Bug 1701318 - Selinux kills apache
Summary: Selinux kills apache
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 31
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Ben Levenson
Depends On:
TreeView+ depends on / blocked
Reported: 2019-04-18 15:26 UTC by Nicolas Mailhot
Modified: 2020-03-27 09:20 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2020-03-27 09:20:21 UTC
Type: Bug

Attachments (Terms of Use)

Description Nicolas Mailhot 2019-04-18 15:26:44 UTC
SELinux is preventing httpd from map access on the chr_file /dev/zero.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that httpd should be allowed map access on the zero chr_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# ausearch -c 'httpd' --raw | audit2allow -M my-httpd
# semodule -X 300 -i my-httpd.pp

Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:zero_device_t:s0
Target Objects                /dev/zero [ chr_file ]
Source                        httpd
Source Path                   httpd
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.14.4-11.fc31.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     
Platform                      Linux 
                              5.1.0-0.rc4.git1.1.fc31.x86_64 #1 SMP Tue Apr 9
                              15:31:39 UTC 2019 x86_64 x86_64
Alert Count                   3
First Seen                    2019-04-18 17:14:40 CEST
Last Seen                     2019-04-18 17:18:03 CEST
Local ID                      f5f06307-68b5-4068-9087-45dae2eb6a95

Comment 1 Ben Cotton 2019-08-13 17:13:09 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to '31'.

Comment 2 Ben Cotton 2019-08-13 19:27:08 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to 31.

Comment 3 Fedora Update System 2019-10-04 13:35:19 UTC
FEDORA-2019-64732fd6a5 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-64732fd6a5

Comment 4 Fedora Update System 2019-10-04 22:51:02 UTC
selinux-policy-3.14.4-36.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-64732fd6a5

Note You need to log in before you can comment on or make changes to this bug.