0

I have Centos 7.9 server running with Apache and Git, however if I do a

[root@a]# git status
fatal: Out of memory? mmap failed: Permission denied

But if Disable or Permissive the SE-Linux via below commands it start working fine.

setenforce Permissive

Any idea on how to fix this issue permanently with SELinux enabled?

Audit log says

node=a type=PROCTITLE msg=audit(1630636505.296:37076): proctitle=67697400737461747573
node=a type=MMAP msg=audit(1630636505.296:37076): fd=3 flags=0x2
node=a type=SYSCALL msg=audit(1630636505.296:37076): arch=c000003e syscall=9 success=no exit=-13 a0=0 a1=3ebd0 a2=3 a3=2 items=0 ppid=8008 pid=8156 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=570 comm="git" exe="/usr/bin/git" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
node=a type=AVC msg=audit(1630636505.296:37076): avc:  denied  { map } for  pid=8156 comm="git" path="/www/site/.git/index" dev="sda2" ino=540400 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:httpd_t:s0 tclass=file permissive=0
mahen3d
  • 4,342
  • 14
  • 36
  • 57

1 Answers1

2

The problem is this file you're mapping:

/www/site/.git/index

This file has the type httpd_t however that isn't actually a legitimate file type but is a process (or domain type as its known) instead.

You should probably set the context of /www as being httpd_sys_content_t or if you want to allow the webserver to write to it httpd_sys_content_rw_t.

If I had to guess, I'm going to assume you did a chcon -t httpd_t on /www in error.

The best approach to fix this properly will be to reset and restore the file contexts:

# semanage fcontext -a -t httpd_sys_content_t '/www(/.*)?'
# restorecon -rv /www

This should set the correct context and prevent future context mishaps.

Then test the git status again to check it worked.

Matthew Ife
  • 23,357
  • 3
  • 55
  • 72