☰

我需要如何配置 selinux 才能拥有“setenforce 1”并且仍然能够运行我的 web 服务？

tag-icon • tag-icon apache-2.4 virtualhost centos7 selinux 503-error
我需要如何配置 selinux 才能拥有“setenforce 1”并且仍然能够运行我的 web 服务？

我的问题如下：

我gitlab在我的云服务器上安装了CentOS7，并将其配置为使用apache2/httpdnginx 而不是 web 服务器。

为此，我遵循stackoverflow 上的这个答案而且它有神奇的功效，但为了使其工作我需要设置setenforce为0。

当我将其设置为 时1，我在尝试连接到子域 时收到 503 错误代码git.my-domain.com，但我仍然能够连接到my-domain.com，httpd 的错误日志显示以下内容：

[Thu Jul 11 18:03:01.130095 2019] [proxy:error] [pid 30819] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Thu Jul 11 18:03:01.130150 2019] [proxy_http:error] [pid 30819] [client 62.216.200.13:62106] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Thu Jul 11 18:03:01.239208 2019] [proxy:error] [pid 30821] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Thu Jul 11 18:03:01.239266 2019] [proxy_http:error] [pid 30821] [client 62.216.200.13:62151] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Thu Jul 11 18:04:34.519172 2019] [proxy:error] [pid 30820] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Thu Jul 11 18:04:34.519222 2019] [proxy_http:error] [pid 30820] [client 62.216.200.13:62204] AH01114: HTTP: failed to make connection to backend: 127.0.0.1

我的VirtualHost配置如下：

Servername my-domain.com
<VirtualHost my-domain.com:80>
        Servername my-domain.com
        ServerSignature Off

        DocumentRoot /var/www
</VirtualHost>

<VirtualHost git.my-domain.com:80>
        Servername git.my-domain.com
        ServerSignature Off

        <Location />
                Require all granted

                ProxyPassReverse http://127.0.0.1:8080
                ProxyPassReverse http://git.my-domain.com/
        </Location>

        RewriteEngine on
        RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
        RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]

        # needed for downloading attachments
        DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public

        ErrorLog /var/log/httpd/error_log
        CustomLog /var/log/httpd/access_log combined env=!dontlog
</VirtualHost>

<VirtualHost monitoring.my-domain.com:80>
        Servername monitoring.my-domain.com
        ServerSignature Off

        ProxyPreserveHost On
        <Location />
                ProxyPassReverse http://127.0.0.1:8669
                ProxyPassReverse http://monitoring.my-domain.com/
        </Location>
</VirtualHost>

的输出httpd -S是

VirtualHost configuration:
5.83.160.122:80        is a NameVirtualHost
         default server my-domain.com (/etc/httpd/conf.d/vhosts.conf:3)
         port 80 namevhost my-domain.com (/etc/httpd/conf.d/vhosts.conf:3)
         port 80 namevhost git.my-domain.com (/etc/httpd/conf.d/vhosts.conf:10)
         port 80 namevhost monitoring.my-domain.com (/etc/httpd/conf.d/vhosts.conf:34)
ServerRoot: "/etc/httpd"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/etc/httpd/logs/error_log"
Mutex proxy: using_defaults
Mutex authn-socache: using_defaults
Mutex default: dir="/run/httpd/" mechanism=default 
Mutex mpm-accept: using_defaults
Mutex authdigest-opaque: using_defaults
Mutex proxy-balancer-shm: using_defaults
Mutex rewrite-map: using_defaults
Mutex authdigest-client: using_defaults
PidFile: "/run/httpd/httpd.pid"
Define: _RH_HAS_HTTPPROTOCOLOPTIONS
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="apache" id=48
Group: name="apache" id=48

输出audit：

[daniel@my-domain ~]$ sudo ausearch -m avc --start today
----
time->Fri Jul 12 11:08:27 2019
type=PROCTITLE msg=audit(1562922507.353:49213): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1562922507.353:49213): arch=c000003e syscall=42 success=no exit=-115 a0=c a1=562969a61490 a2=10 a3=7ffef15e3a60 items=0 ppid=8022 pid=9454 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1562922507.353:49213): avc:  denied  { name_connect } for  pid=9454 comm="httpd" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
----
time->Fri Jul 12 11:13:30 2019
type=PROCTITLE msg=audit(1562922810.248:50062): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1562922810.248:50062): arch=c000003e syscall=42 success=no exit=-13 a0=c a1=562969a61490 a2=10 a3=7ffef15e3fcc items=0 ppid=8022 pid=8026 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1562922810.248:50062): avc:  denied  { name_connect } for  pid=8026 comm="httpd" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
----
time->Fri Jul 12 11:13:46 2019
type=PROCTITLE msg=audit(1562922826.077:50073): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1562922826.077:50073): arch=c000003e syscall=42 success=no exit=-13 a0=c a1=562969a61490 a2=10 a3=7ffef15e3a60 items=0 ppid=8022 pid=16531 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1562922826.077:50073): avc:  denied  { name_connect } for  pid=16531 comm="httpd" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
[daniel@my-domain ~]$

我不太了解 SELinux，因此如果能提供任何帮助我都会很感激。

答案1

默认情况下，SELinux 不允许 httpd 在许多端口上进行通信。

设置布尔值httpd_can_network_connect

setsebool -P httpd_can_network_connect 1

这应该允许连接出去。

相关内容