☰

SELinux “anon_hugepage” PHP-FPM 权限错误

tag-icon • tag-icon centos php-fpm centos7 selinux
SELinux “anon_hugepage” PHP-FPM 权限错误

请解释以下错误的来源以及为什么我的文件列表中缺少“anon_hugepage”。

SELinux 阻止 /usr/sbin/php-fpm 对文件 /anon_hugepage (已删除) 进行写访问。

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label. 
/anon_hugepage (deleted) default label should be etc_runtime_t.
Then you can run restorecon.
Do \# /sbin/restorecon -v /anon_hugepage (deleted)

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that php-fpm should be allowed write access on the anon_hugepage (deleted) file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do allow this access for now by executing:

\# grep php-fpm /var/log/audit/audit.log | audit2allow -M mypol

\# semodule -i mypol.pp


Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:hugetlbfs_t:s0
Target Objects                /anon_hugepage (deleted) [ file ]
Source                        php-fpm
Source Path                   /usr/sbin/php-fpm
Port                          <Unknown>
Host                          localhost
Source RPM Packages           php70w-fpm-7.0.11-1.w7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-60.el7_2.9.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     instance-1
Platform                      Linux instance-1 3.10.0-327.36.1.el7.x86_64 #1 SMP
                              Sun Sep 18 13:04:29 UTC 2016 x86_64 x86_64
Alert Count                   1
First Seen                    2016-10-07 08:46:26 UTC
Last Seen                     2016-10-07 08:46:26 UTC
Local ID                      1711a7c8-1f3d-4dda-be96-69f7553186d4

Raw Audit Messages
type=AVC msg=audit(1475829986.9:445): avc:  denied  { write } for  pid=1360 comm="php-fpm" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=18206 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=file


type=SYSCALL msg=audit(1475829986.9:445): arch=x86_64 syscall=mmap success=no exit=EACCES a0=0 a1=8000000 a2=3 a3=40021 items=0 ppid=1 pid=1360 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=php-fpm exe=/usr/sbin/php-fpm subj=system_u:system_r:httpd_t:s0 key=(null)

Hash: php-fpm,httpd_t,hugetlbfs_t,file,write

****

我尝试了以下操作，但没有成功：

touch /anon_hugepage
semanage fcontext -a -t etc_runtime_t /anon_hugepage
restorecon -v /anon_hugepage

答案1

我觉得文件anon_hugepage丢失了，因为它显示“已删除”。此外，消息还指出要更改运行时并执行：

/sbin/restorecon -v /anon_hugepage

启用 SELinux 后，php 应该能够访问该文件。请确保该文件存在并且具有正确的权限和所有权。

相关内容