redhat Apache fast-cgi selinux权限

我的Apache安装是运行的PHP作为fastcgi，和虚拟
主机指向/ home / / public_html。
和fastcgi是家/ /cgi-bin/php.fcgi

与selinux public_html设置是：

/usr/sbin/setsebool -P httpd_enable_homedirs 1 chcon -R -t httpd_sys_content_t /home/someuser/public_html 

所有者和组是用户，例如用户“someuser”：

 ls -all /home/someuser/cgi-bin/ drwxr-xr-x 2 someuser someuser 4096 Sep 7 13:14 . drwx--x--x 6 someuser someuser 4096 Sep 6 18:17 .. -rwxr-xr-x 1 someuser someuser 308 Sep 7 13:14 php.fcgi ls -all /home/someuser/public_html/ | greep info.php -rw-r--r-- 1 someuser someuser 24 Sep 3 16:24 info.php 

什么时候访问该网站我得到“禁止…”和日志说：

• 关于Apache SSLProxyEngine
• 从现有目录使用SVN
• 麻烦在安装mod_ssl
• 在Apache上有一个域的多个redirect
• 限制访问网站和服务器的部分

[Fri Sep 07 12:02:51 2012] [error] [client xxxx]（13）权限被拒绝：访问/cgi-bin/php.fcgi/info.php被拒绝

我的selinux conf是：

 SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 

所以我杀Selinux（SELINUX =禁用），重新启动系统，一切正常!!!!!

问题是Selinux，我不想禁用Selinux。 我试图没有成功：

 setsebool -P httpd_enable_cgi 1 chcon -t httpd_sys_script_exec_t /home/someuser/cgi-bin/php.fcgi chcon -R -t httpd_sys_content_t /home/someuser/cgi-bin 

或者，也许是更好的变化Selinux
SELINUX =执行SELINUX =许可

并禁用selinux的httpd？
（我想我最好find正确的configuration）

感谢有关此事的任何build议

---

我的环境：

红帽企业Linux服务器版本5.8（Tikanga）

服务器版本：Apache / 2.2.3

PHP 5.1.6（cli）（内置：Jun 22 2012 06:20:25）版权所有（c）1997-2006 The PHP Group
Zend Engine v2.1.0，版权所有（c）1998-2006 Zend Technologies

一些日志：

 ps -ZC httpd LABEL PID TTY TIME CMD system_u:system_r:httpd_t 2822 ? 00:00:00 httpd system_u:system_r:httpd_t 2823 ? 00:00:00 httpd system_u:system_r:httpd_t 2824 ? 00:00:00 httpd system_u:system_r:httpd_t 2825 ? 00:00:00 httpd system_u:system_r:httpd_t 2826 ? 00:00:00 httpd system_u:system_r:httpd_t 2836 ? 00:00:00 httpd system_u:system_r:httpd_t 2837 ? 00:00:00 httpd system_u:system_r:httpd_t 2838 ? 00:00:00 httpd system_u:system_r:httpd_t 2839 ? 00:00:00 httpd system_u:system_r:httpd_t 2840 ? 00:00:00 httpd 

---

  getsebool -a | grep httpd allow_httpd_anon_write --> off allow_httpd_bugzilla_script_anon_write --> off allow_httpd_cvs_script_anon_write --> off allow_httpd_mod_auth_pam --> off allow_httpd_nagios_script_anon_write --> off allow_httpd_prewikka_script_anon_write --> off allow_httpd_squid_script_anon_write --> off allow_httpd_sys_script_anon_write --> off httpd_builtin_scripting --> on httpd_can_network_connect --> off httpd_can_network_connect_db --> off httpd_can_network_relay --> off httpd_can_sendmail --> on httpd_disable_trans --> off httpd_enable_cgi --> on httpd_enable_ftp_server --> off httpd_enable_homedirs --> on httpd_execmem --> off httpd_read_user_content --> off httpd_rotatelogs_disable_trans --> off httpd_setrlimit --> off httpd_ssi_exec --> off httpd_suexec_disable_trans --> off httpd_tty_comm --> on httpd_unified --> on httpd_use_cifs --> off httpd_use_nfs --> off 

有审计日志

 /var/log/audit/audit.log 

type = SYSCALL msg = audit（1345834208.027：963）：arch = c000003e syscall = 4 success = no exit = -13 a0 = 2aaf1543e390 a1 = 7fff393c9510 a2 = 7fff393c9510 a3 = 2aaf1543bd58 items = 0 ppid = 27519 pid = 27523 auid = 517 uid = 48 gid = 48 euid = 48 suid = 48 fsuid = 48 egid = 48 sgid = 48 fsgid = 48 tty =（none）ses = 4 comm =“httpd”exe =“/ usr / sbin / httpd”subj = user_u： system_r：httpd_t：s0 key =（null）
type = AVC msg = audit（1345834208.027：964）：avc：denied {getattr} for pid = 27523 comm =“httpd”path =“/ home / loemsera / public_html / index.php”dev = sda2 ino = 4593912 scontext = user_u ：system_r：httpd_t：s0 tcontext = user_u：object_r：user_home_t：s0 tclass = file
type = SYSCALL msg = audit（1345834208.027：964）：arch = c000003e syscall = 6 success = no exit = -13 a0 = 2aaf1543e470 a1 = 7fff393c9510 a2 = 7fff393c9510 a3 = 0 items = 0 ppid = 27519 pid = 27523 auid = 517 uid = 48 gid = 48 euid = 48 suid = 48 fsuid = 48 egid = 48 sgid = 48 fsgid = 48 tty =（none）ses = 4 comm =“httpd”exe =“/ usr / sbin / httpd”subj = user_u： system_r：httpd_t：s0 key =（null）
type = AVC msg = audit（1345834208.028：965）：avc：denied {getattr} for pid = 27523 comm =“httpd”path =“/ home / loemsera / public_html / index.php”dev = sda2 ino = 4593912 scontext = user_u ：system_r：httpd_t：s0 tcontext = user_u：object_r：user_home_t：s0 tclass = file