Hi,
I'm running http on a fully updated Centos 5 system.
httpd-2.2.3-43.el5.centos.3.x86_64
selinux-policy-2.4.6-279.el5_5.2.noarch
selinux-policy-targeted-2.4.6-279.el5_5.2.noarch
I'm trying to run a cgi script from a user directory.
With SELinux enabled I get the following error.
[Thu Dec 02 12:10:11 2010] [error] [client 193.1.104.8]
(13)Permission denied: exec of '/usr/sbin/suexec' failed
[Thu Dec 02 12:10:11 2010] [error] [client 193.1.104.8]
Premature end of script headers: survey.cgi
With SELinux in permissive mode I get the following AVC
Summary:
SELinux prevented httpd executing access to http files.
Detailed Description:
[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]
SELinux prevented httpd executing access to http files. Ordinarily httpd is
allowed full access to all files labeled with http file context. This machine
has a tightened security policy with the httpd_unified turned off, this
requires
explicit labeling of all files. If a file is a cgi script it needs to be
labeled
with httpd_TYPE_script_exec_t in order to be executed. If it is read-only
content, it needs to be labeled httpd_TYPE_content_t, it is writable content.
it
needs to be labeled httpd_TYPE_script_rw_t or httpd_TYPE_script_ra_t. You can
use the chcon command to change these contexts. Please refer to the man page
"man httpd_selinux" or FAQ (http://fedora.redhat.com/docs/selinux-apache-fc3)
"TYPE" refers to one of "sys", "user" or "staff" or potentially other script
types.
Allowing Access:
Changing the "httpd_unified" boolean to true will allow this access:
"setsebool -P httpd_unified=1"
The following command will allow this access:
setsebool -P httpd_unified=1
Additional Information:
Source Context system_u:system_r:httpd_t
Target Context system_u:object_r:httpd_suexec_exec_t
Target Objects /usr/sbin/suexec [ file ]
Source suexec
Source Path /usr/sbin/suexec
Port <Unknown>
Host a.b.c.d
Source RPM Packages httpd-2.2.3-43.el5.centos.3
Target RPM Packages httpd-2.2.3-43.el5.centos.
Policy RPM selinux-policy-2.4.6-279.el5_5.2
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name httpd_unified
Host Name a.b.c.d
Platform Linux a.b.c.d 2.6.18-194.17.4.el5
#1 SMP Mon Oct 25 15:50:53 EDT 2010 x86_64
Alert Count 2
First Seen Thu Dec 2 13:09:20 2010
Last Seen Thu Dec 2 13:33:32 2010
Local ID 4a26d013-6f04-4a0f-af21-760368cc9908
Line Numbers
Raw Audit Messages
host=a.b.c.d type=AVC msg=audit(1291296812.604:97588): avc: denied {
execute_no_trans } for pid=5567 comm="httpd" path="/usr/sbin/suexec" dev=sda2
ino=1791541 scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:httpd_suexec_exec_t:s0 tclass=file
host=a.b.c.d type=SYSCALL msg=audit(1291296812.604:97588): arch=c000003e
syscall=59 success=yes exit=0 a0=2abacad53449 a1=2abae3768e90 a2=2abae37684d8
a3=0 items=0 ppid=789 pid=5567 auid=4294967295 uid=48 gid=48 euid=0 suid=0
fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="suexec"
exe="/usr/sbin/suexec" subj=system_u:system_r:httpd_t:s0 key=(null)
So it suggests "setsebool -P httpd_unified=1" will allow this access.
However getsebool -a | grep http gives
httpd_unified --> on
So it is allready on.
Thanks,
Tony