☰

selinux“此策略可能不匹配....”

tag-icon • tag-icon linux security selinux
selinux“此策略可能不匹配....”

我该如何解决以下错误：

type=AVC msg=audit(1365523330.609:4846): avc:  denied  { append } for  pid=12542 comm="FTPMan.pl" name="user_list" dev=dm-0 ino=2884237 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file

Was caused by:
    Unknown - would be allowed by active policy
    Possible mismatch between this policy and the one under which the audit message was generated.

    Possible mismatch between current in-memory boolean settings vs. permanent ones.

关于这个特定错误的文档并不多。

答案1

检查 apache 日志以查找导致问题的实际文件（对我来说是 mod_jk.so）。希望你能在错误日志中找到一行，例如

Cannot load /opt/coldfusion10/config/wsconfig/1/mod_jk.so into server: /opt/coldfusion10/config/wsconfig/1/mod_jk.so: failed to map segment from shared object: Permission denied

然后将该文件的 selinux 权限与 http 可执行文件的权限进行比较。对我来说，它们是

# ls -ldZ /opt/coldfusion10/config/wsconfig/1/mod_jk.so
-rwxr-xr-x. nobody nobody unconfined_u:object_r:httpd_log_t:s0 /opt/coldfusion10/config/wsconfig/1/mod_jk.so
# ls -ldZ /usr/sbin/httpd
-rwxr-xr-x. root root system_u:object_r:httpd_exec_t:s0 /usr/sbin/httpd

您可以看到 mod_jk.so 与 httpd 二进制文件具有不同的权限。要修复此问题，只需将它们设置为相同

# sudo chcon -R -u system_u -r object_r -t httpd_exec_t /opt/coldfusion10/config/wsconfig/1/mod_jk.so

现在它们匹配了，并且对我来说 apache 再次启动了（不会损害我的服务器安全）

相关内容