Bug 984212

Description of problem:
I'm attempting to just set up a basic cgi-bin directory in my user's home directory (using python as the scripting language).  I did the following steps:
1) Reconfigured apache to enable homedirs and enable ~/public_html/cgi-bin to be cgi enabled
2) Ran senlinux command to enable homedirs (setsebool -P httpd_enable_homedirs true)
3) Created python script (python.cgi) that just prints out CGI works
#!/usr/bin/python

print "Content-type: text/html"
print ""
print "CGI works"
4) Created perl script (perl.cgi) which does same
#!/usr/bin/python

print "Content-type: text/html"
print ""
print "CGI works"
5) chmoded both scripts to 755
6) Going to http://<my ip>/~gamer/cgi-bin/perl.cgi correctly returns "CGI works" in browser
7) Going to http://<my ip>/~gamer/cgi-bin/python.cgi returns Internal Server Error to browser; SELinux popup indicates python was trying to access /etc/passwd (presumably as part of the suexec process, except unclear why perl is allowed and not python)
8) Following the suggested approach (through audit2allow / semodule), going to http://<myip>/~gamer/cgi-bin/python.cgi does now return the expected text instead of a server error
SELinux is preventing /usr/bin/python2.7 from 'read' accesses on the file /etc/passwd.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that python2.7 should be allowed read access on the passwd file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep generate_voice. /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:httpd_user_script_t:s0
Target Context                system_u:object_r:passwd_file_t:s0
Target Objects                /etc/passwd [ file ]
Source                        generate_voice.
Source Path                   /usr/bin/python2.7
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           python-2.7.3-13.fc18.x86_64
Target RPM Packages           setup-2.8.57-1.fc18.noarch
Policy RPM                    selinux-policy-3.11.1-97.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.9.6-200.fc18.x86_64 #1 SMP Thu
                              Jun 13 18:56:55 UTC 2013 x86_64 x86_64
Alert Count                   4
First Seen                    2013-07-13 12:20:13 EDT
Last Seen                     2013-07-13 12:40:04 EDT
Local ID                      a0c39846-82f0-45af-a53e-518c2e6bed22

Raw Audit Messages
type=AVC msg=audit(1373733604.35:368): avc:  denied  { read } for  pid=2493 comm="python.cgi" name="passwd" dev="dm-2" ino=3148058 scontext=system_u:system_r:httpd_user_script_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file


type=SYSCALL msg=audit(1373733604.35:368): arch=x86_64 syscall=open success=no exit=EACCES a0=7fe97069c6ca a1=80000 a2=1b6 a3=238 items=0 ppid=1944 pid=2493 auid=4294967295 uid=1004 gid=1004 euid=1004 suid=1004 fsuid=1004 egid=1004 sgid=1004 fsgid=1004 ses=4294967295 tty=(none) comm=python.cgi exe=/usr/bin/python2.7 subj=system_u:system_r:httpd_user_script_t:s0 key=(null)

Hash: generate_voice.,httpd_user_script_t,passwd_file_t,file,read

audit2allow

#============= httpd_user_script_t ==============
allow httpd_user_script_t passwd_file_t:file read;

audit2allow -R
require {
	type httpd_user_script_t;
}

#============= httpd_user_script_t ==============
auth_read_passwd(httpd_user_script_t)


Additional info:
reporter:       libreport-2.1.5
hashmarkername: setroubleshoot
kernel:         3.9.6-200.fc18.x86_64
type:           libreport