SELinux preventing Apache from writing to a file
Solution 1
For files you want Apache to be able to write to, the type must be set to httpd_sys_rw_content_t
.
Solution 2
As already stated, you should instruct SELINUX to allow writing to that file. The right thing to do is to mark /var/www/webapp/k/site/
as of type httpd_sys_rw_content_t
To permanently mark that directory as httpd_sys_rw_content_t
, you can use the command semanage fcontext -a -t httpd_sys_rw_content_t /var/www/webapp/k/site(/.*)?; restorecon -RF /var/www/webapp/k/site/
This will survive SELINUX binary policy updates and filesystem relabeling.
Solution 3
This will change the permissions:
chcon --type httpd_sys_rw_content_t /var/www/webapp/k/site/k.log
Clodoaldo
Updated on September 18, 2022Comments
-
Clodoaldo almost 2 years
SELinux is preventing the
apache
user from writing to a log file which it owns. When I dosetenforce 0
it works. Otherwise it shows this errorIOError: [Errno 13] Permission denied: '/var/www/webapp/k/site/k.log'
The security context of the file:
$ ll -Z k.log -rw-r--r--. apache apache system_u:object_r:httpd_sys_content_t:s0 k.log
The file was created when the SELinux mode was set to permissive.
How to set the security context so the
apache
user can write in that directory? I did set that directory security context usingchcon
but I can't find a suitable file type.From
audit.log
:type=AVC msg=audit(1409945481.163:1561): avc: denied { append } for pid=16862 comm="httpd" name="k.log" dev="dm-1" ino=201614333 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file type=SYSCALL msg=audit(1409945481.163:1561): arch=c000003e syscall=2 success=no exit=-13 a0=7fa8080847a0 a1=441 a2=1b6 a3=3 items=0 ppid=15256 pid=16862 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
-
Derrick Miller over 5 yearsI get this error: -bash: syntax error near unexpected token `('
-
Michael Hampton over 5 yearsYou probably need to escape the parentheses from the shell.