2008/2/6, Kohei KaiGai <kaigai(a)ak.jp.nec.com>:
KH KH wrote:
> 2008/2/5, KaiGai Kohei <kaigai(a)ak.jp.nec.com>:
>> Nicolas Chauvet wrote:
>>> Hello !
>>>
>>> I try to use apache and postgresql with the dotclear blog engine.
>>> When I try to enter the database information from the admin config
>>> wizard within the browser, have a selinux denial :
>>>
>>> audit(1202182131.382:34): avc: denied { name_connect } for pid=2604
>>> comm="httpd" dest=5432 scontext=system_u:system_r:httpd_t:s0
>>> tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket
>>>
>>> [root@haderach ~]# ls -Z /home/www/
>>> drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 dotclear
>>>
>>> [root@haderach ~]# rpm -q sepostgresql
>>> sepostgresql-8.2.6-1.158.fc8
>>> selinux-policy-3.0.8-81.fc8
>>> selinux-policy-targeted-3.0.8-81.fc8
>>>
>>> [root@haderach data]# semodule -l |grep postgre
>>> sepostgresql 1.158
>> Can the following command help you?
>>
>> # setsebool -P httpd_can_network_connect_db=1
>>
> I does: the error disappeared, but i have another:
> from /var/log/sepostgresql.log
> FATAL: sepgsql_system_getpeercon(734): 'user_u:user_r:user_t' is not
> a valid context
I guess you try to connect SE-PostgreSQL runnung on another host without
any labeled networking configuration.
SE-PostgreSQL tries to apply fallbacked security context when it cannot
obtain peer's context. The 'user_u:user_r:user_t' is default fallbacked
context.
Please confirm whether mcstransd is running, or not.
If not running, please start it.
mcstans installed and started, this solved many
problems.
Actually i'm running SE-PostgreSQL on my server host with phpPgAdmin
on the same host but browsed from my workstation.
Now i can enter the parameters from the database and setup my blog engine, thx.
It remains some Selinux denials with sendmail (dotclear want to send a
mail to the admin of the blog engine and with phpPgAdmin
Selinux denials with sendmail:
-------------------
audit(1202299741.450:42): avc: denied { search } for pid=12667
comm="sendmail" name="mail" dev=sda6 ino=1573785
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:etc_mail_t:s0 tclass=dir
audit(1202299741.450:43): avc: denied { search } for pid=12667
comm="sendmail" name="mail" dev=sda6 ino=1573785
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:etc_mail_t:s0 tclass=dir
audit(1202299741.451:44): avc: denied { getattr } for pid=12667
comm="sendmail" path="/etc/mail" dev=sda6 ino=1573785
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:etc_mail_t:s0 tclass=dir
-------------------
> I have also noticed an error in the same log file:
> LOG: could not open directory "/usr/share/sepgsql/timezone": File or
> directory doens't exist
> Where i've made a ln -s timezoneset /usr/share/sepgsql/timezone.
It seems to me packageing error. I'll fix soon.
> About phpPgAdmin: now i can connect but i have this all the time:
> --------------
> ERROR: SELinux: denied { set_param }
> scontext=system_u:system_r:httpd_t:s0
> tcontext=system_u:object_r:sepgsql_db_t:s0 tclass=db_database
> name=dotclear
> STATEMENT: set datestyle='ISO'
> --------------
The default security policy for SE-PostgreSQL does not allow to execute
"SET ..." statement by non-administratvie users.
However, it might not be a appropriate policy. I'll update this part of
policy on the next update. please wait for some days.
> Seems related to the command used to set the passwd ?!
> psql -d dotclear -c "alter user dotclear with password
'my_passwd'"
> I have used that previously from a wiki, without noticing well what
> means templates1:
> psql -d template1 -c "alter user dotclear with password
'my_passwd'"
> and the same error sometimes appears with template1 instead of dotclear
Is it really same errors?
This error also appears all the time with phpPgAdmin but
with a
different name={dotclear,template1} . The second one appears when I
want to delete a unused database:
-------------------------
Erreur SQL :
ERROR: SELinux: denied { set_param }
scontext=system_u:system_r:httpd_t
tcontext=system_u:object_r:sepgsql_db_t tclass=db_database
name=template1
Dans l'instruction :
set datestyle='ISO'
-------------------------
Erreur SQL :
ERROR: SELinux: denied { drop } scontext=system_u:system_r:httpd_t
tcontext=system_u:object_r:sepgsql_db_t tclass=db_database
name=postgres
Dans l'instruction :
DROP DATABASE "postgres"
--------------------------
tuple:{update} on sepgsql_sysobj_t should be evaluated with ALTER
USER statement.
If you want non-administrative users to execute the statement,
"sepgsql_enable_users_ddl" boolean should be turned on.
I have turn this
on also, actually even connected from sepgsql user
show the error.
Thx for your help!
Nicolas (kwizart )