EL5 backport of httpd_tmp_exec SELinux boolean from EL6.

README.md

Python code or modules that require ctypes can raise the following cryptic exception when run under mod_wsgi.

mod_wsgi (pid=4203): Exception occurred processing WSGI script 'xxx.wsgi'.
Traceback (most recent call last):
  File "xxx.wsgi", line 8, in simple_app
    import ctypes
  File "/usr/lib64/python2.6/ctypes/__init__.py", line 546, in <module>
    CFUNCTYPE(c_int)(lambda: None)
MemoryError

This can be resolved in recent Fedora and RHEL releases by enabling a new httpd_tmp_exec boolean.

• https://bugzilla.redhat.com/show_bug.cgi?id=488396
• https://bugzilla.redhat.com/show_bug.cgi?id=645193

For EL5 the below SELinux module can be used to the same effect.

httpdtmpexec.te

policy_module(httpdtmpexec, 0.0.1)

require {
        type httpd_t;
        type httpd_tmp_t;
        type httpd_tmpfs_t;
        class file execute;
};

bool httpd_tmp_exec false;

if (httpd_tmp_exec) {
    allow httpd_t httpd_tmp_t:file execute;
    allow httpd_t httpd_tmpfs_t:file execute;
};