+++ This bug was initially created as a clone of Bug #1178210 +++

Sorry to publish this here, but I couldn't find where to post a bug for EPEL packages.

Description of problem:
php-fpm can't write/read to/from the redis socket

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-260.el6_6.1.noarch

How reproducible:
First, configure redis to use a socket at /var/run/redis/redis.sock (where the PID is by default).

then, try to use redis from php:

<?php

ini_set( 'display_errors', 'On' );
$redis = new Redis();

$redis->pconnect( '/var/run/redis/redis.sock' );

echo 'sending ping... ';
echo $redis->ping() . "\n";

echo 'setting name ... ' . "\n";
$redis->set( 'Name', 'Renich Bon Ciric' );

echo 'getting name. The name is: ';
echo $redis->get( 'Name' ) . "\n";

?>


Actual results:
[root@web1 public]# ausearch -i -sv no -ts recent 
----
type=SYSCALL msg=audit(01/02/2015 15:33:08.834:23071) : arch=x86_64 syscall=connect success=no exit=-13(Permission denied) a0=0x5 a1=0x7ffffc01ce60 a2=0x1b a3=0x1f3d1a0 items=0 ppid=21091 pid=21103 auid=root uid=apache gid=apache euid=apache suid=apache fsuid=apache egid=apache sgid=apache fsgid=apache tty=(none) ses=3433 comm=php-fpm exe=/usr/sbin/php-fpm subj=unconfined_u:system_r:httpd_t:s0 key=(null) 
type=AVC msg=audit(01/02/2015 15:33:08.834:23071) : avc:  denied  { write } for  pid=21103 comm=php-fpm name=redis.sock dev=dm-2 ino=1701412 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file 
----
type=SYSCALL msg=audit(01/02/2015 15:33:08.833:23070) : arch=x86_64 syscall=connect success=no exit=-13(Permission denied) a0=0x5 a1=0x7ffffc01abc0 a2=0x1b a3=0x1f43840 items=0 ppid=21091 pid=21103 auid=root uid=apache gid=apache euid=apache suid=apache fsuid=apache egid=apache sgid=apache fsgid=apache tty=(none) ses=3433 comm=php-fpm exe=/usr/sbin/php-fpm subj=unconfined_u:system_r:httpd_t:s0 key=(null) 
type=AVC msg=audit(01/02/2015 15:33:08.833:23070) : avc:  denied  { write } for  pid=21103 comm=php-fpm name=redis.sock dev=dm-2 ino=1701412 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file 
[root@web1 public]# ausearch -i -sv no -ts recent | audit2allow


#============= httpd_t ==============
allow httpd_t var_run_t:sock_file write;


Expected results:
It should write and read the var.

--- Additional comment from Daniel Walsh on 2015-01-03 17:44:05 CET ---

Looks like we would need to back port redis policy to make this work.

For now you could add a custom policy module.

--- Additional comment from Renich Bon Ciric on 2015-01-04 20:49:45 CET ---

(In reply to Daniel Walsh from comment #1)
> Looks like we would need to back port redis policy to make this work.
> 
> For now you could add a custom policy module.

Ok, I will.

--- Additional comment from Miroslav Grepl on 2015-04-14 11:05:59 CEST ---

commit cf60c35e07d2e430a4061ab30c6c40a49bfb5704
Author: Miroslav Grepl <mgrepl>
Date:   Tue Apr 14 11:05:24 2015 +0200

    Allow redis to create /var/run/redis/redis.sock.

--- Additional comment from Miroslav Grepl on 2015-06-03 13:20:51 CEST ---

commit a8cc60eeb13cf7f9a636261a26455afbaeacd75e
Author: Miroslav Grepl <mgrepl>
Date:   Wed Jun 3 13:20:00 2015 +0200

    Allow php-fpm write access to /var/run/redis/redis.sock

--- Additional comment from errata-xmlrpc on 2015-07-22 09:10:24 CEST ---

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1375.html

--- Additional comment from Angelo Lisco on 2019-10-04 22:13:21 CEST ---

It seems that the patch was lost somewhere around the git repository...

On a rhel7 it was working fine because of the following policy rule:

sesearch -A -s httpd_t -t redis_var_run_t -c sock_file -p write ; echo $?
# Found 1 semantic av rules:
   allow domain pidfile : sock_file { write getattr append open } ; 
0

but I don't have any output querying the selinux target policy on a rhel8 with the following command:
# sesearch -A -s httpd_t -t redis_var_run_t -c sock_file -p write ; echo $?
0

Do I have to open a new bugzilla report?

--- Additional comment from Lukas Vrabec on 2019-10-07 09:04:16 CEST ---

Hi Angelo, 

This is RHEL-6 bugzilla, could you please open ticket for RHEL-8 with your issue? 

Thanks,
Lukas.