Selinux Apache avc denied

[Alain Reguera Delgado]

Hi, this is my first message. I am completely new in SELinux.

I can't make my web application able to send emails. Selinux blocks it
and return to me an avc denied in /var/log/messages.

---
...
Jul 27 15:41:38 hostname kernel: audit(1122493298.486:0): avc:  denied
{ execute } for  pid=4011 comm=httpd name=bash dev=hda5 ino=844138
scontext=user_u:system_r:httpd_t tcontext=system_u:object_r:shell_exec_t
tclass=file
...
---

Have you some comments about?

I've been reading the faqs and redhat's manual, but it turns confuse to
me. I continue reading and write to you, hoping you light my selinux's
way, and help me to work in the first steps understanding the
technology.

I've been stopped the web development. I feel selinux is a brilliant
technology I'd like to implement in my webserver.

Thanks for your reading time...\:)>
-- alain

On Fri, 29 Jul 2005 23:32:01 EDT, Alain Reguera Delgado said:

>  I've been stopped the web development. I feel selinux is a
> brilliant
>  technology I'd like to implement in my webserver. 
Actually, you have that almost totally backwards - SELinux is a brilliant
technology that gets implemented in the kernel to make sure it doesn't
matter *what* gets implemented in the webserver.  Even if malicious code
gets control of the webserver, it still can't access anything the webserver
wasn't supposed to access...

Now, about the actual problem:

>  Jul 27 15:41:38 hostname kernel: audit(1122493298.486:0): avc: 
> denied
>  { execute } for  pid=4011 comm=httpd name=bash dev=hda5 ino=844138
>  scontext=user_u:system_r:httpd_t tcontext=system_u:object_r:shell_exec_t
>  tclass=file 
Unfortunately, this is *much* too big a can of worms to solve directly - it
would be technically possible to just add a rule that says 'httpd_t can
exec shell_exec_t' - but that would be a *really* *bad* idea because then
any exploit could get a shell (and exec_no_trans only partially minimizes
the problem).

Can you re-arrange the code so that /usr/sbin/sendmail gets invoked directly,
rather than via a shell?  If so, then maybe we can add a can_exec of sendmail_exec_t.

Policy Gurus:  How big a hole would adding a 'can_exec(sendmail_exec_t)' or
'domain_auto_trans(sendmail_t)' cause?  And how many of these common "web
interface
wants to send mail" problems would it solve?

[Colin Walters]

On Fri, 2005-07-29 at 23:56 -0400, Valdis.Kletnieks(a)vt.edu wrote:
>  On Fri, 29 Jul 2005 23:32:01 EDT, Alain Reguera Delgado said:
>  
>  > I've been stopped the web development. I feel selinux is a brilliant
>  > technology I'd like to implement in my webserver.
>  
>  Actually, you have that almost totally backwards - SELinux is a brilliant
>  technology that gets implemented in the kernel  
One of the good things about SELinux actually is that it covers more
than the kernel; e.g. dbus acts as a "userspace object manager" in
concert with the kernel to secure the whole system.  Similarly, there
are patches for Xorg.  I think it does make sense in some situations to
patch the webserver.

>  Unfortunately, this is *much* too big a can of worms to solve
> directly - it
>  would be technically possible to just add a rule that says 'httpd_t can
>  exec shell_exec_t' - but that would be a *really* *bad* idea because then
>  any exploit could get a shell (and exec_no_trans only partially minimizes
>  the problem). 
I don't see a problem with execute_no_trans; it stays within the httpd_t
security domain.  

>  Policy Gurus:  How big a hole would adding a
> 'can_exec(sendmail_exec_t)' or
>  'domain_auto_trans(sendmail_t)' cause?  And how many of these common "web
> interface
>  wants to send mail" problems would it solve? 
I think policy already has this as httpd_t has the privmail attribute,
and policy grants:

./macros/program/mta_macros.te:63:domain_auto_trans(privmail, sendmail_exec_t,
system_mail_t)

My guess is all we need for this problem is:
can_exec(httpd_t, shell_exec_t)

[Daniel J Walsh]

Colin Walters wrote:

> On Fri, 2005-07-29 at 23:56 -0400, Valdis.Kletnieks(a)vt.edu wrote:
>   
>
> >On Fri, 29 Jul 2005 23:32:01 EDT, Alain Reguera Delgado said:
> >
> >    
> >
> >>I've been stopped the web development. I feel selinux is a brilliant
> >>technology I'd like to implement in my webserver.
> >>      
> >>
> >Actually, you have that almost totally backwards - SELinux is a brilliant
> >technology that gets implemented in the kernel 
> >    
> >
>
> One of the good things about SELinux actually is that it covers more
> than the kernel; e.g. dbus acts as a "userspace object manager" in
> concert with the kernel to secure the whole system.  Similarly, there
> are patches for Xorg.  I think it does make sense in some situations to
> patch the webserver.
>
>   
>
> >Unfortunately, this is *much* too big a can of worms to solve directly - it
> >would be technically possible to just add a rule that says 'httpd_t can
> >exec shell_exec_t' - but that would be a *really* *bad* idea because then
> >any exploit could get a shell (and exec_no_trans only partially minimizes
> >the problem).
> >    
> >
>
> I don't see a problem with execute_no_trans; it stays within the httpd_t
> security domain.  
>
>   
>
> >Policy Gurus:  How big a hole would adding a 'can_exec(sendmail_exec_t)' or
> >'domain_auto_trans(sendmail_t)' cause?  And how many of these common "web
> interface
> >wants to send mail" problems would it solve?
> >    
> >
>
> I think policy already has this as httpd_t has the privmail attribute,
> and policy grants:
>
> ./macros/program/mta_macros.te:63:domain_auto_trans(privmail, sendmail_exec_t,
> system_mail_t)
>
> My guess is all we need for this problem is:
> can_exec(httpd_t, shell_exec_t)
>
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   
>  
What is the settings of httpd_ssi_exec boolean?

getsebool httpd_ssi_exec

Looks like you need this on to make your sendmail work.

setsebool -P httpd_ssi_exec=1

--

[Alain Reguera Delgado]

On Mon, 2005-08-01 at 12:39 -0400, Daniel J Walsh wrote:
>  Colin Walters wrote:
>  
>  >On Fri, 2005-07-29 at 23:56 -0400, Valdis.Kletnieks(a)vt.edu wrote:
>  >  
>  >
>  >>On Fri, 29 Jul 2005 23:32:01 EDT, Alain Reguera Delgado said:
>  >>
>  >>    
>  >>
>  >>>I've been stopped the web development. I feel selinux is a brilliant
>  >>>technology I'd like to implement in my webserver.
>  >>>      
>  >>>
>  >>Actually, you have that almost totally backwards - SELinux is a brilliant
>  >>technology that gets implemented in the kernel 
>  >>    
>  >>
>  >
>  >One of the good things about SELinux actually is that it covers more
>  >than the kernel; e.g. dbus acts as a "userspace object manager" in
>  >concert with the kernel to secure the whole system.  Similarly, there
>  >are patches for Xorg.  I think it does make sense in some situations to
>  >patch the webserver.
>  >
>  >  
>  >
>  >>Unfortunately, this is *much* too big a can of worms to solve directly - it
>  >>would be technically possible to just add a rule that says 'httpd_t can
>  >>exec shell_exec_t' - but that would be a *really* *bad* idea because then
>  >>any exploit could get a shell (and exec_no_trans only partially minimizes
>  >>the problem).
>  >>    
>  >>
>  >
>  >I don't see a problem with execute_no_trans; it stays within the httpd_t
>  >security domain.  
>  >
>  >  
>  >
>  >>Policy Gurus:  How big a hole would adding a 'can_exec(sendmail_exec_t)'
> or
>  >>'domain_auto_trans(sendmail_t)' cause?  And how many of these common
> "web interface
>  >>wants to send mail" problems would it solve?
>  >>    
>  >>
>  >
>  >I think policy already has this as httpd_t has the privmail attribute,
>  >and policy grants:
>  >
>  >./macros/program/mta_macros.te:63:domain_auto_trans(privmail, sendmail_exec_t,
> system_mail_t)
>  >
>  >My guess is all we need for this problem is:
>  >can_exec(httpd_t, shell_exec_t)
>  >
>  >
>  >--
>  >fedora-selinux-list mailing list
>  >fedora-selinux-list(a)redhat.com
>  >http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  >  
>  >
>  What is the settings of httpd_ssi_exec boolean?
>  
>  getsebool httpd_ssi_exec
>  
>  Looks like you need this on to make your sendmail work.
>  
>  setsebool -P httpd_ssi_exec=1 
Daniel, I did what you said, and now all is ok. The application is able
to send mails without problems.

Thanks to all of you for the help solving the problem.

>  
>  -- 
>  
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>