49268 – (selinux) Apache won´t run on with profile selinux/2004.1/x86

Bug 49268 - (selinux) Apache won´t run on with profile selinux/2004.1/x86

Summary: (selinux) Apache won´t run on with profile selinux/2004.1/x86

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	Hardened (show other bugs)
Hardware:	All Linux

Importance:	High major
Assignee:	Chris PeBenito (RETIRED)

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2004-04-28 04:08 UTC by Ewald Wasscher
Modified:	2004-09-08 21:09 UTC (History)
CC List:	0 users

See Also:
Package list:
Runtime testing required:	---

Attachments
Quick fix to make apache-1.3.29-r2 run. (selinux-apache.diff,422 bytes, patch) 2004-04-28 04:13 UTC, Ewald Wasscher	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Ewald Wasscher 2004-04-28 04:08:07 UTC

When starting apache under selinux enforcing mode it fails because of improper labeling of /var/cache/apache-mm, and perhaps /var/cache/apache.

output of ls -Z:

drwxr-xr-x  apache   apache   system_u:object_r:var_t          apache
drwxr-xr-x  root     root     system_u:object_r:var_t          apache-mm

Apache fails to start up as it has no write access to apache-mm, so this should be imho:

drwxr-xr-x  apache   apache   system_u:object_r:httpd_cache_t  apache
drwxr-xr-x  root     root     system_u:object_r:httpd_cache_t  apache-mm

I had these problems for both apache 1.3.29-r2 and 2.0.49-r1

Reproducible: Always
Steps to Reproduce:
1. Set ACCEPT_KEYWORDS to ~x86
2. Set /etc/make.profile to selinux/2004.1/x86
3. Upgrade according to the instructions shown prior to step 2
4. Upgrade to selinux-apache-20040426
5. load the new policy
6. rlpkg apache
7. restart apache

Actual Results:  
Apache won

Comment 1 Ewald Wasscher 2004-04-28 04:08:07 UTC

When starting apache under selinux enforcing mode it fails because of improper labeling of /var/cache/apache-mm, and perhaps /var/cache/apache.

output of ls -Z:

drwxr-xr-x  apache   apache   system_u:object_r:var_t          apache
drwxr-xr-x  root     root     system_u:object_r:var_t          apache-mm

Apache fails to start up as it has no write access to apache-mm, so this should be imho:

drwxr-xr-x  apache   apache   system_u:object_r:httpd_cache_t  apache
drwxr-xr-x  root     root     system_u:object_r:httpd_cache_t  apache-mm

I had these problems for both apache 1.3.29-r2 and 2.0.49-r1

Reproducible: Always
Steps to Reproduce:
1. Set ACCEPT_KEYWORDS to ~x86
2. Set /etc/make.profile to selinux/2004.1/x86
3. Upgrade according to the instructions shown prior to step 2
4. Upgrade to selinux-apache-20040426
5. load the new policy
6. rlpkg apache
7. restart apache

Actual Results:  
Apache won´t start.

Expected Results:  
Apache should start normally.

Comment 2 Ewald Wasscher 2004-04-28 04:13:43 UTC

Created attachment 30228 [details, diff]
Quick fix to make apache-1.3.29-r2 run.

Comment 3 Chris PeBenito (RETIRED) gentoo-dev

2004-09-08 21:09:54 UTC

this one's fixed, the bug just got by me