terribleprodigybear

>it’s not running as “bear”?
It doesn’t SEEM to be

[bear@main ~]$ ps auxx | grep bear
root 61704 0.0 0.6 15452 10496 ? Ss 11:27 0:00 sshd-session: bear [priv]
bear 61712 0.0 0.7 22252 13628 ? Ss 11:27 0:00 /usr/lib/systemd/systemd --user
bear 61714 0.0 0.1 14268 2892 ? S 11:27 0:00 (sd-pam)
bear 61723 0.0 0.5 16748 9172 ? S 11:27 0:01 sshd-session: bear@pts/0
bear 61724 0.0 0.2 7360 4364 pts/0 Ss 11:27 0:00 -bash
bear 65193 0.0 0.2 9184 4016 pts/0 R+ 13:24 0:00 ps auxx
bear 65194 0.0 0.1 6396 2260 pts/0 S+ 13:24 0:00 grep --color=auto bear

[bear@main ~]$ ps auxx | grep apache
apache 991 0.0 5.1 377972 90196 ? S Sep15 0:08 php-fpm: pool www
apache 992 0.0 5.1 378912 89804 ? S Sep15 0:08 php-fpm: pool www
apache 993 0.0 4.8 377884 84908 ? S Sep15 0:07 php-fpm: pool www
apache 996 0.0 5.0 378468 87468 ? S Sep15 0:08 php-fpm: pool www
apache 997 0.0 5.2 379792 91072 ? S Sep15 0:08 php-fpm: pool www
apache 2143 0.0 5.3 384452 93260 ? S Sep15 0:08 php-fpm: pool www
apache 23516 0.0 5.3 384360 93128 ? S Sep15 0:07 php-fpm: pool www
apache 30176 0.0 5.0 378680 88076 ? S Sep15 0:06 php-fpm: pool www
apache 30234 0.0 4.8 377524 85384 ? S Sep15 0:05 php-fpm: pool www
apache 30243 0.0 5.0 379764 87984 ? S Sep15 0:05 php-fpm: pool www
apache 47590 0.0 4.7 377892 83300 ? S Sep16 0:02 php-fpm: pool www
apache 50972 0.0 0.4 21168 7968 ? S Sep16 0:00 /usr/sbin/httpd -DFOREGROUND
apache 50973 0.0 1.1 1112156 19900 ? Sl Sep16 0:12 /usr/sbin/httpd -DFOREGROUND
apache 50974 0.0 1.2 981332 22544 ? Sl Sep16 0:10 /usr/sbin/httpd -DFOREGROUND
apache 50975 0.0 1.1 981004 20236 ? Sl Sep16 0:10 /usr/sbin/httpd -DFOREGROUND
apache 51151 0.0 1.0 980940 19148 ? Sl Sep16 0:10 /usr/sbin/httpd -DFOREGROUND
bear 65196 0.0 0.1 6396 2220 pts/0 S+ 13:25 0:00 grep --color=auto apache

>Also, look for SELINUX errors/warnings in the logs
well well well… this is fun!

Sep 17 13:31:37 main setroubleshoot[68371]: SELinux is preventing /usr/sbin/php-fpm from write access on the file class-wp-sitemaps-renderer.php.#012#012*****  Plugin httpd_write_content (92.2 confidence) suggests   ***************#012#012If you want to allow php-fpm to have write access on the class-wp-sitemaps-renderer.php file#012Then you need to change the label on 'class-wp-sitemaps-renderer.php'#012Do#012# semanage fcontext -a -t httpd_sys_rw_content_t 'class-wp-sitemaps-renderer.php'#012# restorecon -v 'class-wp-sitemaps-renderer.php'#012#012*****  Plugin catchall_boolean (7.83 confidence) suggests   ******************#012#012If you want to allow httpd to unified#012Then you must tell SELinux about this by enabling the 'httpd_unified' boolean.#012#012Do#012setsebool -P httpd_unified 1#012#012*****  Plugin catchall (1.41 confidence) suggests   **************************#012#012If you believe that php-fpm should be allowed write access on the class-wp-sitemaps-renderer.php file by default.#012Then #012    You should report this as a bug.#012#012    If you are certain this access is legitimate and not an intrusion attempt, you#012    can generate a local policy module to allow it.#012    Custom policy modules are not supported as they may weaken the system policy and expose the system to security vulnerabilities.#012    #012Do#012# ausearch -c 'php-fpm' --raw | audit2allow -M my-phpfpm#012# semodule -X 300 -i my-phpfpm.pp#012

And so I followed the advice given:

[bear@main ~]$ sudo setsebool -P httpd_unified 1
[bear@main ~]$
[bear@main ~]$ ausearch -c 'php-fpm' --raw | audit2allow -M my-phpfpm
Error opening config file (Permission denied)
NOTE - using built-in end_of_event_timeout: 2
NOTE - using built-in logs: /var/log/audit/audit.log
Error opening /var/log/audit/audit.log (Permission denied)
Nothing to do
[bear@main ~]$ sudo ausearch -c 'php-fpm' --raw | audit2allow -M my-phpfpm
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i my-phpfpm.pp

[bear@main ~]$ sudo semodule -i my-phpfpm.pp
[bear@main ~]$

And it works! Site Health is no longer giving me errors.

Thank you thank you thank you!