Dyfrin

The correct selinux settings (trying to avoid disabling it)

Vote 0 Votes

Hello after a recent server update to f16, I went with a fresh install, not wanting to take legacy junk with me in an update.

I copied everything over, and did a backup in the tools.

When I got httpd perl mysql etc all installed and went to run movabletype, errors happened because cgi couldn't execute.

Changed chcon -t httpd_sys_script_exec_t *.cgi in movabletype (I have all cgi there, not in /var/www/cgi-bin) and now it works, sorta.

I get error messages any time the cgi tries to write/change/etc files. I get these error messages, showing clearly selinux is denying it:

/sbin/ausearch -m avc -ts today

time->Thu Dec 8 15:05:25 2011
type=SYSCALL msg=audit(1323378325.674:55): arch=c000003e syscall=2 success=yes exit=5 a0=3842090 a1=242 a2=1b6 a3=7fb9df8e8520 items=0 ppid=1068 pid=1182 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="mt.cgi" exe="/usr/bin/perl" subj=system_u:system_r:httpd_sys_script_t:s0 key=(null)
type=AVC msg=audit(1323378325.674:55): avc: denied { write } for pid=1182 comm="mt.cgi" name="index.htm.new" dev=dm-2 ino=1053376 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
type=AVC msg=audit(1323378325.674:55): avc: denied { create } for pid=1182 comm="mt.cgi" name="index.htm.new" scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
type=AVC msg=audit(1323378325.674:55): avc: denied { add_name } for pid=1182 comm="mt.cgi" name="index.htm.new" scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=dir
type=AVC msg=audit(1323378325.674:55): avc: denied { write } for pid=1182 comm="mt.cgi" name="01" dev=dm-2 ino=1049181 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=dir


Like I said the movabletype works, just can't publish anything. Any ideas?

For reference
movabletype and site folders are both are:
drwxrwxr-x. ftpuser apache unconfined_u:object_r:httpd_sys_content_t:s0

all the .cgi files are:
-rwxr-xr-x. ftpuser apache unconfined_u:object_r:httpd_sys_script_exec_t:s0 mt.cgi

(changed username to ftpuser, who is main group apache, which httpd is running as apache:apache):
ExecCGI is in the options in the directory for httpd

Reported on Movable Type 5

3 Replies

| Add a Reply
  • What about the server path?

    Did that changed?

    Look inside the movable type admin at each website and blog level was is their publishing path and make sure that is the same after the server update.

    In terms of permissions, the .cgi files should be 755, the folders 777 and the files 666.

    Kind Regards,
    Mihai Bocsaru

    ----------------------------------
    Daily Movable Type Consultant

    Web Development
    Movable Type Consulting
    Six Apart Partner

    http://www.pro-it-service.com/
    ----------------------------------

    Movable Type Demo
    http://www.movabletypedemo.org/
    ----------------------------------

    Open Melody Demo
    http://www.openmelodydemo.org/

  • Server path did not change.
    CHMOD permissions were correct.

    I know it is a selinux permission issue.

    The resolution was:
    httpd_sys_rw_content_t
    on the websites/blogs directories(the ones that gets generated by publishing a site), and the support folder in mt-static.

    Selinux is still enforcing and movabletype is working.

  • Alright and congratulations for that!

Add a Reply

If you need to share template code, replace all the "<" signs with "&lt;" or use this utility.

Forum Groups

1774 6167

Last Topic: Template modules by Zielun on Feb 16, 2012

86 302

Last Topic: website entries by masoud on Oct 26, 2011

1434 5088

Last Topic: Maintenance announcement by Nick on Feb 17, 2012

695 2912

Last Topic: Insert Image / File Fails by Russ Miller on Feb 10, 2012

84 291

Last Topic: How to have some other characters in entry basename automatically written by Afshin Haghighatnia on Dec 22, 2011

174 740

Last Topic: Captcha images rendering slowly by ScottM on Feb 12, 2012

190 568

Last Topic: Analytics Reporting by michael webster on Feb 5, 2012

48 210

Last Topic: An idea and also a request by Afshin Haghighatnia on Jun 29, 2011

64 246

Last Topic: jQuery in MT 5.1 still at 1.4 - why? by perlmonkey on May 25, 2011

code.sixapart.com

137 478

Last Topic: Getting a thumbnail with xpath by Peter on Mar 13, 2011

222 720

Last Topic: Custom Field for Asset Not Appearing by android on Feb 9, 2012