SELinux Notes - Revision history

Simson: /* Problem: CGI scripts won't run. */

2020-11-04T14:46:04Z

Problem: CGI scripts won't run.

← Older revision		Revision as of 07:46, 4 November 2020
Line 56:		Line 56:
	$ restorecon -R -v /var/www/html/bin		$ restorecon -R -v /var/www/html/bin

	~~See the errors~~:		References:
	~~$ journalctl~~ -xe		* https://serverfault.com/questions/691501/apache-permission-denied-exec-of-var-www-html-cgi-test-first-pl-failed

			==Problem: View selunux logs===

	~~References:~~		$ journalctl -xea
	* https://serverfault.com/questions/691501/apache-~~permission-denied-exec-of-var-www-html-cgi-test-first-pl-failed~~

	==Problem: Apache can't make outgoing network connections==		==Problem: Apache can't make outgoing network connections==

2020-10-06T12:49:01Z

Resolving SELinugx Problems

← Older revision		Revision as of 05:49, 6 October 2020
Line 10:		Line 10:
	* https://www.lisenet.com/2016/advanced-apache-configuration-with-selinux-on-rhel-7/		* https://www.lisenet.com/2016/advanced-apache-configuration-with-selinux-on-rhel-7/

	=Resolving ~~SELinugx~~ Problems=		=Resolving SELinux Problems=

	==Problem: apache can't access the files==		==Problem: apache can't access the files==
Line 132:		Line 132:

	# chcon -R -t mysqld_db_t /data2/mysql /var/lib/mysql		# chcon -R -t mysqld_db_t /data2/mysql /var/lib/mysql


	= Disabling SELinux =		= Disabling SELinux =

2020-10-06T12:48:44Z

← Older revision		Revision as of 05:48, 6 October 2020
Line 63:		Line 63:
	* https://serverfault.com/questions/691501/apache-permission-denied-exec-of-var-www-html-cgi-test-first-pl-failed		* https://serverfault.com/questions/691501/apache-permission-denied-exec-of-var-www-html-cgi-test-first-pl-failed

			==Problem: Apache can't make outgoing network connections==
			By default, Apache running on selinux cannot make outgoing network connections. This is controlled by SELinux boolean variables. Here are all of the ones that matter:
			<pre>
			$ sudo semanage boolean -l \|grep net \| grep http
			httpd_can_network_relay (off , off) Allow httpd to can network relay
			httpd_can_network_connect_db (on , on) Allow httpd to can network connect db
			httpd_can_network_connect (on , on) Allow httpd to can network connect
			httpd_can_network_memcache (off , off) Allow httpd to can network memcache
			httpd_can_network_connect_cobbler (off , off) Allow httpd to can network connect cobbler
			$
			</pre>

			You can enable this and make it persistent across reboots with:
			<pre>
			$ sudo getsebool httpd_can_network_connect
			httpd_can_network_connect --> off
			$ sudo setsebool -P httpd_can_network_connect on
			$ sudo getsebool httpd_can_network_connect
			httpd_can_network_connect --> on
			$
			</pre>

	==Problem: RHEL doesn't support PHP7.x==		==Problem: RHEL doesn't support PHP7.x==

2019-10-28T17:51:19Z

@@ Line 10: / Line 10: @@
 * https://www.lisenet.com/2016/advanced-apache-configuration-with-selinux-on-rhel-7/
 ==Problem: apache can't access the files==
@@ Line 62: / Line 63: @@
 * https://serverfault.com/questions/691501/apache-permission-denied-exec-of-var-www-html-cgi-test-first-pl-failed
 ==Problem: RHEL doesn't support PHP7.x==
@@ Line 85: / Line 80: @@
 * https://www.mediawiki.org/wiki/SELinux
 *     https://serverfault.com/questions/322117/selinux-letting-apache-talk-to-mysql-on-centos

2019-09-11T18:03:12Z

Problem: CGI scripts won't run.

← Older revision		Revision as of 11:03, 11 September 2019
Line 55:		Line 55:
	$ restorecon -R -v /var/www/html/bin		$ restorecon -R -v /var/www/html/bin

			See the errors:
			$ journalctl -xe

2019-04-23T19:52:05Z

Problem: apache can't access the files

← Older revision		Revision as of 12:52, 23 April 2019
Line 21:		Line 21:
	If you can't run PHP, you may have the files in the wrong SELinux security context. You can change the security		If you can't run PHP, you may have the files in the wrong SELinux security context. You can change the security

	# ~~Use~~ ls -lZ /var/www/html/~~xxx to check the security context~~		# Check the security context:
			ls -lZ /var/www/html/

	# You can give the web server read/write access to the files with:		# You can give the web server read/write access to the files with:
	chcon -R -t httpd_sys_rw_content_t /var/www/html/xxx		chcon -R -t httpd_sys_rw_content_t /var/www/html/xxx


	==Problem: CGI scripts won't run.==		==Problem: CGI scripts won't run.==

2019-03-25T18:16:06Z

Problem: RHEL doesn't support PHP7.x

← Older revision		Revision as of 11:16, 25 March 2019
Line 73:		Line 73:
	# Install httpd, httpd-devel and php		# Install httpd, httpd-devel and php
	# Now download PHP7		# Now download PHP7
	./configure --with-apxs2=/usr/bin/apxs --enable-mbstring -with-mysqli		./configure --with-apxs2=/usr/bin/apxs --enable-mbstring --with-mysqli --with-openssl

	# And let httpd scripts make outbound TCP connections:		# And let httpd scripts make outbound TCP connections:

2019-03-23T14:49:26Z

Problem: RHEL doesn't support PHP7.x

← Older revision		Revision as of 07:49, 23 March 2019
Line 74:		Line 74:
	# Now download PHP7		# Now download PHP7
	./configure --with-apxs2=/usr/bin/apxs --enable-mbstring -with-mysqli		./configure --with-apxs2=/usr/bin/apxs --enable-mbstring -with-mysqli

			# And let httpd scripts make outbound TCP connections:

			# setsebool -P httpd_can_network_connect 1


	For running mediawiki, also see:		For running mediawiki, also see:
	* https://www.mediawiki.org/wiki/SELinux		* https://www.mediawiki.org/wiki/SELinux
			* https://serverfault.com/questions/322117/selinux-letting-apache-talk-to-mysql-on-centos

2019-03-23T14:24:54Z

Problem: RHEL doesn't support PHP7.x

← Older revision		Revision as of 07:24, 23 March 2019
Line 74:		Line 74:
	# Now download PHP7		# Now download PHP7
	./configure --with-apxs2=/usr/bin/apxs --enable-mbstring -with-mysqli		./configure --with-apxs2=/usr/bin/apxs --enable-mbstring -with-mysqli

			For running mediawiki, also see:
			* https://www.mediawiki.org/wiki/SELinux

2019-03-23T14:10:59Z

Problem: RHEL doesn't support PHP7.x

← Older revision		Revision as of 07:10, 23 March 2019
Line 71:		Line 71:

	Solution:		Solution:
	1. Install httpd, httpd-devel and php		# Install httpd, httpd-devel and php
	2. Now download PHP7		# Now download PHP7
	./configure --with-apxs2=/usr/bin/apxs --enable-mbstring -with-mysqli		./configure --with-apxs2=/usr/bin/apxs --enable-mbstring -with-mysqli