<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=Content-Type content="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 11 (filtered medium)"> <style>  </style> </head> <body lang=EN-US link=blue vlink=purple> <div class=Section1> I just copied mod_slam.so to /etc/httpd/modules, executed chcon –r mod_alias.so mod_slam.so, and edited /etc/httpd/httpd.conf to load the new module. As a result, I get the following avc error in my /var/log/messages.<o:p></o:p> <o:p> </o:p> Aug 2 13:28:00 build02 kernel: audit(1186079280.127:7): avc: denied { execmod } for pid=18939 comm="httpd" name="mod_slam.so" dev=dm-0 ino=8847362 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_modules_t:s0 tclass=file<o:p></o:p> <o:p> </o:p> When I pass this text to audit2allow I get very little help.<o:p></o:p> <o:p> </o:p> $ tail -1 /var/log/messages | audit2allow<o:p></o:p> <o:p> </o:p> <o:p> </o:p> #============= httpd_t ==============<o:p></o:p> allow httpd_t httpd_modules_t:file execmod;<o:p></o:p> #<o:p></o:p> <o:p> </o:p> When I pass it to audit2why I get no more help still.<o:p></o:p> <o:p> </o:p> Aug 2 14:17:07 build02 kernel: audit(1186082227.562:10): avc: denied { execmod } for pid=19707 comm="httpd" name="mod_slam.so" dev=dm-0 ino=8847362 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_modules_t:s0 tclass=file<o:p></o:p> Was caused by:<o:p></o:p> Missing or disabled TE allow rule.<o:p></o:p> Allow rules may exist but be disabled by boolean settings; check boolean settings.<o:p></o:p> You can see the necessary allow rules by running audit2allow with this audit message as input.<o:p></o:p> <o:p> </o:p> <o:p> </o:p> What I find frustrating is that loading the installed modules (i.e., installed with the httpd package) do not cause avc errors. In fact, if I rename, say, mod_alias.so to something else it still loads after I temporarily edit httpd.conf. And so, I find it hard to believe that the security policy knows about specific file names. When I copy mod_alias.so to something else (i.e., to give it a new inode) it still loads and so I think that proves the security policy also knows nothing about inodes. These two tests of renaming/copying mod_alias.so demonstrate to me that rebooting the server or some other “configuration” action is not necessary.<o:p></o:p> <o:p> </o:p> My actual first question, since I know so little about selinux, is this: if my module has the same security context as other modules, then why does an attempt to load it cause that avc error?<o:p></o:p> <o:p> </o:p> Can anyone render assistance?<o:p></o:p> </div> </body> </html>