Linux – SELinux prevents Nagios plugins from running on RHEL6

The target types are file_t. That normally is the case where no type was ever set on the file and that is the default.

You'll need to relabel the filesystem in order to get things going again.

Normally the command fixfiles is used for this on redhat but I'm pretty sure that relates to RPM databases for some work so isn't likely as relevent in gentoo. You should be able to use restorecon though.

You'll need to boot into a permissive mode to try and relabel the filesystem.

Running FastCGI your way leaves a big security hole: the PHP interpreter is run as user "httpd" (at least I can't see anything about suexec here).

We have a working setup with SELinux and PHP as FastCGI here at CentOS 6, but it was really tricky to get everything working.

A few tips for the start:

• you don't need to reboot to disable/enable selinux - just use the command "setenforce 0" or "setenforce 1" :)
• always try to get everything working with SELinux disabled, then enable it and have a look at audit.log

Here we go:

• enable suexec
• change SELinux type for php.fcgi to httpd_fastcgi_script_exec_t
• your FastCGI starter (php.fcgi) should not be writable by the user owning it (otherwise he can tweak many settings and limits). Give it the "immutable" flag: chattr +i php.fcgi

• suexec has some trouble with FastCGI, so we have to make it permissive:

  yum install policycoreutils-python
  semanage permissive -a httpd_suexec_t
  

Good luck!