I guess FC3 SELinux matter(Re: Error: Permission denied: FastCGI: can't create server "/home/httpd/cgi-bin/php-starter": bind() failed

Hello, Maciej.

# This is repost. I forgot to change my From: to registered addr. Sorry.

At Wed, 16 Mar 2005 18:06:42 +0100,
Maciej Bochyński wrote:
> 
> [1  <text/plain; ISO-8859-2 (7bit)>]
> Hi,
> For a couple of days I tried to install and launch FastCGI with my
> Apache 2.0.52 + php 4.3.10 (Fedora Core 3).
> 

I guess you have a similar problem to me. I also use FC3 and my case is
both of perl and tcl. 

For my case, 

 # setenforce permissive

changed the situation. (Script worked fine, but /var/log/messages was
filled by audit warnings.)

Have you tried above? If it solves, then the problem is about
SELinux.

You can choose either:

 (a) disable selinux

or:

 (b) write and install SELinux configs for mod_fastcgi.

----------------------------------------

Here is my patch for (b). Since I'm *very* new to this ML and
SELinux, this may *not* a good/recommendable solution. And of course,
your scripts should have right security contexts.


To use this, you need 3 steps:

  # yum install selinux-policy-targeted-sources

  # cd /etc/selinux && patch -p0 < THIS_FILE

  # make -C /etc/selinux/targeted/src/policy reload


--- /dev/null   2005-03-04 00:08:22.471365248 +0900
+++ targeted/src/policy/domains/program/mod_fastcgi.te
@@ -0,0 +1,6 @@
+allow httpd_sys_script_t httpd_t:unix_stream_socket {
+  ioctl read write getattr accept shutdown
+};
+allow httpd_sys_script_t httpd_log_t:file {
+  ioctl
+};
--- /dev/null   2005-03-04 00:08:22.471365248 +0900
+++ targeted/src/policy/file_contexts/program/mod_fastcgi.fc
@@ -0,0 +1,2 @@
+# mod_fastcgi
+/var/run/fastcgi(/.*)?         system_u:object_r:httpd_var_run_t


Note: Creation of unix domain socket is still prohibited, so I expect
this is secure.
--
hkoba

___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/