CentOS

Hi,

I've just recently had to move a ton of scripts from an old server to an Azure cloud VM. I was pleased that I managed to get pretty much everything working and set up with SELinux without too many difficulties, but I've discovered one problematic Perl script.

The script is used in various websites to fetch images using LWP from a remote site and then display them on the web page. All very simple stuff. However, it now has problems fetching anything when used via http. However, if I use the script from the server command line, as a regular user, then it fetches with no problems.

So, I've spent a day or two banging my head on the wall, but then eventually decided to see if it could be SELinux-related by temporarily setting SELinux to permissive mode. This transpired to work, and the script then worked exactly as it should do. FYI. I've now turned off permissive mode.

I thought I had the right permissions and contexts and everything on the file/directory, as everything else in the same dir works just fine. Obviously I'm missing some finer point about how SELinux works. The output below displays the dir and file permissions, etc.
If anyone is able to point me in the right direction then it would be much appreciated. Many thanks in advance.

A few ideas come to mind:

- SELinux prevents the apache user from loading remote content

- SELinux prevents the script execution entirely (eg php interpreter)

- SELinux prevents the script from saving the loaded image into a temporary directory

- SELinux prevents the script from sharing the loaded image from the temporary directory

you need to read the AVC errors in /var/log/audit/audit.log and see which specific context(s) causes trouble, by using the audit2why and audit2allow commands.

Hmm. Alright, thx, I'll see if I can view the relevant audit log stuff and report back.

Just for info' though, regarding your possibles list:

a) the script is not prevented from working in its entirety, since it will happily print a message to say that no image was retrieved.

b) the images are printed directly, and not stored anywhere (except memory); i.e. it retrieves image data into a variable and then prints it with a jpeg content header.

Okay, now working - thank you very much. I didn't know about audit2why or audit2allow.

I didn't actually have those on the system, so:
And after ...
... it very kindly told me that I could resolve the issue with:
... which I did, and it's now working as expected.

Thanks a lot; appreciated.