Bug 671197 - SELinux is preventing /usr/sbin/httpd from 'getattr' accesses on the directory /var/www/html/s-test.
Summary: SELinux is preventing /usr/sbin/httpd from 'getattr' accesses on the director...
Keywords:
Status: CLOSED DUPLICATE of bug 652297
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: i386
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:c0816d79130...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-01-20 18:11 UTC by Yukio Adamczyk
Modified: 2011-01-24 16:07 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-01-20 20:28:40 UTC
Type: ---


Attachments (Terms of Use)

Description Yukio Adamczyk 2011-01-20 18:11:55 UTC
SELinux is preventing /usr/sbin/httpd from 'getattr' accesses on the directory /var/www/html/s-test.

*****  Plugin restorecon (99.5 confidence) suggests  *************************

If you want to fix the label. 
/var/www/html/s-test default label should be httpd_sys_content_t.
Then restorecon を実行することができます。
Do
# /sbin/restorecon -v /var/www/html/s-test

*****  Plugin catchall (1.49 confidence) suggests  ***************************

If httpd に、 s-test directory の getattr アクセスがデフォルトで許可されるべきです。   
Then これをバグをして報告すべきです。 
このアクセスを許可するために、ローカルポリシーモジュールを生成することができます。
Do
allow this access for now by executing:
# grep httpd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:httpd_t:s0
Target Context                unconfined_u:object_r:execmem_exec_t:s0
Target Objects                /var/www/html/s-test [ dir ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          <不明>
Host                          (removed)
Source RPM Packages           httpd-2.2.17-1.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-20.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.10-74.fc14.i686
                              #1 SMP Thu Dec 23 16:17:40 UTC 2010 i686 i686
Alert Count                   8
First Seen                    2011年01月20日 04時50分40秒
Last Seen                     2011年01月21日 02時46分22秒
Local ID                      0c7d7a1f-ae76-42e7-ba23-ad663e14a8ba

Raw Audit Messages
type=AVC msg=audit(1295545582.883:27602): avc:  denied  { getattr } for  pid=14621 comm="httpd" path="/var/www/html/s-test" dev=dm-0 ino=142837 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:execmem_exec_t:s0 tclass=dir

httpd,httpd_t,execmem_exec_t,dir,getattr
type=SYSCALL msg=audit(1295545582.883:27602): arch=i386 syscall=lstat64 success=no exit=EACCES a0=afa885b0 a1=bffe0690 a2=707ff4 a3=2008171 items=0 ppid=14613 pid=14621 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=1 comm=httpd exe=/usr/sbin/httpd subj=unconfined_u:system_r:httpd_t:s0 key=(null)
httpd,httpd_t,execmem_exec_t,dir,getattr

#============= httpd_t ==============
allow httpd_t execmem_exec_t:dir getattr;

Comment 1 Daniel Walsh 2011-01-20 20:28:40 UTC
The alert tells you what to do.

 /sbin/restorecon -v /var/www/html/s-test

Why is this file labeled execmem_exec_t?

Comment 2 Yukio Adamczyk 2011-01-22 17:50:01 UTC
(In reply to comment #1)
> The alert tells you what to do.
> 
>  /sbin/restorecon -v /var/www/html/s-test
> 
> Why is this file labeled execmem_exec_t?

I made this directory for a test of access restriction.
Here is a source of .htaccess
--------------------------------------------------
AuthUserFile /var/www/html/s-test/.htpasswd
AuthGroupFile /dev/null
AuthName "Please enter your UserName and password"
AuthType Basic
require valid-user
--------------------------------------------------

When trying to access this directory, an error was notified of from selinux.
The source process: /usr/sbin/httpd
Attemped this access: exexstack
On this process: Unknown

Then I tried the command :
# chcon -t execmem_exec_t /var/www/html/s-test

When trying to access /var/www/html/s-test, this bug occurred. 8-(
I thought it was also settled in execmem_exec_t stupidly. :-(

Next, I tried the command :
# /sbin/restorecon -v /var/www/html/s-test
# setsebool -P httpd_execmem 1

Everything is no problem now. :-)

Comment 3 Daniel Walsh 2011-01-24 16:07:40 UTC
Take a look at the allow_execstack bug.  It tells you how to look for the library causing this problem.

*** This bug has been marked as a duplicate of bug 652297 ***


Note You need to log in before you can comment on or make changes to this bug.