Johnny Hughes wrote:

On 09/20/2017 07:19 AM, hw wrote:

...

hw wrote:

...

Hi,

how do I allow CGI programs to print (using 'lpr -P some-printer some-file.pdf') when lighttpd is being used for a web server?

When selinux is permissive, the printer prints; when it´s enforcing, the printer does not print, and I´m getting the log message '/bin/lpr: Permission denied'.

'getsebool -a | grep http' doesn´t show any boolean I could make out to be responsible for this.

Any idea what I need to do/change to allow printing without disabling selinux? _______________________________________________ CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos

Nobody knows?

Look in your audit logs while in permissive mode and you should see the issue in there, the wiki has details:

https://wiki.centos.org/HowTos/SELinux#head-798c98ef37cb8a00425a048152113b7a...

Thanks! I´m guessing I´m supposed to use ausearch to search for something, and I don´t know what to search for.

So far, lighttpd can not print and can not send emails (using MIME::Lite) unless selinux is permissive. Using

'ausearch -c "httpd" -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -i'

, I only get

type=PROCTITLE msg=audit(09/21/2017 14:08:40.569:559) : proctitle=/usr/sbin/lighttpd -D -f /etc/lighttpd/lighttpd.conf type=SYSCALL msg=audit(09/21/2017 14:08:40.569:559) : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x559fc8094740 a1=O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_CLOEXEC a2=0644 a3=0x7 items=0 ppid=1 pid=14081 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=lighttpd exe=/usr/sbin/lighttpd subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(09/21/2017 14:08:40.569:559) : avc: denied { write } for pid=14081 comm=lighttpd name=www dev="sda2" ino=64608 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir

Any idea what I would need to search for, or how to figure out what I would need to allow?

On 09/22/2017 06:58 AM, hw wrote:

PS: Now I found this:

type=PROCTITLE msg=audit(09/22/2017 12:08:29.911:1023) : proctitle=/usr/lib/sendmail -t -oi -oem -fwawi-genimp type=SYSCALL msg=audit(09/22/2017 12:08:29.911:1023) : arch=x86_64 syscall=setgroups success=no exit=EPERM(Operation not permitted) a0=0x1 a1=0x7ffc1df3b0d0 a2=0x0 a3=0x7f5d77c3a300 items=0 ppid=19417 pid=19418 auid=unset uid=lighttpd gid=lighttpd euid=root suid=root fsuid=root egid=lighttpd sgid=lighttpd fsgid=lighttpd tty=(none) ses=unset comm=sendmail exe=/usr/sbin/exim subj=system_u:system_r:httpd_sys_script_t:s0 key=(null) type=AVC msg=audit(09/22/2017 12:08:29.911:1023) : avc: denied { setgid } for pid=19418 comm=sendmail capability=setgid scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_sys_script_t:s0 tclass=capability

type=SYSCALL msg=audit(09/15/2017 12:12:14.551:31746) : arch=x86_64 syscall=open success=yes exit=7 a0=0x7ffd1659ec70 a1=O_RDONLY a2=0x0 a3=0x9 items=0 ppid=27605 pid=27633 auid=unset uid=lighttpd gid=lighttpd euid=lighttpd suid=lighttpd fsuid=lighttpd egid=lighttpd sgid=lighttpd fsgid=lighttpd tty=(none) ses=unset comm=lpr exe=/usr/bin/lpr.cups subj=system_u:system_r:httpd_sys_script_t:s0 key=(null) type=AVC msg=audit(09/15/2017 12:12:14.551:31746) : avc: denied { open } for pid=27633 comm=lpr path=/etc/cups/lpoptions dev="sdb2" ino=153957 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:cupsd_rw_etc_t:s0 tclass=file type=AVC msg=audit(09/15/2017 12:12:14.551:31746) : avc: denied { read } for pid=27633 comm=lpr name=lpoptions dev="sdb2" ino=153957 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:cupsd_rw_etc_t:s0 tclass=file

So I can see that sending email and printing was denied -- which I already found out --- and I don´t have any idea how to allow it.

hw wrote:

...

Johnny Hughes wrote:

...

On 09/20/2017 07:19 AM, hw wrote:

...

hw wrote:

...

Hi,

how do I allow CGI programs to print (using 'lpr -P some-printer some-file.pdf') when lighttpd is being used for a web server?

When selinux is permissive, the printer prints; when it´s enforcing, the printer does not print, and I´m getting the log message '/bin/lpr: Permission denied'.

'getsebool -a | grep http' doesn´t show any boolean I could make out to be responsible for this.

Any idea what I need to do/change to allow printing without disabling selinux? _______________________________________________ CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos

Nobody knows?

Look in your audit logs while in permissive mode and you should see the issue in there, the wiki has details:

https://wiki.centos.org/HowTos/SELinux#head-798c98ef37cb8a00425a048152113b7a...

Thanks! I´m guessing I´m supposed to use ausearch to search for something, and I don´t know what to search for.

So far, lighttpd can not print and can not send emails (using MIME::Lite) unless selinux is permissive. Using

'ausearch -c "httpd" -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -i'

, I only get

type=PROCTITLE msg=audit(09/21/2017 14:08:40.569:559) : proctitle=/usr/sbin/lighttpd -D -f /etc/lighttpd/lighttpd.conf type=SYSCALL msg=audit(09/21/2017 14:08:40.569:559) : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x559fc8094740 a1=O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_CLOEXEC a2=0644 a3=0x7 items=0 ppid=1 pid=14081 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=lighttpd exe=/usr/sbin/lighttpd subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(09/21/2017 14:08:40.569:559) : avc: denied { write } for pid=14081 comm=lighttpd name=www dev="sda2" ino=64608 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir

Any idea what I would need to search for, or how to figure out what I would need to allow? _______________________________________________ CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos

---

CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos

First thing to enable httpd to send mail, you can turn on the send mail boolean.

# setsebool -P httpd_can_sendmail 1

The ability to print you would need to add custom rules.

# grep lpr /var/log/audit/audit.log | audit2allow -R -M myprint

# semodule -i myprint.pp

If you get another failure on lpt, you might have to run these commands a couple of times.

On 09/22/2017 08:24 AM, hw wrote:

Daniel Walsh wrote:

...

On 09/22/2017 06:58 AM, hw wrote:

...

PS: Now I found this:

type=PROCTITLE msg=audit(09/22/2017 12:08:29.911:1023) : proctitle=/usr/lib/sendmail -t -oi -oem -fwawi-genimp type=SYSCALL msg=audit(09/22/2017 12:08:29.911:1023) : arch=x86_64 syscall=setgroups success=no exit=EPERM(Operation not permitted) a0=0x1 a1=0x7ffc1df3b0d0 a2=0x0 a3=0x7f5d77c3a300 items=0 ppid=19417 pid=19418 auid=unset uid=lighttpd gid=lighttpd euid=root suid=root fsuid=root egid=lighttpd sgid=lighttpd fsgid=lighttpd tty=(none) ses=unset comm=sendmail exe=/usr/sbin/exim subj=system_u:system_r:httpd_sys_script_t:s0 key=(null) type=AVC msg=audit(09/22/2017 12:08:29.911:1023) : avc: denied { setgid } for pid=19418 comm=sendmail capability=setgid scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:system_r:httpd_sys_script_t:s0 tclass=capability

type=SYSCALL msg=audit(09/15/2017 12:12:14.551:31746) : arch=x86_64 syscall=open success=yes exit=7 a0=0x7ffd1659ec70 a1=O_RDONLY a2=0x0 a3=0x9 items=0 ppid=27605 pid=27633 auid=unset uid=lighttpd gid=lighttpd euid=lighttpd suid=lighttpd fsuid=lighttpd egid=lighttpd sgid=lighttpd fsgid=lighttpd tty=(none) ses=unset comm=lpr exe=/usr/bin/lpr.cups subj=system_u:system_r:httpd_sys_script_t:s0 key=(null) type=AVC msg=audit(09/15/2017 12:12:14.551:31746) : avc: denied { open } for pid=27633 comm=lpr path=/etc/cups/lpoptions dev="sdb2" ino=153957 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:cupsd_rw_etc_t:s0 tclass=file type=AVC msg=audit(09/15/2017 12:12:14.551:31746) : avc: denied { read } for pid=27633 comm=lpr name=lpoptions dev="sdb2" ino=153957 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:cupsd_rw_etc_t:s0 tclass=file

So I can see that sending email and printing was denied -- which I already found out --- and I don´t have any idea how to allow it.

hw wrote:

...

Johnny Hughes wrote:

...

On 09/20/2017 07:19 AM, hw wrote:

...

hw wrote: > > Hi, > > how do I allow CGI programs to print (using 'lpr -P some-printer > some-file.pdf') when > lighttpd is being used for a web server? > > When selinux is permissive, the printer prints; when it´s > enforcing, > the printer > does not print, and I´m getting the log message '/bin/lpr: > Permission > denied'. > > 'getsebool -a | grep http' doesn´t show any boolean I could make > out > to be responsible > for this. > > Any idea what I need to do/change to allow printing without > disabling > selinux? > _______________________________________________ > CentOS mailing list > CentOS@centos.org > https://lists.centos.org/mailman/listinfo/centos

Nobody knows?

Look in your audit logs while in permissive mode and you should see the issue in there, the wiki has details:

https://wiki.centos.org/HowTos/SELinux#head-798c98ef37cb8a00425a048152113b7a...

Thanks! I´m guessing I´m supposed to use ausearch to search for something, and I don´t know what to search for.

So far, lighttpd can not print and can not send emails (using MIME::Lite) unless selinux is permissive. Using

'ausearch -c "httpd" -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -i'

, I only get

type=PROCTITLE msg=audit(09/21/2017 14:08:40.569:559) : proctitle=/usr/sbin/lighttpd -D -f /etc/lighttpd/lighttpd.conf type=SYSCALL msg=audit(09/21/2017 14:08:40.569:559) : arch=x86_64 syscall=open success=no exit=EACCES(Permission denied) a0=0x559fc8094740 a1=O_WRONLY|O_CREAT|O_EXCL|O_NOCTTY|O_TRUNC|O_CLOEXEC a2=0644 a3=0x7 items=0 ppid=1 pid=14081 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=lighttpd exe=/usr/sbin/lighttpd subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(09/21/2017 14:08:40.569:559) : avc: denied { write } for pid=14081 comm=lighttpd name=www dev="sda2" ino=64608 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=dir

Any idea what I would need to search for, or how to figure out what I would need to allow? _______________________________________________ CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos

---

CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos

First thing to enable httpd to send mail, you can turn on the send mail boolean.

# setsebool -P httpd_can_sendmail 1

Oh I looked at these variables and somehow didn´t see it.

...

The ability to print you would need to add custom rules.

# grep lpr /var/log/audit/audit.log | audit2allow -R -M myprint

# semodule -i myprint.pp

If you get another failure on lpt, you might have to run these commands a couple of times.

Thank you very much! Both problems are now fixed :)

However:

grep lpr /var/log/audit/audit.log | audit2allow -R -M myprint could not open interface info [/var/lib/sepolgen/interface_info]

I don´t know what´s missing, so I omitted the -R option, and it worked.

That is fine. The -R Sometimes finds additional rules.