I need to use Puppeteer on a Centos 7.4.1708 system but when I have SELinux set to Enforcing I'm getting AVC errors.

If I run sudo cat /var/log/messages I get:

SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome from search access on the directory /sys/fs/cgroup/cpuset.

*****  Plugin restorecon_source (99.5 confidence) suggests   *****************

If you want to fix the label.
/var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome default label should be httpd_sys_content_t.    
Then you can run restorecon.    
# /sbin/restorecon -v /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome

This same message appears maybe 6 or 7 times.

When I try to do the above though, restorecon won't set the context of the file.

Set policy (as root):
semanage fcontext -a -t httpd_sys_content_t '/var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome'

Check policy:
matchpathcon /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome
/var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome system_u:object_r:httpd_sys_content_t:s0

That looks good, but then...
Set new context to file:
/sbin/restorecon -v /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome

restorecon fails to work. I don't get any errors from it even if I use -vv. I have also tried to force restorecon with -F but that doesn't work either.

Here's the files current context:
ls -Z /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome Shows:
-rwxrwxrwx. root root system_u:object_r:nfs_t:s0 /var/www/html/node_modules/puppeteer/.local-chromium/linux-549031/chrome-linux/chrome

The current context is nfs_t because I use synced folders with nfs in Vagrant running virtual box. I can't change to smb because it doesn't sync both ways using a Windows host.

Any ideas on how I can fix this issue? I've been at it for nearly two days now.

Note: If I set SELinux to Permissive then Puppeteer/Chromium runs without issue.

Thanks :)

Edit: I also should mention I have httpd_use_nfs set to on.

Here's a pastebin of all my SELinux booleans.

SELinux booleans

Edit 2:

Using the advice of @HBruijn I try to mount with defined context, but receive error.

AS root command:
mount /var/www -o context="system_u:object_r:httpd_sys_content_t:s0"

mount.nfs: requested NFS version or transport protocol is not supported

Server is my private server setup in vagrantfile.
config.vm.network "private_network", ip: ""

The export path is the same path Vagrant uses when it mounts a folder on vagrant up e.g

Any ideas??

migrated from serverfault.com May 7 '18 at 12:15

This question came from our site for system and network administrators.


I think you're trying to solve the problem from the wrong end, have you considered giving your webserver access to NFS shares instead with:

setsebool -P httpd_use_nfs=1 

EDIT Based on your comment that you running VirtualBox on Windows:

I think that your Windows host does not support labeling and then the client (your CentOS) assigns a default security policy as nfs_t.

You may need to set your preferred security context as a mount option to override that default (in the mount command or /etc/fstab) :

# mount server:/export /var/www/html -o  context="system_u:object_r:httpd_sys_content_t:s0" 

See the RHEL 6 manual

  • Sorry, I forgot to mention that I already have httpd_use_nfs --> on. I'll edit the OP. – turrican_34 May 7 '18 at 11:56
  • I've added a pastebin of all my other SELinux booleans. – turrican_34 May 7 '18 at 12:08
  • Am I correct in understanding that you are running VirtualBox on Windows with a CentOS guest OS? – HBruijn May 7 '18 at 12:11
  • Yes, thats correct. Using the winnfsd plugin to get nfs working in windows. – turrican_34 May 7 '18 at 12:14
  • When I run that as root I get this error: mount.nfs: Failed to resolve server server: Name or service not known mount.nfs: Operation already in progress – turrican_34 May 7 '18 at 12:36

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.