質問: selinuxは、nginxがphp-fpm経由で書き込むことを妨げています サーバーを使用してnfsタイプマウントポイントに[〜#〜] nginx [経由で書き込みます〜#〜]使用php-fpm最初のステップで、次のエラーが表示されます。2017/01/16 11:32:59 [error] 55463#0: *22 fastcgi sent in stderr: "php message: php warning: mkdir(): permission denied in /var/www/html/x/x.php on line 75 php message: php warning: mkdir(): permission denied in /x/x/x/x/x.php on line 79 php message: php warning: mkdir(): permission denied in /x/x/x/x/x.php on line 83 php message: php warning: mkdir(): permission denied in /x/x/x/x/x.php on line 87 php message: php warning: mkdir(): permission denied in /x/x/x/x/x.php on line 91 php message: php warning: mkdir(): permission denied in /x/x/x/x/x.php on line 95 php message: php warning: move_uploaded_file(/mnt/x/x/x/x/x/x.z): failed to open stream: no such file or directory in /var/www/html/x/x.php on line 104 php message: php warning: move_uploaded_file(): unable to move '/tmp/x' to '/mnt/x/x/x/x/x/x.z' in /var/www/html/x/x.php on line 104" while reading response header from upstream, client: ipaddr, server: _, request: "post /convert/uploadfile http/1.1", upstream: "fastcgi://unix:/run/php-fpm/php-fpm.sock:", host: "ipaddr", referrer: "http://ipaddr/xjob" エラー104は、mkdirを実行できなかったためまったく問題なく、ディレクトリに何も移動できません。とにかく、その後、私は自分でselinuxが原因で発生しているのではないかと思ったので、チェックしました/var/log/messageが表示されませんでした。 audit.logにログインしている可能性があるため、うんざりしていました。 /var/log/audit.d/audit.logのログは次のとおりです。type=avc msg=audit(1484554859.698:1415): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir type=syscall msg=audit(1484554859.698:1415): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=4 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=avc msg=audit(1484554859.698:1416): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir type=syscall msg=audit(1484554859.698:1416): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=avc msg=audit(1484554859.698:1417): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir type=syscall msg=audit(1484554859.698:1417): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=avc msg=audit(1484554859.698:1418): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir type=syscall msg=audit(1484554859.698:1418): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=avc msg=audit(1484554859.698:1419): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir type=syscall msg=audit(1484554859.698:1419): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) type=avc msg=audit(1484554859.698:1420): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir type=syscall msg=audit(1484554859.698:1420): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null) 誰かがこの問題を案内してくれると、本当に元気になります。ちなみに、selinuxをたくさん無効にしたので、selinuxを無効にするつもりはありません。アップデート1@dimitarが言ったように、これがgetsebool -a | grep -i httpの出力です。$ getsebool -a | grep -i http httpd_anon_write --> off httpd_builtin_scripting --> on httpd_can_check_spam --> off httpd_can_connect_ftp --> off httpd_can_connect_ldap --> off httpd_can_connect_mythtv --> off httpd_can_connect_zabbix --> off httpd_can_network_connect --> off httpd_can_network_connect_cobbler --> off httpd_can_network_connect_db --> off httpd_can_network_memcache --> off httpd_can_network_relay --> off httpd_can_sendmail --> off httpd_dbus_avahi --> off httpd_dbus_sssd --> off httpd_dontaudit_search_dirs --> off httpd_enable_cgi --> on httpd_enable_ftp_server --> off httpd_enable_homedirs --> off httpd_execmem --> off httpd_graceful_shutdown --> on httpd_manage_ipa --> off httpd_mod_auth_ntlm_winbind --> off httpd_mod_auth_pam --> off httpd_read_user_content --> off httpd_run_ipa --> off httpd_run_preupgrade --> off httpd_run_stickshift --> off httpd_serve_cobbler_files --> off httpd_setrlimit --> off httpd_ssi_exec --> off httpd_sys_script_anon_write --> off httpd_tmp_exec --> off httpd_tty_comm --> off httpd_unified --> off httpd_use_cifs --> off httpd_use_fusefs --> off httpd_use_gpg --> off httpd_use_nfs --> off httpd_use_openstack --> off httpd_use_sasl --> off httpd_verify_dns --> off named_tcp_bind_http_port --> off prosody_bind_http_port --> off また、ファイルのコンテキストは以下に示すwwwディレクトリと同じです。drwxr-xr-x. nginx nginx system_u:object_r:httpd_sys_content_t:s0 www アップデート2コマンドsetsebool -p httpd_can_network_connect onを回答として提供された@dimitarとして使用した後、私のaudit.logは次のようになります。 アップデート3@farazxによって提供された答えは私の問題を解決しましたが、@ dimitarが尋ねたように、これがsealert -a /var/log/audit.d/audit.log > somefile.txtの結果です。***** plugin catchall (1.41 confidence) suggests ************************** if you believe that php-fpm should be allowed setattr access on the 1395_10_27_jsadminlog.txt file by default. then you should report this as a bug. you can generate a local policy module to allow this access. do allow this access for now by executing: # ausearch -c 'php-fpm' --raw | audit2allow -m my-phpfpm # semodule -i my-phpfpm.pp additional information: source context system_u:system_r:httpd_t:s0 target context system_u:object_r:httpd_sys_content_t:s0 target objects 1395_10_27_jsadminlog.txt [ file ] source php-fpm source path /usr/sbin/php-fpm port <unknown> host <unknown> source rpm packages php-fpm-5.4.16-42.el7.x86_64 target rpm packages policy rpm selinux-policy-3.13.1-102.el7_3.7.noarch selinux enabled true policy type targeted enforcing mode enforcing host name setb0 platform linux setb0 3.10.0-327.el7.x86_64 #1 smp thu nov 19 22:10:57 utc 2015 x86_64 x86_64 alert count 1 first seen 2017-01-16 12:42:55 irst last seen 2017-01-16 12:42:55 irst local id 0076ec8b-214b-4379-b9f3-1523f46d6b36 raw audit messages type=avc msg=audit(1484557975.199:1436): avc: denied { setattr } for pid=55476 comm="php-fpm" name="1395_10_27_jsadminlog.txt" dev="dm-0" ino=963720 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file type=syscall msg=audit(1484557975.199:1436): arch=x86_64 syscall=chmod success=yes exit=0 a0=7f36808c6cb8 a1=1ed a2=7f367b331100 a3=7f367b3080f0 items=0 ppid=55471 pid=55476 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm=php-fpm exe=/usr/sbin/php-fpm subj=system_u:system_r:httpd_t:s0 key=(null) hash: php-fpm,httpd_t,httpd_sys_content_t,file,setattr 本当にありがとうございました。
回答: setsebool -p httpd_can_network_connect onは、問題を解決するフラグを永続的に有効にします。