Dan Track wrote:
Hi
I'm trying to get httpd to serve an index.cgi page, but I think that
selinux is stopping it. Could some one please help me fix this. The
file is located in /opt/web/serve/index.cgi.
The error I'm getting is:
audit(1152698374.032:438): avc: denied { execute } for pid=15894
comm="httpd" name="index.cgi" dev=cciss/c0d0p7 ino=23920735
scontext=root:system_r:httpd_t tcontext=root:object_r:usr_t
tclass=file
audit(1152698442.617:439): avc: denied { write } for pid=15973
comm="httpd" name=".stats.conf.swp" dev=cciss/c0d0p2 ino=56213
scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_config_t
tclass=file
audit(1152698535.680:440): avc: denied { write } for pid=16073
comm="httpd" name=".stats.conf.swp" dev=cciss/c0d0p2 ino=56213
scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_config_t
tclass=file
audit(1152698608.814:441): avc: denied { write } for pid=16156
comm="httpd" name=".stats.conf.swp" dev=cciss/c0d0p2 ino=56213
scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_config_t
tclass=file
audit(1152698609.891:442): avc: denied { execute } for pid=16166
comm="httpd" name="index.cgi" dev=cciss/c0d0p7 ino=23920735
scontext=root:system_r:httpd_t tcontext=root:object_r:usr_t
tclass=file
You should read "man httpd_selinux" and set contexts appropriately.
Your script should be httpd_sys_script_exec_t rather than usr_t.
You appear to be trying to write (from the server itself) to a file
".stats.conf.swp", which is a httpd configuration file (httpd_config_t).
Is that really supposed to be happening?
Paul.
