You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by David Johnson <dj...@schoolcraft.edu> on 2015/10/16 16:21:45 UTC
[users@httpd] Error executing script through Apache
Hello Apache community,
I am migrating our schools ERP system from HP-UX to Redhat.
We run a UniData database utilizing Apache to access our data through our intranet.
All I am trying to do is migrate the system to the new OS, but I am having issues initializing the database through Apache.
I have it configured to run as user www, and we are trying to execute a cgi script that is really very simple.
It is setting a few environment variables, changing directory, and calling the database program.
I have the httpd.conf set up to allow cgi execution, have mapped my script alias directory.
I can execute cgi scripts fine, but when I try to call the UniData database I get the error "Error when getting SMM's shmid (errno=13)."
I opened a case with Rocket (They own UniData) and they said...
"errno=13 is coming from the Linux level and is a 'permissions denied' error. You may want to try what the user is trying as root, or check on the permissions of files they are trying to use"
As you know I cannot run Apache as root, and when I call the cgi script from the command line as user www it works just fine, so I know it not permissions on the database files.
Does anyone have any clues as to what I may need to change in my configuration?
What would be different about being logged in as www at the command line and calling a script vs. running Apache as www and calling it through the intranet?
Thank you in advance for any help any of you may have to offer!
David C. Johnson
David C.Johnson
Schoolcraft College
Administrative Systems
Senior Systems Administrator
A-180
1(734)462-4716
djohnson@schoolcraft.edu<ma...@schoolcraft.edu>
Re: [users@httpd] Error executing script through Apache
Posted by Pete Houston <ph...@openstrike.co.uk>.
On Fri, Oct 16, 2015 at 02:37:24PM +0000, David Johnson wrote:
> Please forgive my ignorance, but what can I do now to resolve this?
Depending on your current SELinux policy and what precisely it is that
you want to allow you could either adjust an appropriate boolean,
correct any files/dirs with the wrong contexts or make a policy
adjustment.
If you have support for this particular application from the vendor you
could of course go back to them with the extract from the audit log and
ask for their advice. That's probably the best plan. If they just say
"Disable SELinux" then ignore their advice :-)
Good luck,
Pete
--
Openstrike - improving business through open source
http://www.openstrike.co.uk/ or call 01722 770036
RE: [users@httpd] Error executing script through Apache
Posted by David Johnson <dj...@schoolcraft.edu>.
Hello All
Pete - You were right!
When I try to execute I get this in the audit log.
type=AVC msg=audit(1445006093.179:15955): avc: denied { write } for pid=22733 comm="udt" name="apphome" dev=dm-0 ino=23199745 scontext=unconfined_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=dir
type=SYSCALL msg=audit(1445006093.179:15955): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=ffeb8bcc a1=242 a2=1b6 a3=7 items=0 ppid=22731 pid=22733 auid=0 uid=800 gid=100 euid=800 suid=800 fsuid=800 egid=100 sgid=100 fsgid=100 tty=(none) ses=1242 comm="udt" exe="/usr/ud73/bin/udt" subj=unconfined_u:system_r:httpd_sys_script_t:s0 key=(null)
type=AVC msg=audit(1445006093.179:15956): avc: denied { append } for pid=22733 comm="udt" name="udt.errlog" dev=dm-0 ino=64490264 scontext=unconfined_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file
type=SYSCALL msg=audit(1445006093.179:15956): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=ffeb66ac a1=441 a2=1b6 a3=83d46a9 items=0 ppid=22731 pid=22733 auid=0 uid=800 gid=100 euid=800 suid=800 fsuid=800 egid=100 sgid=100 fsgid=100 tty=(none) ses=1242 comm="udt" exe="/usr/ud73/bin/udt" subj=unconfined_u:system_r:httpd_sys_script_t:s0 key=(null)
type=AVC msg=audit(1445006093.179:15957): avc: denied { associate } for pid=22733 comm="udt" key=1157629479 scontext=unconfined_u:system_r:httpd_sys_script_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm
type=SYSCALL msg=audit(1445006093.179:15957): arch=40000003 syscall=117 per=400000 success=no exit=-13 a0=17 a1=45000627 a2=0 a3=0 items=0 ppid=22731 pid=22733 auid=0 uid=800 gid=100 euid=800 suid=800 fsuid=800 egid=100 sgid=100 fsgid=100 tty=(none) ses=1242 comm="udt" exe="/usr/ud73/bin/udt" subj=unconfined_u:system_r:httpd_sys_script_t:s0 key=(null)
Please forgive my ignorance, but what can I do now to resolve this?
Thank you,
David C. Johnson
David C.Johnson
Schoolcraft College
Administrative Systems
Senior Systems Administrator
A-180
1(734)462-4716
djohnson@schoolcraft.edu
-----Original Message-----
From: Pete Houston [mailto:ph1@openstrike.co.uk]
Sent: Friday, October 16, 2015 10:27 AM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Error executing script through Apache
On Fri, Oct 16, 2015 at 02:21:45PM +0000, David Johnson wrote:
> What would be different about being logged in as www at the command line and calling a script vs. running Apache as www and calling it through the intranet?
The SELinux context will be different. Check the audit log to see if it's being denied.
Pete
--
Openstrike - improving business through open source http://www.openstrike.co.uk/ or call 01722 770036
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Error executing script through Apache
Posted by Pete Houston <ph...@openstrike.co.uk>.
On Fri, Oct 16, 2015 at 02:21:45PM +0000, David Johnson wrote:
> What would be different about being logged in as www at the command line and calling a script vs. running Apache as www and calling it through the intranet?
The SELinux context will be different. Check the audit log to see if
it's being denied.
Pete
--
Openstrike - improving business through open source
http://www.openstrike.co.uk/ or call 01722 770036