Re: [BackupPC-devel] BackupPC_Admin C wrapper and apache hell

[Richard Shaw]

Ok, good news...

I updated my package to 4.1.0 and put BackupPC_Admin in
/usr/libexec/BackupPC and changed the apache directive from:



to



And I could log in!

I had a new SELinux error that access to /etc/BackupPC/LOCK was denied but
I added a httpd_lock_t context to the LOCK file and that seems to have gone
away. I was able to do a backup of my local home directory.

Thanks,
Richard
--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot___
BackupPC-devel mailing list
BackupPC-devel@lists.sourceforge.net
List:https://lists.sourceforge.net/lists/listinfo/backuppc-devel
Wiki:http://backuppc.wiki.sourceforge.net
Project: http://backuppc.sourceforge.net/

Re: [BackupPC-devel] BackupPC_Admin C wrapper and apache hell

[Richard Shaw]

On Wed, Mar 22, 2017 at 4:56 PM, Kenneth Porter 
wrote:

> On 3/22/2017 5:37 AM, Richard Shaw wrote:
> > No, pretty sure that's not the case. There is a straightforward error
> > in apache's error_log saying it's not allowing access due to the
> > configuration and when I use a Directory directive to allow access to
> > /usr/sbin it works, but I don't want to allow apache access to
> > everything in /usr/sbin (or /usr/libexec)
>
> I thought you could put the binary in /usr/libexec/BackupPC and then use
> a Directory directive on that.


Hadn't thought of that... Thanks!

Richard
--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot___
BackupPC-devel mailing list
BackupPC-devel@lists.sourceforge.net
List:https://lists.sourceforge.net/lists/listinfo/backuppc-devel
Wiki:http://backuppc.wiki.sourceforge.net
Project: http://backuppc.sourceforge.net/

Re: [BackupPC-devel] BackupPC_Admin C wrapper and apache hell

[Kenneth Porter]

On 3/22/2017 5:37 AM, Richard Shaw wrote:
> No, pretty sure that's not the case. There is a straightforward error 
> in apache's error_log saying it's not allowing access due to the 
> configuration and when I use a Directory directive to allow access to 
> /usr/sbin it works, but I don't want to allow apache access to 
> everything in /usr/sbin (or /usr/libexec)

I thought you could put the binary in /usr/libexec/BackupPC and then use 
a Directory directive on that.


---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus


--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
___
BackupPC-devel mailing list
BackupPC-devel@lists.sourceforge.net
List:https://lists.sourceforge.net/lists/listinfo/backuppc-devel
Wiki:http://backuppc.wiki.sourceforge.net
Project: http://backuppc.sourceforge.net/

Re: [BackupPC-devel] BackupPC_Admin C wrapper and apache hell

[Richard Shaw]

On Tue, Mar 21, 2017 at 11:24 AM, Fritz Elfert 
wrote:

> Is your selinux by any chance enabled? Try setenforce=0 temporarily. If
> it works after that, enable it again and after it fails, use audit2allow
> to figure out the necessary rulesets.


No, pretty sure that's not the case. There is a straightforward error in
apache's error_log saying it's not allowing access due to the configuration
and when I use a Directory directive to allow access to /usr/sbin it works,
but I don't want to allow apache access to everything in /usr/sbin (or
/usr/libexec)

Thanks,
Richard
--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot___
BackupPC-devel mailing list
BackupPC-devel@lists.sourceforge.net
List:https://lists.sourceforge.net/lists/listinfo/backuppc-devel
Wiki:http://backuppc.wiki.sourceforge.net
Project: http://backuppc.sourceforge.net/

Re: [BackupPC-devel] BackupPC_Admin C wrapper and apache hell

[Fritz Elfert]

Is your selinux by any chance enabled? Try setenforce=0 temporarily. If
it works after that, enable it again and after it fails, use audit2allow
to figure out the necessary rulesets.

CU
 -Fritz

On 21.03.2017 13:50, Richard Shaw wrote:
> On Mon, Mar 20, 2017 at 9:36 PM, Kenneth Porter  > wrote:
> 
> --On Sunday, March 19, 2017 6:41 PM -0500 Richard Shaw
> mailto:hobbes1...@gmail.com>> wrote:
> 
> > The problem is that a compiled binary doesn't belong in /usr/share/...
> > (although that's where the current package put it) so I have migrated it
> > to /usr/sbin/BackupPC_Admin.
> 
> Would it make more sense to put it in /usr/libexec?
> 
> 
> I thought about that as well but in either case it doesn't solve the
> apache directive issue...
> 
> Thanks,
> Richard 
> 
> 
> --
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> 
> 
> 
> ___
> BackupPC-devel mailing list
> BackupPC-devel@lists.sourceforge.net
> List:https://lists.sourceforge.net/lists/listinfo/backuppc-devel
> Wiki:http://backuppc.wiki.sourceforge.net
> Project: http://backuppc.sourceforge.net/
> 




signature.asc
Description: OpenPGP digital signature
--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot___
BackupPC-devel mailing list
BackupPC-devel@lists.sourceforge.net
List:https://lists.sourceforge.net/lists/listinfo/backuppc-devel
Wiki:http://backuppc.wiki.sourceforge.net
Project: http://backuppc.sourceforge.net/

Re: [BackupPC-devel] BackupPC_Admin C wrapper and apache hell

[Les Mikesell]

On Tue, Mar 21, 2017 at 7:50 AM, Richard Shaw  wrote:
>>
>> > The problem is that a compiled binary doesn't belong in /usr/share/...
>> > (although that's where the current package put it) so I have migrated it
>> > to /usr/sbin/BackupPC_Admin.
>>
>> Would it make more sense to put it in /usr/libexec?
>
>
> I thought about that as well but in either case it doesn't solve the apache
> directive issue...
>

Is it possible to use Apache's own suEXEC mechanism?

-- 
   Les Mikesell
 lesmikes...@gmail.com

--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
___
BackupPC-devel mailing list
BackupPC-devel@lists.sourceforge.net
List:https://lists.sourceforge.net/lists/listinfo/backuppc-devel
Wiki:http://backuppc.wiki.sourceforge.net
Project: http://backuppc.sourceforge.net/

Re: [BackupPC-devel] BackupPC_Admin C wrapper and apache hell

[Juergen Harms]

The Mageia BackupPC 3 package puts BackupPC_Admin (the suid executable) 
into /var//backuppc/, next to BackupPC_Admin.cgi - and Apache does 
not complain. Normally Mageia is configured along the same lines as 
Fedora. Could this be a viable alternative for BackupPC 4?

Juergen

--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
___
BackupPC-devel mailing list
BackupPC-devel@lists.sourceforge.net
List:https://lists.sourceforge.net/lists/listinfo/backuppc-devel
Wiki:http://backuppc.wiki.sourceforge.net
Project: http://backuppc.sourceforge.net/

Re: [BackupPC-devel] BackupPC_Admin C wrapper and apache hell

[Richard Shaw]

On Mon, Mar 20, 2017 at 9:36 PM, Kenneth Porter 
wrote:

> --On Sunday, March 19, 2017 6:41 PM -0500 Richard Shaw
>  wrote:
>
> > The problem is that a compiled binary doesn't belong in /usr/share/...
> > (although that's where the current package put it) so I have migrated it
> > to /usr/sbin/BackupPC_Admin.
>
> Would it make more sense to put it in /usr/libexec?


I thought about that as well but in either case it doesn't solve the apache
directive issue...

Thanks,
Richard
--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot___
BackupPC-devel mailing list
BackupPC-devel@lists.sourceforge.net
List:https://lists.sourceforge.net/lists/listinfo/backuppc-devel
Wiki:http://backuppc.wiki.sourceforge.net
Project: http://backuppc.sourceforge.net/

Re: [BackupPC-devel] BackupPC_Admin C wrapper and apache hell

[Kenneth Porter]

--On Sunday, March 19, 2017 6:41 PM -0500 Richard Shaw 
 wrote:

> The problem is that a compiled binary doesn't belong in /usr/share/...
> (although that's where the current package put it) so I have migrated it
> to /usr/sbin/BackupPC_Admin.

Would it make more sense to put it in /usr/libexec?




---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus


--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
___
BackupPC-devel mailing list
BackupPC-devel@lists.sourceforge.net
List:https://lists.sourceforge.net/lists/listinfo/backuppc-devel
Wiki:http://backuppc.wiki.sourceforge.net
Project: http://backuppc.sourceforge.net/