http AVC

[Tony Molloy]

Hi,

I'm running http on a fully updated Centos 5 system.

httpd-2.2.3-43.el5.centos.3.x86_64
selinux-policy-2.4.6-279.el5_5.2.noarch
selinux-policy-targeted-2.4.6-279.el5_5.2.noarch


I'm trying to run a cgi script from a user directory.

With SELinux enabled I get the following error.

[Thu Dec 02 12:10:11 2010] [error] [client 193.1.104.8]
   (13)Permission denied: exec of '/usr/sbin/suexec' failed
[Thu Dec 02 12:10:11 2010] [error] [client 193.1.104.8] 
   Premature end of script headers: survey.cgi


With SELinux in permissive mode I get the following AVC

Summary:

SELinux prevented httpd executing access to http files.

Detailed Description:

[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]

SELinux prevented httpd executing access to http files. Ordinarily httpd is
allowed full access to all files labeled with http file context. This machine
has a tightened security policy with the httpd_unified turned off, this 
requires
explicit labeling of all files. If a file is a cgi script it needs to be 
labeled
with httpd_TYPE_script_exec_t in order to be executed. If it is read-only
content, it needs to be labeled httpd_TYPE_content_t, it is writable content. 
it
needs to be labeled httpd_TYPE_script_rw_t or httpd_TYPE_script_ra_t. You can
use the chcon command to change these contexts. Please refer to the man page
"man httpd_selinux" or FAQ (http://fedora.redhat.com/docs/selinux-apache-fc3)
"TYPE" refers to one of "sys", "user" or "staff" or potentially other script
types.

Allowing Access:

Changing the "httpd_unified" boolean to true will allow this access: 
"setsebool -P httpd_unified=1"

The following command will allow this access:

setsebool -P httpd_unified=1

Additional Information:

Source Context                system_u:system_r:httpd_t
Target Context                system_u:object_r:httpd_suexec_exec_t
Target Objects                /usr/sbin/suexec [ file ]
Source                        suexec
Source Path                   /usr/sbin/suexec
Port                          <Unknown>
Host                          a.b.c.d
Source RPM Packages           httpd-2.2.3-43.el5.centos.3
Target RPM Packages           httpd-2.2.3-43.el5.centos.
Policy RPM                    selinux-policy-2.4.6-279.el5_5.2
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   httpd_unified
Host Name                     a.b.c.d
Platform                      Linux a.b.c.d 2.6.18-194.17.4.el5
                              #1 SMP Mon Oct 25 15:50:53 EDT 2010 x86_64
Alert Count                   2
First Seen                    Thu Dec  2 13:09:20 2010
Last Seen                     Thu Dec  2 13:33:32 2010
Local ID                      4a26d013-6f04-4a0f-af21-760368cc9908
Line Numbers                  

Raw Audit Messages            

host=a.b.c.d type=AVC msg=audit(1291296812.604:97588): avc:  denied  { 
execute_no_trans } for  pid=5567 comm="httpd" path="/usr/sbin/suexec" dev=sda2 
ino=1791541 scontext=system_u:system_r:httpd_t:s0 
tcontext=system_u:object_r:httpd_suexec_exec_t:s0 tclass=file

host=a.b.c.d type=SYSCALL msg=audit(1291296812.604:97588): arch=c000003e 
syscall=59 success=yes exit=0 a0=2abacad53449 a1=2abae3768e90 a2=2abae37684d8 
a3=0 items=0 ppid=789 pid=5567 auid=4294967295 uid=48 gid=48 euid=0 suid=0 
fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="suexec" 
exe="/usr/sbin/suexec" subj=system_u:system_r:httpd_t:s0 key=(null)


So it suggests "setsebool -P httpd_unified=1" will allow this access.

However getsebool -a | grep http gives
httpd_unified --> on

So it is allready on.


Thanks,

Tony
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.fedoraproject.org/pipermail/selinux/attachments/20101202/9447d607/attachment.html