Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
If glusterfs-fuse mount is used for the web-site content directory, the httpd process is prevented from accessing the content by SELinux.
Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.7.19-155.el6_3.14
How reproducible:
Always reproducible
Steps to Reproduce:
1.set up an RHS server to provide a gluster volume with the web content
2.mount the gluster volume on a web server system, using glusterfs-fuse mount, at the Document Root of the web site, and try to start the httpd service.
------------------------------------------------------------------
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.3 (Santiago)
# rpm -qa | grep -i selinux
selinux-policy-3.7.19-155.el6_3.14.noarch
selinux-policy-targeted-3.7.19-155.el6_3.14.noarch
libselinux-utils-2.0.94-5.3.el6.x86_64
libselinux-2.0.94-5.3.el6.x86_64
# sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 24
Policy from config file: targeted
# rpm -qa | grep -i gluster
glusterfs-3.3.0.5rhs-41.el6rhs.x86_64
glusterfs-fuse-3.3.0.5rhs-41.el6rhs.x86_64
# mount -t glusterfs RHSvm1:/AppStore /var/www/html/
# df -Th /var/www/html/
Filesystem Type Size Used Avail Use% Mounted on
RHSvm1:/AppStore
fuse.glusterfs 1.2T 799M 1.2T 1% /var/www/html
# ls -dZ /var/www/html/
drwxr-xr-x. root root system_u:object_r:fusefs_t:s0 /var/www/html/
# service httpd start
Starting httpd: Syntax error on line 292 of /etc/httpd/conf/httpd.conf:
DocumentRoot must be a directory
[FAILED]
------------------------------------------------------------------
3.on trying to start the httpd service, it fails with the following messages in audit.log
------------------------------------------------------------------
type=AVC msg=audit(1360920366.461:910): avc: denied { getattr } for pid=4483 comm="httpd" path="/var/www/html" dev=fuse ino=1 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=dir
type=SYSCALL msg=audit(1360920366.461:910): arch=c000003e syscall=4 success=no exit=-13 a0=7f2459b9b278 a1=7fff958bd4d0 a2=7fff958bd4d0 a3=7f24571e4d90 items=0 ppid=4482 pid=4483 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=123 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
------------------------------------------------------------------
4. unmount the gluster volume, and try to remount it with mount option ' context=system_u:object_r:httpd_sys_content_t:s0'. The mount option is ignored, and the same errors occur as above when starting the httpd service.
------------------------------------------------------------------
# ls -dZ /var/www/
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/
# mount -t glusterfs -o context='system_u:object_r:httpd_sys_content_t:s0' RHSvm1:/AppStore /var/www/html/
unknown option context (ignored)
# ls -dZ /var/www/html/
drwxr-xr-x. root root system_u:object_r:fusefs_t:s0 /var/www/html/
# service httpd start
Starting httpd: Syntax error on line 292 of /etc/httpd/conf/httpd.conf:
DocumentRoot must be a directory
[FAILED]
------------------------------------------------------------------
5. unmount the gluster volume, and mount it again using glusterfs-fuse mount on a Document Root subdirectory. The httpd service can be started up now, but any access attempts to the web content stored in the gluster volume is prevented by SELinux, with the foloowing messages.
------------------------------------------------------------------
type=AVC msg=audit(1360920659.832:917): avc: denied { search } for pid=4549 comm="httpd" name="/" dev=fuse ino=1 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=dir
type=SYSCALL msg=audit(1360920659.832:917): arch=c000003e syscall=4 success=no exit=-13 a0=7f1d0e3c0da8 a1=7fffe8f7d130 a2=7fffe8f7d130 a3=0 items=0 ppid=4544 pid=4549 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=123 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1360920659.836:918): avc: denied { getattr } for pid=4549 comm="httpd" path="/var/www/html/testsite" dev=fuse ino=1 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=dir
type=SYSCALL msg=audit(1360920659.836:918): arch=c000003e syscall=6 success=no exit=-13 a0=7f1d0e3c0ea0 a1=7fffe8f7d130 a2=7fffe8f7d130 a3=1 items=0 ppid=4544 pid=4549 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=123 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
------------------------------------------------------------------
Actual results:
httpd (httpd_t)cannot access web content stored in a gluster volume, mounted using gluster-fuse (fusefs_t) mount method.
Expected results:
httpd should be able to access web content stored in a gluster volume, mounted using gluster-fuse mount method.
Additional info:
If the gluster volume is mounted using nfs, and the 'httpd_use_nfs' boolean is turned on, httpd is able to be started up, and it can access the web content.
Description of problem: If glusterfs-fuse mount is used for the web-site content directory, the httpd process is prevented from accessing the content by SELinux. Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-155.el6_3.14 How reproducible: Always reproducible Steps to Reproduce: 1.set up an RHS server to provide a gluster volume with the web content 2.mount the gluster volume on a web server system, using glusterfs-fuse mount, at the Document Root of the web site, and try to start the httpd service. ------------------------------------------------------------------ # cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.3 (Santiago) # rpm -qa | grep -i selinux selinux-policy-3.7.19-155.el6_3.14.noarch selinux-policy-targeted-3.7.19-155.el6_3.14.noarch libselinux-utils-2.0.94-5.3.el6.x86_64 libselinux-2.0.94-5.3.el6.x86_64 # sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 24 Policy from config file: targeted # rpm -qa | grep -i gluster glusterfs-3.3.0.5rhs-41.el6rhs.x86_64 glusterfs-fuse-3.3.0.5rhs-41.el6rhs.x86_64 # mount -t glusterfs RHSvm1:/AppStore /var/www/html/ # df -Th /var/www/html/ Filesystem Type Size Used Avail Use% Mounted on RHSvm1:/AppStore fuse.glusterfs 1.2T 799M 1.2T 1% /var/www/html # ls -dZ /var/www/html/ drwxr-xr-x. root root system_u:object_r:fusefs_t:s0 /var/www/html/ # service httpd start Starting httpd: Syntax error on line 292 of /etc/httpd/conf/httpd.conf: DocumentRoot must be a directory [FAILED] ------------------------------------------------------------------ 3.on trying to start the httpd service, it fails with the following messages in audit.log ------------------------------------------------------------------ type=AVC msg=audit(1360920366.461:910): avc: denied { getattr } for pid=4483 comm="httpd" path="/var/www/html" dev=fuse ino=1 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=dir type=SYSCALL msg=audit(1360920366.461:910): arch=c000003e syscall=4 success=no exit=-13 a0=7f2459b9b278 a1=7fff958bd4d0 a2=7fff958bd4d0 a3=7f24571e4d90 items=0 ppid=4482 pid=4483 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=123 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null) ------------------------------------------------------------------ 4. unmount the gluster volume, and try to remount it with mount option ' context=system_u:object_r:httpd_sys_content_t:s0'. The mount option is ignored, and the same errors occur as above when starting the httpd service. ------------------------------------------------------------------ # ls -dZ /var/www/ drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/ # mount -t glusterfs -o context='system_u:object_r:httpd_sys_content_t:s0' RHSvm1:/AppStore /var/www/html/ unknown option context (ignored) # ls -dZ /var/www/html/ drwxr-xr-x. root root system_u:object_r:fusefs_t:s0 /var/www/html/ # service httpd start Starting httpd: Syntax error on line 292 of /etc/httpd/conf/httpd.conf: DocumentRoot must be a directory [FAILED] ------------------------------------------------------------------ 5. unmount the gluster volume, and mount it again using glusterfs-fuse mount on a Document Root subdirectory. The httpd service can be started up now, but any access attempts to the web content stored in the gluster volume is prevented by SELinux, with the foloowing messages. ------------------------------------------------------------------ type=AVC msg=audit(1360920659.832:917): avc: denied { search } for pid=4549 comm="httpd" name="/" dev=fuse ino=1 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=dir type=SYSCALL msg=audit(1360920659.832:917): arch=c000003e syscall=4 success=no exit=-13 a0=7f1d0e3c0da8 a1=7fffe8f7d130 a2=7fffe8f7d130 a3=0 items=0 ppid=4544 pid=4549 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=123 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1360920659.836:918): avc: denied { getattr } for pid=4549 comm="httpd" path="/var/www/html/testsite" dev=fuse ino=1 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=dir type=SYSCALL msg=audit(1360920659.836:918): arch=c000003e syscall=6 success=no exit=-13 a0=7f1d0e3c0ea0 a1=7fffe8f7d130 a2=7fffe8f7d130 a3=1 items=0 ppid=4544 pid=4549 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=123 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null) ------------------------------------------------------------------ Actual results: httpd (httpd_t)cannot access web content stored in a gluster volume, mounted using gluster-fuse (fusefs_t) mount method. Expected results: httpd should be able to access web content stored in a gluster volume, mounted using gluster-fuse mount method. Additional info: If the gluster volume is mounted using nfs, and the 'httpd_use_nfs' boolean is turned on, httpd is able to be started up, and it can access the web content.