I'm stuck with an selinux problem and I hope someone can point me in the right direction.
I have apache installed into some custom directories, and am adding fcontext entries to the file_context.local using the commands shown below. These commands are being executed via a puppet manifext, using exec's, eg
exec{'fix_projects_apache_context':
command => "/usr/sbin/semanage fcontext -a -t httpd_exec_t '/opt/projects/apache(/.*)?' ; /sbin/restorecon -R -v /opt/projects/apache",
user => 'root',
unless => "/bin/grep '/opt/projects/apache(/.*)?' /etc/selinux/targeted/contexts/files/file_contexts.local",
logoutput => 'true',
}
1. Executables in /opt/projects/apache/{bin,sbin,ssl}
/usr/sbin/semanage fcontext -a -t httpd_exec_t '/opt/projects/apache(/.*)?'; /sbin/restorecon -R -v /opt/projects/apache
2. Site configs in /etc/httpd-site1/{conf,conf.d} and /etc/httpd-site2/{conf,conf.d}
/usr/sbin/semanage fcontext -a -t httpd_config_t '/etc/httpd(.*)?/conf(.d)?(/.*)?' ; /sbin/restorecon -R -v /etc/httpd*/conf*
3. Logs in /var/mylogs/webserver
/usr/sbin/semanage fcontext -a -t httpd_log_t '/var/mylogs/webServer(/.*)?' ; /sbin/restorecon -R -v /var/mylogs/webServer
4. Webcontent in /mycontent/webcontent
/usr/sbin/semanage fcontext -a -t httpd_sys_content_t '/mycontent/webcontent(/.*)?' ; /sbin/restorecon -R -v /mycontent/webcontent
The issue I have is that these entries are initially set correctly yet their contexts seem to be reverted on subsequent puppet runs and I cannot understand why. eg. If I do:
ls -Z
-rw-r--r-- webservd webservd system_u:object_r:etc_t httpd.conf
which is incorrect, as matchpathcon reports the correct context:
matchpathcon /etc/httpd-site1/conf/httpd.conf
/etc/httpd-site1/conf/httpd.conf system_u:object_r:httpd_config_t
If I run restorecon, the correct contexts are applied, but after a period of time, the config will revert to that shown.
I have a local policy file which is loaded during the regular puppet runs, but my understanding is that this shouldn't affect the file labelling. It is as if a re-label occurs which ignores the settings in my file_context.local override.
Puppet doesn’t seem to provide a very good way of managing fcontect settings on selinux files, at least for situation like mine with multiple files that are deploy from a config management system.
I’m happy to provide further information. System details are selinux-policy-2.4.6-338.el5, RHEL 5.9 (and seen on RHEL 6.4)
Many thanks, Will.