Re: SELinux is preventing httpd from create access

Thomas Mueller <thomas@xxxxxxxxxxxxxx> · Thu, 8 Nov 2018 10:21:58 +0100



    On 11/08/2018 10:02 AM, Mahmood Naderan
      wrote:

    
                Hi,
                

                Whenever I upload a file via my web browser to my
                  web sever, I see the following lines in /var/log/messages
              
            
    ...

    
                Raw Audit Messages
type=AVC msg=audit(1541666899.294:27636): avc:  denied  { create } for  pid=25734 comm="httpd" name="temp_5be3f85348052_5be3f85347985.docx" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=file


type=SYSCALL msg=audit(1541666899.294:27636): arch=x86_64 syscall=open success=no exit=EACCES a0=7ffc8a052400 a1=241 a2=1b6 a3=2823ea08d07abe97 items=0 ppid=13555 pid=25734 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)


    ...

    
                # ausearch -c 'httpd' --raw | audit2allow -M my-httpd
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i my-httpd.pp

# semodule -i my-httpd.pp
#


    I don't think autid2allow  produces a good solution for this
    problem. 

    
    what is the full path to the file apache fails to write?

    
    - Thomas

  
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx