SELinux permission denied to Phusion Passenger for redmine

Question

I am trying to install Redmine on CentOS 6.3 but I continue to get this error in the log file

Passenger could not be initialized because of this error: Unable to start 
the Phusion Passenger watchdog (/usr/lib/ruby/gems/1.8/gems/passenger-4.0.20/buildout
 /agents/PassengerWatchdog): Permission denied (errno=13)

I have been looking online and cannot find this error anywhere or any way to fix it. I have tried changing permissions to the folder to 777 and apache:apache but neither work.

The only solution that I have come up with to get redmine to work is to set SELinux to disabled or permissive (which I do not want to do).

Does anyone have another way to fix this problem that leaves SELinux enabled?

Found the SELinux log file under /var/log/messages

here is the end of the file

    Oct 16 14:07:30 localhost pulseaudio[2329]: alsa-util.c: Disabling timer-based scheduling because running inside a VM.
    Oct 16 14:07:30 localhost rtkit-daemon[2183]: Sucessfully made thread 2331 of process 2329 (/usr/bin/pulseaudio) owned by '500' RT at priority 5.
    Oct 16 14:07:30 localhost pulseaudio[2329]: alsa-util.c: Disabling timer-based scheduling because running inside a VM.
    Oct 16 14:07:30 localhost rtkit-daemon[2183]: Sucessfully made thread 2332 of process 2329 (/usr/bin/pulseaudio) owned by '500' RT at priority 5.
    Oct 16 14:07:31 localhost rtkit-daemon[2183]: Sucessfully made thread 2427 of process 2427 (/usr/bin/pulseaudio) owned by '500' high priority at nice level -11.
    Oct 16 14:07:31 localhost pulseaudio[2427]: pid.c: Daemon already running.
    Oct 16 14:08:04 localhost kernel: type=1400 audit(1381957684.726:5): avc:  denied  { execute_no_trans } for  pid=2663 comm="httpd" path="/usr/lib/ruby/gems/1.8/gems/passenger-4.0.20/buildout/agents/PassengerWatchdog" dev=dm-0 ino=1048752 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:lib_t:s0 tclass=file
    Oct 16 14:08:04 localhost kernel: type=1400 audit(1381957684.760:6): avc:  denied  { execute_no_trans } for  pid=2668 comm="httpd" path="/usr/lib/ruby/gems/1.8/gems/passenger-4.0.20/buildout/agents/PassengerWatchdog" dev=dm-0 ino=1048752 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:lib_t:s0 tclass=file
    Oct 16 14:09:11 localhost pulseaudio[2329]: alsa-sink.c: ALSA woke us up to write new data to the device, but there was actually nothing to write!
    Oct 16 14:09:11 localhost pulseaudio[2329]: alsa-sink.c: Most likely this is a bug in the ALSA driver 'snd_intel8x0'. Please report this issue to the ALSA developers.
    Oct 16 14:09:11 localhost pulseaudio[2329]: alsa-sink.c: We were woken up with POLLOUT set -- however a subsequent snd_pcm_avail() returned 0 or another value < min_avail.

any suggestions?

Answer 1

So, you can fix this by using audit2allow (yum install audit-libs-python audit-libs).

SELinux logs to /var/log/audit/audit.log. If you tail and capture the output from restarting the web service (service httpd restart) you can then run the new output through audit2allow and make a module to install under selinux...

So, assuming you have captured it into a file called "audit_tmp":

cat audit_tmp | audit2allow -D -M passenger

This will create a file called passenger.pp which you can apply using:

semodule -i passenger.pp

Doing this will unblock the first thing that was stopping passenger from loading - but be aware that there will probably be more so you will need to repeats the process again until it works. I hope that makes sense!

Answer 2

Take a look at /var/log/syslog. That file contains SELinux error messages, which tell you how to fix up any permission problems.