Description of problem: The default socket location in /run/fcgiwrap.sock is not writable by the Apache or Nginx servers because of the SELinux policy. # ls -laZ /run/fcgiwrap.sock srw-rw----. 1 nginx nginx system_u:object_r:var_run_t:s0 0 dic 2 11:40 /run/fcgiwrap.sock AVC avc: denied { write } for pid=16137 comm="nginx" name="fcgiwrap.sock" dev="tmpfs" ino=5404007 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0 Version-Release number of selected component (if applicable): fcgiwrap-1.1.0-7.20181108git99c942c.fc29.x86_64
Thank you for reporting this. It's good to know someone besides myself is using this package. Strange, I am not seeing this on my system. The web application I am using works well with fcgiwrap and nginx. I see no avc denials with the sock file. I am far from an expert on selinux though so let me ask you, how might you expect this to be solved? I notice the fcgiwrap package you've got in Copr suggests one put the sock file under /run/nginx/fcgiwrap.sock. Do you get the same avc denial in this case? Or should I file an selinux bug report to get this resolved? I'll keep digging.
Hi, Thanks for the package, I still use it for gitweb. I'm currently putting the socket in /var/run/nginx so it's covered by the SELinux policy and is created with the httpd_var_run_t label. These are the locations with that label: # semanage fcontext -l | grep httpd_var_run_t /opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)? all files system_u:object_r:httpd_var_run_t:s0 /var/lib/php/session(/.*)? all files system_u:object_r:httpd_var_run_t:s0 /var/lib/php/wsdlcache(/.*)? all files system_u:object_r:httpd_var_run_t:s0 /var/opt/rh/rh-nginx18/run/nginx(/.*)? all files system_u:object_r:httpd_var_run_t:s0 /var/run/apache.* all files system_u:object_r:httpd_var_run_t:s0 /var/run/cherokee\.pid regular file system_u:object_r:httpd_var_run_t:s0 /var/run/dirsrv/admin-serv.* all files system_u:object_r:httpd_var_run_t:s0 /var/run/gcache_port socket system_u:object_r:httpd_var_run_t:s0 /var/run/httpd.* all files system_u:object_r:httpd_var_run_t:s0 /var/run/lighttpd(/.*)? all files system_u:object_r:httpd_var_run_t:s0 /var/run/mod_.* all files system_u:object_r:httpd_var_run_t:s0 /var/run/nginx.* all files system_u:object_r:httpd_var_run_t:s0 /var/run/php-fpm(/.*)? all files system_u:object_r:httpd_var_run_t:s0 /var/run/thttpd\.pid regular file system_u:object_r:httpd_var_run_t:s0 /var/run/wsgi.* socket system_u:object_r:httpd_var_run_t:s0 /var/www/openshift/broker/httpd/run(/.*)? all files system_u:object_r:httpd_var_run_t:s0 /var/www/openshift/console/httpd/run(/.*)? all files system_u:object_r:httpd_var_run_t:s0 Maybe a good solution can be to create a directory /var/run/fcgiwrap and make it labeled as httpd_var_run_t. I don't know if it's enough to do in the package: # semanage fcontext -a -t httpd_var_run_t '/var/run/fcgiwrap(/.*)?' or the main SELinux policy package has to include this change. With the directory in place, I'd create the socket with %i, to be able to have several instances: ListenStream=/run/fcgiwrap/fcgiwrap-%i.sock
Good idea. I've patched my local service file according to your suggestion and created a bug report against selinux-policy: https://bugzilla.redhat.com/show_bug.cgi?id=1655702 I will push out a new package shortly, with the following changes: 1) Updated fcgiwrap@.socket --------------------------- [Unit] Description=fcgiwrap Socket [Socket] ListenStream=/var/run/fcgiwrap/fcgiwrap-%i.sock SocketUser=%i SocketMode=0660 RuntimeDirectory=fcgiwrap [Install] WantedBy=sockets.target 2) Add README.SELinux that instructs the end user to modify their local policy while we wait for this change to be approved and trickle down: # semanage fcontext -a -t httpd_var_run_t '/var/run/fcgiwrap(/.*)?'
fcgiwrap-1.1.0-8.20181108git99c942c.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-033cf7d73e
fcgiwrap-1.1.0-8.20181108git99c942c.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-f1d6058782
fcgiwrap-1.1.0-8.20181108git99c942c.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-2313a25f7d
fcgiwrap-1.1.0-8.20181108git99c942c.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-f1d6058782
fcgiwrap-1.1.0-8.20181108git99c942c.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-033cf7d73e
fcgiwrap-1.1.0-8.20181108git99c942c.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-2313a25f7d
fcgiwrap-1.1.0-8.20181108git99c942c.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
fcgiwrap-1.1.0-8.20181108git99c942c.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
Found and fixed a typo in the socket file. New packages are in testing.
fcgiwrap-1.1.0-9.20181108git99c942c.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-d425be3696
fcgiwrap-1.1.0-9.20181108git99c942c.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-5bcdf4082e
fcgiwrap-1.1.0-9.20181108git99c942c.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-234ddd69fa
fcgiwrap-1.1.0-9.20181108git99c942c.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.
fcgiwrap-1.1.0-9.20181108git99c942c.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
fcgiwrap-1.1.0-9.20181108git99c942c.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.