[CentOS] selinux denial of cgi script with httpd using ssl

Am 04.09.2017 um 23:49 schrieb Gregory P. Ennis:
> Thanks for your help.
> 
> I did pick up an additional entry in the audit file :
> 
> 
> type=AVC msg=audit(1504561395.709:10196): avc:  denied  { execute } for
> pid=19163 comm="/usr/sbin/httpd" name="s.check.cgi" dev="dm-0"
> ino=537182029 scontext=system_u:system_r:httpd_t:s0
> tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=file
> 
> Unfortunately, I am not sure how the above tells me what is wrong.
> 
> Greg

 From above log entry you see that the file object denied to execute 
('/var/www/cgi-bin/name.of.script.cgi) has the SELinux context type 
httpd_sys_content_t.

# semanage fcontext -l | grep '/var/www/cgi-bin'
/var/www/cgi-bin(/.*)?                             all files 
system_u:object_r:httpd_sys_script_exec_t:s0
[ ... ]

The permitted type is httpd_sys_script_exec_t.

`restorecon -Rv /var/www/cgi-bin/' can fix it. Or more targeted `chcon 
-t httpd_sys_script_exec_t /var/www/cgi-bin/name.of.script.cgi'.

Both audit2why and audit2allow suggest to activate a boolean which you 
may not want to set as it disables a more fine grained priviledge 
separation in the context of httpd actions.

Alexander