SElinux blocking Google-Chrome (headless) - google-chrome-headless

Question

Good evening all,
Last month I commissioned a new OracleLinux server, and installed the latest Chrome version on it.
The project currently, is a small website which needs to generate a PDF report.
First, I create a HTML file with the entire content (it's only a header image, a table, and a footer - nothing too fancy).
Then, PHP issues this to generate the PDF file, after which it's downloaded by the user.
$output = shell_exec('/usr/bin/xvfb-run /usr/bin/google-chrome --no-sandbox --headless --disable-gpu --no-margins --print-to-pdf-no-header --print-to-pdf=/location/to/pdffile.pdf /location/to/htmlfile.html ');
This works great when I perform the action on the commandline (copy & paste the command).
However, when the PHP script executes the action, the following errors are generated and shown in the browser;
[0110/224510.775219:ERROR:file_path_watcher_linux.cc(71)] Failed to read /proc/sys/fs/inotify/max_user_watches
[0110/224510.779754:ERROR:udev_watcher.cc(51)] Failed to initialize a udev monitor. # # Fatal error in , line 0 # ignored # # # #FailureMessage Object: 0x7fff1b3fa650#0 0x55d633e63289 [0110/224510.816882:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...
[0110/224510.830491:ERROR:file_path_watcher_linux.cc(71)] Failed to read /proc/sys/fs/inotify/max_user_watches
[0110/224510.918277:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 2 retry ...
[0110/224511.018809:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 3 retry ...
[0110/224511.119405:WARNING:crash_handler_host_linux.cc(365)] Could not translate tid - assuming crashing thread is thread group leader; syscall_supported=1 [0110/224511.121596:ERROR:crash_handler_host_linux.cc(444)] Failed to write crash dump for pid 106039 Cannot upload crash dump: failed to open --2021-01-10 22:45:11-- https://clients2.google.com/cr/report Resolving clients2.google.com (clients2.google.com)...
[0110/224511.507094:ERROR:headless_shell.cc(391)] Abnormal renderer termination. 172.217.17.142 Connecting to clients2.google.com (clients2.google.com)|172.217.17.142|:443... failed: Permission denied. Giving up. Unexpected crash report id length Failed to get crash dump id. Report Id:
Trying to find anything useless on the internet on those errors, failed.
So I looked further in /var/log/messages
It appears that Chrome needs all kinds of permissions to print a HTML into a PDF.
SElinux is prohibiting Chrome certain actions.
Now I'm wondering ... What is the solution?
Can I simply execute the commands suggested by SElinux in the errors below, or is it better to do something else? If so, what?
After spending the entire weekend on the internet, I found no real information regarding this.
[root#testserver1 bin]# > /var/log/messages
[root#testserver1 bin]# cat /var/log/messages
Jan 10 22:45:10 testserver1 dbus-daemon[1112]: [system] Activating service name='org.fedoraproject.Setroubleshootd' requested by ':1.150' (uid=0 pid=26234 comm="/usr/sbin/sedispatch " label="system_u:system_r:auditd_t:s0") (using servicehelper)
Jan 10 22:45:11 testserver1 kernel: traps: chrome[106039] trap invalid opcode ip:55d636e755d2 sp:7fff1b3fa640 error:0 in chrome[55d6312bf000+7b80000]
Jan 10 22:45:11 testserver1 systemd[1]: Started Process Core Dump (PID 106054/UID 0).
Jan 10 22:45:11 testserver1 dbus-daemon[1112]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Jan 10 22:45:11 testserver1 systemd-coredump[106057]: Process 106039 (chrome) of user 48 dumped core.#012#012Stack trace of thread 106039:#012#0 0x000055d636e755d2 n/a (chrome)#012#1 0x000055d636e7270e n/a (chrome)#012#2 0x000055d6331e2ce1 n/a (chrome)#012#3 0x000055d6331efcef n/a (chrome)#012#4 0x000055d63311e086 n/a (chrome)#012#5 0x000055d63311ec19 n/a (chrome)#012#6 0x000055d6334eb437 n/a (chrome)#012#7 0x000055d63301a159 n/a (chrome)#012#8 0x000055d636e7785a n/a (chrome)#012#9 0x000055d636d6df47 n/a (chrome)#012#10 0x000055d636d6e6d3 n/a (chrome)#012#11 0x000055d636e9f4d6 n/a (chrome)#012#12 0x000055d6385bf1c2 n/a (chrome)#012#13 0x000055d6385af82e n/a (chrome)#012#14 0x000055d6385b1d0f n/a (chrome)#012#15 0x000055d638d3add0 n/a (chrome)#012#16 0x000055d633d7d3e2 n/a (chrome)#012#17 0x000055d633d7b659 n/a (chrome)#012#18 0x000055d633dcae1c n/a (chrome)#012#19 0x000055d633dcac51 n/a (chrome)#012#20 0x000055d633dc94d5 n/a (chrome)#012#21 0x000055d63160676d ChromeMain (chrome)#012#22 0x00007ff0a7daf7a3 __libc_start_main (libc.so.6)#012#23 0x000055d6312bfa6a _start (chrome)#012#012Stack trace of thread 106042:#012#0 0x00007ff0a7e89257 epoll_wait (libc.so.6)#012#1 0x000055d633f9efeb n/a (chrome)#012#2 0x000055d633f9c9cb n/a (chrome)#012#3 0x000055d633e83a4b n/a (chrome)#012#4 0x000055d633e3572a n/a (chrome)#012#5 0x000055d633e0b811 n/a (chrome)#012#6 0x000055d633e4792d n/a (chrome)#012#7 0x000055d633e4e809 n/a (chrome)#012#8 0x000055d633e73b94 n/a (chrome)#012#9 0x00007ff0ada4a16a start_thread (libpthread.so.0)#012#10 0x00007ff0a7e88f23 __clone (libc.so.6)#012#012Stack trace of thread 106043:#012#0 0x00007ff0ada50708 pthread_cond_timedwait##GLIBC_2.3.2 (libpthread.so.0)#012#1 0x000055d633e6fbd1 n/a (chrome)#012#2 0x000055d633e70243 n/a (chrome)#012#3 0x000055d633e489bf n/a (chrome)#012#4 0x000055d633e485ad n/a (chrome)#012#5 0x000055d633e73b94 n/a (chrome)#012#6 0x00007ff0ada4a16a start_thread (libpthread.so.0)#012#7 0x00007ff0a7e88f23 __clone (libc.so.6)#012#012Stack trace of thread 106044:#012#0 0x00007ff0a7e89257 epoll_wait (libc.so.6)#012#1 0x000055d633f9efeb n/a (chrome)#012#2 0x000055d633f9c9cb n/a (chrome)#012#3 0x000055d633e83a4b n/a (chrome)#012#4 0x000055d633e3572a n/a (chrome)#012#5 0x000055d633e0b811 n/a (chrome)#012#6 0x000055d633e4e809 n/a (chrome)#012#7 0x000055d633e73b94 n/a (chrome)#012#8 0x00007ff0ada4a16a start_thread (libpthread.so.0)#012#9 0x00007ff0a7e88f23 __clone (libc.so.6)#012#012Stack trace of thread 106045:#012#0 0x00007ff0ada5031c pthread_cond_wait##GLIBC_2.3.2 (libpthread.so.0)#012#1 0x000055d633e6fa3d n/a (chrome)#012#2 0x000055d633e70396 n/a (chrome)#012#3 0x000055d633e7000e n/a (chrome)#012#4 0x000055d633de6487 n/a (chrome)#012#5 0x000055d633e3572a n/a (chrome)#012#6 0x000055d633e0b811 n/a (chrome)#012#7 0x000055d633e4e809 n/a (chrome)#012#8 0x000055d633e73b94 n/a (chrome)#012#9 0x00007ff0ada4a16a start_thread (libpthread.so.0)#012#10 0x00007ff0a7e88f23 __clone (libc.so.6)#012#012Stack trace of thread 106051:#012#0 0x00007ff0ada50708 pthread_cond_timedwait##GLIBC_2.3.2 (libpthread.so.0)#012#1 0x000055d633e6fbd1 n/a (chrome)#012#2 0x000055d633e70243 n/a (chrome)#012#3 0x000055d633e4875c n/a (chrome)#012#4 0x000055d633e485ad n/a (chrome)#012#5 0x000055d633e73b94 n/a (chrome)#012#6 0x00007ff0ada4a16a start_thread (libpthread.so.0)#012#7 0x00007ff0a7e88f23 __clone (libc.so.6)
Jan 10 22:45:11 testserver1 systemd[1]: systemd-coredump#31-106054-0.service: Succeeded.
Jan 10 22:45:11 testserver1 dbus-daemon[1112]: [system] Activating service name='org.fedoraproject.SetroubleshootPrivileged' requested by ':1.3219' (uid=995 pid=106033 comm="/usr/libexec/platform-python -Es /usr/sbin/setroub" label="system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023") (using servicehelper)
Jan 10 22:45:12 testserver1 dbus-daemon[1112]: [system] Successfully activated service 'org.fedoraproject.SetroubleshootPrivileged'
Jan 10 22:45:13 testserver1 setroubleshoot[106033]: SELinux is preventing /usr/bin/bash from write access on the directory /dev/fd/63. For complete SELinux messages run: sealert -l 472c7d4e-7e04-47a1-9dae-17cd3c696468
Jan 10 22:45:13 testserver1 setroubleshoot[106033]: SELinux is preventing /usr/bin/bash from write access on the directory /dev/fd/63.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that bash should be allowed write access on the 63 directory by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'google-chrome' --raw | audit2allow -M my-googlechrome#012# semodule -X 300 -i my-googlechrome.pp#012
Jan 10 22:45:13 testserver1 setroubleshoot[106033]: failed to retrieve rpm info for /proc/sys/fs/inotify/max_user_watches
Jan 10 22:45:14 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from read access on the file /proc/sys/fs/inotify/max_user_watches. For complete SELinux messages run: sealert -l 1c33cba5-b4df-430d-9bdb-dec10b11639f
Jan 10 22:45:14 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from read access on the file /proc/sys/fs/inotify/max_user_watches.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that chrome should be allowed read access on the max_user_watches file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'ThreadPoolForeg' --raw | audit2allow -M my-ThreadPoolForeg#012# semodule -X 300 -i my-ThreadPoolForeg.pp#012
Jan 10 22:45:15 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the execmem access on a process. For complete SELinux messages run: sealert -l 2c8783bf-dec7-454d-997e-6a2c1dfbb240
Jan 10 22:45:15 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the execmem access on a process.#012#012***** Plugin allow_execmem (53.1 confidence) suggests *********************#012#012If you know why chrome needs to map a memory region that is both executable and writable and understand that this is a potential security problem.#012Then you can allow the mapping by switching one of the following booleans: httpd_execmem#012Do#012follow the advice of the catchall_boolean plugin, otherwise contact your security administrator and report this issue#012#012***** Plugin catchall_boolean (42.6 confidence) suggests ******************#012#012If you want to allow httpd to execmem#012Then you must tell SELinux about this by enabling the 'httpd_execmem' boolean.#012#012Do#012setsebool -P httpd_execmem 1#012#012***** Plugin catchall (5.76 confidence) suggests **************************#012#012If you believe that chrome should be allowed execmem access on processes labeled httpd_t by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'chrome' --raw | audit2allow -M my-chrome#012# semodule -X 300 -i my-chrome.pp#012
Jan 10 22:45:16 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process. For complete SELinux messages run: sealert -l 87b4832d-2497-4a8f-a5b6-7c0124a90cf8
Jan 10 22:45:16 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that chrome should be allowed ptrace access on processes labeled httpd_t by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'chrome' --raw | audit2allow -M my-chrome#012# semodule -X 300 -i my-chrome.pp#012
Jan 10 22:45:16 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process. For complete SELinux messages run: sealert -l 87b4832d-2497-4a8f-a5b6-7c0124a90cf8
Jan 10 22:45:16 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that chrome should be allowed ptrace access on processes labeled httpd_t by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'chrome' --raw | audit2allow -M my-chrome#012# semodule -X 300 -i my-chrome.pp#012
Jan 10 22:45:17 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process. For complete SELinux messages run: sealert -l 87b4832d-2497-4a8f-a5b6-7c0124a90cf8
Jan 10 22:45:17 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that chrome should be allowed ptrace access on processes labeled httpd_t by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'chrome' --raw | audit2allow -M my-chrome#012# semodule -X 300 -i my-chrome.pp#012
Jan 10 22:45:18 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process. For complete SELinux messages run: sealert -l 87b4832d-2497-4a8f-a5b6-7c0124a90cf8
Jan 10 22:45:18 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that chrome should be allowed ptrace access on processes labeled httpd_t by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'chrome' --raw | audit2allow -M my-chrome#012# semodule -X 300 -i my-chrome.pp#012
Jan 10 22:45:19 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process. For complete SELinux messages run: sealert -l 87b4832d-2497-4a8f-a5b6-7c0124a90cf8
Jan 10 22:45:19 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that chrome should be allowed ptrace access on processes labeled httpd_t by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'chrome' --raw | audit2allow -M my-chrome#012# semodule -X 300 -i my-chrome.pp#012
Jan 10 22:45:19 testserver1 setroubleshoot[106033]: failed to retrieve rpm info for /proc/sys/fs/inotify/max_user_watches
Jan 10 22:45:20 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from read access on the file /proc/sys/fs/inotify/max_user_watches. For complete SELinux messages run: sealert -l 1c33cba5-b4df-430d-9bdb-dec10b11639f
Jan 10 22:45:20 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from read access on the file /proc/sys/fs/inotify/max_user_watches.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that chrome should be allowed read access on the max_user_watches file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'ThreadPoolForeg' --raw | audit2allow -M my-ThreadPoolForeg#012# semodule -X 300 -i my-ThreadPoolForeg.pp#012
Jan 10 22:45:21 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process. For complete SELinux messages run: sealert -l 87b4832d-2497-4a8f-a5b6-7c0124a90cf8
Jan 10 22:45:21 testserver1 setroubleshoot[106033]: SELinux is preventing /opt/google/chrome/chrome from using the ptrace access on a process.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that chrome should be allowed ptrace access on processes labeled httpd_t by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'chrome' --raw | audit2allow -M my-chrome#012# semodule -X 300 -i my-chrome.pp#012
[root#testserver1 bin]#
Any help is appreciated.

Answer 1

I feel like an idiot... I should have broaden my search. Instead of looking just for my specific error, look for generic errors and solutions. So I spent a weekend for nothing.
The solution will work for anyone I guess, I found this URL here:
https://www.serverlab.ca/tutorials/linux/administration-linux/troubleshooting-selinux-centos-red-hat/
It explains how to troubleshoot and fix these errors.
Install the setroubleshoot packages using Yum.
sudo yum install setroubleshoot setools
Because I wanted to start with a fresh logfile, I rotated the audit.log;
sudo service auditd rotate
Then... Do whatever you did to generate the errors.
After that, start the just installed troubleshoot package;
sudo sealert -a /var/log/audit/audit.log
It provides a report with all errors found, and ways to fix them.
The report will sort the errors and fixes by confidence level.
My approach was, fix the errors with a 100% confedence level.
Then rotate the logs again, try again what I wanted to do, see if it works or not, and if it doesn't, generate a new report.
Etc.