= bug description =

selinux was set to permissive on the stg nodes and enforcing on the production nodes. Although that worked all week, on Friday evening (Saturday morning UTC) it stopped (or something flipped selinux to enforcing on Friday evening).

= bug analysis =

After struggling with it for a while, I found the following:

The following sebooleans are needed to be turned on:
* allow_ypbind -- we aren't using NIS. is there something in nuancier that's using the NIS port?
* httpd_can_network_connect_db -- this is valid to connect to postgres
* httpd_enable_homedirs -- I couldn't find any files that should be read that was labeled to need this. Not sure what's going on here. Is there a way to tell which file or directory lookup is causing this?

In addition the following custom bit of policy was needed:
* allow httpd_t anon_inodefs_t:file write;

I've no idea what causes that and google had no information more me.

= fix recommendation =

For now, I've worked around these issues by setting selinux to permissive on the production nuancier servers but that leaves me feeling a bit unsettled. Someone should look into these.