0

I have a website running under Django and Apache (httpd) and inside a view I need to call FFMPEG to convert an image to video. It worked on Ubuntu 12 for years, but now we have to migrate it to CentOS 7 and things became complicated. The code is like this:

ffcmd = '/usr/local/bin/ffmpeg -y -loop 1 -i %s -t %d -vf "fade=in:0:5,fade=out:%d:5" -pix_fmt yuv420p -r "30" -c:v libx264 %s %s.mp4 %s' % (##PARAMS##)
import subprocess                                
p = subprocess.Popen(ffcmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
out, err = p.communicate()

But I get an error on the err exit:

Exception: /bin/sh: /usr/local/bin/ffmpeg: Permission denied

After some testing, I discovered that SELinux is blocking and logging it. When I disabled SELinux, it worked, but I have to keep it enabled because of our client inner policies.

I've found some commands that should read that blocked rules and could disabled them, using "audit2allow":

grep httpd /var/log/audit/audit.log | audit2allow -m httpdlocal > httpdlocal.te

Above to see the rules in the httpdlocal.te file . Below to apply them.

grep httpd /var/log/audit/audit.log | audit2allow -M httpdlocal
semodule -i httpdlocal.pp

Even with that, still logging "Permission denied".

I'm on the right track or there's a better way to keep SELinux on "enforcing" mode and unlock FFMPEG execution under Apache?

2
  • 1
    Instead of trying to work around the rules (without knowing what they really are) you should contact the folks who made them, so that they can be changed or at least explained in detail. Are you sure that the problem is really about ffmpeg and not about using a shell (shell=True)? Or at least if you use a shell let it resolve the path to ffmpeg.
    – xenoid
    Commented Oct 18, 2017 at 12:05
  • The SELinux rules are default, our client just imposes to use it, but we can enable and disable any rule for now. The Python commands are working outside Apache and this "shell=True" is just a way to write the shell command (string over list). Actually I just got it working installing FFMPEG inside the website's folder using the SEMODULE command above, but I'll wait for a nicer solution before closing the thread. Commented Oct 18, 2017 at 13:22

0

You must log in to answer this question.

Browse other questions tagged .