Description of problem: Steps to reproduce: 1) dnf install fcgiwrap nginx 2) systemctl start fcgiwrap@nginx 3) systemctl start nginx 3) use a web application such as zoneminder, gitweb, or another that uses fcgiwrap See bz 1655281 for discussion, including the proposed, comprensive solution: https://bugzilla.redhat.com/show_bug.cgi?id=1655281 SELinux is preventing nginx from 'write' accesses on the sock_file fcgiwrap-nginx.sock. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that nginx should be allowed write access on the fcgiwrap-nginx.sock sock_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'nginx' --raw | audit2allow -M my-nginx # semodule -X 300 -i my-nginx.pp Additional Information: Source Context system_u:system_r:httpd_t:s0 Target Context system_u:object_r:var_run_t:s0 Target Objects fcgiwrap-nginx.sock [ sock_file ] Source nginx Source Path nginx Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.14.2-42.fc29.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 4.19.5-300.fc29.x86_64 #1 SMP Tue Nov 27 19:29:23 UTC 2018 x86_64 x86_64 Alert Count 4 First Seen 2018-12-03 10:13:16 CST Last Seen 2018-12-03 11:54:06 CST Local ID 7bd9a497-f146-4fd6-a18f-1e44e87d116f Raw Audit Messages type=AVC msg=audit(1543859646.587:244): avc: denied { write } for pid=2181 comm="nginx" name="fcgiwrap-nginx.sock" dev="tmpfs" ino=18337 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=1 Hash: nginx,httpd_t,var_run_t,sock_file,write Version-Release number of selected component: selinux-policy-3.14.2-42.fc29.noarch Additional info: component: selinux-policy reporter: libreport-2.9.6 hashmarkername: setroubleshoot kernel: 4.19.5-300.fc29.x86_64 type: libreport Potential duplicate: bug 967764
Hi, Where is this socket locate on the system? "fcgiwrap-nginx.sock" THanks, Lukas.
The fcgiwrap package uses instantiated unit files to set file names & permissions that follow the web server user account. Consequently, the filename of the socket file is not static. It has the format fcgiwrap-%i.sock where %i is nginx, httpd, or with whatever user account name the sys admin calls the service. Doing this allows the sys admin to run multiple instances of fcgiwrap, each with different socket files, if such a need arises. The latest fcgiwrap, which is just now coming out of testing, places the socket file(s) into the /var/run/fcgiwrap/ folder. That's a little more than what you asked, but I through it would help to understand the whole picture. Let me know if you have any more questions.
commit 12a725d677bb646bb69d08899a3a47c04957e318 (HEAD -> rawhide) Author: Lukas Vrabec <lvrabec> Date: Mon Jan 21 14:25:36 2019 +0100 Label /var/run/fcgiwrap dir as httpd_var_run_t BZ(1655702) This should fix the issue for future releases. Directory /var/run/fcgiwrap will be labeled as httpd_var_run_t and socket in this dir will inherits the label. Allow rules for this action are already defined in policy: # sesearch -A -s httpd_t -t httpd_var_run_t -c sock_file allow domain pidfile:sock_file { append getattr open write }; allow httpd_t httpd_var_run_t:sock_file { append create getattr ioctl link lock open read rename setattr unlink write };
selinux-policy-3.14.2-49.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-7c13db036c
selinux-policy-3.14.2-49.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-7c13db036c
selinux-policy-3.14.2-49.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.