Summary: SELinux is preventing /usr/sbin/httpd.worker from using potentially mislabeled files /etc/dirsrv. Detailed Description: SELinux has denied the httpd.worker access to potentially mislabeled files /etc/dirsrv. This means that SELinux will not allow httpd to use these files. If httpd should be allowed this access to these files you should change the file context to one of the following types, httpd_bugzilla_rw_content_t, httpd_nutups_cgi_script_exec_t, var_log_t, setrans_var_run_t, sysctl_crypto_t, samba_var_t, pki_ra_var_lib_t, pki_ra_var_run_t, avahi_var_run_t, sysctl_t, abrt_t, bin_t, lib_t, net_conf_t, mnt_t, httpd_cvs_rw_content_t, httpd_git_rw_content_t, httpd_nagios_content_t, httpd_sys_rw_content_t, httpd_w3c_validator_content_t, root_t, tmp_t, httpd_nagios_rw_content_t, usr_t, var_t, public_content_t, httpd_nutups_cgi_rw_content_t, httpd_cobbler_script_exec_t, anon_inodefs_t, httpd_sys_content_t, sysctl_kernel_t, var_lib_nfs_t, home_root_t, httpd_modules_t, httpd_smokeping_cgi_script_exec_t, httpd_git_content_t, httpd_user_content_t, mysqld_var_run_t, httpd_var_lib_t, httpd_var_run_t, device_t, nscd_var_run_t, nslcd_var_run_t, pki_ra_log_t, sssd_var_lib_t, var_t, httpd_squid_rw_content_t, httpd_apcupsd_cgi_content_t, etc_t, pki_tps_log_t, mysqld_db_t, proc_t, httpd_prewikka_content_t, gitosis_var_lib_t, httpd_smokeping_cgi_rw_content_t, httpd_apcupsd_cgi_rw_content_t, httpd_munin_content_t, httpd_squid_content_t, pki_tps_var_lib_t, pki_tps_var_run_t, httpd_awstats_script_exec_t, httpd_smokeping_cgi_content_t, mailman_archive_t, httpd_cvs_content_t, httpd_sys_content_t, logfile, public_content_rw_t, rpm_script_tmp_t, mailman_data_t, security_t, httpd_munin_script_exec_t, var_lock_t, sysctl_t, httpd_w3c_validator_script_exec_t, system_dbusd_var_lib_t, system_dbusd_var_run_t, bin_t, cert_t, httpd_prewikka_rw_content_t, httpd_user_script_exec_t, httpd_cobbler_content_t, squirrelmail_spool_t, httpd_t, httpd_bugzilla_content_t, lib_t, mnt_t, tmp_t, usr_t, var_t, httpd_apcupsd_cgi_script_exec_t, cobbler_var_lib_t, httpd_nagios_script_exec_t, rpm_tmp_t, nagios_etc_t, nagios_log_t, var_run_t, sssd_public_t, httpd_squid_script_exec_t, httpd_awstats_rw_content_t, httpd_w3c_validator_rw_content_t, winbind_var_run_t, cluster_conf_t, autofs_t, device_t, devpts_t, locale_t, likewise_var_lib_t, httpd_bugzilla_script_exec_t, fonts_cache_t, etc_t, fonts_t, httpd_log_t, proc_t, sysfs_t, tmpfs_t, httpd_awstats_content_t, var_lib_t, krb5_conf_t, httpd_user_rw_content_t, httpd_config_t, httpd_nutups_cgi_content_t, sysctl_net_t, rpm_log_t, httpd_cobbler_rw_content_t, httpd_prewikka_script_exec_t, calamaris_www_t, httpd_munin_rw_content_t, var_spool_t, httpd_cache_t, httpd_tmpfs_t, udev_tbl_t, httpd_tmp_t, httpd_sys_script_exec_t, iso9660_t, pki_tps_etc_rw_t, smokeping_var_lib_t, httpd_git_script_exec_t, var_lib_t, var_run_t, mysqld_etc_t, cvs_data_t, httpd_cvs_script_exec_t, configfile, pki_ra_etc_rw_t, dbusd_etc_t, abrt_var_run_t, httpd_squirrelmail_t, httpd_bugzilla_ra_content_t, httpd_bugzilla_rw_content_t, httpd_nutups_cgi_script_exec_t, httpd_cvs_ra_content_t, httpd_cvs_rw_content_t, httpd_git_ra_content_t, httpd_git_rw_content_t, httpd_nagios_content_t, httpd_sys_ra_content_t, httpd_sys_rw_content_t, httpd_w3c_validator_content_t, httpd_nagios_ra_content_t, httpd_nagios_rw_content_t, httpd_nutups_cgi_ra_content_t, httpd_nutups_cgi_rw_content_t, httpd_cobbler_script_exec_t, httpd_smokeping_cgi_script_exec_t, httpd_git_content_t, httpd_user_content_t, root_t, nscd_var_run_t, pcscd_var_run_t, httpd_squid_ra_content_t, httpd_squid_rw_content_t, httpd_apcupsd_cgi_content_t, httpd_prewikka_content_t, httpd_smokeping_cgi_ra_content_t, httpd_smokeping_cgi_rw_content_t, httpd_apcupsd_cgi_ra_content_t, httpd_apcupsd_cgi_rw_content_t, httpd_munin_content_t, httpd_squid_content_t, httpd_awstats_script_exec_t, httpd_smokeping_cgi_content_t, httpd_cvs_content_t, httpd_sys_content_t, httpd_munin_script_exec_t, httpd_w3c_validator_script_exec_t, httpd_prewikka_ra_content_t, httpd_prewikka_rw_content_t, httpd_user_script_exec_t, httpd_cobbler_content_t, httpd_bugzilla_content_t, var_t, var_t, httpd_apcupsd_cgi_script_exec_t, httpd_nagios_script_exec_t, httpd_squid_script_exec_t, httpd_awstats_ra_content_t, httpd_awstats_rw_content_t, httpd_w3c_validator_ra_content_t, httpd_w3c_validator_rw_content_t, httpd_bugzilla_script_exec_t, httpd_awstats_content_t, httpd_user_ra_content_t, httpd_user_rw_content_t, httpd_nutups_cgi_content_t, httpd_cobbler_ra_content_t, httpd_cobbler_rw_content_t, httpd_prewikka_script_exec_t, httpd_munin_ra_content_t, httpd_munin_rw_content_t, httpd_sys_script_exec_t, httpd_git_script_exec_t, var_run_t, var_run_t, httpd_cvs_script_exec_t. Many third party apps install html files in directories that SELinux policy cannot predict. These directories have to be labeled with a file context which httpd can access. Allowing Access: If you want to change the file context of /etc/dirsrv so that the httpd daemon can access it, you need to execute it using semanage fcontext -a -t FILE_TYPE '/etc/dirsrv'. where FILE_TYPE is one of the following: httpd_bugzilla_rw_content_t, httpd_nutups_cgi_script_exec_t, var_log_t, setrans_var_run_t, sysctl_crypto_t, samba_var_t, pki_ra_var_lib_t, pki_ra_var_run_t, avahi_var_run_t, sysctl_t, abrt_t, bin_t, lib_t, net_conf_t, mnt_t, httpd_cvs_rw_content_t, httpd_git_rw_content_t, httpd_nagios_content_t, httpd_sys_rw_content_t, httpd_w3c_validator_content_t, root_t, tmp_t, httpd_nagios_rw_content_t, usr_t, var_t, public_content_t, httpd_nutups_cgi_rw_content_t, httpd_cobbler_script_exec_t, anon_inodefs_t, httpd_sys_content_t, sysctl_kernel_t, var_lib_nfs_t, home_root_t, httpd_modules_t, httpd_smokeping_cgi_script_exec_t, httpd_git_content_t, httpd_user_content_t, mysqld_var_run_t, httpd_var_lib_t, httpd_var_run_t, device_t, nscd_var_run_t, nslcd_var_run_t, pki_ra_log_t, sssd_var_lib_t, var_t, httpd_squid_rw_content_t, httpd_apcupsd_cgi_content_t, etc_t, pki_tps_log_t, mysqld_db_t, proc_t, httpd_prewikka_content_t, gitosis_var_lib_t, httpd_smokeping_cgi_rw_content_t, httpd_apcupsd_cgi_rw_content_t, httpd_munin_content_t, httpd_squid_content_t, pki_tps_var_lib_t, pki_tps_var_run_t, httpd_awstats_script_exec_t, httpd_smokeping_cgi_content_t, mailman_archive_t, httpd_cvs_content_t, httpd_sys_content_t, logfile, public_content_rw_t, rpm_script_tmp_t, mailman_data_t, security_t, httpd_munin_script_exec_t, var_lock_t, sysctl_t, httpd_w3c_validator_script_exec_t, system_dbusd_var_lib_t, system_dbusd_var_run_t, bin_t, cert_t, httpd_prewikka_rw_content_t, httpd_user_script_exec_t, httpd_cobbler_content_t, squirrelmail_spool_t, httpd_t, httpd_bugzilla_content_t, lib_t, mnt_t, tmp_t, usr_t, var_t, httpd_apcupsd_cgi_script_exec_t, cobbler_var_lib_t, httpd_nagios_script_exec_t, rpm_tmp_t, nagios_etc_t, nagios_log_t, var_run_t, sssd_public_t, httpd_squid_script_exec_t, httpd_awstats_rw_content_t, httpd_w3c_validator_rw_content_t, winbind_var_run_t, cluster_conf_t, autofs_t, device_t, devpts_t, locale_t, likewise_var_lib_t, httpd_bugzilla_script_exec_t, fonts_cache_t, etc_t, fonts_t, httpd_log_t, proc_t, sysfs_t, tmpfs_t, httpd_awstats_content_t, var_lib_t, krb5_conf_t, httpd_user_rw_content_t, httpd_config_t, httpd_nutups_cgi_content_t, sysctl_net_t, rpm_log_t, httpd_cobbler_rw_content_t, httpd_prewikka_script_exec_t, calamaris_www_t, httpd_munin_rw_content_t, var_spool_t, httpd_cache_t, httpd_tmpfs_t, udev_tbl_t, httpd_tmp_t, httpd_sys_script_exec_t, iso9660_t, pki_tps_etc_rw_t, smokeping_var_lib_t, httpd_git_script_exec_t, var_lib_t, var_run_t, mysqld_etc_t, cvs_data_t, httpd_cvs_script_exec_t, configfile, pki_ra_etc_rw_t, dbusd_etc_t, abrt_var_run_t, httpd_squirrelmail_t, httpd_bugzilla_ra_content_t, httpd_bugzilla_rw_content_t, httpd_nutups_cgi_script_exec_t, httpd_cvs_ra_content_t, httpd_cvs_rw_content_t, httpd_git_ra_content_t, httpd_git_rw_content_t, httpd_nagios_content_t, httpd_sys_ra_content_t, httpd_sys_rw_content_t, httpd_w3c_validator_content_t, httpd_nagios_ra_content_t, httpd_nagios_rw_content_t, httpd_nutups_cgi_ra_content_t, httpd_nutups_cgi_rw_content_t, httpd_cobbler_script_exec_t, httpd_smokeping_cgi_script_exec_t, httpd_git_content_t, httpd_user_content_t, root_t, nscd_var_run_t, pcscd_var_run_t, httpd_squid_ra_content_t, httpd_squid_rw_content_t, httpd_apcupsd_cgi_content_t, httpd_prewikka_content_t, httpd_smokeping_cgi_ra_content_t, httpd_smokeping_cgi_rw_content_t, httpd_apcupsd_cgi_ra_content_t, httpd_apcupsd_cgi_rw_content_t, httpd_munin_content_t, httpd_squid_content_t, httpd_awstats_script_exec_t, httpd_smokeping_cgi_content_t, httpd_cvs_content_t, httpd_sys_content_t, httpd_munin_script_exec_t, httpd_w3c_validator_script_exec_t, httpd_prewikka_ra_content_t, httpd_prewikka_rw_content_t, httpd_user_script_exec_t, httpd_cobbler_content_t, httpd_bugzilla_content_t, var_t, var_t, httpd_apcupsd_cgi_script_exec_t, httpd_nagios_script_exec_t, httpd_squid_script_exec_t, httpd_awstats_ra_content_t, httpd_awstats_rw_content_t, httpd_w3c_validator_ra_content_t, httpd_w3c_validator_rw_content_t, httpd_bugzilla_script_exec_t, httpd_awstats_content_t, httpd_user_ra_content_t, httpd_user_rw_content_t, httpd_nutups_cgi_content_t, httpd_cobbler_ra_content_t, httpd_cobbler_rw_content_t, httpd_prewikka_script_exec_t, httpd_munin_ra_content_t, httpd_munin_rw_content_t, httpd_sys_script_exec_t, httpd_git_script_exec_t, var_run_t, var_run_t, httpd_cvs_script_exec_t. You can look at the httpd_selinux man page for additional information. Additional Information: Source Context unconfined_u:system_r:httpd_t:s0 Target Context system_u:object_r:dirsrv_config_t:s0 Target Objects /etc/dirsrv [ dir ] Source httpd.worker Source Path /usr/sbin/httpd.worker Port Host barfolomew.hra.local Source RPM Packages httpd-2.2.15-1.fc13 Target RPM Packages 389-ds-base-1.2.6-0.8.rc3.fc13 Policy RPM selinux-policy-3.7.19-33.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name httpd_bad_labels Host Name barfolomew.hra.local Platform Linux barfolomew.hra.local 2.6.33.6-147.fc13.x86_64 #1 SMP Tue Jul 6 22:32:17 UTC 2010 x86_64 x86_64 Alert Count 2 First Seen Thu 15 Jul 2010 11:09:00 AM CDT Last Seen Thu 15 Jul 2010 11:09:00 AM CDT Local ID 4120206e-3223-4145-90f9-a2e2129f42fa Line Numbers Raw Audit Messages node=barfolomew.hra.local type=AVC msg=audit(1279210140.552:32139): avc: denied { search } for pid=12106 comm="httpd.worker" name="dirsrv" dev=dm-1 ino=1048465 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:dirsrv_config_t:s0 tclass=dir node=barfolomew.hra.local type=SYSCALL msg=audit(1279210140.552:32139): arch=c000003e syscall=2 success=no exit=-13 a0=7f8458060dd0 a1=80000 a2=1b6 a3=7fffa028b610 items=0 ppid=12097 pid=12106 auid=2397 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="httpd.worker" exe="/usr/sbin/httpd.worker" subj=unconfined_u:system_r:httpd_t:s0 key=(null)