Apache configuration problem?

abegetchell · 03-21-2006, 08:01 AM

Hi all,

I drove myself crazy yesterday for a couple of hours trying to figure out what I think is an Apache configuration issue on a freshly installed RHEL 4.0 ES system. When I drop some HTML files in /var/www/html I can access these without issue. When I drop a couple of GIFs in the same directory I get the following error attempting to access the GIFs:

Forbidden

You don't have permission to access /image.gif on this server.

Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

Apache/2.0.52 (Red Hat) Server at XXX.XXX.XXX.XXX Port 80

Now, I thought it must have been a permissions problem, given that httpd couldn't seem to access the GIF or the error page to tell me that it couldn't access the GIF, but could access the HTML without issues. When checking the permissions on both the GIF and the error pages, I find that they are exactly the same (ownership and permissions) as the HTML files I can access.

Any ideas? I feel like I'm missing something simple here.

abegetchell · 03-21-2006, 08:47 AM

The plot thickens. Kernel auditing. From /var/log/messages:

Code:

Mar 21 09:40:15 XXXXXXXXXXXX kernel: audit(1142952015.939:578): avc:  denied  { getattr } for  pid=24691 comm="httpd" name="image.gif" dev=sda3 ino=3555340 scontext=root:system_r:httpd_t tcontext=user_u:object_r:user_home_t tclass=file

reddazz · 03-21-2006, 10:18 AM

Are you using selinux? If so try doing "setenforce 0" then try to access the images from the web browser. I turned it off because it was driving me mad and I don't really need it.

abegetchell · 03-21-2006, 10:25 AM

Quote:

Originally Posted by reddazz

Are you using selinux? If so try doing "setenforce 0" then try to access the images from the web browser. I turned it off because it was driving me mad and I don't really need it.

Yup, I'm using SELinux. Running "setenforce 0" (turning SELinux off) did fix the issue, though I'd like to figure out exactly what and how it was doing to cause problems. Why the heck would SELinux not allow httpd to read images from disk?

Thanks for your help!

reddazz · 03-21-2006, 10:36 AM

Quote:

Originally Posted by abegetchell

Yup, I'm using SELinux. Running "setenforce 0" (turning SELinux off) did fix the issue, though I'd like to figure out exactly what and how it was doing to cause problems. Why the heck would SELinux not allow httpd to read images from disk?

Thanks for your help!

Its something to do with the policies but I can't be more precise because I have not delved much into selinux. There are selinux related manuals if you search for RHEL docs on the Redhat website.