Description of problem: The postgresql-pgpoolAdmin seems to be not working with selinux. Version-Release number of selected component (if applicable): # rpm -q postgresql-pgpoolAdmin postgresql-pgpoolAdmin-3.1.1-5.fc20.noarch How reproducible: Always. Steps to Reproduce: 1. yum install postgresql-pgpoolAdmin 2. firefox http://localhost/pgpoolAdmin 3. (additionally firefox http://localhost/pgpoolAdmin/install/ ) Actual results: Error message. Something like "Smarty.class.php: cannnot create template_c". Expected results: The smarty template is used. Webpage is sent to user. Additional info: Can be fixed by creating directory and setting corresponding selinux context. mkdir /usr/share/postgresql-pgpoolAdmin/templates_c/ chmod uga=rwx /usr/share/postgresql-pgpoolAdmin/templates_c/ (unfortunatelly missing in package it self) chcon -R -t httpd_sys_rw_content_t /usr/share/postgresql-pgpoolAdmin/templates_c/ Additionally, the /etc/postgrsql-pgpoolAdmin/* files are modified by http://localhost/pgpoolAdmin/install/. The problem could be solved by modification of configuration file by hand. Additionally, the package seems to have some other problems, which may cause tool is not working.
Why would this tool be writing to a /usr/ directory? /usr should be treated as Read/Only.
Thanks Daniel for explanation. I have updated postgresql-pgpoolAdmin package to use /var/run/ as a read/write folder. I think the selinux policy for this package still needs to be updated. The pgpoolAdmin is running via httpd and it calling php function exec('pcp_node_count'), etc. . I think it is using network socket 9898 to read data from pgpool. Additionally, it may use also 5432 to read data directly from postgresql. Here is attached short part of /var/log/audit/audit.log related to the problem. type=AVC msg=audit(1420634129.475:134): avc: denied { name_connect } for pid=2912 comm="pcp_node_count" dest=9898 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 type=AVC msg=audit(1420634130.434:136): avc: denied { name_connect } for pid=2917 comm="pcp_node_info" dest=9898 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 Actual results: $ setenforce 1 $ firefox http://localhost/pgpoolAdmin/status.php Error Code e1002 Error Message pcp_node_count command error occurred. Expected results: $ setenforce 1 $ firefox http://localhost/pgpoolAdmin/status.php node 0 localhost 5432 Up. Connected. Please let me know if I can provide some additional information. Please tell me also if is the problem somewhere in package and give me a hint how to fix it.
Port 9898 looks like posgresql uses this port for You could turn on the httpd_can_network_connect boolean to allow this. setsebool -P httpd_can_network_connect 1 2ea1c5d40462afa14841640f00b219803d19bc81 defines this port as a postgresql port. You could define this your self # semanage port -a -t posgresql_port_t -p tcp 9898 Then you would turn on the httpd_can_network_connect_db boolean, which would tighten up the security.
This bug appears to have been reported against 'rawhide' during the Fedora 22 development cycle. Changing version to '22'. More information and reason for this action is here: https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora22
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.