SELinux support in awstats RPM

[Aurelien Bompard]

Hi you SELinux gurus :)

I'm trying to add SELinux support to my rpm of awstats in Extras.
Awstats is a perl CGI script which analyses the webserver's logs (and other
logs). It stores its (text-based) databases in /var/lib/awstats, and the
cgi itself is in /usr/share/awstats/wwwroot/cgi-bin/awstats.pl. I use an
alias in an httpd conf file to make it visible from /awstats/ from the web.

For the FC5 package, I've added two semanage calls in %pre to set the
correct types on the cgi and the databases dir.
Before committing and requesting a build, I'd like to make sure with you
that I'm not doing something dangerous, since I'm rather new to SELinux.
Here's the diff :
--- awstats.spec        23 Feb 2006 10:17:11 -0000      1.10
+++ awstats.spec        9 Apr 2006 13:50:38 -0000
@@ -13,6 +13,7 @@
 Requires:   perl
 Requires(post): perl
 Requires(postun): /sbin/service
+Requires(pre):  policycoreutils

 %description
 Advanced Web Statistics is a powerful and featureful tool that generates
@@ -112,6 +113,14 @@
 %clean
 rm -rf $RPM_BUILD_ROOT

+
+%pre
+# Set SELinux types
+semanage fcontext -a -t httpd_sys_script_exec_t \
+    '/usr/share/awstats/wwwroot/cgi-bin(/.*)?' 2>/dev/null || :
+semanage fcontext -a -t httpd_sys_script_rw_t '/var/lib/awstats(/.*)?'
2>/dev/null || :
+
+
 %post
 if [ $1 -eq 1 ]; then
   if [ ! -f %{_sysconfdir}/%{name}/%{name}.`hostname`.conf ]; then


Does it look correct to you ? If I run semanage in %pre, I should not need
to run restorecon on /var/lib/awstats and
on /usr/share/awstats/wwwroot/cgi-bin in %post, do I ?

Is there a better/cleaner way to do it ?
This is a rather common case IMHO, so if we all agree I think it would be
worth having as an example on the Fedora wiki.

Thanks.

Aurélien
-- 
http://aurelien.bompard.org  ~~~~  Jabber : abompard(a)jabber.fr
"You do not really understand something unless you can
explain it to your grandmother." -- Albert Einstein

[Paul Howarth]

On Sun, 2006-04-09 at 15:55 +0200, Aurelien Bompard wrote:
>  Hi you SELinux gurus :)
>  
>  I'm trying to add SELinux support to my rpm of awstats in Extras.
>  Awstats is a perl CGI script which analyses the webserver's logs (and other
>  logs). It stores its (text-based) databases in /var/lib/awstats, and the
>  cgi itself is in /usr/share/awstats/wwwroot/cgi-bin/awstats.pl. I use an
>  alias in an httpd conf file to make it visible from /awstats/ from the web.
>  
>  For the FC5 package, I've added two semanage calls in %pre to set the
>  correct types on the cgi and the databases dir.
>  Before committing and requesting a build, I'd like to make sure with you
>  that I'm not doing something dangerous, since I'm rather new to SELinux.
>  Here's the diff :
>  --- awstats.spec        23 Feb 2006 10:17:11 -0000      1.10
>  +++ awstats.spec        9 Apr 2006 13:50:38 -0000
>  @@ -13,6 +13,7 @@
>   Requires:   perl
>   Requires(post): perl
>   Requires(postun): /sbin/service
>  +Requires(pre):  policycoreutils
>  
>   %description
>   Advanced Web Statistics is a powerful and featureful tool that generates
>  @@ -112,6 +113,14 @@
>   %clean
>   rm -rf $RPM_BUILD_ROOT
>  
>  +
>  +%pre
>  +# Set SELinux types
>  +semanage fcontext -a -t httpd_sys_script_exec_t \
>  +    '/usr/share/awstats/wwwroot/cgi-bin(/.*)?' 2>/dev/null || :
>  +semanage fcontext -a -t httpd_sys_script_rw_t '/var/lib/awstats(/.*)?'
>  2>/dev/null || :
>  +
>  +
>   %post
>   if [ $1 -eq 1 ]; then
>     if [ ! -f %{_sysconfdir}/%{name}/%{name}.`hostname`.conf ]; then
>  
>  
>  Does it look correct to you ? If I run semanage in %pre, I should not need
>  to run restorecon on /var/lib/awstats and
>  on /usr/share/awstats/wwwroot/cgi-bin in %post, do I ?
>  
>  Is there a better/cleaner way to do it ?
>  This is a rather common case IMHO, so if we all agree I think it would be
>  worth having as an example on the Fedora wiki. 
There was some discussion on local policy tweaks in packages last month
(OK, I made a post and Stephen replied...):

http://www.redhat.com/archives/fedora-selinux-list/2006-March/msg00052.html

The suggestion there was for a separate -policy subpackage but I think
handling context changes in %pre should be OK.

Shouldn't you remove the local policy customisation in %postun though?

Paul.

samba smb.conf utmp parameter

I am almost successfully using samba with selinux.  I have run into a
problem with the smb.conf utmp parameter which causes login/logout
information to be written so commands such as who and last will display
samba users.  With utmp enabled, I am getting the following in
/var/log/messages.

Apr  9 10:36:21 localhost kernel: audit(1144593381.511:447): avc:  denied 
{ read write } for  pid=3934 comm="smbd" name="utmp" dev=dm-0
ino=3309575
scontext=root:system_r:smbd_t:s0
tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
Apr  9 10:36:21 localhost kernel: audit(1144593381.511:448): avc:  denied 
{ read } for  pid=3934 comm="smbd" name="utmp" dev=dm-0 ino=3309575
scontext=root:system_r:smbd_t:s0
tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
Apr  9 10:36:21 localhost kernel: audit(1144593381.511:449): avc:  denied 
{ read write } for  pid=3934 comm="smbd" name="utmp" dev=dm-0
ino=3309575
scontext=root:system_r:smbd_t:s0
tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
Apr  9 10:36:21 localhost kernel: audit(1144593381.511:450): avc:  denied 
{ read } for  pid=3934 comm="smbd" name="utmp" dev=dm-0 ino=3309575
scontext=root:system_r:smbd_t:s0
tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file

I believe that the utmp file is in /var/run.  What can I enter to avoid
these messages per user connection and cause the logging to occur?

Mark Orenstein
East Granby School System

[Aurelien Bompard]

Paul Howarth wrote:
>  There was some discussion on local policy tweaks in packages last
> month
>  (OK, I made a post and Stephen replied...):
>  
http://www.redhat.com/archives/fedora-selinux-list/2006-March/msg00052.html

Yes, I saw that, it helped me find the right command.

>  The suggestion there was for a separate -policy subpackage but I
> think
>  handling context changes in %pre should be OK. 
OK. I don't think I'll change the policy frequently for such a small
package, so I don't think a separate rpm is necessary in this particular
case.

>  Shouldn't you remove the local policy customisation in %postun
> though? 
Well, I wonder. The database files will be left over after uninstall,
because we don't want to loose that data, so should I not leave the proper
file context definition as well ?
I guess I'll remove the customization for the cgi-bin, this one is removed.

Thanks,

Aurélien
-- 
http://aurelien.bompard.org  ~~~~  Jabber : abompard(a)jabber.fr
Growth for the sake of growth is the ideology of the cancer cell.

[Paul Howarth]

On Sun, 2006-04-09 at 17:02 +0200, Aurelien Bompard wrote:
>  Paul Howarth wrote:
>  > Shouldn't you remove the local policy customisation in %postun though?
>  
>  Well, I wonder. The database files will be left over after uninstall,
>  because we don't want to loose that data, so should I not leave the proper
>  file context definition as well ?
>  I guess I'll remove the customization for the cgi-bin, this one is removed. 
The existing data files should all have the right context already, and
they'd only lose that context if the system was relabelled.

It could be a problem though if the package was deleted, the system got
relabelled and then the package was reinstalled. That would leave the
database files there and having the wrong context, so the
newly-installed program wouldn't be able to write to them. So it's
probably wise to leave that part of the policy in place as you say.

Paul.

[Aurelien Bompard]

Yeah, well, it doesn't work.
If I run semanage in %pre, the files in /usr/share/awstats/wwwroot/cgi-bin
are still labelled usr_t.

I've made a separate package, as advised by Stephen in your mail, which runs
semanage in %pre (I tried %post too), and I have the following results :

- If I install both awstats and awstats-selinux at the same time (sudo rpm
  -Uvh noarch/awstats-*.rpm), the files are still usr_t

- If I install them separately, first awstats-selinux and then awstats, the
files are labelled correctly (httpd_sys_script_exec_t)

It looks like some transaction mechanism in RPM is causing the problem here.
Is there a RPM guru here ? Stephen ? Dan ?

What is the correct solution ? Run restorecon in %post ?

Thanks for your help,

Aurélien
-- 
http://aurelien.bompard.org  ~~~~  Jabber : abompard(a)jabber.fr
"They that can give up essential liberty to obtain a little temporary
safety, deserve neither liberty nor safety." -- Benjamin Franklin

[Paul Howarth]

Aurelien Bompard wrote:
>  Yeah, well, it doesn't work.
>  If I run semanage in %pre, the files in /usr/share/awstats/wwwroot/cgi-bin
>  are still labelled usr_t.
>  
>  I've made a separate package, as advised by Stephen in your mail, which runs
>  semanage in %pre (I tried %post too), and I have the following results :
>  
>  - If I install both awstats and awstats-selinux at the same time (sudo rpm
>    -Uvh noarch/awstats-*.rpm), the files are still usr_t
>  
>  - If I install them separately, first awstats-selinux and then awstats, the
>  files are labelled correctly (httpd_sys_script_exec_t)
>  
>  It looks like some transaction mechanism in RPM is causing the problem here.
>  Is there a RPM guru here ? Stephen ? Dan ?
>  
>  What is the correct solution ? Run restorecon in %post ?
>  
>  Thanks for your help, 
When you had separate packages, did you have:

Requires(pre): awstats-selinux
in the main awstats package?

Paul.

[Aurelien Bompard]

Paul Howarth wrote:
>  When you had separate packages, did you have:
>  
>  Requires(pre): awstats-selinux
>  in the main awstats package? 
Yes, I tried that too.

Aurélien
-- 
http://aurelien.bompard.org  ~~~~  Jabber : abompard(a)jabber.fr
A: Because we read from top to bottom, left to right.
Q: Why should i start my reply below the quoted text ?

[Daniel J Walsh]

Aurelien Bompard wrote:
>  Hi you SELinux gurus :)
>
>  I'm trying to add SELinux support to my rpm of awstats in Extras.
>  Awstats is a perl CGI script which analyses the webserver's logs (and other
>  logs). It stores its (text-based) databases in /var/lib/awstats, and the
>  cgi itself is in /usr/share/awstats/wwwroot/cgi-bin/awstats.pl. I use an
>  alias in an httpd conf file to make it visible from /awstats/ from the web.
>
>  For the FC5 package, I've added two semanage calls in %pre to set the
>  correct types on the cgi and the databases dir.
>  Before committing and requesting a build, I'd like to make sure with you
>  that I'm not doing something dangerous, since I'm rather new to SELinux.
>  Here's the diff :
>  --- awstats.spec        23 Feb 2006 10:17:11 -0000      1.10
>  +++ awstats.spec        9 Apr 2006 13:50:38 -0000
>  @@ -13,6 +13,7 @@
>   Requires:   perl
>   Requires(post): perl
>   Requires(postun): /sbin/service
>  +Requires(pre):  policycoreutils
>
>   %description
>   Advanced Web Statistics is a powerful and featureful tool that generates
>  @@ -112,6 +113,14 @@
>   %clean
>   rm -rf $RPM_BUILD_ROOT
>
>  +
>  +%pre
>  +# Set SELinux types
>  +semanage fcontext -a -t httpd_sys_script_exec_t \
>  +    '/usr/share/awstats/wwwroot/cgi-bin(/.*)?' 2>/dev/null || :
>  +semanage fcontext -a -t httpd_sys_script_rw_t '/var/lib/awstats(/.*)?'
>  2>/dev/null || :
>  +
>  +
>   %post
>   if [ $1 -eq 1 ]; then
>     if [ ! -f %{_sysconfdir}/%{name}/%{name}.`hostname`.conf ]; then
>
>
>  Does it look correct to you ? If I run semanage in %pre, I should not need
>  to run restorecon on /var/lib/awstats and
>  on /usr/share/awstats/wwwroot/cgi-bin in %post, do I ?
>
>  Is there a better/cleaner way to do it ?
>  This is a rather common case IMHO, so if we all agree I think it would be
>  worth having as an example on the Fedora wiki.
>
>  Thanks.
>
>  Aurélien
>     
In your

%post
chcon --R -t httpd_sys_script_exec_t /usr/share/awstats/wwwroot/cgi-bin
chcon -R -t httpd_sys_script_rw_t /var/lib/awstats

Should be enough.  These should not get relabeled in a restorecon since 
they are customizable types.

[Aurelien Bompard]

Daniel J Walsh wrote:
>  In your
>  
>  %post
>  chcon --R -t httpd_sys_script_exec_t /usr/share/awstats/wwwroot/cgi-bin
>  chcon -R -t httpd_sys_script_rw_t /var/lib/awstats
>  
>  Should be enough.  These should not get relabeled in a restorecon since
>  they are customizable types. 
You mean the call to semanage is not even necessary ? If I remove its action
(with semanage fcontext -d), run chcon on the cgis and run restorecon on
them, they are labelled back to usr_t.
What do you mean by "customizable types" ?

Thanks

Aurélien
-- 
http://aurelien.bompard.org  ~~~~  Jabber : abompard(a)jabber.fr
"As we enjoy great advantages from inventions of others, we should be
glad of an opportunity to serve others by any invention of ours ; and
this we should do freely and generously." -- Benjamin Franklin

[Paul Howarth]

On Tue, 2006-04-11 at 17:43 -0400, Daniel J Walsh wrote:
>  Aurelien Bompard wrote:
>  > Hi you SELinux gurus :)
>  >
>  > I'm trying to add SELinux support to my rpm of awstats in Extras.
>  > Awstats is a perl CGI script which analyses the webserver's logs (and other
>  > logs). It stores its (text-based) databases in /var/lib/awstats, and the
>  > cgi itself is in /usr/share/awstats/wwwroot/cgi-bin/awstats.pl. I use an
>  > alias in an httpd conf file to make it visible from /awstats/ from the web.
>  >
>  > For the FC5 package, I've added two semanage calls in %pre to set the
>  > correct types on the cgi and the databases dir.
>  > Before committing and requesting a build, I'd like to make sure with you
>  > that I'm not doing something dangerous, since I'm rather new to SELinux.
>  > Here's the diff :
>  > --- awstats.spec        23 Feb 2006 10:17:11 -0000      1.10
>  > +++ awstats.spec        9 Apr 2006 13:50:38 -0000
>  > @@ -13,6 +13,7 @@
>  >  Requires:   perl
>  >  Requires(post): perl
>  >  Requires(postun): /sbin/service
>  > +Requires(pre):  policycoreutils
>  >
>  >  %description
>  >  Advanced Web Statistics is a powerful and featureful tool that generates
>  > @@ -112,6 +113,14 @@
>  >  %clean
>  >  rm -rf $RPM_BUILD_ROOT
>  >
>  > +
>  > +%pre
>  > +# Set SELinux types
>  > +semanage fcontext -a -t httpd_sys_script_exec_t \
>  > +    '/usr/share/awstats/wwwroot/cgi-bin(/.*)?' 2>/dev/null || :
>  > +semanage fcontext -a -t httpd_sys_script_rw_t '/var/lib/awstats(/.*)?'
>  > 2>/dev/null || :
>  > +
>  > +
>  >  %post
>  >  if [ $1 -eq 1 ]; then
>  >    if [ ! -f %{_sysconfdir}/%{name}/%{name}.`hostname`.conf ]; then
>  >
>  >
>  > Does it look correct to you ? If I run semanage in %pre, I should not need
>  > to run restorecon on /var/lib/awstats and
>  > on /usr/share/awstats/wwwroot/cgi-bin in %post, do I ?
>  >
>  > Is there a better/cleaner way to do it ?
>  > This is a rather common case IMHO, so if we all agree I think it would be
>  > worth having as an example on the Fedora wiki.
>  >
>  > Thanks.
>  >
>  > Aurélien
>  >   
>  
>  In your
>  
>  %post
>  chcon --R -t httpd_sys_script_exec_t /usr/share/awstats/wwwroot/cgi-bin
>  chcon -R -t httpd_sys_script_rw_t /var/lib/awstats
>  
>  Should be enough.  These should not get relabeled in a restorecon since 
>  they are customizable types.  
Supposing that the package needed non-customizable types, as will
probably be the case for other packages that come along before long.
Would the right thing to do be the semanage to protect against
relabelling plus the chcon in %post to get the right context straight
after package installation?

Any thoughts on why semanage in %pre doesn't work?

Paul.