topic Re: audit with httpd tried to use file system at diff partition in Operating System - Linux

audit with httpd tried to use file system at diff partition

Tammy Liang — Tue, 23 Jan 2007 16:52:52 GMT

I got error message below after I try to start apache httpd daemon. I also see kernel: audit: avc: denied message in /var/log/messages file.

Starting httpd: Syntax error on line 265 of /etc/httpd/conf/httpd.conf:
DocumentRoot must be a directory

kernel: audit(1169587778.590:13): avc: denied { search } for pid=5072 comm="httpd" name="/" dev=sdb2 ino=2 scontext=root:system_r:httpd_t tcontext=system_u:object_r:file_t tclass=dir

Re: audit with httpd tried to use file system at diff partition

Tammy Liang — Tue, 23 Jan 2007 17:13:38 GMT

From the message for /var/log/messages file,
looks audit is involved.
How can I set audit or permission on
partition?

Thanks for any help and reply.

Re: audit with httpd tried to use file system at diff partition

Ivan Krastev — Tue, 23 Jan 2007 18:01:10 GMT

Take a look at this part:
Starting httpd: Syntax error on line 265 of /etc/httpd/conf/httpd.conf:
DocumentRoot must be a directory

fix document root for apache.

regards,
ivan

Re: audit with httpd tried to use file system at diff partition

Steven E. Protter — Tue, 23 Jan 2007 18:38:06 GMT

Shalom,

By default if you enabled SELINUX you will not be permitted a rootdocument for httpd server outside the /var filesystem.

Choices:
Totally disable selinux
Change selinux configuration to permit this.

SEP

Re: audit with httpd tried to use file system at diff partition

Tammy Liang — Wed, 24 Jan 2007 11:15:50 GMT

There is /users/web directory which is defined in DocumentRoot.

I don't think I have SElinux turned it on.
How can I check? How can i turn it off?

Thanks.

Re: audit with httpd tried to use file system at diff partition

Ivan Krastev — Wed, 24 Jan 2007 16:54:45 GMT

Use: sestatus
to obtain status of selinux.

For configuration use: system-config-securitylevel

There you can disable selinux for specific daemons - apache for example.

regards,
ivan

Re: audit with httpd tried to use file system at diff partition

Tammy Liang — Wed, 24 Jan 2007 16:57:41 GMT

Thanks, I got SElinux to enable apache to write to /users directory.