SELinux Prevents httpd Write Files

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP












1















I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log:




type=AVC msg=audit(1488922911.038:6188): avc: denied write for pid=11773 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_t:s0 tclass=dir



type=SYSCALL msg=audit(1488922911.038:6188): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76142c0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11773 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)




It seems the source and target contexts are mismatched. But, it still won't work after I made it unified.




type=AVC msg=audit(1488923356.905:6384): avc: denied write for pid=11709 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=dir



type=SYSCALL msg=audit(1488923356.905:6384): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76122b0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11709 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)




Update



I did a restore of permission by using the restorecon command. But it didn't work.
I'm using the virtual host, I leave everything default:



<VirtualHost *:80>
ServerName www.hometest.com
DocumentRoot /var/www/web1
</VirtualHost>


Here is the SeLinux permissions of my files.



# ls -Z /var/www/web1
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 admin
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 core
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 download
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 extensions
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 image
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 index.php
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 license.txt
-rwxr-x---. apache root system_u:object_r:httpd_sys_content_t:s0 list.bak
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 php.ini
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 resources
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 robots.txt
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 static_pages
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 storefront
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 system
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 task.php
# ls -dZ web1/system/cache/
drwxr-x---. apache apache system_u:system_r:httpd_t:s0 web1/system/cache


Any suggestion?










share|improve this question



















  • 1





    Show some information about your DocumentRoot and the permissions in there ls -lZ /var/www/html . Have you tried restorecon -vvFR /var/www/html ?

    – Valentin Bajrami
    Mar 7 '17 at 21:59















1















I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log:




type=AVC msg=audit(1488922911.038:6188): avc: denied write for pid=11773 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_t:s0 tclass=dir



type=SYSCALL msg=audit(1488922911.038:6188): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76142c0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11773 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)




It seems the source and target contexts are mismatched. But, it still won't work after I made it unified.




type=AVC msg=audit(1488923356.905:6384): avc: denied write for pid=11709 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=dir



type=SYSCALL msg=audit(1488923356.905:6384): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76122b0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11709 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)




Update



I did a restore of permission by using the restorecon command. But it didn't work.
I'm using the virtual host, I leave everything default:



<VirtualHost *:80>
ServerName www.hometest.com
DocumentRoot /var/www/web1
</VirtualHost>


Here is the SeLinux permissions of my files.



# ls -Z /var/www/web1
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 admin
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 core
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 download
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 extensions
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 image
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 index.php
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 license.txt
-rwxr-x---. apache root system_u:object_r:httpd_sys_content_t:s0 list.bak
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 php.ini
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 resources
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 robots.txt
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 static_pages
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 storefront
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 system
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 task.php
# ls -dZ web1/system/cache/
drwxr-x---. apache apache system_u:system_r:httpd_t:s0 web1/system/cache


Any suggestion?










share|improve this question



















  • 1





    Show some information about your DocumentRoot and the permissions in there ls -lZ /var/www/html . Have you tried restorecon -vvFR /var/www/html ?

    – Valentin Bajrami
    Mar 7 '17 at 21:59













1












1








1








I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log:




type=AVC msg=audit(1488922911.038:6188): avc: denied write for pid=11773 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_t:s0 tclass=dir



type=SYSCALL msg=audit(1488922911.038:6188): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76142c0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11773 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)




It seems the source and target contexts are mismatched. But, it still won't work after I made it unified.




type=AVC msg=audit(1488923356.905:6384): avc: denied write for pid=11709 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=dir



type=SYSCALL msg=audit(1488923356.905:6384): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76122b0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11709 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)




Update



I did a restore of permission by using the restorecon command. But it didn't work.
I'm using the virtual host, I leave everything default:



<VirtualHost *:80>
ServerName www.hometest.com
DocumentRoot /var/www/web1
</VirtualHost>


Here is the SeLinux permissions of my files.



# ls -Z /var/www/web1
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 admin
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 core
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 download
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 extensions
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 image
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 index.php
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 license.txt
-rwxr-x---. apache root system_u:object_r:httpd_sys_content_t:s0 list.bak
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 php.ini
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 resources
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 robots.txt
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 static_pages
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 storefront
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 system
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 task.php
# ls -dZ web1/system/cache/
drwxr-x---. apache apache system_u:system_r:httpd_t:s0 web1/system/cache


Any suggestion?










share|improve this question
















I recently setup a website on RHEL7. The SELinux is in Enforcing mode. However, whatever how I tune the context, it always prevents httpd from writing. Here is the audit.log:




type=AVC msg=audit(1488922911.038:6188): avc: denied write for pid=11773 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_t:s0 tclass=dir



type=SYSCALL msg=audit(1488922911.038:6188): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76142c0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11773 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)




It seems the source and target contexts are mismatched. But, it still won't work after I made it unified.




type=AVC msg=audit(1488923356.905:6384): avc: denied write for pid=11709 comm="httpd" name="cache" dev="xvda2" ino=42006369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=dir



type=SYSCALL msg=audit(1488923356.905:6384): arch=c000003e syscall=21 success=no exit=-13 a0=7f76f76122b0 a1=2 a2=0 a3=7f76e89b0ec0 items=0 ppid=740 pid=11709 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)




Update



I did a restore of permission by using the restorecon command. But it didn't work.
I'm using the virtual host, I leave everything default:



<VirtualHost *:80>
ServerName www.hometest.com
DocumentRoot /var/www/web1
</VirtualHost>


Here is the SeLinux permissions of my files.



# ls -Z /var/www/web1
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 admin
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 core
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 download
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 extensions
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 image
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 index.php
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 license.txt
-rwxr-x---. apache root system_u:object_r:httpd_sys_content_t:s0 list.bak
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 php.ini
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 resources
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 robots.txt
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 static_pages
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 storefront
drwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 system
-rwxr-x---. apache apache system_u:object_r:httpd_sys_content_t:s0 task.php
# ls -dZ web1/system/cache/
drwxr-x---. apache apache system_u:system_r:httpd_t:s0 web1/system/cache


Any suggestion?







apache-httpd selinux






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Mar 7 '17 at 22:24







NeilWang

















asked Mar 7 '17 at 21:53









NeilWangNeilWang

96210




96210







  • 1





    Show some information about your DocumentRoot and the permissions in there ls -lZ /var/www/html . Have you tried restorecon -vvFR /var/www/html ?

    – Valentin Bajrami
    Mar 7 '17 at 21:59












  • 1





    Show some information about your DocumentRoot and the permissions in there ls -lZ /var/www/html . Have you tried restorecon -vvFR /var/www/html ?

    – Valentin Bajrami
    Mar 7 '17 at 21:59







1




1





Show some information about your DocumentRoot and the permissions in there ls -lZ /var/www/html . Have you tried restorecon -vvFR /var/www/html ?

– Valentin Bajrami
Mar 7 '17 at 21:59





Show some information about your DocumentRoot and the permissions in there ls -lZ /var/www/html . Have you tried restorecon -vvFR /var/www/html ?

– Valentin Bajrami
Mar 7 '17 at 21:59










1 Answer
1






active

oldest

votes


















1














I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).



http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/



Try



# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache





share|improve this answer

























  • Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.

    – NeilWang
    Mar 9 '17 at 1:24












  • (Which it says is for mod_cache, whereas I assumed the system/cache directory was being used by some PHP code).

    – sourcejedi
    Mar 9 '17 at 12:39











  • I agree with you.

    – NeilWang
    Mar 10 '17 at 9:37










Your Answer








StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);













draft saved

draft discarded


















StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f349852%2fselinux-prevents-httpd-write-files%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









1














I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).



http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/



Try



# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache





share|improve this answer

























  • Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.

    – NeilWang
    Mar 9 '17 at 1:24












  • (Which it says is for mod_cache, whereas I assumed the system/cache directory was being used by some PHP code).

    – sourcejedi
    Mar 9 '17 at 12:39











  • I agree with you.

    – NeilWang
    Mar 10 '17 at 9:37















1














I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).



http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/



Try



# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache





share|improve this answer

























  • Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.

    – NeilWang
    Mar 9 '17 at 1:24












  • (Which it says is for mod_cache, whereas I assumed the system/cache directory was being used by some PHP code).

    – sourcejedi
    Mar 9 '17 at 12:39











  • I agree with you.

    – NeilWang
    Mar 10 '17 at 9:37













1












1








1







I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).



http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/



Try



# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache





share|improve this answer















I think you need to apply httpd_sys_rw_content_t to the files which are written to (the cache directory).



http://www.serverlab.ca/tutorials/linux/web-servers-linux/configuring-selinux-policies-for-apache-web-servers/



Try



# semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/web1/system/cache(/.*)?"
# restorecon -Rv /var/www/web1/system/cache






share|improve this answer














share|improve this answer



share|improve this answer








edited Jan 28 at 9:48

























answered Mar 7 '17 at 22:51









sourcejedisourcejedi

24.3k440107




24.3k440107












  • Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.

    – NeilWang
    Mar 9 '17 at 1:24












  • (Which it says is for mod_cache, whereas I assumed the system/cache directory was being used by some PHP code).

    – sourcejedi
    Mar 9 '17 at 12:39











  • I agree with you.

    – NeilWang
    Mar 10 '17 at 9:37

















  • Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.

    – NeilWang
    Mar 9 '17 at 1:24












  • (Which it says is for mod_cache, whereas I assumed the system/cache directory was being used by some PHP code).

    – sourcejedi
    Mar 9 '17 at 12:39











  • I agree with you.

    – NeilWang
    Mar 10 '17 at 9:37
















Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.

– NeilWang
Mar 9 '17 at 1:24






Thanks man, it finally works after I set it to "httpd_cache_t" according to the blog you linked.

– NeilWang
Mar 9 '17 at 1:24














(Which it says is for mod_cache, whereas I assumed the system/cache directory was being used by some PHP code).

– sourcejedi
Mar 9 '17 at 12:39





(Which it says is for mod_cache, whereas I assumed the system/cache directory was being used by some PHP code).

– sourcejedi
Mar 9 '17 at 12:39













I agree with you.

– NeilWang
Mar 10 '17 at 9:37





I agree with you.

– NeilWang
Mar 10 '17 at 9:37

















draft saved

draft discarded
















































Thanks for contributing an answer to Unix & Linux Stack Exchange!


  • Please be sure to answer the question. Provide details and share your research!

But avoid


  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f349852%2fselinux-prevents-httpd-write-files%23new-answer', 'question_page');

);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown






Popular posts from this blog

Peggy Mitchell

The Forum (Inglewood, California)

Palaiologos