my problem is as follows:
I installed gitlab on a cloudserver of mine running CentOS7, and I configured it to use apache2/httpd instead of nginx as webserver.
For doing so I followed this answer on stackoverflow and it works as a charm, but for it to work I need to set setenforce to 0.
As soon as I set it to 1, I get 503 Error codes when trying to connect to the subdomain git.my-domain.com, but I am still able to connect to my-domain.com, with the error-logs of httpd showing the following:
[Thu Jul 11 18:03:01.130095 2019] [proxy:error] [pid 30819] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Thu Jul 11 18:03:01.130150 2019] [proxy_http:error] [pid 30819] [client 62.216.200.13:62106] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Thu Jul 11 18:03:01.239208 2019] [proxy:error] [pid 30821] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Thu Jul 11 18:03:01.239266 2019] [proxy_http:error] [pid 30821] [client 62.216.200.13:62151] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
[Thu Jul 11 18:04:34.519172 2019] [proxy:error] [pid 30820] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Thu Jul 11 18:04:34.519222 2019] [proxy_http:error] [pid 30820] [client 62.216.200.13:62204] AH01114: HTTP: failed to make connection to backend: 127.0.0.1
My VirtualHost-configuration looks as follows:
Servername my-domain.com
<VirtualHost my-domain.com:80>
Servername my-domain.com
ServerSignature Off
DocumentRoot /var/www
</VirtualHost>
<VirtualHost git.my-domain.com:80>
Servername git.my-domain.com
ServerSignature Off
<Location />
Require all granted
ProxyPassReverse http://127.0.0.1:8080
ProxyPassReverse http://git.my-domain.com/
</Location>
RewriteEngine on
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
RewriteRule .* http://127.0.0.1:8080%{REQUEST_URI} [P,QSA]
# needed for downloading attachments
DocumentRoot /opt/gitlab/embedded/service/gitlab-rails/public
ErrorLog /var/log/httpd/error_log
CustomLog /var/log/httpd/access_log combined env=!dontlog
</VirtualHost>
<VirtualHost monitoring.my-domain.com:80>
Servername monitoring.my-domain.com
ServerSignature Off
ProxyPreserveHost On
<Location />
ProxyPassReverse http://127.0.0.1:8669
ProxyPassReverse http://monitoring.my-domain.com/
</Location>
</VirtualHost>
The output of httpd -S is
VirtualHost configuration:
5.83.160.122:80 is a NameVirtualHost
default server my-domain.com (/etc/httpd/conf.d/vhosts.conf:3)
port 80 namevhost my-domain.com (/etc/httpd/conf.d/vhosts.conf:3)
port 80 namevhost git.my-domain.com (/etc/httpd/conf.d/vhosts.conf:10)
port 80 namevhost monitoring.my-domain.com (/etc/httpd/conf.d/vhosts.conf:34)
ServerRoot: "/etc/httpd"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/etc/httpd/logs/error_log"
Mutex proxy: using_defaults
Mutex authn-socache: using_defaults
Mutex default: dir="/run/httpd/" mechanism=default
Mutex mpm-accept: using_defaults
Mutex authdigest-opaque: using_defaults
Mutex proxy-balancer-shm: using_defaults
Mutex rewrite-map: using_defaults
Mutex authdigest-client: using_defaults
PidFile: "/run/httpd/httpd.pid"
Define: _RH_HAS_HTTPPROTOCOLOPTIONS
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="apache" id=48
Group: name="apache" id=48
The audit-output:
[daniel@my-domain ~]$ sudo ausearch -m avc --start today
----
time->Fri Jul 12 11:08:27 2019
type=PROCTITLE msg=audit(1562922507.353:49213): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1562922507.353:49213): arch=c000003e syscall=42 success=no exit=-115 a0=c a1=562969a61490 a2=10 a3=7ffef15e3a60 items=0 ppid=8022 pid=9454 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1562922507.353:49213): avc: denied { name_connect } for pid=9454 comm="httpd" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
----
time->Fri Jul 12 11:13:30 2019
type=PROCTITLE msg=audit(1562922810.248:50062): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1562922810.248:50062): arch=c000003e syscall=42 success=no exit=-13 a0=c a1=562969a61490 a2=10 a3=7ffef15e3fcc items=0 ppid=8022 pid=8026 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1562922810.248:50062): avc: denied { name_connect } for pid=8026 comm="httpd" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
----
time->Fri Jul 12 11:13:46 2019
type=PROCTITLE msg=audit(1562922826.077:50073): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1562922826.077:50073): arch=c000003e syscall=42 success=no exit=-13 a0=c a1=562969a61490 a2=10 a3=7ffef15e3a60 items=0 ppid=8022 pid=16531 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1562922826.077:50073): avc: denied { name_connect } for pid=16531 comm="httpd" dest=8080 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
[daniel@my-domain ~]$
I am not knowing my way around SELinux all too good, so any help would be appreciated.
