4

PREMISE and PURPOSE

There is this thread about Passenger/mod_rails fails to initialize in Fedora 12 when starting Apache . Bottom line, the problem is due to the permission, and you can avoid this by calling

setenforce 0

before running

service httpd start

and calling

setenforce 1

after that to set it back. It works cool, but I want the sequence to run automatically when Fedora restarts.



PROBLEM

I looked into /etc/init.d/httpd and found out it just redirects to etc/rc.d/init.d/functions, and the key call is 

systemctl_redirect $0 $1

So, I thought simply surrounding this call with setenforce calls like this would work.

setenforce 0
systemctl_redirect $0 $1
setenforce 1

But it does not work. It emits new error like this (in httpd error log) :

Cannot change the directory '/tmp/passenger.1.0.8581/generation-0/buffered_uploads' its UID to 48 and GID to 48: Operation not permitted (1)

When I omit the last setenforce 1, then it finally works! But obviously I want to set it back somewhere.



QUESTION

How can I hook these setenforce 0 and setenforce 1 calls to the booting sequence of httpd? I am feeling that the most proper way would be to write my own /etc/init.d/httpd script that does not use systemctl, but I want to avoid that since it looks like a thorny path... But if I am wrong and if you can suggest easy way of writing my own etc/init.d/httpd script, I would appreciated that too.

Community
  • 1
  • 1
barley
  • 4,403
  • 25
  • 28

1 Answers1

0

You are using a wrong approach to your problem. You SHOULD not disable SELinux on you system. What you need to do, is trying to figure out the problem, using SELinux Troubleshooter, and add a rule to allow the desired operation. Usually they give you the commands you need to run.

First ensure you are using the latest versions available, then if the problem persist, please consider to create a bug report here, you'll get developers assistance.

Paulo Fidalgo
  • 21,709
  • 7
  • 99
  • 115
  • 1
    The thing is, there is no good SELinux profile for Phusion Passenger at the moment. We (the authors) don't have a good understanding of SELinux and the little documentation that we can find aren't very helpful. If anybody can contribute a good SELinux profile and be willing to maintain it then that would be great. Until then, disabling SELinux entirely is unfortunately the easiest way to get things working. – Hongli Aug 26 '13 at 09:58