Bug 818563

Description of problem:
In the default installation, Apache can't execute the CGI scripts of lightsquid

Version-Release number of selected component (if applicable):
lightsquid-1.8-11.fc15.noarch
lightsquid-apache-1.8-11.fc15.noarch
selinux-policy-targeted-3.10.0-84.fc16.noarch

How reproducible:
Try to access to http://yourserver/lightsquid and see the error_log and the selinux alerts

Steps to Reproduce:
1. yum install lightsquid lightsquid-apache
2. systemctl restart httpd.service
3. Go to http://localhost/lightsquid
  
Actual results:
500 Internal error and SELinux informing about blocking execution

Expected results:
Executing the CGI

Additional info:
I think all the files in /usr/share/lightsquid/cgi should be labeled as httpd_sys_script_exec_t

This is the SELinux alert:

SELinux is preventing /usr/sbin/httpd from execute access on the file index.cgi.

*****  Plugin catchall_labels (83.8 confidence) suggests  ********************

If you want to allow httpd to have execute access on the index.cgi file
Then you need to change the label on index.cgi
Do
# semanage fcontext -a -t FILE_TYPE 'index.cgi'
where FILE_TYPE is one of the following: mailman_cgi_exec_t, abrt_retrace_worker_exec_t, dirsrvadmin_unconfined_script_exec_t, bin_t, lib_t, httpd_unconfined_script_exec_t, httpd_rotatelogs_exec_t, passenger_exec_t, httpd_exec_t, shell_exec_t, httpd_helper_exec_t, lib_t, ld_so_t, abrt_helper_exec_t, httpd_php_exec_t, httpd_passwd_exec_t, textrel_shlib_t, httpd_modules_t, chroot_exec_t, httpd_suexec_exec_t, application_exec_type, httpd_collectd_script_exec_t, httpd_apcupsd_cgi_script_exec_t, httpd_awstats_script_exec_t, httpd_squid_script_exec_t, httpd_nagios_script_exec_t, httpd_bugzilla_script_exec_t, httpd_prewikka_script_exec_t, httpd_dirsrvadmin_script_exec_t, httpd_sys_script_exec_t, httpd_git_script_exec_t, httpd_mojomojo_script_exec_t, httpd_cvs_script_exec_t, httpd_nutups_cgi_script_exec_t, httpd_cobbler_script_exec_t, httpd_mediawiki_script_exec_t, httpd_smokeping_cgi_script_exec_t, httpd_dspam_script_exec_t, httpd_munin_script_exec_t, httpd_w3c_validator_script_exec_t, httpd_user_script_exec_t.
Then execute:
restorecon -v 'index.cgi'


*****  Plugin catchall (17.1 confidence) suggests  ***************************

If you believe that httpd should be allowed execute access on the index.cgi file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep httpd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:usr_t:s0
Target Objects                index.cgi [ file ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          <Unknown>
Host                          xenon.local
Source RPM Packages           httpd-2.2.22-2.fc16.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.10.0-84.fc16.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     xenon.local
Platform                      Linux xenon.local 3.3.2-6.fc16.x86_64 #1 SMP Sat
                              Apr 21 12:43:20 UTC 2012 x86_64 x86_64
Alert Count                   5
First Seen                    Thu 03 May 2012 12:41:38 PM CEST
Last Seen                     Thu 03 May 2012 01:20:08 PM CEST
Local ID                      748cf0cb-bd54-4a9f-ba4f-5bd2cfabc997

Raw Audit Messages
type=AVC msg=audit(1336044008.152:619): avc:  denied  { execute } for  pid=10392 comm="httpd" name="index.cgi" dev="sda3" ino=1464103 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file


type=SYSCALL msg=audit(1336044008.152:619): arch=x86_64 syscall=execve success=no exit=EACCES a0=7f403eb925a8 a1=7f403eb94088 a2=7f403eb940a0 a3=7fff97e89b30 items=0 ppid=10339 pid=10392 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)

Hash: httpd,httpd_t,usr_t,file,execute

audit2allow

#============= httpd_t ==============
allow httpd_t usr_t:file execute;

audit2allow -R

#============= httpd_t ==============
allow httpd_t usr_t:file execute;