<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=Content-Type content="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 11 (filtered medium)"> <style>  </style> </head> <body lang=EN-US link=blue vlink=purple> <div class=Section1> If someone would be so kind to answer a noob question. When installing an apache authentication extension called WebAuth (3.5.4), it works great with selinux disabled (setenforce 0), but turn on enforcement (setenforce 1), bam, cant read/write the necessary files. To selinux, perhaps it looks like rogue code trying to modify configuration files.<o:p></o:p> <o:p> </o:p> Files:<o:p></o:p> /etc/httpd/conf/webauth/keytab<o:p></o:p> /etc/httpd/conf/webauth/keyring<o:p></o:p> /etc/httpd/conf/webauth/service_token_cache<o:p></o:p> <o:p> </o:p> Messages:<o:p></o:p> audit(1187726388.800:5): avc: denied { write } for pid=2030 comm="httpd" name="webauth" dev=dm-0 ino=66396 scontext=root:system_r:httpd_t:s0 tcontext=root:object_r:httpd_config_t:s0 tclass=dir<o:p></o:p> audit(1187727527.410:38): avc: denied { read } for pid=2229 comm="httpd" name="keytab" dev=dm-0 ino=196626 scontext=root:system_r:httpd_t:s0 tcontext=root:object_r:user_home_t:s0 tclass=file<o:p></o:p> audit(1187727527.415:39): avc: denied { read } for pid=2229 comm="httpd" name="keytab" dev=dm-0 ino=196626 scontext=root:system_r:httpd_t:s0 tcontext=root:object_r:user_home_t:s0 tclass=file<o:p></o:p> audit(1187727527.420:40): avc: denied { write } for pid=2229 comm="httpd" name="service_token_cache" dev=dm-0 ino=66426 scontext=root:system_r:httpd_t:s0 tcontext=root:object_r:httpd_config_t:s0 tclass=file<o:p></o:p> <o:p> </o:p> audit2allow says<o:p></o:p> “allow httpd_t httpd_config_t:dir write;<o:p></o:p> allow httpd_t httpd_config_t:file write;<o:p></o:p> allow httpd_t user_home_t:file read;”<o:p></o:p> but this seems arbitrarily permissive.<o:p></o:p> <o:p> </o:p> What would give only access read/write access these three files? Sorry if this is off-topic.<o:p></o:p> <o:p> </o:p> Running RHEL 5 (“ES”, 32-bit) patched. RTFM’ed already: <a href="http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/">http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/</a> not much help.<o:p></o:p> <o:p></o:p> Kind Regards,<o:p></o:p> Barry Allard<o:p></o:p> Systems Administrator<o:p></o:p> Stanford Medical Informatics<o:p></o:p> +1.650.723.7270<o:p></o:p> <o:p> </o:p> </div> </body> </html>