LOG：Jan 17 23:46:46 s1 setroubleshoot: SELinux is preventing the http daemon from connecting to network port 3306 For complete SELinux messages. run sealert -l ed55546b-97a3-4eea-9cf2-9aa2b6fce245

看得出是selinux的问题。

根据日志提示，开始解决。

[root@s1 ~]# sealert -l ed55546b-97a3-4eea-9cf2-9aa2b6fce245

摘要:

SELinux is preventing the http daemon from connecting to network port 3306

详细的描述:

SELinux has denied the http daemon from connecting to 3306. An httpd script is
trying to do a network connect to a remote port. If you did not setup httpd to
network connections, this could signal a intrusion attempt.

正在允许访问:

If you want httpd to connect to network ports you need to turn on the
httpd_can_network_network_connect boolean: “setsebool -P
httpd_can_network_connect=1”

以下命令将允许这个权限:

setsebool -P httpd_can_network_connect=1

附加的信息:

源上下文                  root:system_r:httpd_t
目标上下文               system_u:object_r:mysqld_port_t
目标对象                  None [ tcp_socket ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          3306
Host                          s1
Source RPM Packages           httpd-2.2.3-43.el5
Target RPM Packages
策略 RPM                    selinux-policy-2.4.6-279.el5
Selinux 激活                True
策略类型                  targeted
MLS 激活                    True
强制模式                  Enforcing
插件名称                  httpd_can_network_connect
主机名                     s1
平台                        Linux s1 2.6.18-194.el5 #1 SMP Tue Mar 16 21:52:43
                              EDT 2010 i686 i686
警告记数                  27
First Seen                    Mon Jan 17 23:41:16 2011
Last Seen                     Tue Jan 18 00:05:35 2011
Local ID                      ed55546b-97a3-4eea-9cf2-9aa2b6fce245
行数

原始 Audit 消息

host=s1 type=AVC msg=audit(1295280335.304:112): avc:  denied  { name_connect } f                                              or  pid=4718 comm=”httpd” dest=3306 scontext=root:system_r:httpd_t:s0 tcontext=s                                              ystem_u:object_r:mysqld_port_t:s0 tclass=tcp_socket

host=s1 type=SYSCALL msg=audit(1295280335.304:112): arch=40000003 syscall=102 su                                              ccess=no exit=-13 a0=3 a1=bf8c5a20 a2=3fbe6f8 a3=2 items=0 ppid=4716 pid=4718 au                                              id=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none)                                               ses=2 comm=”httpd” exe=”/usr/sbin/httpd” subj=root:system_r:httpd_t:s0 key=(null                                              )

[root@s1 ~]# setsebool -P httpd_can_network_connect=1

[root@s1 ~]#

再次访问，解决。