KH KH wrote:
2008/2/5, KaiGai Kohei <kaigai(a)ak.jp.nec.com>:
> Nicolas Chauvet wrote:
>> Hello !
>>
>> I try to use apache and postgresql with the dotclear blog engine.
>> When I try to enter the database information from the admin config
>> wizard within the browser, have a selinux denial :
>>
>> audit(1202182131.382:34): avc: denied { name_connect } for pid=2604
>> comm="httpd" dest=5432 scontext=system_u:system_r:httpd_t:s0
>> tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket
>>
>> [root@haderach ~]# ls -Z /home/www/
>> drwxr-xr-x root root system_u:object_r:httpd_sys_content_t:s0 dotclear
>>
>> [root@haderach ~]# rpm -q sepostgresql
>> sepostgresql-8.2.6-1.158.fc8
>> selinux-policy-3.0.8-81.fc8
>> selinux-policy-targeted-3.0.8-81.fc8
>>
>> [root@haderach data]# semodule -l |grep postgre
>> sepostgresql 1.158
> Can the following command help you?
>
> # setsebool -P httpd_can_network_connect_db=1
>
I does: the error disappeared, but i have another:
from /var/log/sepostgresql.log
FATAL: sepgsql_system_getpeercon(734): 'user_u:user_r:user_t' is not
a valid context
I guess you try to connect SE-PostgreSQL runnung on another host without
any labeled networking configuration.
SE-PostgreSQL tries to apply fallbacked security context when it cannot
obtain peer's context. The 'user_u:user_r:user_t' is default fallbacked
context.
Please confirm whether mcstransd is running, or not.
If not running, please start it.
I have also noticed an error in the same log file:
LOG: could not open directory "/usr/share/sepgsql/timezone": File or
directory doens't exist
Where i've made a ln -s timezoneset /usr/share/sepgsql/timezone.
It seems to me packageing error. I'll fix soon.
About phpPgAdmin: now i can connect but i have this all the time:
--------------
ERROR: SELinux: denied { set_param }
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:sepgsql_db_t:s0 tclass=db_database
name=dotclear
STATEMENT: set datestyle='ISO'
--------------
The default security policy for SE-PostgreSQL does not allow to execute
"SET ..." statement by non-administratvie users.
However, it might not be a appropriate policy. I'll update this part of
policy on the next update. please wait for some days.
Seems related to the command used to set the passwd ?!
psql -d dotclear -c "alter user dotclear with password 'my_passwd'"
I have used that previously from a wiki, without noticing well what
means templates1:
psql -d template1 -c "alter user dotclear with password 'my_passwd'"
and the same error sometimes appears with template1 instead of dotclear
Is it really same errors?
tuple:{update} on sepgsql_sysobj_t should be evaluated with ALTER USER statement.
If you want non-administrative users to execute the statement,
"sepgsql_enable_users_ddl" boolean should be turned on.
Thanks,
>> On the other hand, when i try to use phpPgAdmin, it works.
But i need to
>> change: /var/lib/pgsql/data/pg_hba.conf from ident sameuser to
>> md5.(tryed the same for dotclear without sucess).
Was /var/lib/sepgsql/data/pg_hba.conf from the above
--
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai(a)ak.jp.nec.com>