Bug 1323333 - PHP-FPM not allowed to do slow logging
Summary: PHP-FPM not allowed to do slow logging
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.7
Hardware: Unspecified
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-04-01 22:40 UTC by Renich Bon Ciric
Modified: 2018-09-20 18:02 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-11-02 17:27:23 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Renich Bon Ciric 2016-04-01 22:40:38 UTC
Description of problem:
When you enable slow logs in PHP-FPM, you get a ton of errors regarding ptrace. 

Version-Release number of selected component (if applicable):
3.7.19-279

How reproducible:
Junst enable slowlogs in /etc/php-fpm.d/www.conf

slowlog = /var/log/php-fpm/www-slow.log
request_slowlog_timeout = 5s

Here's a policy that works for me. I think it should be corrected and included into mainstream. Slow logs are very important and should be allowed. Maybe creating a boolean for this?

module php-fpm-slow_logs 1.0;

require {
    type httpd_t;
    class capability sys_ptrace;
    class process ptrace;
}

#============= httpd_t ==============
allow httpd_t self:capability sys_ptrace;
allow httpd_t self:process ptrace;

Comment 2 Lukas Vrabec 2016-04-18 10:06:54 UTC
I suggest to move this to rhel-6.9. It's quite late for rhel-6.8 fixes.
Also, I have no idea why is this needed for slow-logging. Any ideas whats going on here?

Comment 5 Lukas Vrabec 2016-11-02 17:27:23 UTC
Red Hat Enterprise Linux version 6 is entering the Production 2 phase of its
lifetime and this bug doesn't meet the criteria for it, i.e. only high severity
issues will be fixed. Please see
https://access.redhat.com/support/policy/updates/errata/ for further
information.

Feel free to clone this bug to RHEL-7 if it is still a problem for you.


Note You need to log in before you can comment on or make changes to this bug.