SELinux Prevents httpd Write Files

Clash Royale CLAN TAG#URR8PPP
I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log:
type=AVC msg=audit(1488922911.038:6188): avc: denied write for pid=11773 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_t:s0 tclass=dir
type=SYSCALL msg=audit(1488922911.038:6188): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76142c0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11773 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
It seems the source and target contexts are mismatched. But, it still won't work after I made it unified.
type=AVC msg=audit(1488923356.905:6384): avc: denied write for pid=11709 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=dir
type=SYSCALL msg=audit(1488923356.905:6384): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76122b0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11709 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
Update
I did a restore of permission by using the restorecon command. But it didn't work.
I'm using the virtual host, I leave everything default:
<VirtualHost *:80>
ServerName www.hometest.com
DocumentRoot /var/www/web1
</VirtualHost>
Here is the SeLinux permissions of my files.
# ls -Z /var/www/web1
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 admin
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 core
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 download
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 extensions
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 image
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 index.php
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 license.txt
-rwxr-x---. apache root system_u:object_r:httpd_sys_content_t:s0 list.bak
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 php.ini
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 resources
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 robots.txt
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 static_pages
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 storefront
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 system
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 task.php
# ls -dZ web1/system/cache/
drwxr-x---. apache apache system_u:system_r:httpd_t:s0 web1/system/cache
Any suggestion?
apache-httpd selinux
add a comment |
I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log:
type=AVC msg=audit(1488922911.038:6188): avc: denied write for pid=11773 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_t:s0 tclass=dir
type=SYSCALL msg=audit(1488922911.038:6188): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76142c0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11773 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
It seems the source and target contexts are mismatched. But, it still won't work after I made it unified.
type=AVC msg=audit(1488923356.905:6384): avc: denied write for pid=11709 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=dir
type=SYSCALL msg=audit(1488923356.905:6384): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76122b0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11709 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
Update
I did a restore of permission by using the restorecon command. But it didn't work.
I'm using the virtual host, I leave everything default:
<VirtualHost *:80>
ServerName www.hometest.com
DocumentRoot /var/www/web1
</VirtualHost>
Here is the SeLinux permissions of my files.
# ls -Z /var/www/web1
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 admin
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 core
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 download
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 extensions
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 image
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 index.php
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 license.txt
-rwxr-x---. apache root system_u:object_r:httpd_sys_content_t:s0 list.bak
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 php.ini
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 resources
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 robots.txt
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 static_pages
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 storefront
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 system
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 task.php
# ls -dZ web1/system/cache/
drwxr-x---. apache apache system_u:system_r:httpd_t:s0 web1/system/cache
Any suggestion?
apache-httpd selinux
1
Show some information about yourDocumentRootand the permissions in therels -lZ /var/www/html. Have you triedrestorecon -vvFR /var/www/html?
– Valentin Bajrami
Mar 7 '17 at 21:59
add a comment |
I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log:
type=AVC msg=audit(1488922911.038:6188): avc: denied write for pid=11773 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_t:s0 tclass=dir
type=SYSCALL msg=audit(1488922911.038:6188): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76142c0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11773 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
It seems the source and target contexts are mismatched. But, it still won't work after I made it unified.
type=AVC msg=audit(1488923356.905:6384): avc: denied write for pid=11709 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=dir
type=SYSCALL msg=audit(1488923356.905:6384): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76122b0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11709 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
Update
I did a restore of permission by using the restorecon command. But it didn't work.
I'm using the virtual host, I leave everything default:
<VirtualHost *:80>
ServerName www.hometest.com
DocumentRoot /var/www/web1
</VirtualHost>
Here is the SeLinux permissions of my files.
# ls -Z /var/www/web1
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 admin
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 core
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 download
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 extensions
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 image
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 index.php
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 license.txt
-rwxr-x---. apache root system_u:object_r:httpd_sys_content_t:s0 list.bak
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 php.ini
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 resources
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 robots.txt
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 static_pages
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 storefront
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 system
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 task.php
# ls -dZ web1/system/cache/
drwxr-x---. apache apache system_u:system_r:httpd_t:s0 web1/system/cache
Any suggestion?
apache-httpd selinux
I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log:
type=AVC msg=audit(1488922911.038:6188): avc: denied write for pid=11773 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_t:s0 tclass=dir
type=SYSCALL msg=audit(1488922911.038:6188): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76142c0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11773 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
It seems the source and target contexts are mismatched. But, it still won't work after I made it unified.
type=AVC msg=audit(1488923356.905:6384): avc: denied write for pid=11709 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=dir
type=SYSCALL msg=audit(1488923356.905:6384): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76122b0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11709 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
Update
I did a restore of permission by using the restorecon command. But it didn't work.
I'm using the virtual host, I leave everything default:
<VirtualHost *:80>
ServerName www.hometest.com
DocumentRoot /var/www/web1
</VirtualHost>
Here is the SeLinux permissions of my files.
# ls -Z /var/www/web1
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 admin
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 core
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 download
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 extensions
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 image
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 index.php
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 license.txt
-rwxr-x---. apache root system_u:object_r:httpd_sys_content_t:s0 list.bak
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 php.ini
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 resources
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 robots.txt
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 static_pages
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 storefront
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 system
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 task.php
# ls -dZ web1/system/cache/
drwxr-x---. apache apache system_u:system_r:httpd_t:s0 web1/system/cache
Any suggestion?
apache-httpd selinux
apache-httpd selinux
edited Mar 7 '17 at 22:24
NeilWang
asked Mar 7 '17 at 21:53
NeilWangNeilWang
96210
96210
1
Show some information about yourDocumentRootand the permissions in therels -lZ /var/www/html. Have you triedrestorecon -vvFR /var/www/html?
– Valentin Bajrami
Mar 7 '17 at 21:59
add a comment |
1
Show some information about yourDocumentRootand the permissions in therels -lZ /var/www/html. Have you triedrestorecon -vvFR /var/www/html?
– Valentin Bajrami
Mar 7 '17 at 21:59
1
1
Show some information about your
DocumentRoot and the permissions in there ls -lZ /var/www/html . Have you tried restorecon -vvFR /var/www/html ?– Valentin Bajrami
Mar 7 '17 at 21:59
Show some information about your
DocumentRoot and the permissions in there ls -lZ /var/www/html . Have you tried restorecon -vvFR /var/www/html ?– Valentin Bajrami
Mar 7 '17 at 21:59
add a comment |
1 Answer
1
active
oldest
votes
I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).
http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/
Try
# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache
Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.
– NeilWang
Mar 9 '17 at 1:24
(Which it says is formod_cache, whereas I assumed the system/cache directory was being used by some PHP code).
– sourcejedi
Mar 9 '17 at 12:39
I agree with you.
– NeilWang
Mar 10 '17 at 9:37
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f349852%2fselinux-prevents-httpd-write-files%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).
http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/
Try
# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache
Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.
– NeilWang
Mar 9 '17 at 1:24
(Which it says is formod_cache, whereas I assumed the system/cache directory was being used by some PHP code).
– sourcejedi
Mar 9 '17 at 12:39
I agree with you.
– NeilWang
Mar 10 '17 at 9:37
add a comment |
I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).
http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/
Try
# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache
Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.
– NeilWang
Mar 9 '17 at 1:24
(Which it says is formod_cache, whereas I assumed the system/cache directory was being used by some PHP code).
– sourcejedi
Mar 9 '17 at 12:39
I agree with you.
– NeilWang
Mar 10 '17 at 9:37
add a comment |
I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).
http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/
Try
# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache
I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).
http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/
Try
# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache
edited Jan 28 at 9:48
answered Mar 7 '17 at 22:51
sourcejedisourcejedi
24.3k440107
24.3k440107
Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.
– NeilWang
Mar 9 '17 at 1:24
(Which it says is formod_cache, whereas I assumed the system/cache directory was being used by some PHP code).
– sourcejedi
Mar 9 '17 at 12:39
I agree with you.
– NeilWang
Mar 10 '17 at 9:37
add a comment |
Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.
– NeilWang
Mar 9 '17 at 1:24
(Which it says is formod_cache, whereas I assumed the system/cache directory was being used by some PHP code).
– sourcejedi
Mar 9 '17 at 12:39
I agree with you.
– NeilWang
Mar 10 '17 at 9:37
Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.
– NeilWang
Mar 9 '17 at 1:24
Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.
– NeilWang
Mar 9 '17 at 1:24
(Which it says is for
mod_cache, whereas I assumed the system/cache directory was being used by some PHP code).– sourcejedi
Mar 9 '17 at 12:39
(Which it says is for
mod_cache, whereas I assumed the system/cache directory was being used by some PHP code).– sourcejedi
Mar 9 '17 at 12:39
I agree with you.
– NeilWang
Mar 10 '17 at 9:37
I agree with you.
– NeilWang
Mar 10 '17 at 9:37
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f349852%2fselinux-prevents-httpd-write-files%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Show some information about your
DocumentRootand the permissions in therels -lZ /var/www/html. Have you triedrestorecon -vvFR /var/www/html?– Valentin Bajrami
Mar 7 '17 at 21:59