Open akqopensystems opened 5 years ago
Dear,
That is not actually a bug. And this is correct, that SElinux blocked abnormal behaviour.
You should understand how does SElinux works to troubleshoot and control it. After reading that "documentaion" I started more deeper to understand SElinux philosophy and meaning: https://people.redhat.com/duffy/selinux/selinux-coloring-book_A4-Stapled.pdf
First need to examine logs: start with emptying logs, tailing them and repeating an action, which does not work. Backup log, do not remove (otherwise need to touch it)
cp /var/log/audit/audit.log /var/log/audit/audit.log.202003121106
cat > /var/log/audit/audit.log
C-c
tail them
tail -f /var/log/audit/audit.log | grep "denied"
understand them
grep "chrome" /var/log/audit/audit.log | grep "denied" | grep "ptrace" | audit2allow
grep "chrome" /var/log/audit/audit.log | grep "denied" | grep "exec" | audit2allow
finally make a SE module
grep "chrome" /var/log/audit/audit.log | grep "denied" | audit2allow -a -M icinga_pdfexport
install module and check
semodule -i icinga_pdfexport.pp
semodule -l | grep pdfexport
switch SE booleans on, if needed
setsebool -P httpd_execmem true
setsebool -P httpd_can_network_connect true
getsebool -a | grep httpd
My environment: RHEL7.7
Thanks @OG2K!
This is indeed more of a documentation issue.
Issue
With an active SELinux the PDF module is not possible to generate a PDF Report.
To Reproduce
Set SELinux in permissive Mode and then it works.
Logs
google-chrome --version
): Google Chrome 76.0.3809.100php --version
): php 7.1.8 (rh-php71)