-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
KH KH wrote:
2008/2/6, Kohei KaiGai <kaigai(a)ak.jp.nec.com>:
> KH KH wrote:
>> 2008/2/5, KaiGai Kohei <kaigai(a)ak.jp.nec.com>:
>>> Nicolas Chauvet wrote:
>>>> Hello !
>>>>
>>>> I try to use apache and postgresql with the dotclear blog engine.
>>>> When I try to enter the database information from the admin config
>>>> wizard within the browser, have a selinux denial :
>>>>
>>>> audit(1202182131.382:34): avc: denied { name_connect } for pid=2604
>>>> comm="httpd" dest=5432 scontext=system_u:system_r:httpd_t:s0
>>>> tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket
>>>>
>>>> [root@haderach ~]# ls -Z /home/www/
>>>> drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 dotclear
>>>>
>>>> [root@haderach ~]# rpm -q sepostgresql
>>>> sepostgresql-8.2.6-1.158.fc8
>>>> selinux-policy-3.0.8-81.fc8
>>>> selinux-policy-targeted-3.0.8-81.fc8
>>>>
>>>> [root@haderach data]# semodule -l |grep postgre
>>>> sepostgresql 1.158
>>> Can the following command help you?
>>>
>>> # setsebool -P httpd_can_network_connect_db=1
>>>
>> I does: the error disappeared, but i have another:
>> from /var/log/sepostgresql.log
>> FATAL: sepgsql_system_getpeercon(734): 'user_u:user_r:user_t' is not
>> a valid context
> I guess you try to connect SE-PostgreSQL runnung on another host without
> any labeled networking configuration.
> SE-PostgreSQL tries to apply fallbacked security context when it cannot
> obtain peer's context. The 'user_u:user_r:user_t' is default fallbacked
> context.
>
> Please confirm whether mcstransd is running, or not.
> If not running, please start it.
mcstans installed and started, this solved many problems.
Actually i'm running SE-PostgreSQL on my server host with phpPgAdmin
on the same host but browsed from my workstation.
Now i can enter the parameters from the database and setup my blog engine, thx.
It remains some Selinux denials with sendmail (dotclear want to send a
mail to the admin of the blog engine and with phpPgAdmin
Selinux denials with sendmail:
-------------------
audit(1202299741.450:42): avc: denied { search } for pid=12667
comm="sendmail" name="mail" dev=sda6 ino=1573785
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:etc_mail_t:s0 tclass=dir
audit(1202299741.450:43): avc: denied { search } for pid=12667
comm="sendmail" name="mail" dev=sda6 ino=1573785
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:etc_mail_t:s0 tclass=dir
audit(1202299741.451:44): avc: denied { getattr } for pid=12667
comm="sendmail" path="/etc/mail" dev=sda6 ino=1573785
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:etc_mail_t:s0 tclass=dir
Turn on the httpd_can_sendmail
boolean
-------------------
>> I have also noticed an error in the same log file:
>> LOG: could not open directory "/usr/share/sepgsql/timezone": File or
>> directory doens't exist
>> Where i've made a ln -s timezoneset /usr/share/sepgsql/timezone.
> It seems to me packageing error. I'll fix soon.
>
>> About phpPgAdmin: now i can connect but i have this all the time:
>> --------------
>> ERROR: SELinux: denied { set_param }
>> scontext=system_u:system_r:httpd_t:s0
>> tcontext=system_u:object_r:sepgsql_db_t:s0 tclass=db_database
>> name=dotclear
>> STATEMENT: set datestyle='ISO'
>> --------------
> The default security policy for SE-PostgreSQL does not allow to execute
> "SET ..." statement by non-administratvie users.
> However, it might not be a appropriate policy. I'll update this part of
> policy on the next update. please wait for some days.
>
>> Seems related to the command used to set the passwd ?!
>> psql -d dotclear -c "alter user dotclear with password
'my_passwd'"
>> I have used that previously from a wiki, without noticing well what
>> means templates1:
>> psql -d template1 -c "alter user dotclear with password
'my_passwd'"
>> and the same error sometimes appears with template1 instead of dotclear
> Is it really same errors?
This error also appears all the time with phpPgAdmin but with a
different name={dotclear,template1} . The second one appears when I
want to delete a unused database:
-------------------------
Erreur SQL :
ERROR: SELinux: denied { set_param }
scontext=system_u:system_r:httpd_t
tcontext=system_u:object_r:sepgsql_db_t tclass=db_database
name=template1
Dans l'instruction :
set datestyle='ISO'
-------------------------
Erreur SQL :
ERROR: SELinux: denied { drop } scontext=system_u:system_r:httpd_t
tcontext=system_u:object_r:sepgsql_db_t tclass=db_database
name=postgres
Dans l'instruction :
DROP DATABASE "postgres"
--------------------------
> tuple:{update} on sepgsql_sysobj_t should be evaluated with ALTER USER statement.
>
> If you want non-administrative users to execute the statement,
> "sepgsql_enable_users_ddl" boolean should be turned on.
I have turn this on also, actually even connected from sepgsql user
show the error.
Thx for your help!
Nicolas (kwizart )
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org
iEYEARECAAYFAkep0cMACgkQrlYvE4MpobNDTwCggfNV7xx00Qj60BSWQTBHVsLz
2AcAn0T/VNEYy/QFlp0ZdkXPLALcIwnu
=tLmS
-----END PGP SIGNATURE-----