Apologies for reopening a long dormant thread but I stumbled here attempting to install Grav on cent8 and this pointed me in the right direction.
This problem was not caused by file-permission issues or not having curl or openssl. It was (as stated above) created by SELinux. It is a bad idea to simply disable SELinux and so I wanted to provide the proper answer.
The (Hopefully) Simple Fix:
For me to fix my installation I needed to execute these four commands to allow httpd access to the system:
sudo setsebool -P httpd_can_network_connect 1
sudo setsebool -P httpd_graceful_shutdown 1
sudo setsebool -P httpd_can_network_relay 1
sudo setsebool -P nis_enabled 1
That probably will fix most people using RHEL8/CENT8 but I'll explain how I got there below for if anyone needs to find their way.
How to Find the Problem (SELinux Diagnostics):
- Make sure you've got setroubleshoot installed
sudo dnf -y install setroubleshoot
- I recommend you just wipe your SELinux audit log and reboot your system to find your problem.
sudo mv /var/log/audit/audit.log /var/log/audit/audit.log.old
sudo reboot
- Go ahead and check your audit log and try to find the error, it should be Type=AVC
sudo nano /var/log/audit/audit.log
- You can use Ctrl+W to find Type=AVC, a line should look like this
type=AVC msg=audit(1611165511.516:53): avc: denied { name_connect } for pid=812 comm="php-fpm" dest=443 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0
You'll know the error is possibly from Grav because of the comm or pid
- Copy the audit number Ex: 1611165511.516:53
- Using SETroubleshoot we'll get it to tell us what's configured wrong, input your audit number in place of mine below
sudo grep 1611165511.516:53 /var/log/audit/audit.log | audit2why
This will output something like this:
`type=AVC msg=audit(1611165511.516:53): avc: denied { name_connect } for pid=812 comm="php-fpm" dest=443 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0
Was caused by:
One of the following booleans was set incorrectly.
Description:
Allow httpd to can network connect
Allow access by executing:
# setsebool -P httpd_can_network_connect 1
Description:
Allow httpd to graceful shutdown
Allow access by executing:
# setsebool -P httpd_graceful_shutdown 1
Description:
Allow httpd to can network relay
Allow access by executing:
# setsebool -P httpd_can_network_relay 1
Description:
Allow nis to enabled
Allow access by executing:
# setsebool -P nis_enabled 1`
And that gives you the commands to fix it with. Sometimes it's a little more vague on its fixes but usually you can google for help.
I hope this gets anyone else who stumbles here out of the situation.
