Attempt to write a readonly database - Django w/ SELinux error

You have to add writing rights to the directory in which your sqlite database is stored. So running chmod 664 /srv/mysite should help.

This is a security risk, so better solution is to change the owner of your database to www-data:

chown www-data:www-data /srv/mysitechown www-data:www-data /srv/mysite/DATABASE.sqlite

In short, it happens when the application which writes to the sqlite database does not have write permission.

This can be solved in three ways:

1. Granting ownership of db.sqlite3 file and its parent directory (thereby write access also) to the user using chown (Eg: chown username db.sqlite3 )
2. Running the webserver (often gunicorn) as root user (run the command sudo -i before you run gunicorn or django runserver)
3. Allowing read and write access to all users by running command chmod 777 db.sqlite3 (Dangerous option)

Never go for the third option unless you are running the webserver in a local machine or the data in the database is not at all important for you.

Second option is also not recommended. But you can go for it, if you are sure that your application is not vulnerable for code injection attack.

This issue is caused by SELinux. After setting file ownership just as you did, I hit this issue. The audit2why(1) tool can be used to diagnose SELinux denials from the log:

(django)[f22-4:www/django/demo] ftweedal% sudo audit2why -atype=AVC msg=audit(1437490152.208:407): avc:  denied  { write }      for  pid=20330 comm="httpd" name="db.sqlite3" dev="dm-1" ino=52036      scontext=system_u:system_r:httpd_t:s0      tcontext=unconfined_u:object_r:httpd_sys_content_t:s0      tclass=file permissive=0    Was caused by:    The boolean httpd_unified was set incorrectly.     Description:    Allow httpd to unified    Allow access by executing:    # setsebool -P httpd_unified 1

Sure enough, running sudo setsebool -P httpd_unified 1 resolved the issue.

Looking into what httpd_unified is for, I came across a fedora-selinux-list post which explains:

This Boolean is off by default, turning it on will allow all httpd executables to have full access to all content labeled with a http file context. Leaving it off makes sure that one httpd service can not interfere with another.

So turning on httpd_unified lets you circumvent the default behaviour that prevents multiple httpd instances on the same server - all running as user apache - messing with each others' stuff.

In my case, I am only running one httpd, so it was fine for me to turn on httpd_unified. If you cannot do this, I suppose some more fine-grained labelling is needed.