ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > ื•ื•ืึธืจืงืฉืึธืคึผ RHEL 8 ื‘ื™ืชื: ื‘ื ื™ืŸ ืืจื‘ืขื˜ืŸ ื•ื•ืขื‘ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–

ื•ื•ืึธืจืงืฉืึธืคึผ RHEL 8 ื‘ื™ืชื: ื‘ื ื™ืŸ ืืจื‘ืขื˜ืŸ ื•ื•ืขื‘ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–

RHEL 8 Beta ืึธืคืคืขืจืก ื“ืขื•ื•ืขืœืึธืคึผืขืจืก ืคื™ืœืข ื ื™ื™ึทืข ืคึฟืขื™ึดืงื™ื™ื˜ืŸ, ื“ื™ ืœื™ืกื˜ื™ื ื’ ืคื•ืŸ ื•ื•ืึธืก ืงืขืŸ ื ืขืžืขืŸ ื‘ืœืขื˜ืขืจ, ืึธื‘ืขืจ, ืœืขืจื ืขืŸ ื ื™ื™ึทืข ื˜ื™ื ื’ื– ืื™ื– ืฉื˜ืขื ื“ื™ืง ื‘ืขืกืขืจ ืื™ืŸ ืคื™ืจ, ืึทื–ื•ื™ ืื•ื ื˜ืŸ ืžื™ืจ ืคืึธืจืฉืœืึธื’ืŸ ืึท ื•ื•ืึทืจืฉื˜ืึทื˜ ืื•ื™ืฃ ืึทืงื˜ืฉืึทื•ื•ืึทืœื™ ืงืจื™ื™ื™ื˜ื™ื ื’ ืึท ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื™ื ืคืจืึทืกื˜ืจืึทืงื˜ืฉืขืจ ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ Red Hat Enterprise Linux 8 Beta.

ื•ื•ืึธืจืงืฉืึธืคึผ RHEL 8 ื‘ื™ืชื: ื‘ื ื™ืŸ ืืจื‘ืขื˜ืŸ ื•ื•ืขื‘ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–

ืœืึธืžื™ืจ ื ืขืžืขืŸ Python, ืึท ืคืึธืœืงืก ืคึผืจืึธื’ืจืึทืžืžื™ื ื’ ืฉืคึผืจืึทืš ืฆื•ื•ื™ืฉืŸ ื“ืขื•ื•ืขืœืึธืคึผืขืจืก, ื•ื•ื™ ืึท ื™ืงืขืจ, ืึท ืงืึธืžื‘ื™ื ืึทืฆื™ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹Django ืื•ืŸ PostgreSQL, ืึท ืคืขืจืœื™ ืคึผืจืึธืกื˜ ืงืึธืžื‘ื™ื ืึทืฆื™ืข ืคึฟืึทืจ ืงืจื™ื™ื™ื˜ื™ื ื’ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–, ืื•ืŸ ืงืึทื ืคื™ื’ื™ืขืจ RHEL 8 Beta ืฆื• ืึทืจื‘ืขื˜ืŸ ืžื™ื˜ ื–ื™ื™. ื“ืขืจื ืึธืš ืžื™ืจ ืœื™ื™ื’ืŸ ืึท ืคึผืึธืจ ืžืขืจ (ืึทื ืงืœืึทืกืกื™ืคื™ืขื“) ื™ื ื’ืจื™ื“ื™ืึทื ืฅ.

ื“ื™ ืคึผืจืึธื‘ืข ืกื•ื•ื™ื•ื•ืข ื•ื•ืขื˜ ื˜ื•ื™ืฉืŸ, ื•ื•ื™ื™ึทืœ ืขืก ืื™ื– ื˜ืฉื™ืงืึทื•ื•ืข ืฆื• ื•ื™ืกืคืึธืจืฉืŸ ื“ื™ ืคึผืึทืกืึทื‘ื™ืœืึทื˜ื™ื– ืคื•ืŸ ืึธื˜ืึทืžื™ื™ืฉืึทืŸ, ืืจื‘ืขื˜ืŸ ืžื™ื˜ ืงืึทื ื˜ื™ื™ื ืขืจื– ืื•ืŸ ื˜ืจื™ื™ื ื’ ื™ื ื•ื•ื™ื™ืจืึทื ืžืึทื ืฅ ืžื™ื˜ ืงื™ื™ืคืœ ืกืขืจื•ื•ืขืจืก. ืฆื• ืึธื ื”ื™ื™ื‘ืŸ ืžื™ื˜ ืึท ื ื™ื™ึทืข ืคึผืจื•ื™ืขืงื˜, ืื™ืจ ืงืขื ืขืŸ ืึธื ื”ื™ื™ื‘ืŸ ืฆื• ืฉืึทืคึฟืŸ ืึท ืงืœื™ื™ืŸ ืคึผืฉื•ื˜ ืคึผืจืึธื•ื˜ืึทื˜ื™ื™ืคึผ ืžื™ื˜ ื”ืึทื ื˜, ืึทื–ื•ื™ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ืคึผื•ื ืงื˜ ื•ื•ืึธืก ื“ืึทืจืฃ ืคึผืึทืกื™ืจืŸ ืื•ืŸ ื•ื•ื™ ืขืก ื™ื ื˜ืขืจืึทืงืฅ, ืื•ืŸ ื“ืึทืŸ ืžืึทืš ืื•ื™ืฃ ืฆื• ืึธื˜ืึทืžื™ื™ื˜ ืื•ืŸ ืฉืึทืคึฟืŸ ืžืขืจ ืงืึธืžืคึผืœื™ืฆื™ืจื˜ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทื ื–. ื”ื™ื™ึทื ื˜ ืžื™ืจ ื–ืขื ืขืŸ ื’ืขืจืขื“ื˜ ื•ื•ืขื’ืŸ ื“ืขืจ ืฉืึทืคื•ื ื’ ืคื•ืŸ ืึทื–ืึท ืึท ืคึผืจืึธื•ื˜ืึทื˜ื™ื™ืคึผ.

ืœืึธืžื™ืจ ืึธื ื”ื™ื™ื‘ืŸ ืžื™ื˜ ื“ื™ืคึผืœื™ื™ื™ื ื’ ื“ื™ RHEL 8 Beta VM ื‘ื™ืœื“. ืื™ืจ ืงืขื ืขืŸ ื™ื ืกื˜ืึทืœื™ืจืŸ ืึท ื•ื•ื™ืจื˜ื•ืึทืœ ืžืึทืฉื™ืŸ ืคึฟื•ืŸ ืงืจืึทืฆืŸ, ืึธื“ืขืจ ื ื•ืฆืŸ ื“ื™ KVM ื’ืึทืกื˜ ื‘ื™ืœื“ ื‘ื ื™ืžืฆื ืžื™ื˜ ื“ื™ื™ืŸ ื‘ื™ืชื ืึทื‘ืึธื ืขืžืขื ื˜. ื•ื•ืขืŸ ืื™ืจ ื ื•ืฆืŸ ืึท ื’ืึทืกื˜ ื‘ื™ืœื“, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืงืึทื ืคื™ื’ื™ืขืจ ืึท ื•ื•ื™ืจื˜ื•ืึทืœ ืงืึธืžืคึผืึทืงื˜ื“ื™ืกืง ื•ื•ืึธืก ื•ื•ืขื˜ ืึทื ื˜ื”ืึทืœื˜ืŸ ืžืขื˜ืึทื“ืึทื˜ืึท ืื•ืŸ ื‘ืึทื ื™ืฆืขืจ ื“ืึทื˜ืŸ ืคึฟืึทืจ ื•ื•ืึธืœืงืŸ ื™ื ื™ื˜ื™ืึทืœื™ื–ืึทื˜ื™ืึธืŸ (ื•ื•ืึธืœืงืŸ-ื™ื ื™ื˜). ืื™ืจ ื˜ืึธืŸ ื ื™ื˜ ื“ืึทืจืคึฟืŸ ืฆื• ื˜ืึธืŸ ืขืคึผืขืก ืกืคึผืขืฆื™ืขืœ ืžื™ื˜ ื“ื™ ื“ื™ืกืง ืกื˜ืจื•ืงื˜ื•ืจ ืึธื“ืขืจ ื‘ื ื™ืžืฆื ืคึผืึทืงืึทื“ื–ืฉืึทื–; ืงื™ื™ืŸ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื•ื•ืขื˜ ื˜ืึธืŸ.

ื–ืืœ ืก ื ืขืžืขืŸ ืึท ื ืขืขื ื˜ืขืจ ืงื•ืง ื‘ื™ื™ึท ื“ื™ ื’ืื ืฆืข ืคึผืจืึธืฆืขืก.

ื™ื ืกื˜ืึธืœื™ื ื’ Django

ืžื™ื˜ ื“ื™ ื ื•ืึทืกื˜ ื•ื•ืขืจืกื™ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹Django, ืื™ืจ ื•ื•ืขื˜ ื“ืึทืจืคึฟืŸ ืึท ื•ื•ื™ืจื˜ื•ืึทืœ ืกื•ื•ื™ื•ื•ืข (ื•ื•ื™ืจื˜ื•ืึทืœืขื ื•ื•) ืžื™ื˜ Python 3.5 ืึธื“ืขืจ ืฉืคึผืขื˜ืขืจ. ืื™ืŸ ื“ื™ ื‘ื™ืชื ื”ืขืจื•ืช ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ืึทื– Python 3.6 ืื™ื– ื‘ืืจืขื›ื˜ื™ื’ื˜, ืœืึธืžื™ืจ ื˜ืฉืขืง ืื•ื™ื‘ ื“ืึธืก ืื™ื– ื˜ืึทืงืข ื“ืขืจ ืคืึทืœ: 

[cloud-user@8beta1 ~]$ python
-bash: python: command not found
[cloud-user@8beta1 ~]$ python3
-bash: python3: command not found

Red Hat ืึทืงื˜ื™ื•ื•ืœื™ ื ื™ืฆื˜ Python ื•ื•ื™ ืึท ืกื™ืกื˜ืขื ื˜ืึธืึธืœืงื™ื˜ ืื™ืŸ RHEL, ืึทื–ื•ื™ ื•ื•ืึธืก ื“ืึธืก ืจืขื–ื•ืœื˜ืึทื˜?

ื“ืขืจ ืคืึทืงื˜ ืื™ื– ืึทื– ืคื™ืœืข ืคึผื™ื˜ื”ืึธืŸ ื“ืขื•ื•ืขืœืึธืคึผืขืจืก ื ืึธืš ื‘ืึทื˜ืจืึทื›ื˜ืŸ ื“ื™ ื™ื‘ืขืจื’ืึทื ื’ ืคื•ืŸ Python 2 ืฆื• Python 2, ื‘ืฉืขืช Python 3 ื–ื™ืš ืื™ื– ืื•ื ื˜ืขืจ ืึทืงื˜ื™ื•ื• ืึทื ื˜ื•ื•ื™ืงืœื•ื ื’, ืื•ืŸ ืžืขืจ ืื•ืŸ ืžืขืจ ื ื™ื™ึทืข ื•ื•ืขืจืกื™ืขืก ื–ืขื ืขืŸ ืงืขืกื™ื™ื“ืขืจ ืืจื•ื™ืก. ื“ืขืจื™ื‘ืขืจ, ืฆื• ื˜ืจืขืคืŸ ื“ื™ ื ื•ื™ื˜ ืคึฟืึทืจ ืกื˜ืึทื‘ื™ืœ ืกื™ืกื˜ืขื ืžื›ืฉื™ืจื™ื ืื•ืŸ ืคืึธืจืฉืœืึธื’ืŸ ื ื™ืฆืขืจืก ืึทืงืกืขืก ืฆื• ืคืึทืจืฉื™ื“ืŸ ื ื™ื™ึทืข ื•ื•ืขืจืกื™ืขืก ืคื•ืŸ ืคึผื™ื˜ื”ืึธืŸ, ืกื™ืกื˜ืขื ืคึผื™ื˜ื”ืึธืŸ ืื™ื– ืืจื™ื‘ืขืจื’ืขืคืืจืŸ ืื™ืŸ ืึท ื ื™ื™ึทืข ืคึผืขืงืœ ืื•ืŸ ืฆื•ื’ืขืฉื˜ืขืœื˜ ื“ื™ ืคื™ื™ื™ืงื™ื™ื˜ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ื‘ื™ื™ื“ืข Python 2.7 ืื•ืŸ 3.6. ืžืขืจ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ืขื ื“ืขืจื•ื ื’ืขืŸ ืื•ืŸ ื•ื•ืึธืก ื–ื™ื™ ื–ืขื ืขืŸ ื’ืขืžืื›ื˜ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขืคึฟื•ื ืขืŸ ืื™ืŸ ื“ื™ ื•ื™ืกื’ืึทื‘ืข ืื™ืŸ Langdon White ืก ื‘ืœืึธื’ (ืœืึทื ื’ื“ืึธืŸ ื•ื•ื™ื™ืกืข).

ืึทื–ื•ื™, ืฆื• ื‘ืึทืงื•ืžืขืŸ ืืจื‘ืขื˜ืŸ ืคึผื™ื˜ื”ืึธืŸ, ืื™ืจ ื ืึธืจ ื“ืึทืจืคึฟืŸ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ืฆื•ื•ื™ื™ ืคึผืึทืงืึทื“ื–ืฉืึทื–, ืžื™ื˜ ืคึผื™ื˜ื”ืึธืŸ3-ืคึผื™ืคึผ ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜ ื•ื•ื™ ืึท ื“ืขืคึผืขื ื“ืขื ืกื™. 

sudo yum install python36 python3-virtualenv

ืคืืจื•ื•ืืก ื˜ืึธืŸ ื ื™ื˜ ื ื•ืฆืŸ ื“ื™ืจืขืงื˜ ืžืึธื“ื•ืœืข ืงืึทืœืœืก ื•ื•ื™ Langdon ืกืึทื’ื“ื–ืฉืขืกืฅ ืื•ืŸ ื™ื ืกื˜ืึทืœื™ืจืŸ pip3? ืื™ืŸ ื–ื™ื ืขืŸ ื“ื™ ืึทืคึผืงืึทืžื™ื ื’ ืึธื˜ืึทืžื™ื™ืฉืึทืŸ, ืขืก ืื™ื– ื‘ืึทื•ื•ื•ืกื˜ ืึทื– Ansible ื•ื•ืขื˜ ื“ืึทืจืคืŸ ืคึผื™ืคึผ ืื™ื ืกื˜ืึทืœื™ืจืŸ ืฆื• ืœื•ื™ืคืŸ, ื•ื•ื™ื™ึทืœ ื“ื™ ืคึผื™ืคึผ ืžืึธื“ื•ืœืข ืฉื˜ื™ืฆื˜ ื ื™ืฉื˜ ื•ื•ื™ืจื˜ื•ืขืœืขื•ื•ืก ืžื™ื˜ ืึท ืžื ื”ื’ ืคึผื™ืคึผ ืขืงืกืขืงื•ื˜ืึทื‘ืœืข.

ืžื™ื˜ ืึท ืืจื‘ืขื˜ืŸ ืคึผื™ื˜ื”ืึธืŸ 3 ื™ื‘ืขืจื–ืขืฆืขืจ ืฆื• ื“ื™ื™ืŸ ื‘ืึทื–ื™ื™ึทื˜ื™ืงื•ื ื’, ืื™ืจ ืงืขื ืขืŸ ืคืึธืจื–ืขืฆืŸ ืžื™ื˜ ื“ื™ Django ื™ื™ึทื ืžืึธื ื˜ื™ืจื•ื ื’ ืคึผืจืึธืฆืขืก ืื•ืŸ ื”ืึธื‘ืŸ ืึท ืืจื‘ืขื˜ืŸ ืกื™ืกื˜ืขื ืฆื•ื–ืึทืžืขืŸ ืžื™ื˜ ืื•ื ื“ื–ืขืจ ืื ื“ืขืจืข ืงืึทืžืคึผืึธื•ื ืึทื ืฅ. ืขืก ื–ืขื ืขืŸ ืคื™ืœืข ื™ืžืคึผืœืึทืžืขื ื˜ื™ื™ืฉืึทืŸ ืึธืคึผืฆื™ืขืก ื‘ื ื™ืžืฆื ืื•ื™ืฃ ื“ืขืจ ืื™ื ื˜ืขืจื ืขืฅ. ืขืก ืื™ื– ืื™ื™ืŸ ื•ื•ืขืจืกื™ืข ื“ืขืจืœืื ื’ื˜ ื“ืึธ, ืึธื‘ืขืจ ื™ื•ื–ืขืจื– ืงืขื ืขืŸ ื ื•ืฆืŸ ื–ื™ื™ืขืจ ืื™ื™ื’ืขื ืข ืคึผืจืึทืกืขืกืึทื–.

ืžื™ืจ ื•ื•ืขืœืŸ ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ื™ PostgreSQL ืื•ืŸ Nginx ื•ื•ืขืจืกื™ืขืก ื‘ื ื™ืžืฆื ืื™ืŸ RHEL 8 ื“ื•ืจืš ืคืขืœื™ืงื™ื™ึทื˜ ื ื™ืฆืŸ Yum.

sudo yum install nginx postgresql-server

PostgreSQL ื•ื•ืขื˜ ื“ืึทืจืคืŸ psycopg2, ืึธื‘ืขืจ ืขืก ื“ืึทืจืฃ ื–ื™ื™ืŸ ื‘ืืจืขื›ื˜ื™ื’ื˜ ื‘ืœื•ื™ื– ืื™ืŸ ืึท ื•ื•ื™ืจื˜ื•ืึทืœ ื™ื ื•ื•ื™ื™ืจืึทื ืžืขื ืึทืœ ืกื•ื•ื™ื•ื•ืข, ืึทื–ื•ื™ ืžื™ืจ ื•ื•ืขืœืŸ ื™ื ืกื˜ืึทืœื™ืจืŸ ืขืก ืžื™ื˜ pip3 ืฆื•ื–ืึทืžืขืŸ ืžื™ื˜ Django ืื•ืŸ Gunicorn. ืื‘ืขืจ ืขืจืฉื˜ืขืจ ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืฉื˜ืขืœืŸ ื•ื•ื™ืจื˜ื•ืขืœืขื ื•ื•.

ืขืก ืื™ื– ืฉื˜ืขื ื“ื™ืง ืึท ืคึผืœืึทืฅ ืคื•ืŸ ื“ืขื‘ืึทื˜ืข ืื•ื™ืฃ ื“ื™ ื˜ืขืžืข ืคื•ืŸ โ€‹โ€‹ื˜ืฉื•ื–ื™ื ื’ ื“ื™ ืจืขื›ื˜ ืึธืจื˜ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ Django ืคึผืจืึทื“ื–ืฉืขืงืก, ืึธื‘ืขืจ ืื•ื™ื‘ ืื™ืจ ื–ืขื ื˜ ืื™ืŸ ืฆื•ื•ื™ื™ืคืœ, ืื™ืจ ืงืขื ื˜ ืฉื˜ืขื ื“ื™ืง ื•ื•ืขื ื“ืŸ ืฆื• ื“ื™ Linux Filesystem Hierarchy Standard. ืกืคึผืึทืกื™ืคื™ืงืœื™, ื“ื™ FHS ื–ืื’ื˜ ืึทื– / srv ืื™ื– ื’ืขื ื™ืฆื˜ ืฆื•: "ืกื˜ืึธืจ ื”ืึธืกื˜-ืกืคึผืขืฆื™ืคื™ืฉ ื“ืึทื˜ืŸ - ื“ืึทื˜ืŸ ื•ื•ืึธืก ื“ื™ ืกื™ืกื˜ืขื ื˜ืจืื’ื˜, ืึทื–ืึท ื•ื•ื™ ื•ื•ืขื‘ ืกืขืจื•ื•ืขืจ ื“ืึทื˜ืŸ ืื•ืŸ ืกืงืจื™ืคึผืก, ื“ืึทื˜ืŸ ืกื˜ืึธืจื“ ืื•ื™ืฃ ืคื˜ืคึผ ืกืขืจื•ื•ืขืจืก ืื•ืŸ ืงืึธื ื˜ืจืึธืœ ืกื™ืกื˜ืขื ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ื–." ื•ื•ืขืจืกื™ืขืก (ื“ืขืจืฉื™ื™ื ื•ื ื’ ืื™ืŸ FHS -2.3 ืื™ืŸ 2004)."

ื“ืึธืก ืื™ื– ืคึผื•ื ืงื˜ ืื•ื ื“ื–ืขืจ ืคืึทืœ, ืึทื–ื•ื™ ืžื™ืจ ืฉื˜ืขืœืŸ ืึทืœืฅ ืžื™ืจ ื“ืึทืจืคึฟืŸ ืื™ืŸ / srv, ื•ื•ืึธืก ืื™ื– ืึธื•ื ื“ ื“ื•ืจืš ืื•ื ื“ื–ืขืจ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื‘ืึทื ื™ืฆืขืจ (ื•ื•ืึธืœืงืŸ-ื‘ืึทื ื™ืฆืขืจ).

sudo mkdir /srv/djangoapp
sudo chown cloud-user:cloud-user /srv/djangoapp
cd /srv/djangoapp
virtualenv django
source django/bin/activate
pip3 install django gunicorn psycopg2
./django-admin startproject djangoapp /srv/djangoapp

ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ PostgreSQL ืื•ืŸ Django ืื™ื– ื’ืจื™ื ื’: ืฉืึทืคึฟืŸ ืึท ื“ืึทื˜ืึทื‘ื™ื™ืก, ืฉืึทืคึฟืŸ ืึท ื‘ืึทื ื™ืฆืขืจ, ืงืึทื ืคื™ื’ื™ืขืจ ืคึผืขืจืžื™ืฉืึทื ื–. ืื™ื™ืŸ ื–ืึทืš ืฆื• ื”ืึทืœื˜ืŸ ืื™ืŸ ื–ื™ื ืขืŸ ื•ื•ืขืŸ ื˜ื›ื™ืœืขืก ื™ื ืกื˜ืึธืœื™ื ื’ PostgreSQL ืื™ื– ื“ื™ postgresql-ืกืขื˜ืึทืคึผ ืฉืจื™ืคื˜ ื•ื•ืึธืก ืื™ื– ืื™ื ืกื˜ืึทืœื™ืจืŸ ืžื™ื˜ ื“ื™ postgresql-server ืคึผืขืงืœ. ื“ืขืจ ืฉืจื™ืคื˜ ื”ืขืœืคึผืก ืื™ืจ ื“ื•ืจื›ืคื™ืจืŸ ื™ืงืขืจื“ื™ืง ื˜ืึทืกืงืก ืคึฟืึทืจื‘ื•ื ื“ืŸ ืžื™ื˜ ื“ืึทื˜ืึทื‘ื™ื™ืก ืงื ื•ื™ืœ ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข, ืึทื–ืึท ื•ื•ื™ ืงื ื•ื™ืœ ื™ื ื™ื˜ื™ืึทืœื™ื–ืึทื˜ื™ืึธืŸ ืึธื“ืขืจ ื“ื™ ืึทืคึผื’ืจื™ื™ื“ ืคึผืจืึธืฆืขืก. ืฆื• ืงืึทื ืคื™ื’ื™ืขืจ ืึท ื ื™ื™ึทืข PostgreSQL ื‘ื™ื™ึทืฉืคึผื™ืœ ืื•ื™ืฃ ืึท RHEL ืกื™ืกื˜ืขื, ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืœื•ื™ืคืŸ ื“ื™ ื‘ืึทืคึฟืขืœ: 

sudo /usr/bin/postgresql-setup -initdb

ื“ืขืจื ืึธืš ืื™ืจ ืงืขื ืขืŸ ืึธื ื”ื™ื™ื‘ืŸ PostgreSQL ื ื™ืฆืŸ systemd, ืฉืึทืคึฟืŸ ืึท ื“ืึทื˜ืึทื‘ื™ื™ืก ืื•ืŸ ืฉื˜ืขืœืŸ ืึท ืคึผืจื•ื™ืขืงื˜ ืื™ืŸ Django. ื’ืขื“ืขื ืงื˜ ืฆื• ืจื™ืกื˜ืึทืจื˜ PostgreSQL ื ืึธืš ืžืื›ืŸ ืขื ื“ืขืจื•ื ื’ืขืŸ ืฆื• ื“ืขืจ ืงืœื™ืขื ื˜ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข (ื™ื•ื–ืฉืึทื•ื•ืึทืœื™ pg_hba.conf) ืฆื• ืงืึทื ืคื™ื’ื™ืขืจ ืคึผืึทืจืึธืœ ืกื˜ืึธืจื™ื“ื–ืฉ ืคึฟืึทืจ ื“ื™ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื‘ืึทื ื™ืฆืขืจ. ืื•ื™ื‘ ืื™ืจ ื˜ืจืขืคืŸ ืื ื“ืขืจืข ืฉื•ื•ืขืจื™ืงื™ื™ื˜ืŸ, ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืฆื• ื˜ื•ื™ืฉืŸ ื“ื™ IPv4 ืื•ืŸ IPv6 ืกืขื˜ื˜ื™ื ื’ืก ืื™ืŸ ื“ื™ pg_hba.conf ื˜ืขืงืข.

systemctl enable -now postgresql

sudo -u postgres psql
postgres=# create database djangoapp;
postgres=# create user djangouser with password 'qwer4321';
postgres=# alter role djangouser set client_encoding to 'utf8';
postgres=# alter role djangouser set default_transaction_isolation to 'read committed';
postgres=# alter role djangouser set timezone to 'utc';
postgres=# grant all on DATABASE djangoapp to djangouser;
postgres=# q

ืื™ืŸ ื“ืขืจ ื˜ืขืงืข /var/lib/pgsql/data/pg_hba.conf:

# IPv4 local connections:
host    all        all 0.0.0.0/0                md5
# IPv6 local connections:
host    all        all ::1/128                 md5

ืื™ืŸ ื“ืขืจ ื˜ืขืงืข /srv/djangoapp/settings.py:

# Database
DATABASES = {
   'default': {
       'ENGINE': 'django.db.backends.postgresql_psycopg2',
       'NAME': '{{ db_name }}',
       'USER': '{{ db_user }}',
       'PASSWORD': '{{ db_password }}',
       'HOST': '{{ db_host }}',
   }
}

ื ืึธืš ืงืึทื ืคื™ื’ื™ืขืจื™ื ื’ ื“ื™ ืกืขื˜ื˜ื™ื ื’ืก.py ื˜ืขืงืข ืื™ืŸ ื“ื™ ืคึผืจื•ื™ืขืงื˜ ืื•ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื“ื™ ื“ืึทื˜ืึทื‘ื™ื™ืก ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ, ืื™ืจ ืงืขื ืขืŸ ืึธื ื”ื™ื™ื‘ืŸ ื“ื™ ืึทื ื˜ื•ื•ื™ืงืœื•ื ื’ ืกืขืจื•ื•ืขืจ ืฆื• ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืึทื– ืึทืœืฅ ืึทืจื‘ืขื˜. ื ืึธืš ืกื˜ืึทืจื˜ื™ื ื’ ื“ื™ ืึทื ื˜ื•ื•ื™ืงืœื•ื ื’ ืกืขืจื•ื•ืขืจ, ืขืก ืื™ื– ืึท ื’ื•ื˜ืข ื’ืขื“ืึทื ืง ืฆื• ืฉืึทืคึฟืŸ ืึท ืึทื“ืžื™ื ื™ืกื˜ืจืึทื˜ืึธืจ ื‘ืึทื ื™ืฆืขืจ ืฆื• ืคึผืจื•ื‘ื™ืจืŸ ื“ื™ ืงืฉืจ ืฆื• ื“ื™ ื“ืึทื˜ืึทื‘ื™ื™ืก. 

./manage.py runserver 0.0.0.0:8000
./manage.py createsuperuser

ื•ื•ืกื’ื™? ื•ื•ื™ื™?

ื“ืขืจ ืึทื ื˜ื•ื•ื™ืงืœื•ื ื’ ืกืขืจื•ื•ืขืจ ืื™ื– ื ื•ืฆื™ืง ืคึฟืึทืจ ื˜ืขืกื˜ื™ื ื’, ืึธื‘ืขืจ ืฆื• ืœื•ื™ืคืŸ ื“ื™ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืื™ืจ ืžื•ื–ืŸ ืงืึทื ืคื™ื’ื™ืขืจ ื“ื™ ืฆื•ื ืขืžืขืŸ ืกืขืจื•ื•ืขืจ ืื•ืŸ ืคึผืจืึทืงืกื™ ืคึฟืึทืจ ื“ื™ ื•ื•ืขื‘ ืกืขืจื•ื•ื™ืจืขืจ ื’ืึทื˜ืขื•ื•ื™ื™ึท ืฆื•ื‘ื™ื ื“ (WSGI). ืขืก ื–ืขื ืขืŸ ืขื˜ืœืขื›ืข ืคึผืจืึธืกื˜ ืงืึทืžื‘ืึทื ื™ื™ืฉืึทื ื–, ืœืžืฉืœ, Apache HTTPD ืžื™ื˜ uWSGI ืึธื“ืขืจ Nginx ืžื™ื˜ Gunicorn.

ื“ื™ ืึทืจื‘ืขื˜ ืคื•ืŸ ื“ื™ ื•ื•ืขื‘ ืกืขืจื•ื•ืขืจ ื’ืึทื˜ืขื•ื•ื™ื™ึท ืฆื•ื‘ื™ื ื“ ืื™ื– ืฆื• ืคืึธืจื•ื™ืก ืจื™ืงื•ื•ืขืก ืคื•ืŸ ื“ื™ ื•ื•ืขื‘ ืกืขืจื•ื•ืขืจ ืฆื• ื“ื™ ืคึผื™ื˜ื”ืึธืŸ ื•ื•ืขื‘ ืคืจื™ื™ืžื•ื•ืขืจืง. WSGI ืื™ื– ืึท ืจืขืœื™ืง ืคื•ืŸ ื“ื™ ืฉืจืขืงืœืขืš ืคืึทืจื’ืึทื ื’ืขื ื”ื™ื™ื˜ ื•ื•ืขืŸ CGI ืขื ื“ื–ืฉืึทื ื– ื–ืขื ืขืŸ ืึทืจื•ื, ืื•ืŸ ื”ื™ื™ึทื ื˜ WSGI ืื™ื– ื“ื™ ื“ืข ืคืึทืงื˜ืึธ ื ืึธืจืžืึทืœ, ืจืึทื’ืึทืจื“ืœืึทืก ืคื•ืŸ ื“ื™ ื•ื•ืขื‘ ืกืขืจื•ื•ืขืจ ืึธื“ืขืจ ืคึผื™ื˜ื”ืึธืŸ ืคืจื™ื™ืžื•ื•ืขืจืง ื’ืขื•ื•ื™ื™ื ื˜. ืึธื‘ืขืจ ื˜ืจืึธืฅ ื–ื™ื™ึทืŸ ื•ื•ื™ื™ื“ืกืคึผืจืขื“ ื ื•ืฆืŸ, ืขืก ื–ืขื ืขืŸ ื ืึธืš ืคื™ืœืข ื ื•ืึทื ืกื™ื– ื•ื•ืขืŸ ืืจื‘ืขื˜ืŸ ืžื™ื˜ ื“ื™ ืคืจืึทืžืขื•ื•ืึธืจืงืก, ืื•ืŸ ืคื™ืœืข ื‘ืจื™ืจื•ืช. ืื™ืŸ ื“ืขื ืคืึทืœ, ืžื™ืจ ื•ื•ืขืœืŸ ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ืคืึทืจืœื™ื™ื’ืŸ ื™ื ื˜ืขืจืึทืงืฉืึทืŸ ืฆื•ื•ื™ืฉืŸ Gunicorn ืื•ืŸ Nginx ื“ื•ืจืš ืึท ื›ืึธืœืขืœ.

ื–ื™ื ื˜ ื‘ื™ื™ื“ืข ืงืึทืžืคึผืึธื•ื ืึทื ืฅ ื–ืขื ืขืŸ ืื™ื ืกื˜ืึทืœื™ืจืŸ ืื•ื™ืฃ ื“ื™ ื–ืขืœื‘ืข ืกืขืจื•ื•ืขืจ, ืœืึธื–ืŸ ืื•ื ื“ื– ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ื ื•ืฆืŸ ืึท UNIX ื›ืึธืœืขืœ ืึทื ืฉื˜ืึธื˜ ืคื•ืŸ ืึท ื ืขืฅ ื›ืึธืœืขืœ. ื–ื™ื ื˜ ืงืึธืžื•ื ื™ืงืึทืฆื™ืข ืจื™ืงื•ื•ื™ื™ืขืจื– ืึท ื›ืึธืœืขืœ ืื™ืŸ ืงื™ื™ืŸ ืคืึทืœ, ืœืึธื–ืŸ ืื•ื ื“ื– ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ื ืขืžืขืŸ ื ืึธืš ืึท ืฉืจื™ื˜ ืื•ืŸ ืงืึทื ืคื™ื’ื™ืขืจ ื›ืึธืœืขืœ ืึทืงื˜ืึทื•ื•ื™ื™ืฉืึทืŸ ืคึฟืึทืจ ื’ื•ื ื™ืงืึธืจืŸ ื“ื•ืจืš ืกื™ืกื˜ืขื.

ื“ืขืจ ืคึผืจืึธืฆืขืก ืคื•ืŸ ืงืจื™ื™ื™ื˜ื™ื ื’ ื›ืึธืœืขืœ ืึทืงื˜ื™ื•ื•ื™ื™ื˜ื™ื“ ื‘ืึทื“ื™ื ื•ื ื’ืก ืื™ื– ื’ืึทื ืฅ ืคึผืฉื•ื˜. ืขืจืฉื˜ืขืจ, ืึท ืึทืคึผืึทืจืึทื˜ ื˜ืขืงืข ืื™ื– ื‘ืืฉืืคืŸ ื•ื•ืึธืก ื›ึผื•ืœืœ ืึท ListenStream ื“ื™ืจืขืงื˜ื™ื•ื• ื•ื•ื™ื™ื–ืŸ ืฆื• ื“ื™ ืคื•ื ื˜ ืื™ืŸ ื•ื•ืึธืก ื“ื™ UNIX ื›ืึธืœืขืœ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื‘ืืฉืืคืŸ, ื“ืขืจื ืึธืš ืึท ืึทืคึผืึทืจืึทื˜ ื˜ืขืงืข ืคึฟืึทืจ ื“ื™ ืกืขืจื•ื•ื™ืก ืื™ืŸ ื•ื•ืึธืก ื“ื™ ืจืขืงื•ื•ื™ืจืขืก ื“ื™ืจืขืงื˜ื™ื•ื• ื•ื•ืขื˜ ืคื•ื ื˜ ืฆื• ื“ื™ ื›ืึธืœืขืœ ืึทืคึผืึทืจืึทื˜ ื˜ืขืงืข. ื“ืขืจื ืึธืš, ืื™ืŸ ื“ื™ ืกืขืจื•ื•ื™ืก ืึทืคึผืึทืจืึทื˜ ื˜ืขืงืข, ืึทืœืข ื•ื•ืึธืก ื‘ืœื™ื™ื‘ื˜ ืื™ื– ืฆื• ืจื•ืคืŸ Gunicorn ืคึฟื•ืŸ ื“ื™ ื•ื•ื™ืจื˜ื•ืึทืœ ืกื•ื•ื™ื•ื•ืข ืื•ืŸ ืฉืึทืคึฟืŸ ืึท WSGI ื‘ื™ื™ื ื“ื™ื ื’ ืคึฟืึทืจ ื“ื™ UNIX ื›ืึธืœืขืœ ืื•ืŸ ื“ื™ Django ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ.

ื“ืึธ ื–ืขื ืขืŸ ืขื˜ืœืขื›ืข ื‘ื™ื™ืฉืคื™ืœืŸ ืคื•ืŸ ืึทืคึผืึทืจืึทื˜ ื˜ืขืงืขืก ืึทื– ืื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ื•ื•ื™ ืึท ื™ืงืขืจ. ืขืจืฉื˜ืขืจ ืžื™ืจ ืฉื˜ืขืœืŸ ืึทืจื•ื™ืฃ ื“ื™ ื›ืึธืœืขืœ. 

[Unit]
Description=Gunicorn WSGI socket

[Socket]
ListenStream=/run/gunicorn.sock

[Install]
WantedBy=sockets.target

ืื™ืฆื˜ ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืงืึทื ืคื™ื’ื™ืขืจ ื“ื™ ื’ื•ื ื™ืงืึธืจืŸ ื“ื™ื™ืžืึทืŸ.

[Unit]
Description=Gunicorn daemon
Requires=gunicorn.socket
After=network.target

[Service]
User=cloud-user
Group=cloud-user
WorkingDirectory=/srv/djangoapp

ExecStart=/srv/djangoapp/django/bin/gunicorn 
         โ€”access-logfile - 
         โ€”workers 3 
         โ€”bind unix:gunicorn.sock djangoapp.wsgi

[Install]
WantedBy=multi-user.target

ืคึฟืึทืจ Nginx, ืขืก ืื™ื– ืึท ืคึผืฉื•ื˜ ืขื ื™ืŸ ืคื•ืŸ ืงืจื™ื™ื™ื˜ื™ื ื’ ืคึผืจืึทืงืกื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืขืก ืื•ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึท ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ ืฆื• ืงืจืึธื ืกื˜ืึทื˜ื™ืง ืื™ื ื”ืึทืœื˜ ืื•ื™ื‘ ืื™ืจ ื ื•ืฆืŸ ืื™ื™ืŸ. ืื™ืŸ RHEL, Nginx ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืขืก ื–ืขื ืขืŸ ืœื™ื’ืŸ ืื™ืŸ /etc/nginx/conf.d. ืื™ืจ ืงืขื ื˜ ื ืึธื›ืžืึทื›ืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ื‘ื™ื™ืฉืคึผื™ืœ ืื™ืŸ ื“ืขืจ ื˜ืขืงืข /etc/nginx/conf.d/default.conf ืื•ืŸ ืึธื ื”ื™ื™ื‘ืŸ ื“ื™ ื“ื™ื ืกื˜. ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืฆื• ืฉื˜ืขืœืŸ ื“ื™ server_name ืฆื• ื’ืœื™ื™ึทื›ืŸ ื“ื™ื™ืŸ ื‘ืึทืœืขื‘ืึธืก ื ืึธืžืขืŸ. 

server {
   listen 80;
   server_name 8beta1.example.com;

   location = /favicon.ico { access_log off; log_not_found off; }
   location /static/ {
       root /srv/djangoapp;
   }

   location / {
       proxy_set_header Host $http_host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
       proxy_pass http://unix:/run/gunicorn.sock;
   }
}

ืึธื ื”ื™ื™ื‘ ื“ื™ Gunicorn ื›ืึธืœืขืœ ืื•ืŸ Nginx ื ื™ืฆืŸ ืกื™ืกื˜ืขืž ืื•ืŸ ืื™ืจ ื–ืขื ื˜ ื’ืจื™ื™ื˜ ืฆื• ืึธื ื”ื™ื™ื‘ืŸ ื˜ืขืกื˜ื™ื ื’.

ืฉืœืขื›ื˜ ื’ื™ื™ื˜ื•ื•ื™ื™ ื˜ืขื•ืช?

ืื•ื™ื‘ ืื™ืจ ืึทืจื™ื™ึทืŸ ื“ื™ ืึทื“ืจืขืก ืื™ืŸ ื“ื™ื™ืŸ ื‘ืœืขื˜ืขืจืขืจ, โ€‹โ€‹ืื™ืจ ื•ื•ืขื˜ ืžื™ืกื˜ืึธืžืข ื‘ืึทืงื•ืžืขืŸ ืึท 502 Bad Gateway ื˜ืขื•ืช. ืขืก ืงืขืŸ ื–ื™ื™ืŸ ื’ืขืคึฟื™ืจื˜ ื“ื•ืจืš ื™ื ืงืขืจืขืงื˜ืœื™ ืงืึทื ืคื™ื’ื™ืขืจื“ UNIX ื›ืึธืœืขืœ ืคึผืขืจืžื™ืฉืึทื ื–, ืึธื“ืขืจ ืขืก ืงืขืŸ ื–ื™ื™ืŸ ืจืขื›ื˜ ืฆื• ืžืขืจ ืงืึธืžืคึผืœื™ืฆื™ืจื˜ ื™ืฉื•ื– ืฉื™ื™ึทื›ื•ืช ืฆื• ืึทืงืกืขืก ืงืึธื ื˜ืจืึธืœ ืื™ืŸ SELinux.

ืื™ืŸ ื“ื™ nginx ื˜ืขื•ืช ืงืœืึธืฅ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ืึท ืฉื•ืจื” ื•ื•ื™ ื“ืึธืก: 

2018/12/18 15:38:03 [crit] 12734#0: *3 connect() to unix:/run/gunicorn.sock failed (13: Permission denied) while connecting to upstream, client: 192.168.122.1, server: 8beta1.example.com, request: "GET / HTTP/1.1", upstream: "http://unix:/run/gunicorn.sock:/", host: "8beta1.example.com"

ืื•ื™ื‘ ืžื™ืจ ืคึผืจื•ื‘ื™ืจืŸ ื’ื•ื ื™ืงืึธืจืŸ ื’ืœื™ื™ึทืš, ืžื™ืจ ื•ื•ืขืœืŸ ื‘ืึทืงื•ืžืขืŸ ืึท ืœื™ื™ื“ื™ืง ืขื ื˜ืคืขืจ. 

curl โ€”unix-socket /run/gunicorn.sock 8beta1.example.com

ื–ืืœ ืก ืจืขื›ืขื ืขืŸ ืื•ื™ืก ื•ื•ืึธืก ื“ืึธืก ื›ืึทืคึผืึทื ื–. ืื•ื™ื‘ ืื™ืจ ืขืคึฟืขื ืขืŸ ื“ืขื ืงืœืึธืฅ, ืื™ืจ ื•ื•ืขื˜ ืจื•ื‘ึฟ ืžืกืชึผืžื ื–ืขืŸ ืึทื– ื“ื™ ืคึผืจืึธื‘ืœืขื ืื™ื– ืฉื™ื™ึทื›ื•ืช ืฆื• SELinux. ื–ื™ื ื˜ ืžื™ืจ ืœื•ื™ืคืŸ ืึท ื“ื™ื™ืžืึทืŸ ืคึฟืึทืจ ื•ื•ืึธืก ืงื™ื™ืŸ ืคึผืึธืœื™ื˜ื™ืง ืื™ื– ื‘ืืฉืืคืŸ, ืขืก ืื™ื– ืื ื’ืขืฆื™ื™ื›ื ื˜ ื•ื•ื™ init_t. ื–ืืœ ืก ืคึผืจื•ื‘ื™ืจืŸ ื“ืขื ื˜ืขืึธืจื™ืข ืื™ืŸ ืคื™ืจ. 

sudo setenforce 0

ืึทืœืข ื“ืขื ืงืขืŸ ืคืึทืจืฉืึทืคืŸ ืงืจื™ื˜ื™ืง ืื•ืŸ ื˜ืจืขืจืŸ ืคื•ืŸ ื‘ืœื•ื˜, ืึธื‘ืขืจ ื“ืึธืก ืื™ื– ื ืึธืจ ื“ื™ื‘ืึทื’ื™ื ื’ ื“ื™ ืคึผืจืึธื•ื˜ืึทื˜ื™ื™ืคึผ. ืœืึธืžื™ืจ ื“ื™ืกื™ื™ื‘ืึทืœ ื“ื™ ื˜ืฉืขืง ื ืึธืจ ืฆื• ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืึทื– ื“ืึธืก ืื™ื– ื“ืขืจ ืคึผืจืึธื‘ืœืขื, ื ืึธืš ื•ื•ืึธืก ืžื™ืจ ื•ื•ืขืœืŸ ืฆื•ืจื™ืงืงื•ืžืขืŸ ืึทืœืฅ ืฆื•ืจื™ืง ืฆื• ื–ื™ื™ืŸ ืึธืจื˜.

ื“ื•ืจืš ืจืขืคืจืขืฉื™ื ื’ ื“ืขื ื‘ืœืึทื˜ ืื™ืŸ ื“ืขื ื‘ืœืขื˜ืขืจืขืจ ืึธื“ืขืจ ืจื™ืจืึทื ื™ื ื’ ืื•ื ื“ื–ืขืจ ืงืขืจืœ ื‘ืึทืคึฟืขืœ, ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ื“ื™ Django ืคึผืจื•ื‘ื™ืจืŸ ื‘ืœืึทื˜.

ืึทื–ื•ื™, ืžื™ืจ ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืึทื– ืึทืœืฅ ืึทืจื‘ืขื˜ ืื•ืŸ ืขืก ื–ืขื ืขืŸ ืงื™ื™ืŸ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืคึผืจืึธื‘ืœืขืžืก, ืžื™ืจ ื’ืขื‘ืŸ SELinux ื•ื•ื™ื“ืขืจ. 

sudo setenforce 1

ืื™ืš ื•ื•ืขืœ ื ื™ืฉื˜ ืจืขื“ืŸ ื•ื•ืขื’ืŸ Audit2allow ืึธื“ืขืจ ืงืจื™ื™ื™ื˜ื™ื ื’ ืคืœื™ื ืง-ื‘ืื–ื™ืจื˜ ืคึผืึทืœืึทืกื™ื– ืžื™ื˜ ืกืขืคึผืึธืœื’ืขืŸ ื“ืึธ, ื•ื•ื™ื™ึทืœ ืขืก ืื™ื– ืงื™ื™ืŸ ืคืึทืงื˜ื™ืฉ Django ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ ื“ืขื ืžืึธืžืขื ื˜, ืึทื–ื•ื™ ืขืก ืื™ื– ืงื™ื™ืŸ ื’ืึทื ืฅ ืžืึทืคึผืข ืคื•ืŸ โ€‹โ€‹ื•ื•ืึธืก Gunicorn ื–ืืœ ื•ื•ืขืœืŸ ืฆื• ืึทืงืกืขืก ืื•ืŸ ื•ื•ืึธืก ืขืก ื–ืึธืœ ืœื™ื™ืงืขื ืขืŸ ืึทืงืกืขืก ืฆื•. ื“ืขืจื™ื‘ืขืจ, ืขืก ืื™ื– ื ื™ื™ื˜ื™ืง ืฆื• ื”ืึทืœื˜ืŸ SELinux ืคืœื™ืกื ื“ื™ืง ืฆื• ื‘ืึทืฉื™ืฆืŸ ื“ื™ ืกื™ืกื˜ืขื, ืื•ืŸ ืื™ืŸ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ืฆื™ื™ื˜ ืœืึธื–ืŸ ื“ื™ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืœื•ื™ืคืŸ ืื•ืŸ ืœืึธื–ืŸ ืึทืจื˜ื™ืงืœืขืŸ ืื™ืŸ ื“ื™ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืงืœืึธืฅ ืึทื–ื•ื™ ืึทื– ื“ื™ ืคืึทืงื˜ื™ืฉ ืคึผืึธืœื™ื˜ื™ืง ืงืขื ืขืŸ ื–ื™ื™ืŸ ื‘ืืฉืืคืŸ ืคึฟื•ืŸ ื–ื™ื™.

ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ืคึผืขืจืžื™ืกื™ื•ื• ื“ืึธื•ืžื™ื™ื ื–

ื ื™ื˜ ืึทืœืขืžืขืŸ ื”ืื˜ ื’ืขื”ืขืจื˜ ืคื•ืŸ ืขืจืœื•ื™ื‘ื˜ ื“ืึธื•ืžื™ื™ื ื– ืื™ืŸ SELinux, ืึธื‘ืขืจ ื–ื™ื™ ื–ืขื ืขืŸ ื’ืึธืจื ื™ืฉื˜ ื ื™ื™ึท. ืคื™ืœืข ืืคื™ืœื• ื’ืขืืจื‘ืขื˜ ืžื™ื˜ ื–ื™ื™ ืึธืŸ ืืคื™ืœื• ืจื™ืึทืœื™ื™ื–ื™ื ื’ ืขืก. ื•ื•ืขืŸ ืึท ืคึผืึธืœื™ื˜ื™ืง ืื™ื– ื‘ืืฉืืคืŸ ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืึทืจื˜ื™ืงืœืขืŸ, ื“ื™ ื‘ืืฉืืคืŸ ืคึผืึธืœื™ื˜ื™ืง ืจืขืคึผืจืึทื–ืขื ืฅ ื“ื™ ืจื™ื–ืึทืœื•ื•ื“ ืคืขืœื“. ื–ืืœ ืก ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ืฉืึทืคึฟืŸ ืึท ืคึผืฉื•ื˜ ืคึผืขืจืžื™ื˜ื™ื ื’ ืคึผืึธืœื™ื˜ื™ืง.

ืฆื• ืฉืึทืคึฟืŸ ืึท ืกืคึผืขืฆื™ืคื™ืฉ ืขืจืœื•ื™ื‘ื˜ ืคืขืœื“ ืคึฟืึทืจ ื’ื•ื ื™ืงืึธืจืŸ, ืื™ืจ ื“ืึทืจืคึฟืŸ ืึท ืžื™ืŸ ืคื•ืŸ ืคึผืึธืœื™ื˜ื™ืง, ืื•ืŸ ืื™ืจ ืื•ื™ืš ื“ืึทืจืคึฟืŸ ืฆื• ืฆื™ื™ื›ืŸ ื“ื™ ืฆื•ื ืขืžืขืŸ ื˜ืขืงืขืก. ืื™ืŸ ื“ืขืจืฆื•, ืžื›ืฉื™ืจื™ื ื–ืขื ืขืŸ ื“ืืจืฃ ืฆื• ืึทืกืขืžื‘ืึทืœ ื ื™ื™ึทืข ืคึผืึทืœืึทืกื™ื–. 

sudo yum install selinux-policy-devel

ื“ืขืจ ื“ืขืจืœื•ื™ื‘ื˜ ื“ืึธื•ืžื™ื™ื ื– ืžืขืงืึทื ื™ื–ืึทื ืื™ื– ืึท ื’ืจื•ื™ืก ื’ืขืฆื™ื™ึทื’ ืฆื• ื™ื“ืขื ื˜ื™ืคื™ืฆื™ืจืŸ ืคึผืจืึธื‘ืœืขืžืก, ืกืคึผืขืฆื™ืขืœ ื•ื•ืขืŸ ืขืก ืงื•ืžื˜ ืฆื• ืึท ืžื ื”ื’ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืึธื“ืขืจ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– ื•ื•ืึธืก ืฉื™ืงืŸ ืึธืŸ ืคึผืึทืœืึทืกื™ื– ืฉื•ื™ืŸ ื‘ืืฉืืคืŸ. ืื™ืŸ ื“ืขื ืคืึทืœ, ื“ื™ ืขืจืœื•ื™ื‘ื˜ ืคืขืœื“ ืคึผืึธืœื™ื˜ื™ืง ืคึฟืึทืจ ื’ื•ื ื™ืงืึธืจืŸ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื•ื•ื™ ืคึผืฉื•ื˜ ื•ื•ื™ ืžืขื’ืœืขืš - ื“ืขืจืงืœืขืจืŸ ืึท ื”ื•ื™ืคึผื˜ ื˜ื™ืคึผ (gunicorn_t), ื“ืขืจืงืœืขืจืŸ ืึท ื˜ื™ืคึผ ื•ื•ืึธืก ืžื™ืจ ื•ื•ืขืœืŸ ื ื•ืฆืŸ ืฆื• ืฆื™ื™ื›ืŸ ืงื™ื™ืคืœ ืขืงืกืขืงื•ื˜ืึทื‘ืœืขืก (gunicorn_exec_t), ืื•ืŸ ื“ืขืžืึธืœื˜ ืฉื˜ืขืœืŸ ืึท ื™ื‘ืขืจื’ืึทื ื’ ืคึฟืึทืจ ืกื™ืกื˜ืขื ืฆื• ืจื™ื›ื˜ื™ืง ืฆื™ื™ื›ืŸ. ืคืœื™ืกื ื“ื™ืง ืคึผืจืึทืกืขืกืึทื– . ื“ื™ ืœืขืฆื˜ืข ืฉื•ืจื” ืฉื˜ืขืœื˜ ื“ื™ ืคึผืึธืœื™ื˜ื™ืง ื•ื•ื™ ืขื ื™ื™ื‘ืึทืœื“ ื“ื•ืจืš ืคืขืœื™ืงื™ื™ึทื˜ ืื™ืŸ ื“ืขืจ ืฆื™ื™ื˜ ืขืก ืื™ื– ืœืึธื•ื“ื™ื“.

gunicorn.te:

policy_module(gunicorn, 1.0)

type gunicorn_t;
type gunicorn_exec_t;
init_daemon_domain(gunicorn_t, gunicorn_exec_t)
permissive gunicorn_t;

ืื™ืจ ืงืขื ืขืŸ ืฆื•ื ื•ื™ืคื ืขืžืขืŸ ื“ืขื ืคึผืึธืœื™ื˜ื™ืง ื˜ืขืงืข ืื•ืŸ ืœื™ื™ื’ืŸ ืขืก ืฆื• ื“ื™ื™ืŸ ืกื™ืกื˜ืขื. 

make -f /usr/share/selinux/devel/Makefile
sudo semodule -i gunicorn.pp

sudo semanage permissive -a gunicorn_t
sudo semodule -l | grep permissive

ืœืึธืžื™ืจ ื˜ืฉืขืง ืฆื• ื–ืขืŸ ืื•ื™ื‘ SELinux ื‘ืœืึทืงื™ื ื’ ืขืคึผืขืก ืึทื ื“ืขืจืฉ ื•ื•ื™ ื•ื•ืึธืก ืื•ื ื“ื–ืขืจ ืื•ืžื‘ืึทืงืึทื ื˜ ื“ื™ื™ืžืึทืŸ ืึทืงืกืขืก. 

sudo ausearch -m AVC

type=AVC msg=audit(1545315977.237:1273): avc:  denied { write } for pid=19400 comm="nginx" name="gunicorn.sock" dev="tmpfs" ino=52977 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0

SELinux ืคึผืจื™ื•ื•ืขื ืฅ Nginx ืคื•ืŸ ืฉืจื™ื™ื‘ืŸ ื“ืึทื˜ืŸ ืฆื• ื“ื™ UNIX ื›ืึธืœืขืœ ื’ืขื ื™ืฆื˜ ื“ื•ืจืš Gunicorn. ื˜ื™ืคึผื™ืงืึทืœืœื™, ืื™ืŸ ืึทื–ืึท ืงืึทืกืขืก, ืคึผืึทืœืึทืกื™ื– ืึธื ื”ื™ื™ื‘ืŸ ืฆื• ื˜ื•ื™ืฉืŸ, ืึธื‘ืขืจ ืขืก ื–ืขื ืขืŸ ืื ื“ืขืจืข ื˜ืฉืึทืœืึทื ื“ื–ืฉื™ื– ืคืึธืจื•ื™ืก. ืื™ืจ ืงืขื ืขืŸ ืื•ื™ืš ื˜ื•ื™ืฉืŸ ื“ื™ ืคืขืœื“ ืกืขื˜ื˜ื™ื ื’ืก ืคื•ืŸ ืึท ืจื™ืกื˜ืจื™ืงืฉืึทืŸ ืคืขืœื“ ืฆื• ืึท ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืคืขืœื“. ืื™ืฆื˜ ืœืึธื–ืŸ ืื•ื ื“ื– ืžืึทืš httpd_t ืฆื• ื“ื™ ืคึผืขืจืžื™ืฉืึทื ื– ืคืขืœื“. ื“ืึธืก ื•ื•ืขื˜ ื’ืขื‘ืŸ Nginx ื“ื™ ื ื•ื™ื˜ื™ืง ืึทืงืกืขืก ืื•ืŸ ืžื™ืจ ืงืขื ืขืŸ ืคืึธืจื–ืขืฆืŸ ืžื™ื˜ ื•ื•ื™ื™ึทื˜ืขืจ ื“ื™ื‘ืึทื’ื™ื ื’ ืึทืจื‘ืขื˜. 

sudo semanage permissive -a httpd_t

ืึทื–ื•ื™, ืึทืžืึธืœ ืื™ืจ ื”ืึธื‘ืŸ ื’ืขืจืื˜ืŸ ืฆื• ื”ืึทืœื˜ืŸ SELinux ืคึผืจืึธื˜ืขืงื˜ืขื“ (ืื™ืจ ื˜ืึทืงืข ื–ืึธืœ ื ื™ืฉื˜ ืœืึธื–ืŸ ืึท SELinux ืคึผืจื•ื™ืขืงื˜ ืื™ืŸ ืจื™ืกื˜ืจื™ืงื˜ื™ื“ ืžืึธื“ืข) ืื•ืŸ ื“ื™ ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ื“ืึธื•ืžื™ื™ื ื– ื–ืขื ืขืŸ ืœืึธื•ื“ื™ื“, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืจืขื›ืขื ืขืŸ ื•ื•ืึธืก ืคึผื•ื ืงื˜ ื“ืึทืจืฃ ื–ื™ื™ืŸ ืื ื’ืขืฆื™ื™ื›ื ื˜ ื•ื•ื™ gunicorn_exec_t ืฆื• ื‘ืึทืงื•ืžืขืŸ ืึทืœืฅ ืืจื‘ืขื˜ืŸ ืจืขื›ื˜ ื•ื•ื™ื“ืขืจ. ืœืึธืžื™ืจ ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ื‘ืึทื–ื•ื›ืŸ ื“ืขื ื•ื•ืขื‘ื–ื™ื™ื˜ืœ ืฆื• ื–ืขืŸ ื ื™ื™ึทืข ืึทืจื˜ื™ืงืœืขืŸ ื•ื•ืขื’ืŸ ืึทืงืกืขืก ืจื™ืกื˜ืจื™ืงืฉืึทื ื–. 

sudo ausearch -m AVC -c gunicorn

ืื™ืจ ื•ื•ืขื˜ ื–ืขืŸ ืึท ืคึผืœืึทืฅ ืคื•ืŸ ืึทืจื˜ื™ืงืœืขืŸ ืžื™ื˜ 'comm="gunicorn"' ื•ื•ืึธืก ื˜ืึธืŸ ืคืึทืจืฉื™ื“ืŸ ื˜ื™ื ื’ื– ืื•ื™ืฃ ื˜ืขืงืขืก ืื™ืŸ / srv/djangoapp, ืึทื–ื•ื™ ื“ืึธืก ืื™ื– ื“ืึธืš ืื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ ืงืึทืžืึทื ื“ื– ื•ื•ืึธืก ื–ืขื ืขืŸ ื•ื•ืขืจื˜ ืคืœืึทื’ื™ื ื’.

ืึธื‘ืขืจ ืื™ืŸ ื“ืขืจืฆื•, ืึท ืึธื ื–ืึธื’ ื•ื•ื™ ื“ืึธืก ืื™ื–: 

type=AVC msg=audit(1545320700.070:1542): avc:  denied { execute } for pid=20704 comm="(gunicorn)" name="python3.6" dev="vda3" ino=8515706 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0

ืื•ื™ื‘ ืื™ืจ ืงื•ืง ืื™ืŸ ื“ื™ ืกื˜ืึทื˜ื•ืก ืคื•ืŸ ื“ื™ ื’ื•ื ื™ืงืึธืจืŸ ืกืขืจื•ื•ื™ืก ืึธื“ืขืจ ืœื•ื™ืคืŸ ื“ื™ ps ื‘ืึทืคึฟืขืœ, ืื™ืจ ื•ื•ืขื˜ ื ื™ืฉื˜ ื–ืขืŸ ืงื™ื™ืŸ ืคืœื™ืกื ื“ื™ืง ืคึผืจืึทืกืขืกืึทื–. ืขืก ืงื•ืงื˜ ื•ื•ื™ ื’ื•ื ื™ืงืึธืจืŸ ืื™ื– ื˜ืจื™ื™ื ื’ ืฆื• ืึทืงืกืขืก ื“ื™ ืคึผื™ื˜ื”ืึธืŸ ื™ื‘ืขืจื–ืขืฆืขืจ ืื™ืŸ ืื•ื ื“ื–ืขืจ ื•ื•ื™ืจื˜ื•ืึทืœ ื™ื ื•ื•ื™ื™ืจืึทื ืžืขื ืึทืœ ืกื•ื•ื™ื•ื•ืข, ืขืคืฉืขืจ ืฆื• ืœื•ื™ืคืŸ ืึทืจื‘ืขื˜ ืกืงืจื™ืคึผืก. ืื™ืฆื˜ ืœืึธื–ืŸ ืื•ื ื“ื– ืฆื™ื™ื›ืŸ ื“ื™ ืฆื•ื•ื™ื™ ืขืงืกืขืงื•ื˜ืึทื‘ืœืข ื˜ืขืงืขืก ืื•ืŸ ื˜ืฉืขืง ืื•ื™ื‘ ืžื™ืจ ืงืขื ืขืŸ ืขืคึฟืขื ืขืŸ ืื•ื ื“ื–ืขืจ Django ืคึผืจื•ื‘ื™ืจืŸ ื‘ืœืึทื˜. 

chcon -t gunicorn_exec_t /srv/djangoapp/django/bin/gunicorn /srv/djangoapp/django/bin/python3.6

ื“ื™ ื’ื•ื ื™ืงืึธืจืŸ ื“ื™ื ืกื˜ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืจื™ืกื˜ืึทืจื˜ื™ื“ ืื™ื™ื“ืขืจ ื“ื™ ื ื™ื™ึทืข ืงื•ื•ื™ื˜ืœ ืงืขื ืขืŸ ื–ื™ื™ืŸ ืื•ื™ืกื’ืขืงืœื™ื‘ืŸ. ืื™ืจ ืงืขื ืขืŸ ืจื™ืกื˜ืึทืจื˜ ืขืก ืžื™ื“ ืึธื“ืขืจ ื”ืึทืœื˜ืŸ ื“ื™ ื“ื™ื ืกื˜ ืื•ืŸ ืœืึธื–ืŸ ื“ื™ ื›ืึธืœืขืœ ืึธื ื”ื™ื™ื‘ืŸ ืขืก ื•ื•ืขืŸ ืื™ืจ ืขืคึฟืขื ืขืŸ ื“ืขื ืคึผืœืึทืฅ ืื™ืŸ ื“ืขื ื‘ืœืขื˜ืขืจืขืจ. ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืึทื– ืคึผืจืึทืกืขืกืึทื– ื”ืึธื‘ืŸ ื‘ืืงื•ืžืขืŸ ื“ื™ ืจื™ื›ื˜ื™ืง ืœืึทื‘ืขืœืก ื ื™ืฆืŸ ืคึผืก. 

ps -efZ | grep gunicorn

ื“ื• ื–ืืœืกื˜ ื ื™ืฉื˜ ืคืึทืจื’ืขืกืŸ ืฆื• ืฉืึทืคึฟืŸ ืึท ื ืึธืจืžืึทืœ SELinux ืคึผืึธืœื™ื˜ื™ืง ืฉืคึผืขื˜ืขืจ!

ืื•ื™ื‘ ืื™ืจ ืงื•ืง ืื™ืŸ ื“ื™ AVC ืึทืจื˜ื™ืงืœืขืŸ ืื™ืฆื˜, ื“ื™ ืœืขืฆื˜ืข ืึธื ื–ืึธื’ ื›ึผื•ืœืœ ืคึผืขืจืžื™ืกื™ื•ื•=1 ืคึฟืึทืจ ืึทืœืฅ ืฉื™ื™ึทื›ื•ืช ืฆื• ื“ื™ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ, ืื•ืŸ ืคึผืขืจืžื™ืกื™ื•ื•=0 ืคึฟืึทืจ ื“ื™ ืจืขืฉื˜ ืคื•ืŸ ื“ื™ ืกื™ืกื˜ืขื. ืื•ื™ื‘ ืื™ืจ ืคึฟืึทืจืฉื˜ื™ื™ืŸ ื•ื•ืึธืก ืžื™ืŸ ืคื•ืŸ ืึทืงืกืขืก ืึท ืคืึทืงื˜ื™ืฉ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื“ืึทืจืฃ, ืื™ืจ ืงืขื ืขืŸ ื’ืขืฉื•ื•ื™ื ื“ ื’ืขืคึฟื™ื ืขืŸ ื“ื™ ื‘ืขืกื˜ืขืจ ื•ื•ืขื’ ืฆื• ืกืึธืœื•ื•ืข ืึทื–ืึท ืคึผืจืึธื‘ืœืขืžืก. ืึธื‘ืขืจ ื‘ื™ื– ื“ืขืžืึธืœื˜, ืขืก ืื™ื– ื‘ืขืกื˜ืขืจ ืฆื• ื”ืึทืœื˜ืŸ ื“ื™ ืกื™ืกื˜ืขื ื–ื™ื›ืขืจ ืื•ืŸ ื‘ืึทืงื•ืžืขืŸ ืึท ืงืœืึธืจ, ื ื™ืฆืœืขืš ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืคื•ืŸ ื“ื™ Django ืคึผืจื•ื™ืขืงื˜. 

sudo ausearch -m AVC

ื’ืขื˜ืจืืคืŸ!

ื ืืจื‘ืขื˜ืŸ Django ืคึผืจื•ื™ืขืงื˜ ืื™ื– ืืจื•ื™ืก ืžื™ื˜ ืึท ืคืจืึธื ื˜ืขื ื“ ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ Nginx ืื•ืŸ Gunicorn WSGI. ืžื™ืจ ืงืึทื ืคื™ื’ื™ืขืจื“ Python 3 ืื•ืŸ PostgreSQL 10 ืคึฟื•ืŸ ื“ื™ RHEL 8 ื‘ื™ืชื ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™ื–. ืื™ืฆื˜ ืื™ืจ ืงืขื ืขืŸ ืคืึธืจื•ื™ืก ืื•ืŸ ืฉืึทืคึฟืŸ (ืึธื“ืขืจ ืคืฉื•ื˜ ืฆืขื•ื•ื™ืงืœืขืŸ) Django ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– ืึธื“ืขืจ ื•ื™ืกืคืึธืจืฉืŸ ืื ื“ืขืจืข ื‘ื ื™ืžืฆื ืžื›ืฉื™ืจื™ื ืื™ืŸ RHEL 8 ื‘ื™ืชื ืฆื• ืึธื˜ืึทืžื™ื™ื˜ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ืคึผืจืึธืฆืขืก, ืคึฟืึทืจื‘ืขืกืขืจืŸ ืคืึธืจืฉื˜ืขืœื•ื ื’ ืึธื“ืขืจ ืืคื™ืœื• ืงืึทื ื˜ืึทืžืึทื ื™ื™ื– ื“ืขื ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ.

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’