]: segfault at 0 ip 081035fd sp bfc46580 error 6 in mono[8048000+29d000]
Aug  9 17:27:34 shadmin abrt[3010]: not dumping repeating crash in '/opt/mono/bin/mono'
Aug  9 17:27:36 shadmin kernel: mono[3012]: segfault at 0 ip 081035fd sp bfe50c60 error 6 in mono[8048000+29d000]
Aug  9 17:27:36 shadmin abrt[3013]: not dumping repeating crash in '/opt/mono/bin/mono'

A glance at my httpd.conf (I have commented few lines, maybe need later)
I followed : 1)Manual Mod_Mono Configuration
2)To troubleshoot : 503 Service Temporarily Unavailable

# httpd.conf :
ServerTokens OS
ServerRoot "/etc/httpd"
PidFile run/httpd.pid
Timeout 60
KeepAlive Off
MaxKeepAliveRequests 100
KeepAliveTimeout 2
Listen 80
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_alias_module modules/mod_authn_alias.so
LoadModule authn_anon_module modules/mod_authn_anon.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_owner_module modules/mod_authz_owner.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_dbm_module modules/mod_authz_dbm.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule include_module modules/mod_include.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule env_module modules/mod_env.so
LoadModule ext_filter_module modules/mod_ext_filter.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule expires_module modules/mod_expires.so
LoadModule deflate_module modules/mod_deflate.so
LoadModule headers_module modules/mod_headers.so
LoadModule usertrack_module modules/mod_usertrack.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule info_module modules/mod_info.so
LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule substitute_module modules/mod_substitute.so
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule cache_module modules/mod_cache.so
LoadModule suexec_module modules/mod_suexec.so
LoadModule disk_cache_module modules/mod_disk_cache.so
LoadModule cgi_module modules/mod_cgi.so
LoadModule version_module modules/mod_version.so
#Manual Load of Mono:
LoadModule mono_module modules/mod_mono.so
User apache
Group apache
#Note : mod_mono.conf is in /etc/httpd/conf.d/
Include conf.d/*.conf
ServerAdmin root@localhost
UseCanonicalName Off
DocumentRoot "/var/www/html"
UserDir disabled
HostnameLookups Off
<VirtualHost 192.168.***.***:80>  ## Note : ***.*** can be any random static IP I'm using
    ServerAdmin root@shadmin.shahu.com
    DocumentRoot /var/www/html/
    ServerName shadmin.shahu.com
    ServerAlias *.shahu.com
    ErrorLog logs/shadmin.shahu.com-error_log
    CustomLog logs/shadmin.shahu.com-access_log common
    HostnameLookups off
#   Note : Used 'UseCanonicalName off' above but 'on' below (I think it acts differently for VirtualHost; Correct me if I'm wrong in this case)
    UseCanonicalName on
#   MonoPath default "/opt/mono/bin/mono"
#   MonoServerPath default "/opt/mono/bin/mod-mono-server2"
    MonoAutoApplication disabled
    AddHandler   mono    .aspx .ascx .asax .ashx .config .cs .asmx .axd
    Alias /ASP-Portal "/var/www/html/ASP-Portal"
    MonoApplications "/ASP-Portal:/var/www/html/ASP-Portal"
    <Location /ASP-Portal>
#       MonoSetServerAlias default
        SetHandler mono
    </Location>
#   <Directory /var/www/html/ASP-Portal>
#       Options Indexes FollowSymLinks
#       AllowOverride None
#       Order allow,deny
#       Allow from all
#   </Directory>
</VirtualHost>

.aspx accessed when SELinux disabled; To allow mono server while SELinux is enforcing, I followed links below:

1)[SELinux Policies for Mono (.NET) Web Applications ]
www.brendanwhelan.net/2013/selinux-policies-for-mono-web-applications
Followed steps according to above link; got this :

[root@shadmin /]# cat /var/log/messages | audit2allow

#============= ifconfig_t ==============
allow ifconfig_t self:capability sys_module;

then, this:

make /usr/share/selinux/devel/mod_mono.pp
make: *** No rule to make target `/usr/share/selinux/devel/mod_mono.pp'.  Stop.

2) Then, tried another [link to configure SELinux policies]
www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/
Following above link, i got: (Note : I stored ASP.NET apps in '/var/www/html/ASP-Portal')

[root@shadmin /]# semanage fcontext -a -t http_sys_content_t "/var/www/html/ASP-Portal(/.*)?"
libsepol.context_from_record: type http_sys_content_t is not defined (No such file or directory).
libsepol.context_from_record: could not create context structure (Invalid argument).
libsemanage.validate_handler: invalid context system_u:object_r:http_sys_content_t:s0 specified for /var/www/html/ASP-Portal(/.*)? [all files] (Invalid argument).
libsemanage.dbase_llist_iterate: could not iterate over records (Invalid argument).
/usr/sbin/semanage: Could not commit semanage transaction

I can't make policies either, I tried to make this post very short but also explained whatever I've done so far.. How may i allow SELinux to run mono server flawlessly? Any help?
P.S.: I'm using Redhat 6.1 on VirtualBox 5.1 on windows host

  • 2
    Read the documentation, fix your typos, and bring your system up to date. – Michael Hampton Aug 10 '16 at 7:59
  • okay, reading... – vivek.patwardhan Aug 10 '16 at 8:08
  • Read the documentation, so i have to set boolian enabled of few services. but one question arises.. What services mono server uses? and how can i get rid of error : "Failed to connect to mod-mono-server after several attempts to spawn the process." – vivek.patwardhan Aug 10 '16 at 12:07
  • Well, to get rid of "Failed to connect to mod-mono-server after several attempts to spawn the process" error, I had to enable seboolean of httpd_execmem. At least error 503 : Service temporarily unavailable is gone. I'm sure that mono-server can launch now. :) Thanks @Michael , I read the documentation, problem was concerned with SELinux. – vivek.patwardhan Aug 12 '16 at 7:08
0

This is not exact solution for overall problem, but at least Error 503 : Service temporarily unavailable is gone.
Here i've done something:

# setsebool httpd_execmem on
# getsebool -a | grep httpd_execmem
httpd_execmem --> on

To check SELinux status:

# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

Now, mono server is running while SELinux is enforced, but with another error (Yeiks!):

# elinks --dump 127.0.0.1/ASP-Portal/index.aspx
   Failed to create shadow copy (CopyFile).
   Description: HTTP 500. Error processing request.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.