Description of problem: SELinux is preventing ruby-mri from 'ioctl' accesses on the file /srv/redmine/enginee/app/views/admin/projects.html.erb. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that ruby-mri should be allowed ioctl access on the projects.html.erb file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ruby-mri' --raw | audit2allow -M my-rubymri # semodule -X 300 -i my-rubymri.pp Additional Information: Source Context system_u:system_r:httpd_t:s0 Target Context unconfined_u:object_r:var_t:s0 Target Objects /srv/redmine/enginee/app/views/admin/projects.html .erb [ file ] Source ruby-mri Source Path ruby-mri Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-260.3.fc26.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.11.11-300.fc26.x86_64 #1 SMP Mon Jul 17 16:32:11 UTC 2017 x86_64 x86_64 Alert Count 2188 First Seen 2017-07-15 08:07:27 +03 Last Seen 2017-08-06 03:11:03 +03 Local ID a6598507-8ed9-4a28-810d-26e804b328f5 Raw Audit Messages type=AVC msg=audit(1501978263.199:1193): avc: denied { ioctl } for pid=8625 comm="utils.rb:110" path="/srv/redmine/enginee/app/views/admin/projects.html.erb" dev="dm-1" ino=1759372 ioctlcmd=0x5401 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0 Hash: ruby-mri,httpd_t,var_t,file,ioctl Version-Release number of selected component: selinux-policy-3.13.1-260.3.fc26.noarch Additional info: component: selinux-policy reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.11.11-300.fc26.x86_64 type: libreport
The problem is SELinux does not know what this content is. If you want to allow this content to be used by httpd_t, you need to label it httpd_sys_content_t. # semange fcontext -a -t httpd_sys_content_t '/srv/redmine(/.*)?' # restorecon -R -v /src/redmine These commands will set the default labeling for the redmine directory to be httpd_t content, and it will survive reboots and relabels.