0

my problem is as follows:

I installed gitlab on a cloudserver of mine running CentOS7, and I configured it to use apache2/httpd instead of nginx as webserver.

For doing so I followed this answer on stackoverflow and it works as a charm, but for it to work I need to set setenforce to 0.

As soon as I set it to 1, I get 503 Error codes when trying to connect to the subdomain git.my-domain.com, but I am still able to connect to my-domain.com, with the error-logs of httpd showing the following:

[Thu Jul 11 18:03:01.130095 2019] [proxy:error] [pid 30819] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Thu Jul 11 18:03:01.130150 2019] [proxy_http:error] [pid 30819] [client 62.216.200.13:62106] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Thu Jul 11 18:03:01.239208 2019] [proxy:error] [pid 30821] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Thu Jul 11 18:03:01.239266 2019] [proxy_http:error] [pid 30821] [client 62.216.200.13:62151] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Thu Jul 11 18:04:34.519172 2019] [proxy:error] [pid 30820] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Thu Jul 11 18:04:34.519222 2019] [proxy_http:error] [pid 30820] [client 62.216.200.13:62204] AH01114: HTTP: failed to make connection to backend: 127.0.0.1

My VirtualHost-configuration looks as follows:

Servername my-domain.com
<VirtualHost my-domain.com:80>
        Servername my-domain.com
        ServerSignature Off

        DocumentRoot /var/www
</VirtualHost>

<VirtualHost git.my-domain.com:80>
        Servername git.my-domain.com
        ServerSignature Off

        <Location />
                Require all granted

                ProxyPassReverse http://127.0.0.1:8080
                ProxyPassReverse http://git.my-domain.com/
        </Location>

        RewriteEngine on
        RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
        RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]

        # needed for downloading attachments
        DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public

        ErrorLog /var/log/httpd/error_log
        CustomLog /var/log/httpd/access_log combined env=!dontlog
</VirtualHost>

<VirtualHost monitoring.my-domain.com:80>
        Servername monitoring.my-domain.com
        ServerSignature Off

        ProxyPreserveHost On
        <Location />
                ProxyPassReverse http://127.0.0.1:8669
                ProxyPassReverse http://monitoring.my-domain.com/
        </Location>
</VirtualHost>

The output of httpd -S is

VirtualHost configuration:
5.83.160.122:80        is a NameVirtualHost
         default server my-domain.com (/etc/httpd/conf.d/vhosts.conf:3)
         port 80 namevhost my-domain.com (/etc/httpd/conf.d/vhosts.conf:3)
         port 80 namevhost git.my-domain.com (/etc/httpd/conf.d/vhosts.conf:10)
         port 80 namevhost monitoring.my-domain.com (/etc/httpd/conf.d/vhosts.conf:34)
ServerRoot: "/etc/httpd"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/etc/httpd/logs/error_log"
Mutex proxy: using_defaults
Mutex authn-socache: using_defaults
Mutex default: dir="/run/httpd/" mechanism=default 
Mutex mpm-accept: using_defaults
Mutex authdigest-opaque: using_defaults
Mutex proxy-balancer-shm: using_defaults
Mutex rewrite-map: using_defaults
Mutex authdigest-client: using_defaults
PidFile: "/run/httpd/httpd.pid"
Define: _RH_HAS_HTTPPROTOCOLOPTIONS
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="apache" id=48
Group: name="apache" id=48

The audit-output:

[daniel@my-domain ~]$ sudo ausearch -m avc --start today
----
time->Fri Jul 12 11:08:27 2019
type=PROCTITLE msg=audit(1562922507.353:49213): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1562922507.353:49213): arch=c000003e syscall=42 success=no exit=-115 a0=c a1=562969a61490 a2=10 a3=7ffef15e3a60 items=0 ppid=8022 pid=9454 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1562922507.353:49213): avc:  denied  { name_connect } for  pid=9454 comm="httpd" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
----
time->Fri Jul 12 11:13:30 2019
type=PROCTITLE msg=audit(1562922810.248:50062): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1562922810.248:50062): arch=c000003e syscall=42 success=no exit=-13 a0=c a1=562969a61490 a2=10 a3=7ffef15e3fcc items=0 ppid=8022 pid=8026 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1562922810.248:50062): avc:  denied  { name_connect } for  pid=8026 comm="httpd" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
----
time->Fri Jul 12 11:13:46 2019
type=PROCTITLE msg=audit(1562922826.077:50073): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1562922826.077:50073): arch=c000003e syscall=42 success=no exit=-13 a0=c a1=562969a61490 a2=10 a3=7ffef15e3a60 items=0 ppid=8022 pid=16531 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1562922826.077:50073): avc:  denied  { name_connect } for  pid=16531 comm="httpd" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
[daniel@my-domain ~]$ 

I am not knowing my way around SELinux all too good, so any help would be appreciated.

0

By default with SELinux httpd isn't allowed to speak out on lots of ports.

Set the boolean httpd_can_network_connect

setsebool -P httpd_can_network_connect 1

This should allow the connection out.

  • Thanks, that did the trick! – Daniel Jul 12 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.