Bug 1074716 - SELinux denials during Joomla CMS installation
Summary: SELinux denials during Joomla CMS installation
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 20
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1074714
TreeView+ depends on / blocked
 
Reported: 2014-03-11 00:02 UTC by Dale Macartney
Modified: 2014-03-13 09:16 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2014-03-13 09:16:23 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Dale Macartney 2014-03-11 00:02:24 UTC
Description of problem:
When running through the web based installation of Joomla 3.2, SELinux blocks the final stage of the setup of removing installation directory and saving configuration file. 

Version-Release number of selected component (if applicable):
Joomla 3.2.3 
httpd 2.4.7-3.f20
selinux-policy-3.12.1-122.fc20

How reproducible:
Every time

Steps to Reproduce:
(Steps based on joomla rpm https://bugzilla.redhat.com/show_bug.cgi?id=1074714)
1. yum install joomla
2. service httpd start
3. browse to http://ip/joomla/ and run through setup


Actual results:
Once the setup reaches the last page, it will fail to save configuration.php as well as fail to delete the installation directory

Expected results:
Setup should automatically save configuration.php and the installation directory should successfully be removed when clicking the delete button. 

Additional info:

AVC denials that are present when SELinux is permissive is as follows:

type=AVC msg=audit(1394492490.924:1283): avc:  denied  { write } for  pid=4526 comm="httpd" name="joomla" dev="dm-1" ino=1970901 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
type=AVC msg=audit(1394492530.383:1284): avc:  denied  { add_name } for  pid=4850 comm="httpd" name="configuration.php" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
type=AVC msg=audit(1394492530.383:1284): avc:  denied  { create } for  pid=4850 comm="httpd" name="configuration.php" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
type=AVC msg=audit(1394492530.383:1284): avc:  denied  { write } for  pid=4850 comm="httpd" path="/var/www/joomla/configuration.php" dev="dm-1" ino=1972147 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
type=AVC msg=audit(1394492551.580:1285): avc:  denied  { write } for  pid=4852 comm="httpd" name="configuration.php" dev="dm-1" ino=1972147 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
type=AVC msg=audit(1394492552.681:1286): avc:  denied  { setattr } for  pid=4852 comm="httpd" name="CHANGELOG" dev="dm-1" ino=2102676 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
type=AVC msg=audit(1394492552.682:1287): avc:  denied  { remove_name } for  pid=4852 comm="httpd" name="CHANGELOG" dev="dm-1" ino=2102676 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
type=AVC msg=audit(1394492552.682:1287): avc:  denied  { unlink } for  pid=4852 comm="httpd" name="CHANGELOG" dev="dm-1" ino=2102676 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
type=AVC msg=audit(1394492552.684:1288): avc:  denied  { rmdir } for  pid=4852 comm="httpd" name="application" dev="dm-1" ino=2102685 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir
type=AVC msg=audit(1394492552.756:1289): avc:  denied  { rename } for  pid=4852 comm="httpd" name="robots.txt.dist" dev="dm-1" ino=1971572 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file

Comment 1 Miroslav Grepl 2014-03-12 12:17:43 UTC
Try to execute

# chcon -R -t httpd_sys_rw_content_t /var/www/joomla

to see if everything works correctly.

Comment 2 Miroslav Grepl 2014-03-12 12:39:50 UTC
Also what does

$ rpm -qf /var/www/joomla

i don't see in on my rawhide system.

Comment 3 Dale Macartney 2014-03-12 14:38:57 UTC
(In reply to Miroslav Grepl from comment #1)
> Try to execute
> 
> # chcon -R -t httpd_sys_rw_content_t /var/www/joomla
> 
> to see if everything works correctly.

This works perfectly. No output in audit.log and no restrictions in function. 

By the way, this is not in rawhide as yet as it is still under package review. 

The location has been moved to /usr/share, however the following worked perfectly. 

chcon -R -t httpd_sys_rw_content_t  /usr/share/joomla/

Comment 4 Miroslav Grepl 2014-03-13 09:16:23 UTC
Added.


Note You need to log in before you can comment on or make changes to this bug.