If your nginx is running as httpd_t putting the socket you're connecting to in /var/run/httpd or /var/run/nginx are two good places to start:

grep httpd_var_run_t /etc/selinux/targeted/contexts/files/file_contexts
/var/run/wsgi.* -s system_u:object_r:httpd_var_run_t:s0
/var/run/mod_.* system_u:object_r:httpd_var_run_t:s0
/var/run/httpd.* system_u:object_r:httpd_var_run_t:s0
/var/run/nginx.* system_u:object_r:httpd_var_run_t:s0
/var/run/apache.* system_u:object_r:httpd_var_run_t:s0
/var/run/php-fpm(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/run/lighttpd(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/lib/php/session(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/lib/php/wsdlcache(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/run/dirsrv/admin-serv.* system_u:object_r:httpd_var_run_t:s0
/var/opt/rh/rh-nginx18/run/nginx(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/www/openshift/broker/httpd/run(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/www/openshift/console/httpd/run(/.*)? system_u:object_r:httpd_var_run_t:s0
/opt/dirsrv/var/run/dirsrv/dsgw/cookies(/.*)? system_u:object_r:httpd_var_run_t:s0
/var/run/thttpd\.pid -- system_u:object_r:httpd_var_run_t:s0
/var/run/gcache_port -s system_u:object_r:httpd_var_run_t:s0
/var/run/cherokee\.pid -- system_u:object_r:httpd_var_run_t:s0


sesearch -A -C -s httpd_t -c sock_file -p write | grep httpd_var_run_t
   allow httpd_t httpd_var_run_t : sock_file { ioctl read write create getattr setattr lock append unlink link rename open } ;



On Tue, Sep 13, 2016 at 1:35 PM Yuri Kanivetsky <yuri.kanivetsky@gmail.com> wrote:
Hi,

I'm trying to make nginx talk to an app over socket. Actually, I seem
to have succeeded, but I'm concerned if the policy I installed is a
good one.

Here's what I see in audit.log when nginx tries to connect to my app:


type=AVC msg=audit(1473789962.311:2330): avc:  denied  { write } for
pid=16814 comm="nginx" name="a1.sock" dev="dm-0" ino=525810
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=sock_file
type=SYSCALL msg=audit(1473789962.311:2330): arch=c000003e syscall=42
success=no exit=-13 a0=d a1=188a730 a2=6e a3=7ffde6992400 items=0
ppid=16813 pid=16814 auid=4294967295 uid=995 gid=993 euid=995 suid=995
fsuid=995 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295
comm="nginx" exe="/usr/sbin/nginx" subj=system_u:system_r:httpd_t:s0
key=(null)


And here's what audit2allow has generated:


module nginx 1.0;

require {
        type httpd_t;
        type httpd_sys_content_t;
        class sock_file write;
}

#============= httpd_t ==============
allow httpd_t httpd_sys_content_t:sock_file write;


The question is, "Is httpd_sys_content_t an appropriate type for the
task?" Is there the one, that suits better? Or should I create a
separate one?

Regards,
Yuri
--
selinux mailing list
selinux@lists.fedoraproject.org
https://lists.fedoraproject.org/admin/lists/selinux@lists.fedoraproject.org
--
Jeremy Young