Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 469894 - www-servers/nginx tmp location changed, SELinux file context change needed
Summary: www-servers/nginx tmp location changed, SELinux file context change needed
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Sven Vermeulen (RETIRED)
URL:
Whiteboard: sec-policy r2
Keywords:
Depends on:
Blocks:
 
Reported: 2013-05-14 23:08 UTC by Vincent Brillault
Modified: 2013-08-15 07:46 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Vincent Brillault 2013-05-14 23:08:25 UTC
As per the changelog states:
"""
*nginx-1.4.1-r2 (13 May 2013)

  13 May 2013; Tiziano Müller <dev-zero@gentoo.org>
  +files/nginx-1.4.1-fix-perl-install-path.patch, +files/nginx.initd-r2,
  +nginx-1.4.1-r2.ebuild:
  Set permissions for log- and tmp-dir in ebuild only, including a one-time
  postinst-fix for bug #469094, resp. bug #458726. Moved the tmp-dirs to
  /var/lib/nginx/tmp and set the nginx-homedir to /var/lib/nginx (following the
  other distros here). Fix perl-module installation to use /usr instead of
  /usr/local for PREFIX.
"""

"Moved the tmp-dirs to /var/lib/nginx/tmp" make the following context obsolete:
/var/tmp/nginx(/.*)?  gen_context(system_u:object_r:nginx_tmp_t,s0)

This rule should be replaced by:
/var/lib/nginx/tmp(/.*)?  gen_context(system_u:object_r:nginx_tmp_t,s0)


If not changed, the following avc/errors can be triggered:

avc:  denied  { read write } for  pid=3803 comm="nginx" path="/var/lib/nginx/tmp/client/0000000001" dev="sda1" ino=393737 scontext=system_u:system_r:nginx_t tcontext=system_u:object_r:nginx_var_lib_t tclass=file

2013/05/15 01:05:55 [crit] 3803#0: *42 open() "//var/lib/nginx/tmp/client/0000000001" failed (13: Permission denied), client: 85.4.247.32, server: ...., request: "POST /..... HTTP/1.1", host: "....."
Comment 1 Sven Vermeulen (RETIRED) gentoo-dev 2013-06-22 19:00:20 UTC
Thanks, in repo. Will be in r2
Comment 2 Sven Vermeulen (RETIRED) gentoo-dev 2013-07-21 16:27:11 UTC
In repo, ~arch (rev 2 of the policies)
Comment 3 Sven Vermeulen (RETIRED) gentoo-dev 2013-08-15 07:46:50 UTC
r2 is now stable