Bug 1323333

Summary: PHP-FPM not allowed to do slow logging
Product: Red Hat Enterprise Linux 6 Reporter: Renich Bon Ciric <renich>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED WONTFIX QA Contact: Milos Malik <mmalik>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.7CC: dwalsh, lvrabec, mgrepl, mmalik, plautrba, pvrabec, renich, ssekidde
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-02 17:27:23 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Renich Bon Ciric 2016-04-01 22:40:38 UTC
Description of problem:
When you enable slow logs in PHP-FPM, you get a ton of errors regarding ptrace. 

Version-Release number of selected component (if applicable):
3.7.19-279

How reproducible:
Junst enable slowlogs in /etc/php-fpm.d/www.conf

slowlog = /var/log/php-fpm/www-slow.log
request_slowlog_timeout = 5s

Here's a policy that works for me. I think it should be corrected and included into mainstream. Slow logs are very important and should be allowed. Maybe creating a boolean for this?

module php-fpm-slow_logs 1.0;

require {
    type httpd_t;
    class capability sys_ptrace;
    class process ptrace;
}

#============= httpd_t ==============
allow httpd_t self:capability sys_ptrace;
allow httpd_t self:process ptrace;

Comment 2 Lukas Vrabec 2016-04-18 10:06:54 UTC
I suggest to move this to rhel-6.9. It's quite late for rhel-6.8 fixes.
Also, I have no idea why is this needed for slow-logging. Any ideas whats going on here?

Comment 5 Lukas Vrabec 2016-11-02 17:27:23 UTC
Red Hat Enterprise Linux version 6 is entering the Production 2 phase of its
lifetime and this bug doesn't meet the criteria for it, i.e. only high severity
issues will be fixed. Please see
https://access.redhat.com/support/policy/updates/errata/ for further
information.

Feel free to clone this bug to RHEL-7 if it is still a problem for you.