Re: Calling SELinux Expert...

[Panu Matilainen <pmatilai welho com>]

On Fri, 4 Mar 2005, Gavin Young wrote:

> Hey guys, hopefully someone out there can help me with this because I'm
> an SELinux virgin so to speak.
>
> We have a RHEL v4 box running apache amongst other things. No changes
> have been made to the standard Redhat policies.
>
> We are wanting to run a perl based web app (Sql-Ledger)
> from /usr/local/sql-ledger but SELinux is stopping us.
>
> With SELinux disabled it works correctly. When SELinux protection of the
> HTTPD daemon is switched on the browser displays: Internal Server Error
> and /var/log/messages reports
>
> Mar  3 15:13:23 zorb1 kernel: audit(1109816003.103:0): avc:  denied
> { execute } for  pid=24711 exe=/usr/sbin/httpd name=login.pl dev=dm-0
> ino=9228595 scontext=root:system_r:httpd_t tcontext=root:object_r:usr_t
> tclass=file
>
> > From what I can tell SELinux is stopping scripts being run from any
> other directory apart from /var/www/cgi-bin. I have tried moving the
> sql-ledger directory into cgi-bin but that doesn't appear to help
> because it is still a sub-directory of cgi-bin.

The release notes give a hint to the right direction but doesn't directly 
talk about cgi - you need to set the file contexts of the sql-ledger stuff 
as cgi-content, something like this:
"chcon -R -h -t httpd_sys_script_exec_t <path to slq-ledger directory>"

	- Panu -