Selinux/Firewall Errors

[kevinscof]

I have installed FC6 and configure apache and php. For my default website httpd and the website all work as it is supposed to. I am using webmin also to setup virtual websites. When I add a virtual website httpd will not start. This following is my errors that I receive:
Apr 24 11:40:51 ns3 kernel: audit(1177436450.985:216): avc: denied { read write } for pid=3601 comm="httpd" name="0" dev=devpts ino=2 scontext=user_u:system_r:httpd_t:s0 tcontext=user_u:object_r:telnetd_devpts_t:s0 tclass=chr_file
Apr 24 11:40:51 ns3 kernel: audit(1177436450.986:217): avc: denied { read write } for pid=3601 comm="httpd" name="0" dev=devpts ino=2 scontext=user_u:system_r:httpd_t:s0 tcontext=user_u:object_r:telnetd_devpts_t:s0 tclass=chr_file
Apr 24 11:40:51 ns3 kernel: audit(1177436450.986:218): avc: denied { read write } for pid=3601 comm="httpd" name="0" dev=devpts ino=2 scontext=user_u:system_r:httpd_t:s0 tcontext=user_u:object_r:telnetd_devpts_t:s0 tclass=chr_file
Apr 24 11:40:51 ns3 kernel: audit(1177436450.986:219): avc: denied { read write } for pid=3601 comm="httpd" name="0" dev=devpts ino=2 scontext=user_u:system_r:httpd_t:s0 tcontext=user_u:object_r:telnetd_devpts_t:s0 tclass=chr_file
Apr 24 11:40:51 ns3 kernel: audit(1177436451.132:220): avc: denied { append } for pid=3601 comm="httpd" name="error_log" dev=dm-0 ino=11502084 scontext=user_u:system_r:httpd_t:s0 tcontext=user_u:object_r:home_root_t:s0 tclass=file

If I run the command /usr/sbin/setenforce 0 and then start httpd service everything is working fine. Both my default website and the new virtual website both show up and work as planned. I would like to have selinux running so I would like some help to figure out what I am missing as a setting. I have the webserver set in the firewall to be able to have access also.

[marcrblevins]

Did you look in Selinux/Firewall program, select Selinix tab, scroll down to httpd, click on right arrow. Read thru the list.

[kevinscof]

OK here is the other kicker. Im not running any GUI on this server. so which files would I need to look in to find this config file? I have looked all over the /etc/selinux folder and looked in all of the files there to see if there is anything in them I need set.

[jbannon]

Have a look in /selinux/booleans. All the HTTPD flags are listed there. You might also try getsebool -a | grep 'httpd' to see what you have enabled and disabled. The default settings for enforcing look like this:
allow_httpd_anon_write --> off
allow_httpd_apcupsd_cgi_script_anon_write --> off
allow_httpd_bugzilla_script_anon_write --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_squid_script_anon_write --> off
allow_httpd_sys_script_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
httpd_can_network_relay --> off
httpd_disable_trans --> off
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> on
httpd_rotatelogs_disable_trans --> off
httpd_ssi_exec --> off
httpd_suexec_disable_trans --> off
httpd_tty_comm --> off
httpd_unified --> on

From the look of your avc output I suggest turning httpd_tty_comm on. It is easy enough to try without permanently affecting the security settings using setsebool without the -P option.

[kevinscof]

This is what I have listed under getsebool -a::

allow_httpd_anon_write --> off
allow_httpd_apcupsd_cgi_script_anon_write --> off
allow_httpd_bugzilla_script_anon_write --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_squid_script_anon_write --> off
allow_httpd_sys_script_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_network_connect --> off
httpd_can_network_connect_db --> off
httpd_can_network_relay --> off
httpd_disable_trans --> off
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> on
httpd_rotatelogs_disable_trans --> off
httpd_ssi_exec --> off
httpd_suexec_disable_trans --> off
httpd_tty_comm --> off
httpd_unified --> on

[jbannon]

try 'setsebool httpd_can_network_connect on'. That might work since it seems httpd is being denied a network connection.

[kevinscof]

well that didnt work either. but I do apreciate all the help you have given... it is weird cause if I remove the virtual server that I setup httpd starts and runs fine with just the default server setup.. but as soon as I add another virtual is wont start back up.

[jbannon]

What can we eliminate without trying anything else? It's unlikely to be any of: apcupsd; bugzilla_script; squid_script; network_connect (since we've already established that); disable_trans; or suexec. This is making some assumptions: no printing; no bugzilla; and no su exec (i.e. it's not trying to change user). I seem to dimly recall though that virtual servers require some kind of additional write permissions but I'm not sure as it's a long time since I looked at httpd. Perhaps you could try enabling anon_write for cgi.