{"action":"opened","issue":{"url":"https://api.github.com/repos/mholt/caddy/issues/2203","repository_url":"https://api.github.com/repos/mholt/caddy","labels_url":"https://api.github.com/repos/mholt/caddy/issues/2203/labels{/name}","comments_url":"https://api.github.com/repos/mholt/caddy/issues/2203/comments","events_url":"https://api.github.com/repos/mholt/caddy/issues/2203/events","html_url":"https://github.com/mholt/caddy/issues/2203","id":332607877,"node_id":"MDU6SXNzdWUzMzI2MDc4Nzc=","number":2203,"title":"Selinux policy prevents caddy start","user":{"login":"Gunni","id":358099,"node_id":"MDQ6VXNlcjM1ODA5OQ==","avatar_url":"https://avatars3.githubusercontent.com/u/358099?v=4","gravatar_id":"","url":"https://api.github.com/users/Gunni","html_url":"https://github.com/Gunni","followers_url":"https://api.github.com/users/Gunni/followers","following_url":"https://api.github.com/users/Gunni/following{/other_user}","gists_url":"https://api.github.com/users/Gunni/gists{/gist_id}","starred_url":"https://api.github.com/users/Gunni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gunni/subscriptions","organizations_url":"https://api.github.com/users/Gunni/orgs","repos_url":"https://api.github.com/users/Gunni/repos","events_url":"https://api.github.com/users/Gunni/events{/privacy}","received_events_url":"https://api.github.com/users/Gunni/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-15T00:28:19Z","updated_at":"2018-06-15T00:28:19Z","closed_at":null,"author_association":"NONE","body":"### 1. What version of Caddy are you using (`caddy -version`)?\r\n\tCaddy 0.11.0 (unofficial)\r\n\r\n\tFedora release 27 (Twenty Seven)\r\n\r\n\tName         : selinux-policy-targeted\r\n\tVersion      : 3.13.1\r\n\tRelease      : 283.34.fc27\r\n\r\n### 2. What are you trying to do?\r\nStart caddy after a yum update\r\n\r\n### 3. What is your entire Caddyfile?\r\n\texample.com {\r\n\t\troot /var/www/com.example\r\n\t\timport always.conf\r\n\t\timport tls.conf\r\n\r\n\t\t# not really relevant to this bug\r\n\t}\r\n\r\n### 4. How did you run Caddy (give the full command and describe the execution environment)?\r\nSystemd unit (note override to add quic at the bottom):\r\n\r\n\t# /usr/lib/systemd/system/caddy.service\r\n\t[Unit]\r\n\tDescription=Caddy HTTP/2 web server\r\n\tDocumentation=https://caddyserver.com/docs\r\n\tAfter=network.target\r\n\r\n\t[Service]\r\n\tUser=caddy\r\n\tGroup=caddy\r\n\tEnvironment=CADDYPATH=/var/lib/caddy\r\n\tEnvironmentFile=-/etc/caddy/envfile\r\n\tExecStartPre=/usr/bin/caddy -conf /etc/caddy/caddy.conf -validate\r\n\tExecStart=/usr/bin/caddy -conf /etc/caddy/caddy.conf -log stdout -root /tmp -agree\r\n\tExecReload=/usr/bin/kill -USR1 $MAINPID\r\n\tKillMode=mixed\r\n\tKillSignal=SIGQUIT\r\n\tTimeoutStopSec=5s\r\n\tLimitNOFILE=1048576\r\n\tLimitNPROC=512\r\n\tPrivateTmp=true\r\n\tProtectHome=true\r\n\tProtectSystem=strict\r\n\tReadWriteDirectories=/var/lib/caddy\r\n\tAmbientCapabilities=CAP_NET_BIND_SERVICE\r\n\r\n\t[Install]\r\n\tWantedBy=multi-user.target\r\n\r\n\t# /etc/systemd/system/caddy.service.d/override.conf\r\n\t[Service]\r\n\tExecStart=\r\n\tExecStart=/usr/bin/caddy -conf /etc/caddy/caddy.conf -log stdout -root /tmp -quic -agree\r\n\r\n### 5. Please paste any relevant HTTP request(s) here.\r\nNot relevant\r\n\r\n### 6. What did you expect to see?\r\nCaddy should start\r\n\r\n### 7. What did you see instead (give full error messages and/or log)?\r\nThese alerts remain in the selinux auth.log:\r\n\r\n\tavc:  denied  { mounton } for  pid=6534 comm=\"(caddy)\" path=\"/var/lib/caddy\" dev=\"vda1\" ino=270438 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:httpd_var_lib_t:s0 tclass=dir permissive=0\r\n\tavc:  denied  { read } for  pid=6534 comm=\"caddy\" name=\"somaxconn\" dev=\"proc\" ino=18026 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=0\r\n\tavc:  denied  { mounton } for  pid=6540 comm=\"(caddy)\" path=\"/var/lib/caddy\" dev=\"vda1\" ino=270438 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:httpd_var_lib_t:s0 tclass=dir permissive=0\r\n\tavc:  denied  { read } for  pid=6540 comm=\"caddy\" name=\"somaxconn\" dev=\"proc\" ino=18026 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=0\r\n\r\nTo fix it the unable to start problem, i have done the following:\r\n\r\n- `semanage port -a -t http_port_t -p udp 80`\r\n- `semanage port -a -t http_port_t -p udp 443`\r\n\r\nbecause of:\r\n\r\n\tavc:  denied  { name_bind } for  pid=6143 comm=\"caddy\" src=80 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=udp_socket permissive=0\r\n\tavc:  denied  { name_bind } for  pid=6225 comm=\"caddy\" src=443 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=udp_socket permissive=0\r\n\r\nand also:\r\n\r\n- `semanage boolean -m --on httpd_graceful_shutdown`\r\n\r\nbecause of:\r\n\r\n\tavc:  denied  { name_connect } for  pid=6143 comm=\"caddy\" dest=80 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0\r\n\r\nThe server starts now but audit2allow is suggesting this fix to silence the remaining denies:\r\n\r\n\t#============= httpd_t ==============\r\n\tallow httpd_t sysctl_net_t:file read;\r\n\r\n\t#============= init_t ==============\r\n\tallow init_t httpd_var_lib_t:dir mounton;\r\n\r\n### 8. How can someone who is starting from scratch reproduce the bug as minimally as possible?\r\nProbably a clean fedora 27, install caddy, observe startup failure, might need to enable quic"}}
{"actor":{"display_login":"Gunni"}}