Bug 672079

Summary:

SELinux prevented httpd (/usr/sbin/httpd) rename access to app.eyecode.

Detailed Description:

[SELinux is in permissive mode. This access was not denied.]

SELinux prevented httpd rename access to app.eyecode. httpd scripts are not
allowed to write to content without explicit labeling of all files. If
app.eyecode is writable content. it needs to be labeled httpd_sys_rw_content_t
or if all you need is append you can label it httpd_sys_ra_content_t. Please
refer to 'man httpd_selinux' for more information on setting up httpd and
selinux.

Allowing Access:

You can alter the file context by executing chcon -R -t httpd_sys_rw_content_t
'app.eyecode' You must also change the default file context files on the system
in order to preserve them even on a full relabel. "semanage fcontext -a -t
httpd_sys_rw_content_t 'app.eyecode'"

Fix Command:

chcon -R -t httpd_sys_rw_content_t 'app.eyecode'

Additional Information:

Source Context                unconfined_u:system_r:httpd_t:s0
Target Context                unconfined_u:object_r:httpd_sys_content_t:s0
Target Objects                app.eyecode [ file ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           httpd-2.2.17-1.fc13.1
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-76.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Plugin Name                   httpd_write_content
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.34.7-66.fc13.x86_64 #1 SMP Wed Dec 15 07:04:30
                              UTC 2010 x86_64 x86_64
Alert Count                   1
First Seen                    Sun 23 Jan 2011 12:40:08 AM EET
Last Seen                     Sun 23 Jan 2011 12:40:08 AM EET
Local ID                      bacfaf8d-a9cc-4a7b-a96d-b3c6de3037b4
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1295736008.671:862): avc:  denied  { rename } for  pid=23898 comm="httpd" name="app.eyecode" dev=dm-1 ino=1737511 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1295736008.671:862): arch=c000003e syscall=82 success=yes exit=0 a0=7f1c04729c40 a1=7f1c047f8da8 a2=3 a3=7f1c0448dcf8 items=0 ppid=15854 pid=23898 auid=500 uid=48 gid=487 euid=48 suid=48 fsuid=48 egid=487 sgid=487 fsgid=487 tty=(none) ses=1 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)



Hash String generated from  httpd_write_content,httpd,httpd_t,httpd_sys_content_t,file,rename
audit2allow suggests:

#============= httpd_t ==============
#!!!! This avc can be allowed using the boolean 'httpd_unified'

allow httpd_t httpd_sys_content_t:file rename;