서버 쓰기를 사용하고 있습니다NFS 유형 마운트 지점통과하다엔진엑스사용PHP-FPM. 첫 번째 단계에서는 다음 오류가 표시됩니다.
2017/01/16 11:32:59 [error] 55463#0: *22 FastCGI sent in stderr: "PHP message: PHP Warning: mkdir(): Permission denied in /var/www/html/x/x.php on line 75
PHP message: PHP Warning: mkdir(): Permission denied in /x/x/x/x/x.php on line 79
PHP message: PHP Warning: mkdir(): Permission denied in /x/x/x/x/x.php on line 83
PHP message: PHP Warning: mkdir(): Permission denied in /x/x/x/x/x.php on line 87
PHP message: PHP Warning: mkdir(): Permission denied in /x/x/x/x/x.php on line 91
PHP message: PHP Warning: mkdir(): Permission denied in /x/x/x/x/x.php on line 95
PHP message: PHP Warning: move_uploaded_file(/mnt/x/x/x/x/x/x.z): failed to open stream: No such file or directory in /var/www/html/x/x.php on line 104
PHP message: PHP Warning: move_uploaded_file(): Unable to move '/tmp/x' to '/mnt/x/x/x/x/x/x.z' in /var/www/html/x/x.php on line 104" while reading response header from upstream, client: IPADDR, server: _, request: "POST /convert/uploadFile HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm/php-fpm.sock:", host: "IPADDR", referrer: "http://IPADDR/xjob"
오류 104는 mkdir을 수행할 수 없고 따라서 해당 디렉터리로 아무것도 이동할 수 없기 때문에 전혀 문제가 되지 않습니다.
어쨌든 그 이후에는 나 자신도 그 때문이 아닐까 생각했다.SELinux, 그래서 확인했습니다/var/log/message그러나 아무것도 표시되지 않습니다. 그래서 로그인했을 수도 있다고 추측audit.log, 그런 일이 일어났습니다. 이것은 로그입니다/var/log/audit.d/audit.log:
type=AVC msg=audit(1484554859.698:1415): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1415): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=4 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1484554859.698:1416): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1416): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1484554859.698:1417): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1417): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1484554859.698:1418): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1418): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1484554859.698:1419): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1419): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1484554859.698:1420): avc: denied { add_name } for pid=55475 comm="php-fpm" name="on_demand" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1484554859.698:1420): arch=c000003e syscall=83 success=no exit=-13 a0=7ffe8b951890 a1=1ff a2=8 a3=30 items=0 ppid=55471 pid=55475 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm="php-fpm" exe="/usr/sbin/php-fpm" subj=system_u:system_r:httpd_t:s0 key=(null)
누군가가 이 문제를 해결하도록 안내해 줄 수 있다면 매우 기쁠 것입니다. 그런데,SELinux를 전혀 비활성화할 의향이 없습니다.왜냐하면 나는 그것으로 많은 일을 하기 때문입니다.
업데이트 1
@Dimitar가 말했듯이 출력은 다음과 같습니다 getsebool -a | grep -i http.
$ getsebool -a | grep -i http
httpd_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_check_spam --> off
httpd_can_connect_ftp --> off
httpd_can_connect_ldap --> off
httpd_can_connect_mythtv --> off
httpd_can_connect_zabbix --> off
httpd_can_network_connect --> off
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
httpd_can_sendmail --> off
httpd_dbus_avahi --> off
httpd_dbus_sssd --> off
httpd_dontaudit_search_dirs --> off
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> off
httpd_execmem --> off
httpd_graceful_shutdown --> on
httpd_manage_ipa --> off
httpd_mod_auth_ntlm_winbind --> off
httpd_mod_auth_pam --> off
httpd_read_user_content --> off
httpd_run_ipa --> off
httpd_run_preupgrade --> off
httpd_run_stickshift --> off
httpd_serve_cobbler_files --> off
httpd_setrlimit --> off
httpd_ssi_exec --> off
httpd_sys_script_anon_write --> off
httpd_tmp_exec --> off
httpd_tty_comm --> off
httpd_unified --> off
httpd_use_cifs --> off
httpd_use_fusefs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off
httpd_use_openstack --> off
httpd_use_sasl --> off
httpd_verify_dns --> off
named_tcp_bind_http_port --> off
prosody_bind_http_port --> off
파일의 컨텍스트는 다음과 같이 www 디렉터리와 동일합니다.
drwxr-xr-x. nginx nginx system_u:object_r:httpd_sys_content_t:s0 www
업데이트 2
@Dimitar가 제공한 명령을 setsebool -P httpd_can_network_connect on답변으로 사용한 후 내 audit.log는 다음과 같습니다.
업데이트 3
@FarazX가 제공한 답변으로 내 문제가 해결되었지만 @Dimitar가 요청한 대로 결과는 다음과 같습니다 sealert -a /var/log/audit.d/audit.log > somefile.txt.
***** Plugin catchall (1.41 confidence) suggests **************************
If you believe that php-fpm should be allowed setattr access on the 1395_10_27_jsAdminLog.txt file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'php-fpm' --raw | audit2allow -M my-phpfpm
# semodule -i my-phpfpm.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:object_r:httpd_sys_content_t:s0
Target Objects 1395_10_27_jsAdminLog.txt [ file ]
Source php-fpm
Source Path /usr/sbin/php-fpm
Port <Unknown>
Host <Unknown>
Source RPM Packages php-fpm-5.4.16-42.el7.x86_64
Target RPM Packages
Policy RPM selinux-policy-3.13.1-102.el7_3.7.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name SETB0
Platform Linux SETB0 3.10.0-327.el7.x86_64 #1 SMP Thu Nov
19 22:10:57 UTC 2015 x86_64 x86_64
Alert Count 1
First Seen 2017-01-16 12:42:55 IRST
Last Seen 2017-01-16 12:42:55 IRST
Local ID 0076ec8b-214b-4379-b9f3-1523f46d6b36
Raw Audit Messages
type=AVC msg=audit(1484557975.199:1436): avc: denied { setattr } for pid=55476 comm="php-fpm" name="1395_10_27_jsAdminLog.txt" dev="dm-0" ino=963720 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file
type=SYSCALL msg=audit(1484557975.199:1436): arch=x86_64 syscall=chmod success=yes exit=0 a0=7f36808c6cb8 a1=1ed a2=7f367b331100 a3=7f367b3080f0 items=0 ppid=55471 pid=55476 auid=4294967295 uid=995 gid=992 euid=995 suid=995 fsuid=995 egid=992 sgid=992 fsgid=992 tty=(none) ses=4294967295 comm=php-fpm exe=/usr/sbin/php-fpm subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: php-fpm,httpd_t,httpd_sys_content_t,file,setattr
다들 감사 해요! 감사해요.
답변1
setsebool -P httpd_can_network_connecton은 플래그를 영구적으로 활성화하여 문제를 해결합니다.
답변2
문제를 더 쉽게 찾을 수 있도록 yum을 통해 다음 패키지를 다운로드하는 것이 좋습니다.
$ yum -y install setroubleshoot-server setools-console
이걸 보면 돼공식 링크SELinux 패키지에 대한 추가 정보.
반면에 가치httpd_use_nfs시스템에서 꺼짐으로 설정되어 있으므로 오류가 발생하는 것 같습니다. nfs를 사용하고 있으므로 다음 명령을 사용하여 활성화하십시오. 문제가 해결되지 않으면 @Dimitar가 말한 대로 하고 질문을 업데이트하십시오.sealert -a /var/log/audit.d/audit.log:
$ setsebool -P httpd_use_nfs