My Notepad

  • My Linux Notes
  • My Grid Notes
  • To do List
  • Tuesday, May 30, 2006

     

    Apache & SELinux in Redhat EL4

    I built my own apache 2.0.58 from source under RH EL4 using a non-root user "synew". The reasons I dont like the httpd distributed with Linux wont be dicussed here.
    The self-built apache was installed in $HTTPD, using port 443 for example, then when i try to start apache using:
    $HTTPD/bin/apachectl start
    I got the following errors:

    (13)Permission denied: make_sock: could not bind to address 163.1.26.6:443
    no listening sockets available, shutting down
    Unable to open logs

    The reason is boz of the SELINUX distributed with RH Linux.
    SOLUTION:
    1)yum install selinux-policy-targeted-sources
    2)vi /etc/selinux/targeted/src/policy/net_contexts
    In it, you can see the port 443, 80 are set as http_port_t by default:

    portcon tcp 80 system_u:object_r:http_port_t
    portcon tcp 443 system_u:object_r:http_port_t

    Therefore can only be used as http port by httpd daemon, not by our own built apache!! To use a port for our self-built apache, we need to as a port as http_cache_port_t, like this:

    portcon tcp 3128 system_u:object_r:http_cache_port_t
    portcon tcp 8080 system_u:object_r:http_cache_port_t

    Add the following line to it:
    portcon tcp 443 system_u:object_r:http_cache_port_t
    Then remove port 443 from http_port_t list stated above.

    3) make reload

    ***************
    Don't know wether it's a bug, the above instruction is not really working. You will get an error when trying to reload it.
    You can also try to disable selinux for httpd by:
    setsebool -P httpd_disable_trans 1

    Comments: Post a Comment



    << Home

    Archives

    December 2005   January 2006   February 2006   April 2006   May 2006   June 2006   July 2006   November 2006   February 2007   May 2007   June 2007   November 2007   February 2008   March 2008   April 2008   August 2008   December 2008   March 2009   April 2009   May 2009   June 2009   October 2009   November 2009   December 2009   May 2013  

    This page is powered by Blogger. Isn't yours?