If your nginx is running as httpd_t putting the socket you're connecting to in /var/run/httpd or /var/run/nginx are two good places to start:
grep httpd_var_run_t /etc/selinux/targeted/contexts/files/file_contexts
/var/run/wsgi.* -s system_u:object_r:httpd_var_run_t:s0
/var/run/mod_.* system_u:object_r:httpd_var_run_t:s0
/var/run/httpd.* system_u:object_r:httpd_var_run_t:s0
/var/run/nginx.* system_u:object_r:httpd_var_run_t:s0
/var/run/apache.* system_u:object_r:httpd_var_run_t:s0
/var/run/php-fpm(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/run/lighttpd(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/lib/php/session(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/lib/php/wsdlcache(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/run/dirsrv/admin-serv.* system_u:object_r:httpd_var_run_t:s0
/var/opt/rh/rh-nginx18/run/nginx(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/www/openshift/broker/httpd/run(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/www/openshift/console/httpd/run(/.*)? system_u:object_r:httpd_var_run_t:s0
/opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/run/thttpd\.pid -- system_u:object_r:httpd_var_run_t:s0
/var/run/gcache_port -s system_u:object_r:httpd_var_run_t:s0
/var/run/cherokee\.pid -- system_u:object_r:httpd_var_run_t:s0
sesearch -A -C -s httpd_t -c sock_file -p write | grep httpd_var_run_t
allow httpd_t httpd_var_run_t : sock_file { ioctl read write create getattr setattr lock append unlink link rename open } ;
On Tue, Sep 13, 2016 at 1:35 PM Yuri Kanivetsky <yuri.kanivetsky@xxxxxxxxx> wrote:
Hi,
I'm trying to make nginx talk to an app over socket. Actually, I seem
to have succeeded, but I'm concerned if the policy I installed is a
good one.
Here's what I see in audit.log when nginx tries to connect to my app:
type=AVC msg=audit(1473789962.311:2330): avc: denied { write } for
pid=16814 comm="nginx" name="a1.sock" dev="dm-0" ino=525810
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=sock_file
type=SYSCALL msg=audit(1473789962.311:2330): arch=c000003e syscall=42
success=no exit=-13 a0=d a1=188a730 a2=6e a3=7ffde6992400 items=0
ppid=16813 pid=16814 auid=4294967295 uid=995 gid=993 euid=995 suid=995
fsuid=995 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295
comm="nginx" exe="/usr/sbin/nginx" subj=system_u:system_r:httpd_t:s0
key=(null)
And here's what audit2allow has generated:
module nginx 1.0;
require {
type httpd_t;
type httpd_sys_content_t;
class sock_file write;
}
#============= httpd_t ==============
allow httpd_t httpd_sys_content_t:sock_file write;
The question is, "Is httpd_sys_content_t an appropriate type for the
task?" Is there the one, that suits better? Or should I create a
separate one?
Regards,
Yuri
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://lists.fedoraproject.org/admin/lists/selinux@xxxxxxxxxxxxxxxxxxxxxxx
--
Jeremy Young
-- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://lists.fedoraproject.org/admin/lists/selinux@xxxxxxxxxxxxxxxxxxxxxxx
