Bug 1045041

Summary:	Support for nginx (runs as initrc_t)
Product:	Red Hat Enterprise Linux 6	Reporter:	Gerwin Krist <gerwinkrist>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.6	CC:	dwalsh, lvrabec, mmalik, optak
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.7.19-245.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-14 07:58:56 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	832330, 1052935, 1074615, 1088912

Description Gerwin Krist 2013-12-19 14:03:05 UTC

Description of problem:
We are using Nginx quiet a lot, in combination with php-fpm (which runs oke with selinux). But in EL 6 nginx runs in the initrc_t domain. Dan told me that EL7 has proper support for nginx. 

Can it be supported to EL 6.6 too?

Comment 1 Miroslav Grepl 2014-01-07 07:45:28 UTC

(In reply to Gerwin Krist from comment #0)
> Description of problem:
> We are using Nginx quiet a lot, in combination with php-fpm (which runs oke
> with selinux). But in EL 6 nginx runs in the initrc_t domain. Dan told me
> that EL7 has proper support for nginx. 
> 
> Can it be supported to EL 6.6 too?

Yes, we have

apache.fc:/etc/nginx(/.*)?         gen_context(system_u:object_r:httpd_config_t,s0)
apache.fc:/usr/lib/systemd/system/nginx.*     --  gen_context(system_u:object_r:httpd_unit_file_t,s0)
apache.fc:/usr/sbin/nginx         --  gen_context(system_u:object_r:httpd_exec_t,s0)
apache.fc:/var/lib/nginx(/.*)?            gen_context(system_u:object_r:httpd_var_lib_t,s0)
apache.fc:/var/log/nginx(/.*)?     gen_context(system_u:object_r:httpd_log_t,s0)
apache.fc:/var/run/nginx.*            gen_context(system_u:object_r:httpd_var_run_t,s0)

Comment 2 Miroslav Grepl 2014-04-17 08:34:53 UTC

There are scratch builds for testing

https://brewweb.devel.redhat.com/taskinfo?taskID=7361115

Comment 3 Ondřej Pták 2014-04-17 12:35:18 UTC

Thank you Miroslav, this build helped me to verify 2 bugs and find one new

Comment 4 Lukas Vrabec 2014-05-02 12:33:10 UTC

commit 43d708fda454aed738da8fe19ab747b94fdb22ad
Author: Miroslav Grepl <mgrepl>
Date:   Thu Apr 17 07:57:39 2014 +0200

    Add support for nginx

Comment 7 Lukas Vrabec 2014-07-01 09:25:09 UTC

all right, patch sent.

Comment 10 Lukas Vrabec 2014-07-16 11:50:06 UTC

patch sent.

commit 0b9787033f1973540dfed566343db569c30cacac
Author: Lukas Vrabec <lvrabec>
Date:   Wed Jul 16 11:29:12 2014 +0200

    Label nginx init script as httpd_initrc_exec_t BZ #1045041

Comment 13 errata-xmlrpc 2014-10-14 07:58:56 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1568.html