[CentOS] SELinux - way of the future or good idea but !!!

Tue Dec 7 15:59:57 UTC 2010
Benjamin Franz <jfranz at freerun.com>

On 12/07/2010 07:36 AM, Benjamin Franz wrote:
> On 12/06/2010 06:47 AM, Daniel J Walsh wrote:
>>
>> I agree, and would like to look at the AVC's to understand what could
>> have broken the labeling
>
> Well - since it happened again this morning, here you go. On further 
> investigation in backups, I previously had the user account that I use 
> for the FTP based update with its home directory set to a location 
> inside the /var/www/html tree. Since that unknowingly passed this 
> rule, it silently worked. It was changed to a /home/ based directory 
> instead a while ago - tripping this rule. But not consistently: FTP 
> appears to at least partially work outside the home tree even with the 
> rule active.
>
> I *really* dislike landmines when doing routine system tasks.
>


Ok. SELinux blew up something else that was previously working on that 
machine (yes - I've already done something to fix it for now. I don't 
need anyone saying 'well run sealert'. Been there - done that. Things 
are running now.)  This repeated time suckage is why people routinely 
turn it off.


sealert -l e6e017f5-9c2b-4e7b-895e-51a232042588

Summary:

SELinux is preventing the httpd from using potentially mislabeled files
/var/XXXXXXXXXX/misc/manage_clients/config.xml (var_t).

Detailed Description:

SELinux has denied the httpd access to potentially mislabeled files
/var/XXXXXXXXXX/misc/manage_clients/config.xml. This means that SELinux 
will not
allow httpd to use these files. Many third party apps install html files in
directories that SELinux policy cannot predict. These directories have to be
labeled with a file context which httpd can access.

Allowing Access:

If you want to change the file context of
/var/XXXXXXXXXX/misc/manage_clients/config.xml so that the httpd daemon can
access it, you need to execute it using chcon -t httpd_sys_content_t
'/var/XXXXXXXXXX/misc/manage_clients/config.xml'. You can look at the
httpd_selinux man page for additional information.

Additional Information:

Source Context                system_u:system_r:httpd_t
Target Context                user_u:object_r:var_t
Target Objects                
/var/XXXXXXXXXX/misc/manage_clients/config.xml [
                               file ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port <Unknown>
Host                          XXXXXXXXXX
Source RPM Packages           httpd-2.2.3-43.el5.centos.3
Target RPM Packages
Policy RPM                    selinux-policy-2.4.6-279.el5_5.2
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   httpd_bad_labels
Host Name                     XXXXXXXXXX
Platform                      Linux XXXXXXXXXX 2.6.18-194.26.1.el5 #1 SMP
                               Tue Nov 9 12:54:40 EST 2010 i686 i686
Alert Count                   3
First Seen                    Mon Apr 26 10:20:36 2010
Last Seen                     Tue Dec  7 07:38:17 2010
Local ID                      e6e017f5-9c2b-4e7b-895e-51a232042588
Line Numbers

Raw Audit Messages

host=XXXXXXXXXX type=AVC msg=audit(1291736297.720:6786): avc:  denied  { 
getattr } for  pid=21363 comm="httpd" 
path="/var/XXXXXXXXXX/misc/manage_clients/config.xml" dev=dm-0 
ino=5355222 scontext=system_u:system_r:httpd_t:s0 
tcontext=user_u:object_r:var_t:s0 tclass=file

host=XXXXXXXXXX type=SYSCALL msg=audit(1291736297.720:6786): 
arch=40000003 syscall=195 success=no exit=-13 a0=82e7380 a1=8297c68 
a2=296ff4 a3=82e7380 items=0 ppid=3398 pid=21363 auid=4294967295 uid=48 
gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) 
ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" 
subj=system_u:system_r:httpd_t:s0 key=(null)




-- 
Benjamin Franz