[CentOS] appdynamics php agent prevented by SELinux

Mon May 11 16:09:48 UTC 2015
Valeri Galtsev <galtsev at kicp.uchicago.edu>

On Mon, May 11, 2015 10:38 am, Tim Dunphy wrote:
>>
>> If rpm is configured for _that_ location of log files, I would remove
>> the
>> repository this rpm comes from from configuration and will remember to
>> never-never ever use that repository for anything.
>>
>> Just my $0.02
>>
>
> Yeah I completely get where you're coming from there. However it's not an
> RPM from a repo. I downloaded the rpm from the appdynamics site itself.
> While it may be easy to say "well then just don't use appdynamics"!
> That's
> not a luxury I have. My company uses it and I need to get up to speed on
> how to work with it. So that's why I'm trying out this experiment.

OK, then this is what I would do: create some benign place for that, say,

/opt/appdynamics

Then install rpm with "--root /opt/appdynamics" option. This will force
rpm prepend all paths with "/opt/appdynamics". Instead of, say, putting
something into /usr/lib, it will put this stuff into
/opt/appdynamics/usr/lib (and will create missing paths there when
necessary). So:

rpm -ivh --root /opt/appdynamics/ [your appdynamics rpm name].rpm

After that done, you may need to describe the paths to binaries, libraries
there, say, by adding for libraries:

echo "/opt/appdynamics" >> /etc/ld.so.conf
/sbin/ldconfig -v

and adding extra paths to, say, /etc/profile...

I hope, this helps.

Valeri

>
> Thanks,
> Tim
>
> On Mon, May 11, 2015 at 11:22 AM, Valeri Galtsev
> <galtsev at kicp.uchicago.edu>
> wrote:
>
>>
>> On Mon, May 11, 2015 9:47 am, Tim Dunphy wrote:
>> >>
>> >> That's a rather odd (personally, I think bad) place for a log (or
>> >> even logfile lock) and I'm not at all surprised that selinux is
>> >> keeping your application from writing there. I would check to see if
>> >> there is a setup/configuration option for your application to put
>> >> the log files and related in a more standard location (/var/log,
>> >> /var/run), where it is less likely to run into an issue.
>> >
>> >
>> > Yeah I agree that it's an unusual place to store log files. However
>> I'm
>> > not
>> > aware of any way to change that location since it's an RPM install.
>>
>> If rpm is configured for _that_ location of log files, I would remove
>> the
>> repository this rpm comes from from configuration and will remember to
>> never-never ever use that repository for anything.
>>
>> Just my $0.02
>>
>> Valeri
>>
>> > Maybe
>> > a
>> > source install is possible. I'll do some googling.
>> >
>> >
>> >>
>> >> This isn't really a C7-specific issue/"problem".
>> >
>> >
>> > Yeah that's right. I said that poorly. I had just been dealing with an
>> > issue with systemctl priror to that which was due to it being a C7
>> > machine.
>> > But really only because I had been using systemctl.
>> >
>> > What I'm most curious about is how Apache is reporting SELinux
>> problems
>> > whether or not SELinux is enabled. Like I said earlier, if I have
>> SELinux
>> > set to off, you still see those kind of messages relating to SELinux
>> when
>> > you do a status on httpd.
>> >
>> > Odd.  One thing I did try was to do a restorecon -R -v
>> > /usr/lib/appdynamics-php5/.
>> >
>> > Since it might not be easy to change paths I was hoping to find a way
>> to
>> > solve this using SELinux.. Does anyone else have any suggestions on
>> how
>> to
>> > solve this?
>> >
>> > Thanks,
>> > Tim
>> >
>> > On Sun, May 10, 2015 at 10:20 PM, Richard <
>> > lists-centos at listmail.innovate.net> wrote:
>> >
>> >>
>> >>
>> >> ------------ Original Message ------------
>> >> > Date: Sunday, May 10, 2015 09:02:11 PM -0400
>> >> > From: Tim Dunphy <bluethundr at gmail.com>
>> >> >
>> >> > Hey guys,
>> >> >
>> >> > I've got another C7 problem I was hoping to solve. I
>> >> > installed appdynamics-php-agent-4.0.5.0-1.x86_64 on a C7.1 host.
>> >> >
>> >> > It's failing to communicate with it's controller on another host.
>> >> > And this is the interesting part. Whether or not I have SELinux
>> >> > enabled, I have apache reporting SELinux problems.
>> >> >
>> >> > [root at web1:~] #getenforce
>> >> > Permissive
>> >> >
>> >> > May 10 20:47:56 web1 python[25735]: SELinux is preventing
>> >> > /usr/lib/appdynamics-php5/proxy/jre/bin/java from write access on
>> >> > the file /usr/lib/appdynamics-php5/logs/agent.log.lck.
>> >> >
>> >> >                                     *****  Plugin catchall (100.
>> >>
>> >> That's a rather odd (personally, I think bad) place for a log (or
>> >> even logfile lock) and I'm not at all surprised that selinux is
>> >> keeping your application from writing there. I would check to see if
>> >> there is a setup/configuration option for your application to put
>> >> the log files and related in a more standard location (/var/log,
>> >> /var/run), where it is less likely to run into an issue.
>> >>
>> >> This isn't really a C7-specific issue/"problem".
>> >>
>> >>
>> >> _______________________________________________
>> >> CentOS mailing list
>> >> CentOS at centos.org
>> >> http://lists.centos.org/mailman/listinfo/centos
>> >>
>> >
>> >
>> >
>> > --
>> > GPG me!!
>> >
>> > gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B
>> > _______________________________________________
>> > CentOS mailing list
>> > CentOS at centos.org
>> > http://lists.centos.org/mailman/listinfo/centos
>> >
>>
>>
>> ++++++++++++++++++++++++++++++++++++++++
>> Valeri Galtsev
>> Sr System Administrator
>> Department of Astronomy and Astrophysics
>> Kavli Institute for Cosmological Physics
>> University of Chicago
>> Phone: 773-702-4247
>> ++++++++++++++++++++++++++++++++++++++++
>> _______________________________________________
>> CentOS mailing list
>> CentOS at centos.org
>> http://lists.centos.org/mailman/listinfo/centos
>>
>
>
>
> --
> GPG me!!
>
> gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>


++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++