Re: [CentOS] SELinux blocking cgi script from "writing to socket (httpd_t)"

2012-01-11 Thread Daniel J Walsh
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/11/2012 02:50 PM, 夜神　岩男 wrote: > On 01/12/2012 03:48 AM, Daniel J Walsh wrote: > >> In Fedora we currently dontaudit this leak. >> >> audit2allow -i /tmp/t >> >> >> #= httpd_sys_script_t == # This avc >> has a dont

Re: [CentOS] SELinux blocking cgi script from "writing to socket (httpd_t)"

2012-01-11 Thread 夜神　岩男
On 01/12/2012 03:48 AM, Daniel J Walsh wrote: > In Fedora we currently dontaudit this leak. > > audit2allow -i /tmp/t > > > #= httpd_sys_script_t == > # This avc has a dontaudit rule in the current policy > > allow httpd_sys_script_t httpd_t:udp_socket { read write };

Re: [CentOS] SELinux blocking cgi script from "writing to socket (httpd_t)"

2012-01-11 Thread 夜神　岩男
On 01/12/2012 03:18 AM, Bennett Haselton wrote: > Is this really supposed to get easier over time? :) Now my audit.log > file shows that SELinux is blocking my cgi script, index.cgi (which is > what's actually served when the user visits the front page of one of our > proxy sites like sugarsurfer.

Re: [CentOS] SELinux blocking cgi script from "writing to socket (httpd_t)"

2012-01-11 Thread Daniel J Walsh
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/11/2012 01:18 PM, Bennett Haselton wrote: > Is this really supposed to get easier over time? :) Now my > audit.log file shows that SELinux is blocking my cgi script, > index.cgi (which is what's actually served when the user visits the > front p

[CentOS] SELinux blocking cgi script from "writing to socket (httpd_t)"

2012-01-11 Thread Bennett Haselton
Is this really supposed to get easier over time? :) Now my audit.log file shows that SELinux is blocking my cgi script, index.cgi (which is what's actually served when the user visits the front page of one of our proxy sites like sugarsurfer.com) from having '"read write" to socket (httpd_t)'.