<commit_before>Driftsättning på RHEL 6 (testa)


installera apache mod_fcgid

installera scl ( Software Collections Library ) python33

scl enable python33 bash
virtualenv-3.3  /srv/project/Environment



chcon --ref /usr/bin/python  Environment/bin/python*
chcon -R --ref /opt/rh/python33/root/usr/lib/python3.3/ Environment/lib



chcon -t httpd_sys_content_t -R Environment



SELinux context inuti Virtualenv skall vara:

drwxrwxr-x. spider git  unconfined_u:object_r:var_t:s0   bin
-rwxrwxr-x. spider git system_u:object_r:bin_t:s0        bin/python3
drwxrwxr-x. spider git  system_u:object_r:lib_t:s0       lib
-rw-rw-r--. spider git unconfined_u:object_r:httpd_sys_content_t:s0 bin/activate
-rw-rw-r--. spider git unconfined_u:object_r:httpd_sys_content_t:s0 bin/activate_this.py
drwxrwxr-x. spider git system_u:object_r:lib_t:s0       lib/python3.3/
-rw-rw-r--. spider git system_u:object_r:lib_t:s0       lib/python3.3/site.py






SELinux modul som tillåter setpgid behövs:
[root@devel test]# cat setpgid.te 

module setpgid 1.0;

require {
	type httpd_sys_script_t;
	class process setpgid;
}

#============= httpd_sys_script_t ==============
allow httpd_sys_script_t self:process setpgid;


Genereras med audit2allow


--
Konfig för HTTPD (apache 2.2 )
	Alias / /srv/spindel.devel.takeit.se/test/Foobar.launcher
	<Directory /srv/spindel.devel.takeit.se/test/>
		 SetHandler fcgid-script
		 Options +ExecCGI
		 Order allow,deny
		Allow from all
	</Directory>
----

cat /srv/spindel.devel.takeit.se/test/Foobar.launcher
#!/bin/bash
PWD=`dirname $0`
scl enable python33 "bash -c 'source $PWD/bin/activate; $PWD/testfcgi.py'"
---
-rwxrwxr-x. apache git unconfined_u:object_r:httpd_sys_content_t:s0 /srv/spindel.devel.takeit.se/test/Foobar.launcher



<commit_msg>Mer info för att köra med sqlite<commit_after>Driftsättning på RHEL 6 (testa)


installera apache mod_fcgid

installera scl ( Software Collections Library ) python33

scl enable python33 bash
virtualenv-3.3  /srv/project/Environment





chcon -t httpd_sys_content_t -R Environment
chcon --ref /usr/bin/python  Environment/bin/python*
chcon -R --ref /opt/rh/python33/root/usr/lib/python3.3/ Environment/li*/python3.3/




SELinux context inuti Virtualenv skall vara:

drwxrwxr-x. spider git  unconfined_u:object_r:var_t:s0   bin
-rwxrwxr-x. spider git system_u:object_r:bin_t:s0        bin/python3
drwxrwxr-x. spider git  system_u:object_r:lib_t:s0       lib
-rw-rw-r--. spider git unconfined_u:object_r:httpd_sys_content_t:s0 bin/activate
-rw-rw-r--. spider git unconfined_u:object_r:httpd_sys_content_t:s0 bin/activate_this.py
drwxrwxr-x. spider git system_u:object_r:lib_t:s0       lib/python3.3/
-rw-rw-r--. spider git system_u:object_r:lib_t:s0       lib/python3.3/site.py






SELinux modul som tillåter setpgid behövs:
[root@devel test]# cat setpgid.te 

module setpgid 1.0;

require {
	type httpd_sys_script_t;
	class process setpgid;
}

#============= httpd_sys_script_t ==============
allow httpd_sys_script_t self:process setpgid;


Genereras med audit2allow


--
Konfig för HTTPD (apache 2.2 )
	Alias / /srv/spindel.devel.takeit.se/test/Foobar.launcher
	<Directory /srv/spindel.devel.takeit.se/test/>
		 SetHandler fcgid-script
		 Options +ExecCGI
		 Order allow,deny
		Allow from all
	</Directory>
----

cat /srv/spindel.devel.takeit.se/test/Foobar.launcher
#!/bin/bash
PWD=`dirname $0`
scl enable python33 "bash -c 'source $PWD/bin/activate; $PWD/testfcgi.py'"
---
-rwxrwxr-x. apache git unconfined_u:object_r:httpd_sys_content_t:s0 /srv/spindel.devel.takeit.se/test/Foobar.launcher
---
testfcgi.py ser ut:
#!/usr/bin/env python
import sys
 
from paste.deploy import loadapp
from flup.server.fcgi_fork import WSGIServer
 
app = loadapp('config:/srv/spindel.devel.takeit.se/testapp/fcgi.ini')
server = WSGIServer(app)
server.run()
----
-rwxrwxr-x. spider git unconfined_u:object_r:httpd_sys_content_t:s0 testfcgi.py



---
Med SQLite så måste Apache ha grupp-skriv till katalogen:
sudo chgrp apache projekt
sudo chgrp apache projekt/*.sqlite
chcon -t httpd_sys_rw_content_t projekt/*sqlite




{'fraction_non_alphanumeric': 0.11991172143207454, 'fraction_numerical': 0.016429622363903874, 'mean_word_length': 4.0797011207970115, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5731720', 'n_tokens_mistral': 1767, 'n_tokens_neox': 1621, 'n_words': 330}