disable selinux for httpd

[Arthur Stephens]

Ok I have given up on getting httpd to work under selinux
I would like it disabled it for httpd.
I know how to do that temporary with setsebool but how does one make that permanent?

Maybe when I have some time to spare :) I can come back to it.

Arthur Stephens
Senior Sales Technician
Ptera Wireless Internet
astephens(a)ptera.net
509-927-Ptera

[Daniel J Walsh]

Arthur Stephens wrote:

>  Ok I have given up on getting httpd to work under selinux
>  I would like it disabled it for httpd.
>  I know how to do that temporary with setsebool but how does one make 
>  that permanent?
>
>  Maybe when I have some time to spare :) I can come back to it.
>
>  Arthur Stephens
>  Senior Sales Technician
>  Ptera Wireless Internet
>  astephens(a)ptera.net <mailto:[e-mail]>
>  509-927-Ptera
>
> ------------------------------------------------------------------------
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  
setsebool -P XYZ=0 permanantly turns off boolean XYZ.  
system-config-securitylevel also does this.

[Arthur Stephens]

I have no GUI - this is just a server.
>  setsebool -P XYZ=0 permanantly turns off boolean XYZ. 
I typed
setsebool -P httpd_disable_trans=1
Returned
usage: setsebool boolean value

>  system-config-securitylevel also does this. 
This gives me only
one option
firewall

: (

Arthur Stephens
Senior Sales Technician
Ptera Wireless Internet
astephens(a)ptera.net
509-927-Ptera

----- Original Message ----- 
From: "Daniel J Walsh" <dwalsh(a)redhat.com&gt;
To: "Fedora SELinux support list for users & developers."
<fedora-selinux-list(a)redhat.com&gt;
Sent: Thursday, December 09, 2004 12:05 PM
Subject: Re: disable selinux for httpd


> Arthur Stephens wrote:
>
> > Ok I have given up on getting httpd to work under selinux
> > I would like it disabled it for httpd.
> > I know how to do that temporary with setsebool but how does one make
> > that permanent?
> >
> > Maybe when I have some time to spare :) I can come back to it.
> >
> > Arthur Stephens
> > Senior Sales Technician
> > Ptera Wireless Internet
> > astephens(a)ptera.net <mailto:[e-mail]>
> > 509-927-Ptera
> >
> >------------------------------------------------------------------------
> >
> >--
> >fedora-selinux-list mailing list
> &gt;fedora-selinux-list(a)redhat.com
> >http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >
>  setsebool -P XYZ=0 permanantly turns off boolean XYZ. 
>  system-config-securitylevel also does this. 
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Joe Orton]

On Thu, Dec 09, 2004 at 12:19:41PM -0800, Arthur Stephens wrote:
>  I have no GUI - this is just a server.
>  > setsebool -P XYZ=0 permanantly turns off boolean XYZ.
>  I typed
>  setsebool -P httpd_disable_trans=1
>  Returned
>  usage: setsebool boolean value 
setsebool -P httpd_disable_trans 1

is the correct syntax.

joe

[Daniel J Walsh]

Joe Orton wrote:

> On Thu, Dec 09, 2004 at 12:19:41PM -0800, Arthur Stephens wrote:
>   
>
> >I have no GUI - this is just a server.
> >    
> >
> >>setsebool -P XYZ=0 permanantly turns off boolean XYZ.
> >>      
> >>
> >I typed
> >setsebool -P httpd_disable_trans=1
> >Returned
> >usage: setsebool boolean value
> >    
> >
>
> setsebool -P httpd_disable_trans 1
>
> is the correct syntax.
>
> joe
>   
>  
Either should work with libselinux-1.19.1-8.

> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   
>

[Joe Orton]

On Thu, Dec 09, 2004 at 03:41:58PM -0500, Daniel J Walsh wrote:
>  Joe Orton wrote:
>  
>  >On Thu, Dec 09, 2004 at 12:19:41PM -0800, Arthur Stephens wrote:
>  >>>
>  >>I typed
>  >>setsebool -P httpd_disable_trans=1
>  >>Returned
>  >>usage: setsebool boolean value
>  >
>  >setsebool -P httpd_disable_trans 1
>  >
>  >is the correct syntax.
>  >
>  >joe
>  > 
>  >
>  Either should work with libselinux-1.19.1-8. 
I think Arthur has the original FC3 package for which in fact neither
work ;)

joe

[Daniel J Walsh]

Arthur Stephens wrote:

> I have no GUI - this is just a server.
>   
>
> >setsebool -P XYZ=0 permanantly turns off boolean XYZ.
> >    
> >
> I typed
> setsebool -P httpd_disable_trans=1
> Returned
> usage: setsebool boolean value
>
>   
>
> >system-config-securitylevel also does this.
> >    
> >
> This gives me only one option
> firewall
>
>   
>  
This sounds like you are not running SELinux or are on a screwed up machine.

What does id -Z return?

What does sestatus return?


> : (
>
> Arthur Stephens
> Senior Sales Technician
> Ptera Wireless Internet
> astephens(a)ptera.net
> 509-927-Ptera
>
> ----- Original Message ----- 
> From: "Daniel J Walsh" <dwalsh(a)redhat.com&gt;
> To: "Fedora SELinux support list for users & developers."
> <fedora-selinux-list(a)redhat.com&gt;
> Sent: Thursday, December 09, 2004 12:05 PM
> Subject: Re: disable selinux for httpd
>
>
>   
>
> >Arthur Stephens wrote:
> >
> >    
> >
> >>Ok I have given up on getting httpd to work under selinux
> >>I would like it disabled it for httpd.
> >>I know how to do that temporary with setsebool but how does one make
> >>that permanent?
> >>
> >>Maybe when I have some time to spare :) I can come back to it.
> >>
> >>Arthur Stephens
> >>Senior Sales Technician
> >>Ptera Wireless Internet
> &gt;&gt;astephens(a)ptera.net <mailto:[e-mail]>
> >>509-927-Ptera
> >>
> >>------------------------------------------------------------------------
> >>
> >>--
> >>fedora-selinux-list mailing list
> &gt;&gt;fedora-selinux-list(a)redhat.com
> >>http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >>
> >>      
> >>
> >setsebool -P XYZ=0 permanantly turns off boolean XYZ.
> >system-config-securitylevel also does this.
> >
> >--
> >fedora-selinux-list mailing list
> &gt;fedora-selinux-list(a)redhat.com
> >http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >    
> >
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   
>

[Arthur Stephens]

>  What does id -Z return? 
root:system_r:unconfined_t

>  What does sestatus return? 
SELinux status:         enabled
SELinuxfs mount:        /selinux
Current mode:           enforcing
Policy version:         18

Policy booleans:
allow_ypbind            active
dhcpd_disable_trans     inactive
httpd_disable_trans     active
httpd_enable_cgi        active
httpd_enable_homedirs   active
httpd_ssi_exec          active
httpd_tty_comm          inactive
httpd_unified           active
mysqld_disable_trans    inactive
named_disable_trans     inactive
named_write_master_zonesinactive
nscd_disable_trans      inactive
ntpd_disable_trans      inactive
portmap_disable_trans   inactive
postgresql_disable_transinactive
snmpd_disable_trans     inactive
squid_disable_trans     inactive
syslogd_disable_trans   inactive
ypbind_disable_trans    inactive

----- Original Message ----- 
From: "Daniel J Walsh" <dwalsh(a)redhat.com&gt;
To: "Fedora SELinux support list for users & developers."
<fedora-selinux-list(a)redhat.com&gt;
Sent: Thursday, December 09, 2004 12:40 PM
Subject: Re: disable selinux for httpd


>  Arthur Stephens wrote:
>
>  >I have no GUI - this is just a server.
>  >
>  >
>  >>setsebool -P XYZ=0 permanantly turns off boolean XYZ.
>  >>
>  >>
>  >I typed
>  >setsebool -P httpd_disable_trans=1
>  >Returned
>  >usage: setsebool boolean value
>  >
>  >
>  >
>  >>system-config-securitylevel also does this.
>  >>
>  >>
>  >This gives me only one option
>  >firewall
>  >
>  >
>  >
>  This sounds like you are not running SELinux or are on a screwed up 
machine.
>
>  What does id -Z return? 
>
>  What does sestatus return? 
>
>
> >: (
> >
> >Arthur Stephens
> >Senior Sales Technician
> >Ptera Wireless Internet
> &gt;astephens(a)ptera.net
> >509-927-Ptera
> >
> >----- Original Message ----- 
> >From: "Daniel J Walsh" <dwalsh(a)redhat.com&gt;
> >To: "Fedora SELinux support list for users & developers."
> &gt;&lt;fedora-selinux-list(a)redhat.com&gt;
> >Sent: Thursday, December 09, 2004 12:05 PM
> >Subject: Re: disable selinux for httpd
> >
> >
> >
> >
> >>Arthur Stephens wrote:
> >>
> >>
> >>
> >>>Ok I have given up on getting httpd to work under selinux
> >>>I would like it disabled it for httpd.
> >>>I know how to do that temporary with setsebool but how does one make
> >>>that permanent?
> >>>
> >>>Maybe when I have some time to spare :) I can come back to it.
> >>>
> >>>Arthur Stephens
> >>>Senior Sales Technician
> >>>Ptera Wireless Internet
> &gt;&gt;&gt;astephens(a)ptera.net <mailto:[e-mail]>
> >>>509-927-Ptera
> >>>
>
>>>------------------------------------------------------------------------
> >>>
> >>>--
> >>>fedora-selinux-list mailing list
> &gt;&gt;&gt;fedora-selinux-list(a)redhat.com
> >>>http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >>>
> >>>
> >>>
> >>setsebool -P XYZ=0 permanantly turns off boolean XYZ.
> >>system-config-securitylevel also does this.
> >>
> >>--
> >>fedora-selinux-list mailing list
> &gt;&gt;fedora-selinux-list(a)redhat.com
> >>http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >>
> >>
> >
> >--
> >fedora-selinux-list mailing list
> &gt;fedora-selinux-list(a)redhat.com
> >http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >
> >
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Karsten Wade]

On Thu, 2004-12-09 at 15:40 -0500, Daniel J Walsh wrote:
>  Arthur Stephens wrote:
>  
>  >I have no GUI - this is just a server.
>  >
>  This sounds like you are not running SELinux or are on a screwed up machine.
>  
>  What does id -Z return?
>  
>  What does sestatus return? 
system-config-securitylevel-tui does not have the SELinux tab in
shipping FC3, right?

-- 
Karsten Wade, RHCE, Sr. Tech Writer
a lemon is just a melon in disguise
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41

[Daniel J Walsh]

Karsten Wade wrote:

> On Thu, 2004-12-09 at 15:40 -0500, Daniel J Walsh wrote:
>   
>
> >Arthur Stephens wrote:
> >
> >    
> >
> >>I have no GUI - this is just a server.
> >>
> >>      
> >>
> >This sounds like you are not running SELinux or are on a screwed up machine.
> >
> >What does id -Z return?
> >
> >What does sestatus return?
> >    
> >
>
> system-config-securitylevel-tui does not have the SELinux tab in
> shipping FC3, right?
>
>   
>  
Yes, we only support X-Windows version.

[Ken Snider]

Daniel J Walsh wrote:

>  Yes, we only support X-Windows version. 
There *is* a TUI/Command line way to change these settings however.. yes?

-- 
Ken Snider

[Stephen Smalley]

On Fri, 2004-12-10 at 13:38, Ken Snider wrote:
>  Daniel J Walsh wrote:
>  
>  > Yes, we only support X-Windows version.
>  
>  There *is* a TUI/Command line way to change these settings however.. yes? 
You can always edit /etc/selinux/config or
/etc/selinux/(strict|targeted)/booleans directly.  setbool also has a -P
option to update the booleans file as well as change the current
setting.

Any particular reason that system-config-securitylevel tui doesn't
support SELinux settings?  Shouldn't be hard, right?

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Paul Nasrat]

On Fri, 2004-12-10 at 13:42 -0500, Stephen Smalley wrote:
>  On Fri, 2004-12-10 at 13:38, Ken Snider wrote:
>  > Daniel J Walsh wrote:
>  > 
>  > > Yes, we only support X-Windows version.
>  > 
>  > There *is* a TUI/Command line way to change these settings however.. yes?
>  
>  You can always edit /etc/selinux/config or
>  /etc/selinux/(strict|targeted)/booleans directly.  setbool also has a -P
>  option to update the booleans file as well as change the current
>  setting.
>  
>  Any particular reason that system-config-securitylevel tui doesn't
>  support SELinux settings?  Shouldn't be hard, right? 
I imagine just a time issue, I think all the selinux stuff is within
selinuxPage rather than lokkit.c.  We probably should dump lokkit.c and
have a python backend then cli/tui/gui ontop properly.

Paul

[Daniel J Walsh]

Paul Nasrat wrote:

> On Fri, 2004-12-10 at 13:42 -0500, Stephen Smalley wrote:
>   
>
> >On Fri, 2004-12-10 at 13:38, Ken Snider wrote:
> >    
> >
> >>Daniel J Walsh wrote:
> >>
> >>      
> >>
> >>>Yes, we only support X-Windows version.
> >>>        
> >>>
> >>There *is* a TUI/Command line way to change these settings however.. yes?
> >>      
> >>
> >You can always edit /etc/selinux/config or
> >/etc/selinux/(strict|targeted)/booleans directly.  setbool also has a -P
> >option to update the booleans file as well as change the current
> >setting.
> >
> >Any particular reason that system-config-securitylevel tui doesn't
> >support SELinux settings?  Shouldn't be hard, right?
> >    
> >
>
> I imagine just a time issue, I think all the selinux stuff is within
> selinuxPage rather than lokkit.c.  We probably should dump lokkit.c and
> have a python backend then cli/tui/gui ontop properly.
>
>   
>  
Yup, alot easier to do in python then in "c".

> Paul
>
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   
>

[Alexander Dalloz]

Am Do, den 09.12.2004 schrieb Arthur Stephens um 21:04:

>  Ok I have given up on getting httpd to work under selinux
>  I would like it disabled it for httpd.
>  I know how to do that temporary with setsebool but how does one make that permanent?
>  
>  Maybe when I have some time to spare :) I can come back to it.
>  
>  Arthur Stephens 
Use the GUI tool system-config-securitylevel. It's on the second tab.

Alexander


-- 
Alexander Dalloz | Enger, Germany | new address - new key: 0xB366A773
legal statement: http://www.uni-x.org/legal.html
Fedora GNU/Linux Core 2 (Tettnang) on Athlon kernel 2.6.9-1.6_FC2smp 
Serendipity 21:05:55 up 3 days, 20:28, load average: 0.75, 0.36, 0.29

[Arthur Stephens]

No GUI
and system-config-securitylevel gives me only one option
firewall

----- Original Message ----- 
From: "Alexander Dalloz" <ad+lists(a)uni-x.org&gt;
To: "Fedora SELinux support list for users & developers."
<fedora-selinux-list(a)redhat.com&gt;
Sent: Thursday, December 09, 2004 12:07 PM
Subject: Re: disable selinux for httpd


>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Dave Mack]

I'm curious about the problem with httpd and selinux. I'm running FC3 
and Apache-2.0.52 with Selinux in enforcing mode and at least the basic 
stuff seems to work. What problems are you seeing?

Dave

Arthur Stephens wrote:

>  Ok I have given up on getting httpd to work under selinux
>  I would like it disabled it for httpd.
>  I know how to do that temporary with setsebool but how does one make 
>  that permanent?
>
>  Maybe when I have some time to spare :) I can come back to it.
>
>  Arthur Stephens
>  Senior Sales Technician
>  Ptera Wireless Internet
>  astephens(a)ptera.net <mailto:[e-mail]>
>  509-927-Ptera
>
> ------------------------------------------------------------------------
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>

[Karsten Wade]

On Thu, 2004-12-09 at 17:41 -0800, Dave Mack wrote:
>  I'm curious about the problem with httpd and selinux. I'm
> running FC3 
>  and Apache-2.0.52 with Selinux in enforcing mode and at least the basic 
>  stuff seems to work. What problems are you seeing? 
Check the list archives starting 29 November for the full saga.

Arthur, sorry it's not working out. :(  Better luck in the future, I
hope.

- Karsten
>  
>  Dave
>  
>  Arthur Stephens wrote:
>  
>  > Ok I have given up on getting httpd to work under selinux
>  > I would like it disabled it for httpd.
>  > I know how to do that temporary with setsebool but how does one make 
>  > that permanent?
>  >
>  > Maybe when I have some time to spare :) I can come back to it.
>  >
>  > Arthur Stephens
>  > Senior Sales Technician
>  > Ptera Wireless Internet
>  > astephens(a)ptera.net <mailto:[e-mail]>
>  > 509-927-Ptera
>  >
>  >------------------------------------------------------------------------
>  >
>  >--
>  >fedora-selinux-list mailing list
>  &gt;fedora-selinux-list(a)redhat.com
>  >http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  >
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list 
-- 
Karsten Wade, RHCE, Sr. Tech Writer
a lemon is just a melon in disguise
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41