[CentOS] Help with httpd userdir recovery

J Martin Rushton
Wed, 28 Dec 2016 23:05:24 -0000

On 28/12/16 21:24, m.roth at 5-cent.us wrote:
> Robert Moskowitz wrote:
>>
>>
>> On 12/28/2016 03:32 PM, J Martin Rushton wrote:
>>>
>>> On 28/12/16 20:11, Robert Moskowitz wrote:
>>>>
>>>> On 12/28/2016 01:53 PM, m.roth at 5-cent.us wrote:
>>>>> Robert Moskowitz wrote:
>>>>>> On 12/28/2016 05:11 AM, Todor Petkov wrote:
>>>>>>> On Wed, Dec 28, 2016 at 5:18 AM, Robert Moskowitz
>>>>>>> <rgm at htt-consult.com>
>>>>>>> wrote:
>>>>>>>> Which is why I wonder if there is some
different config for the
>>>>>>>> C7.3
>>>>>>>> version
>>>>>>>> of apache.
>>>>>>>>
>>>>>>>> Or something with the C7-arm build...
>>>>>>> Can you check for SELinux warnings/errors in
>>>>>>> /var/log/audit/audit.log?
>>>>>> Good advice.  As I suspect the problem is with SELinux.
>>>>>>
>>>>>> So I tried an access.  What follows is the access_log
entry, the
>>>>>> error_log entry and the 3 entries in the audit.log:
>>>>>>
>>>>>> 192.168.160.12 - - [28/Dec/2016:11:59:10 -0500]
"GET /~rgm/family/
>>>>>> HTTP/1.1" 403 214 "-" "Mozilla/5.0
(X11; Fedora; Linux x86_64;
>>>>>> rv:50.0)
>>>>>> Gecko/20100101 Firefox/50.0"
>>>>>>
>>>>>> [Wed Dec 28 11:59:10.294915 2016] [autoindex:error]
[pid 2141]
>>>>>> (13)Permission denied: [client 192.168.160.12:56456]
AH01275: Can't
>>>>>> open
>>>>>> directory for index: /home/rgm/public_html/family/
>>>>>>
>>>>>> type=AVC msg=audit(1482944350.289:339): avc:  denied  {
read } for
>>>>>> pid=2141 comm="httpd" name="family"
dev="sda3" ino=262199
>>>>>> scontext=system_u:system_r:httpd_t:s0
>>>>>> tcontext=unconfined_u:object_r:httpd_user_content_t:s0
tclass=dir
>>>>>> permissive=0
>>>>>>
>>>>>> type=SYSCALL msg=audit(1482944350.289:339):
arch=40000028 syscall=322
>>>>>> per=800000 success=no exit=-13 a0=ffffff9c a1=80657458
a2=a4800 a3=0
>>>>>> items=0 ppid=2135 pid=2141 auid=4294967295 uid=48
gid=48 euid=48
>>>>>> suid=48
>>>>>> fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none)
ses=4294967295
>>>>>> comm="httpd"
>>>>>> exe="/usr/sbin/httpd"
subj=system_u:system_r:httpd_t:s0 key=(null)
>>>>>>
>>>>>> type=PROCTITLE msg=audit(1482944350.289:339):
>>>>>>
proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
>>>>>>
>>>>>>
>>>>>> I will say that after enabling selinux on this image
per the
>>>>>> instructions of the team doing the Centos7-arm builds,
I got the
>>>>>> following messages when I did things like
'setsebool -P
>>>>>> httpd_enable_homedirs on':
>>>>>>
>>>>>> [ 2273.047017] SELinux:  Class binder not defined in
policy.
>>>>>> [ 2273.052531] SELinux: the above unknown classes and
permissions
>>>>>> will
>>>>>> be allowed
>>>>>>
>>>>>>
>>>>>> So something may well not be right with my SELinux.
>>>>>>
>>>>> Bang. I would suggest, at this point, that you might want
to set
>>>>> selinux
>>>>> into permissive mode, so you'll get the error messages
from it, and
>>>>> can
>>>>> work out fixes, but will let your system operate as you
intend.
>>>>> setselinux 0
>>>>>
>>>>> Note that this is *temporary*, and will revert on reboot.
To make it
>>>>> permanent, you'd need to edit /etc/selinux/config.
>>>> Thanks, Mark, I was just getting around to that way of
thinking.
>>>>
>>>> The command, at least on my Centos7-arm system is
>>>>
>>>> setenforce 0
>>>>
>>>> A presto it works.  So now to figure out what is wrong with
SElinux on
>>>> this image.
>>>>
>>>> _______________________________________________
>>>> CentOS mailing list
>>>> CentOS at centos.org
>>>> https://lists.centos.org/mailman/listinfo/centos
>>> Have you got the setroubleshoot-server package installed?  For
x86_64 it
>>> is part of the base repository, obviously arm may differ.  The
package
>>> installs a "SELinux Troubleshooter" entry in the
Applications/Sundry
>>> menu, or it can be launched via:
>>
>> No GUI in the base image.  And on arm, we tend to use Xfce.
>>
>>> # /usr/bin/python -Es /usr/bin/sealert -s
>>
>> no sealert bin file, so it is off to install it.
>>
>>> It generates suggestions to fix SELinx issues.  Sometimes it is
quite
>>> useful, on other occasions it just lists vast numbers of
possibilities
>>> with little or no help.  On balance it is worth trying for when it
does
>>> help.
>>
>> I have never had it make useful suggestions to my on my notebook, but
we
>> will see...
>>
>> so here is what happens after I install it:
>>
>> # /usr/bin/python -Es /usr/bin/sealert -s
>> Opps, sealert hit an error!
>>
>> Traceback (most recent call last):
>>    File "/usr/bin/sealert", line 651, in <module>
>>      import gtk
>> ImportError: No module named gtk
>>
>> If it needs a GUI, then that won't work here.  Headless system.
>>
> Nahh... you want to instal setroubleshoot.
>
>        mark
>
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> https://lists.centos.org/mailman/listinfo/centos
>
Sorry, missed the no GUI if it was mentioned earlier.  You _might_ get
away with ssh -Y from a workstation but you might end up wasting time.
No guarantees I'm afraid. :-) Martin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.centos.org/pipermail/centos/attachments/20161228/a562384d/attachment-0001.sig>