Hello,
I have read on this page
<
https://docs.fedoraproject.org/en-US/Fedora/13/html/Security-Enhanced_Lin...
:
/Important//
//Modules created with audit2allow may allow more access than required.
It is recommended that policy created with audit2allow be posted to an
SELinux list, such as fedora-selinux-list, for review. If you believe
their is a bug in policy, create a bug in Red Hat Bugzilla./
So here I post my issue first to make sure audit2allow is giving the
perfect rule to be set and to ask for the best and most secure way to
allow this.
I have been trying to connect to a remote soap over https on port 443
from a simple php script.
But selinux set to enforcing has been blocking the connection.
I have tried the three methods separately and each one of them allowed
the php script to connect correctly to remote soap.
First I need to know which one of the three methods is best (which will
give less privileges?). Does the audit2allow give a rule with "/more
access than required/"?
Second, I want to ask if there is a way to allow remote soap for only
https://www.domain.com and not any other ip address.
Please find php script, selinux log, audit2why output, audit2allow
output and the three methods I have used to allow connection in postscript.
Thank you very much, I really appreciate your help.
Sincerely yours,
Ahmed Sghaier.
PS :
selinux log :
/# grep '1346290066.999:85' /var/log/audit/audit.log //
//type=AVC msg=audit(1346290066.999:85): avc: denied { name_connect }
for pid=2021 comm="httpd" dest=1664
scontext=unconfined_u:system_r:httpd_t:s0
tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket//
//type=SYSCALL msg=audit(1346290066.999:85): arch=c000003e syscall=42
success=no exit=-13 a0=b a1=7f65a9e33b18 a2=10 a3=40 items=0 ppid=2016
pid=2021 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48
fsgid=48 tty=(none) ses=3 comm="httpd" exe="/usr/sbin/httpd"
subj=unconfined_u:system_r:httpd_t:s0 key=(null)/
Method 1 :
/# setsebool -P allow_ypbind 1/
Method 2 :
/# setsebool -P httpd_can_network_connect 1
/Method 3 :
/# grep '1346290066.999:85' /var/log/audit/audit.log | audit2allow -M soap//
//# semodule -i soap.pp/
audit2allow output :
/# grep '1346290066.999:85' /var/log/audit/audit.log | audit2allow //
//#============= httpd_t ==============//
//#!!!! This avc can be allowed using one of the these booleans://
//# allow_ypbind, httpd_can_network_connect//
//allow httpd_t port_t:tcp_socket name_connect;/
audit2why output :
/# grep '1346290066.999:85' /var/log/audit/audit.log | audit2why //
//type=AVC msg=audit(1346290066.999:85): avc: denied { name_connect }
for pid=2021 comm="httpd" dest=1664
scontext=unconfined_u:system_r:httpd_t:s0
tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket//
//
// Was caused by://
// One of the following booleans was set incorrectly.//
// Description://
// Allow system to run with NIS//
//
// Allow access by executing://
// # setsebool -P allow_ypbind 1//
// Description://
// Allow HTTPD scripts and modules to connect to the network
using TCP.//
//
// Allow access by executing://
// # setsebool -P httpd_can_network_connect 1/
php script :
/<?php//
//try {//
//$soap = new
SoapClient("https://www.domain.com/soap.wsdl");//
//echo "SoapLoaded\n";//
////login//
//$session = $soap->login("user", "login"...);//
//echo "LoginSuccessfull\n";//
////logout//
//$soap->logout($session);//
//echo "LogoutSuccessfull\n";//
//} catch(SoapFault $fault) {//
//ec//ho $fault;//
//}//
/ /?>//
/