| Summary: | SELinux prevented httpd (/usr/sbin/httpd) setattr access to myeyes. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | ssabchew <ssabcew> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED NOTABUG | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 13 | CC: | dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:ec471c3a077c31f007185634a89a23deac1b5cfff9ac9ba56d727e1d2aec8356 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-01-24 15:19:04 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
Where is "myeyes" dir located? You need to setup the proper label for this directory. # semanage fcontext -a -t httpd_sys_content_rw_t 'PATHTO/myeyes' # restorecon -R -v PATHTO/myeyes *** Bug 672079 has been marked as a duplicate of this bug. *** *** Bug 672080 has been marked as a duplicate of this bug. *** |
Summary: SELinux prevented httpd (/usr/sbin/httpd) setattr access to myeyes. Detailed Description: [SELinux is in permissive mode. This access was not denied.] SELinux prevented httpd setattr access to myeyes. httpd scripts are not allowed to write to content without explicit labeling of all files. If myeyes is writable content. it needs to be labeled httpd_sys_rw_content_t or if all you need is append you can label it httpd_sys_ra_content_t. Please refer to 'man httpd_selinux' for more information on setting up httpd and selinux. Allowing Access: You can alter the file context by executing chcon -R -t httpd_sys_rw_content_t 'myeyes' You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t httpd_sys_rw_content_t 'myeyes'" Fix Command: chcon -R -t httpd_sys_rw_content_t 'myeyes' Additional Information: Source Context unconfined_u:system_r:httpd_t:s0 Target Context unconfined_u:object_r:httpd_sys_content_t:s0 Target Objects myeyes [ dir ] Source httpd Source Path /usr/sbin/httpd Port <Unknown> Host (removed) Source RPM Packages httpd-2.2.17-1.fc13.1 Target RPM Packages Policy RPM selinux-policy-3.7.19-76.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Plugin Name httpd_write_content Host Name (removed) Platform Linux (removed) 2.6.34.7-66.fc13.x86_64 #1 SMP Wed Dec 15 07:04:30 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Sun 23 Jan 2011 12:32:21 AM EET Last Seen Sun 23 Jan 2011 12:32:21 AM EET Local ID a833d5d7-942b-43d1-95ee-eea0cb9b4d02 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1295735541.459:833): avc: denied { setattr } for pid=22574 comm="httpd" name="myeyes" dev=dm-1 ino=1477206 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=dir node=(removed) type=SYSCALL msg=audit(1295735541.459:833): arch=c000003e syscall=90 success=no exit=-1 a0=7f1c04205f90 a1=1ff a2=2 a3=7f1c04205e60 items=0 ppid=15854 pid=22574 auid=500 uid=48 gid=487 euid=48 suid=48 fsuid=48 egid=487 sgid=487 fsgid=487 tty=(none) ses=1 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null) Hash String generated from httpd_write_content,httpd,httpd_t,httpd_sys_content_t,dir,setattr audit2allow suggests: #============= httpd_t ============== #!!!! This avc can be allowed using the boolean 'httpd_unified' allow httpd_t httpd_sys_content_t:dir setattr;