Fedora Account System
Red Hat Associate
Red Hat Customer
Additional info: hashmarkername: setroubleshoot kernel: 3.6.7-5.fc18.i686.PAE type: libreport
Created attachment 655424 [details] File: description
I am run sudo setsebool -P httpd_enable_homedirs 1 but php-fpm still cannot write to home directory :( this php code if(($handler = fopen($program_dir.'/logs/'.$user.'-'.$fname, "a")) !== false)
setsebool -P httpd_enable_homedirs 1 Only allows httpd_t to traverse "~", if you use this you will still need to label the content that phpfpm is trying to manage with types that phpfpm can manage. I will give you an example Lets assume you have a webapp here: ~/public_html/webapp You have a log content for the webaop here: ~/public_html/webapp/logs you set the boolean httpd_enable_homedirs and you make sure that apache or httpd user can traverse "~" from a traditional Linux securit perspective (something like for example chmod o+x /home/Mikhail The ~/public_html should automatically have been labeled with type httpd_user_content_t and phpfpm can read that content. But phpfpm opens the log file in ~/public_html/webapp/logs for append and phpfpm is not allowed to append to files labeled with type httpd_user_content_t So you will need to use the chcon command to label the logs directory and its content that phpfpm can append to. type httpd_user_content_ra_t should allow this: chcon -R -t httpd_user_content_ra_t ~/public_html/webapp/logs else type httpd_user_content_rw_t will (its a bit broader) By labeling the various content according to their properties you ensure optimal integrity of your webapp content.
chcon not solve this problem. What is wrong here? $ sudo chcon -R -t -v httpd_user_content_ra_t ~/www/bes/logs chcon: cannot access ‘httpd_user_content_ra_t’: No such file or directory chcon: failed to change context of ‘readme’ to ‘unconfined_u:object_r:-v:s0’: Invalid argument chcon: failed to change context of ‘/home/mikhail/www/bes/logs’ to ‘unconfined_u:object_r:-v:s0’: Invalid argument
[mikhail@localhost ~]$ sudo chcon -Rvt httpd_user_content_ra_t ~/www/bes/logs changing security context of ‘/home/mikhail/www/bes/logs/readme’ changing security context of ‘/home/mikhail/www/bes/logs’ [mikhail@localhost ~]$ ls -laZ ~/w winetricks www/ [mikhail@localhost ~]$ ls -laZ ~/www/bes/logs/ drwxrwx---. mikhail mikhail unconfined_u:object_r:httpd_user_ra_content_t:s0 . drwxrwx---. mikhail mikhail unconfined_u:object_r:httpd_user_ra_content_t:s0 .. -rwxrwx---. mikhail mikhail unconfined_u:object_r:httpd_user_ra_content_t:s0 readme
No need to use sudo for this. Is it working now?
no, still occurs SELinux alert
can you show the current avc denial?
type=AVC msg=audit(1354458193.470:38976): avc: denied { create } for pid=6597 comm="php-fpm" name="m_gavrilov-sql.log" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_user_ra_content_t:s0 tclass=file type=SYSCALL msg=audit(1354458193.470:38976): arch=40000003 syscall=5 success=no exit=-13 a0=9c09364 a1=441 a2=1b6 a3=0 items=0 ppid=6592 pid=6597 auid=4294967295 uid=991 gid=988 euid=991 suid=991 fsuid=991 egid=988 sgid=988 fsgid=988 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1354458193.471:38977): avc: denied { create } for pid=6597 comm="php-fpm" name="m_gavrilov-sql.log" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_user_ra_content_t:s0 tclass=file type=SYSCALL msg=audit(1354458193.471:38977): arch=40000003 syscall=5 success=no exit=-13 a0=9c0919c a1=441 a2=1b6 a3=0 items=0 ppid=6592 pid=6597 auid=4294967295 uid=991 gid=988 euid=991 suid=991 fsuid=991 egid=988 sgid=988 fsgid=988 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1354458193.471:38978): avc: denied { create } for pid=6597 comm="php-fpm" name="m_gavrilov-sql.log" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_user_ra_content_t:s0 tclass=file type=SYSCALL msg=audit(1354458193.471:38978): arch=40000003 syscall=5 success=no exit=-13 a0=9c0919c a1=441 a2=1b6 a3=0 items=0 ppid=6592 pid=6597 auid=4294967295 uid=991 gid=988 euid=991 suid=991 fsuid=991 egid=988 sgid=988 fsgid=988 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1354458193.472:38979): avc: denied { create } for pid=6597 comm="php-fpm" name="m_gavrilov-sql.log" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_user_ra_content_t:s0 tclass=file type=SYSCALL msg=audit(1354458193.472:38979): arch=40000003 syscall=5 success=no exit=-13 a0=9c092ac a1=441 a2=1b6 a3=0 items=0 ppid=6592 pid=6597 auid=4294967295 uid=991 gid=988 euid=991 suid=991 fsuid=991 egid=988 sgid=988 fsgid=988 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1354458193.479:38980): avc: denied { create } for pid=6597 comm="php-fpm" name="m_gavrilov-sql.log" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_user_ra_content_t:s0 tclass=file type=SYSCALL msg=audit(1354458193.479:38980): arch=40000003 syscall=5 success=no exit=-13 a0=9c0c0dc a1=441 a2=1b6 a3=0 items=0 ppid=6592 pid=6597 auid=4294967295 uid=991 gid=988 euid=991 suid=991 fsuid=991 egid=988 sgid=988 fsgid=988 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1354458193.490:38981): avc: denied { create } for pid=6597 comm="php-fpm" name="m_gavrilov-sql.log" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_user_ra_content_t:s0 tclass=file type=SYSCALL msg=audit(1354458193.490:38981): arch=40000003 syscall=5 success=no exit=-13 a0=9c2a158 a1=441 a2=1b6 a3=0 items=0 ppid=6592 pid=6597 auid=4294967295 uid=991 gid=988 euid=991 suid=991 fsuid=991 egid=988 sgid=988 fsgid=988 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
ok try httpd_user_content_rw_t instead (this is a bug)
httpd_t should be able to create httpd_user_content_ra_t files create read setattr and append to be more precise The httpd_user and sys_content_ra_t is a file type that can be used for logging. The only difference with httpd_user_content_rw_t should be that httpd_t cannot write to httpd_user_content_ra_t files
(In reply to comment #10) > ok try httpd_user_content_rw_t instead (this is a bug) Thanks, it help. And now my web application is work.
Dominick you want to add create_files_pattern(httpd_$1_script_t, httpd_$1_ra_content_t, httpd_$1_ra_content_t) to apache_content_type()
You mean apache_content_template() Yes, refpolicy already has this so this should trickle down with the next merge. Feel free to add it to Fedora now if you want to. I currently have some computer issues that prevent me to do that currently.
Fixed in selinux-policy-3.11.1-61.fc18.noarch
selinux-policy-3.11.1-62.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-62.fc18
Package selinux-policy-3.11.1-62.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-62.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-20203/selinux-policy-3.11.1-62.fc18 then log in and leave karma (feedback).
selinux-policy-3.11.1-66.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-66.fc18
selinux-policy-3.11.1-66.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.