Re: mj2 install on CentOS 6 - cgi access issues (selinux?)

>>>>> "RW" == Richard Welty <[email protected]> writes:

RW> bigger hammer applied. there is a script available which can process
RW> the AVC messages from an selinux audit log and produce an selinux
RW> policy module that can then be installed to resolve the issues.

Sure; just run:
  audit2allow -M local < list_of_avcs

Then, as root:
  semodule -i local.pp

Test, see what additional AVCs you might get, add them to the
list_of_avcs file, and rerun both commands.  You can see recent AVCs
with (as root):
  ausearch -m avc -ts recent
replace "recent" with "today" or something like "06:00:00" as you wish.

I generally run in permissive mode (setenforce 0) for a while, collect
relevant AVCs (since you will see some unrelated ones), and occasionally
add them to the list_of_avcs file and reprocess it.

If you still have failures you can't attribute to regular permissions,
you can also try disabling dontaudit rules with (as root):
  semodule -BD
Check for anything new that's relevant, and then
  semodule -B
to turn them back on.

There's also audit2why, which will tell you if you have neglected to set
some important selinux boolean.

Wouldn't do any of this on Centos6, though.  There shouldn't be much
reason not to use 7.

 - J<