RE: Selinux + ruby + httpd
Erinn Looney-Triggs wrote:
In trying to develop some SELinux exceptions (via audit2allow) for a
ruby application I came up with the following:
module myruby 1.0;
require {
type httpd_tmp_t;
type lib_t;
type httpd_t;
type tmp_t;
class sock_file { write create unlink getattr setattr };
class capability { fowner fsetid };
class file { read getattr execute_no_trans };
class fifo_file { create unlink getattr setattr };
}
#============= httpd_t ==============
allow httpd_t httpd_tmp_t:fifo_file { create unlink getattr setattr };
allow httpd_t httpd_tmp_t:sock_file { write create unlink getattr
setattr };
allow httpd_t lib_t:file execute_no_trans; #This one is due to
mod_passenger being labelled lib_t
allow httpd_t self:capability { fowner fsetid };
allow httpd_t tmp_t:file { read getattr };
Now the first question I have, is there anything egregiously bad in
there? Aside from lib_t execute due to auto label labelling
mod_passenger as lib_t.
My second question is, I have this policy working on one machine, moved
it to another machine and everything worked, this application was then
deployed on a third machine and I figured, I would just insert the
module again. Well installing the module worked fine but apache is
trying to use a different type on this machine, from audit2allow:
#============= httpd_sys_script_t ==============
allow httpd_sys_script_t devpts_t:chr_file { read write };
allow httpd_sys_script_t httpd_tmp_t:fifo_file setattr;
allow httpd_sys_script_t self:capability { setuid setgid };
Why all the sudden is this machine using httpd_sys_script_t instead of
httpd_t which my other systems use? All the boxes are RHEL 5.5 x64
fully
patched running selinux-policy-2.4.6-279.el5. Now it is possible that
the myruby.pp module mentioned above is working just fine, but why then
would this one system need these extra privileges? Exact same codebase
for the ruby application across the systems. Any insight would be
appreciated.
Is it mod_passenger you're building? I've just built an RHEL 5
rubygem-passenger rpm, since I couldn't find one anywhere else. I
haven't looked at the SELinux side yet, and would also be very
interested if a module is being developed.
Moray.
"To err is human. To purr, feline"