[SOLVED] SELinux keeps blocking my Apache instance

Likeless · 06-23-2016, 06:03 PM

I am using CentOS 7 and have set up a duplicate Apache instance using the systemd structure there.

I can get both Apaches to run if I use setenforce 0. However, when I setenforce 1, the new Apache won't start.

I did my best to go through all the files I created and I have copied the SELinux type across using "ls -Z" and then chcon to the same as httpd.

The failure message I am getting is:

Code:

[Thu Jun 23 23:51:24.123185 2016] [core:notice] [pid 24944] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Thu Jun 23 23:51:24.124434 2016] [suexec:notice] [pid 24944] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Thu Jun 23 23:51:24.146830 2016] [auth_digest:notice] [pid 24944] AH01757: generating secret for digest authentication ...
[Thu Jun 23 23:51:24.147901 2016] [lbmethod_heartbeat:notice] [pid 24944] AH02282: No slotmem from mod_heartmonitor
[Thu Jun 23 23:51:24.147983 2016] [core:error] [pid 24944] (13)Permission denied: AH00099: could not create /etc/httpd-bobby/httpd-bobby.pid
[Thu Jun 23 23:51:24.148000 2016] [core:error] [pid 24944] AH00100: httpd-bobby: could not log pid to file /etc/httpd-bobby/httpd-bobby.pid

But the location has the httpd context:

Code:

[root~]# ls -Z /etc | grep httpd
drwxr-xr-x. root root system_u:object_r:httpd_config_t:s0 httpd
drwxr-xr-x. root root unconfined_u:object_r:httpd_config_t:s0 httpd-bobby

I know it is SELinux because it works with setenforce 0. What am I doing wrong?

unSpawn · 06-24-2016, 02:31 AM

PID files should be created in /run or /var/run. What does 'grep httpd /var/log/messages /var/log/audit/audit.log | sort -u | audit2allow' return?

Likeless · 06-24-2016, 08:58 AM

Code:

[root~]# grep httpd /var/log/messages /var/log/audit/audit.log | sort -u | audit2allow


#============= httpd_t ==============
allow httpd_t httpd_config_t:dir write;
[root~]#

Likeless · 06-24-2016, 09:02 AM

Okay. I changed it to:

Code:

PidFile /run/httpd-bobby/httpd-bobby.pid

and now it works. Thanks