Selinux problem - help

[Paul Howarth]

Dan Track wrote:
> Hi
> 
> I'm trying to get httpd to serve an index.cgi page, but I think that
> selinux is stopping it. Could some one please help me fix this. The
> file is located in /opt/web/serve/index.cgi.
> 
> The error I'm getting is:
> 
> audit(1152698374.032:438): avc:  denied  { execute } for  pid=15894
> comm="httpd" name="index.cgi" dev=cciss/c0d0p7 ino=23920735
> scontext=root:system_r:httpd_t tcontext=root:object_r:usr_t
> tclass=file
> 
> audit(1152698442.617:439): avc:  denied  { write } for  pid=15973
> comm="httpd" name=".stats.conf.swp" dev=cciss/c0d0p2 ino=56213
> scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_config_t
> tclass=file
> 
> audit(1152698535.680:440): avc:  denied  { write } for  pid=16073
> comm="httpd" name=".stats.conf.swp" dev=cciss/c0d0p2 ino=56213
> scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_config_t
> tclass=file
> 
> audit(1152698608.814:441): avc:  denied  { write } for  pid=16156
> comm="httpd" name=".stats.conf.swp" dev=cciss/c0d0p2 ino=56213
> scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_config_t
> tclass=file
> 
> audit(1152698609.891:442): avc:  denied  { execute } for  pid=16166
> comm="httpd" name="index.cgi" dev=cciss/c0d0p7 ino=23920735
> scontext=root:system_r:httpd_t tcontext=root:object_r:usr_t
> tclass=file

You should read "man httpd_selinux" and set contexts appropriately.

Your script should be httpd_sys_script_exec_t rather than usr_t.

You appear to be trying to write (from the server itself) to a file 
".stats.conf.swp", which is a httpd configuration file (httpd_config_t). 
Is that really supposed to be happening?

Paul.