0

I am setting up a simple web site that has a Python CGI script. Everything is working as long as I have selinux set in permissive mode. The issue is that I am using Anaconda and the SELinux context is all wrong. What is really annoying is that I dont get message in

/var/log/messages
/var/log/audit/audit.log

I have determined that I need to has SELinux contexts fixed with my Anaconda install, but I can't find any guides and the errors in my Apache log only get me so far.

How can I configure Anaconda so that Apache can use the Python binary as part of a CGI script?

Edit:

To make it clear I am thinking this is a SELinux issue because when I turn SELinux to permissive or disabled the web app works, but when it is enforcing the browser gets a 500 error. Nothing is logged in the noted locations about SELinux blocking anything so it makes troublesome. I do get a message about the cgi script not being able to execute in the apache log. When I modify the context of the python binary in my anaconda install (that is owned by apache:apache) to match the default python binary installed by yum the error changes to an unable to load a shared library.

Jodosh
  • 21
  • 3
  • What errors are you getting? And why do you think that SELinux is involved? Please be _much_ more detailed in your question. – Michael Hampton Nov 25 '16 at 19:50
  • If SELinux is enforcing I get a 500 error. If SELinux is Permissive or disabled the web app works. – Jodosh Nov 25 '16 at 19:52
  • The only error I get in the Apache logs are "Permission denied: exec of '/path/to/script.py'. Once I change the contact of the Anaconda Python binary to bin_t I get en error loading shared libraries error in the Apache logs – Jodosh Nov 25 '16 at 19:54

1 Answers1

0

SELinux by default prevents executing CGI script, but you can use boolean flags to allow that behavior.

If you want to allow httpd cgi support, you must turn on the httpd_enable_cgi boolean.

setsebool -P httpd_enable_cgi 1

Open httpd_selinux manual page or visit for more info https://linux.die.net/man/8/httpd_selinux

lzap
  • 2,704
  • 2
  • 22
  • 22
  • Unfortunately that made no difference. I still get a 500 "Internal Server Error" with SELinux Enforcing, but it works like a champ with SELinux set to permissive – Jodosh Nov 28 '16 at 20:38