Re: FC3, Apache and CGI web app

[Daniel J Walsh <dwalsh@redhat.com>]

Scott Cain wrote:

>Hello,
>
>I am one of the authors of a web application that is widely used in my
>community, GBrowse ( http://www.gmod.org/ggb/ ).  We've started
>receiving bug reports from users who are trying to install and run it on
>Fedora Core 3 systems with SELinux installed and enabled with the
>default values from the distribution.  
>
>To do some testing, I've installed FC3 and GBrowse and run into the same
>problems.  The only way I've been able to get GBrowse to run is to
>disable SELinux.  There are a few reasons I'd rather not tell my users
>to do that, so I am looking for a way to leave SELinux enabled and still
>run GBrowse.  The first thing I tried was to set httpd_disable_trans=1
>(which the GUI calls "Disable SELinux protection for httpd daemon"), but
>that doesn't help.  Are there any parameters that I can add
>to /etc/selinux/targeted/booleans to allow GBrowse to work?
>
>As far as I can tell, the reason SELinux doesn't like GBrowse is that it
>is a cgi that tries to read a directory and files in the apache conf
>directory.
>
>Thanks,
>Scott
>
>  
>
First make sure you have the latest policy, via yum

yum update selinux-policy-targeted

Next make sure httpd_unified is set

setsebool -P httpd_unified 1

Now try it.

Look for AVC messages in /var/log/messages which will tell you what is 
being denied.
http://fedora.redhat.com/docs/selinux-apache-fc3/
has a lot of information on settingup apache and SElinux.

Dan


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.