SELinux has broken Bugzilla

[ian5251]

Hello,

Background
I have recently upgraded from FC12 to FC13, and last week I updated all packages using YUM. The system is running as a VM inside CentOS 5.5 using KVM. SELinux is enforcing, using the targeted policy. Bugzilla is version 3.6.1 and was NOT installed using RPM or YUM.

My Problem
Bugzilla was working OK on this machine until SELinux was upgraded last week from 3.7.19-28 to 3.7.19-33, and is still broken after testing 3.7.19-37 from the testing repo. With SELinux in enforcing mode, apache returns error 500 when I browse to the main bugzilla page. The apache error log shows this:-

[Mon Jul 19 13:15:08 2010] [error] [client 192.168.40.1] (13)Permission denied: exec of '/var/www/html/bugzilla/index.cgi' failed

Nothing, and I mean absolutely nothing, is recorded in /var/log/audit/audit.log, /var/log/messages or /var/log/secure.

If I set SELinux to Permissive, the problem goes away. My SELinux booleans for HTTP are:-

[root@xxx log]# getsebool -a | grep http
allow_httpd_anon_write --> off
allow_httpd_mod_auth_ntlm_winbind --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_sys_script_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_network_connect --> on
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> on
httpd_can_network_relay --> off
httpd_can_sendmail --> on
httpd_dbus_avahi --> on
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> on
httpd_execmem --> off
httpd_read_user_content --> off
httpd_setrlimit --> off
httpd_ssi_exec --> off
httpd_tmp_exec --> off
httpd_tty_comm --> off
httpd_unified --> off
httpd_use_cifs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off
[root@xxx log]#

I have ensured all ownership and contexts are correct, by using these commands:-

[root@xxx bugzilla]# chown -R apache:apache *
[root@xxx bugzilla]# chcon -R --reference=/var/www/html *

Execute permissions are OK, because the site works when SELinux is Permissive.

Questions

1. If SELinux is blocking index.cgi or some part of it, why isn't anything written to /var/log/audit/audit.log?
2. Can you suggest changing any of my boolean values to solve this?

I have other web-apps using MySQL and they are running correctly in enforcing mode, so it isn't a database issue.

Thanks for reading, and I look forward to receiving your assistance

Ian

[LaKing]

SElinux has some own command of changeing some flags, 'security context' on files, but Im not an SElinux expert.

[jpollard]

If you set SELinux into permissive mode then the log errors should also give you
a reference to what you need to fix/change to eliminate the errors.

I HAVE noticed that there are several files that have a slightly different security
label. I have not yet reloaded the web server...

[ian5251]

As I said, nothing is appearing in the log files. This is very bizarre. Regardless whether SELinux is Permissive or Enforcing, nothing is written to the log files.

[RogerBacon]

As I said, nothing is appearing in the log files. This is very bizarre. Regardless whether SELinux is Permissive or Enforcing, nothing is written to the log files.

Well, if you are running the auditd deamon you can try to temporary disable it, in that case the AVCs will go to /var/log/messges.

If that doesn't work you can disable the dontaudit rules from the policy : semodule -D -B to see if it's something that is dontaudit.

It's hard to tell without the AVC(s).

[domg472]

Policy says that bugzilla cgi script are expected to be in /usr/share/bugzilla.

a reposquery -ql bugzilla confirms this

httpd_t is not allowed to execute generic httpd content

you can fix this particular issue by:

chcon -t httpd_bugzilla_script_exec_t /var/www/html/bugzilla/index.cgi

but it is recommended that you use the bugzilla package provided by fedora