7:51 p.m.
Hey all. I have a tiny web service that I'm running with a ruby
script in ~/.rvm/ , and I'd like to run it out of systemd (just to
keep it running always), but init_t can't read or execute
user_home_t.
Nor can init_t run runcon.
Basically, I can't figure out any way to transition from systemd's
init_t to my user's type (staff_t).
So what's the idiomatic way to handle that sort of thing?
--
http://intelligence.org/ : Our last, best hope for a fantastic future.
.i ko na cpedu lo nu stidi vau loi jbopre .i dafsku lu na go'i li'u .e
lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i
na'i li'u .e
lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu
sofybakni li'u
7:44 a.m.
On 02/11/2015 08:51 PM, Robin Lee Powell wrote:
Hey all. I have a tiny web service that I'm running with a ruby
script in ~/.rvm/ , and I'd like to run it out of systemd (just to
keep it running always), but init_t can't read or execute
user_home_t.
Nor can init_t run runcon.
Basically, I can't figure out any way to transition from systemd's
init_t to my user's type (staff_t).
So what's the idiomatic way to handle that sort of thing?
init_t should be transitioning to a context that can read content in the
users
homedir. What is the label on the ruby script?
Which policy are you using? Do you have unconfined.pp disabled?
Also do you have the actual avcs you are seeing?
11:51 a.m.
New subject: [selinux] Re: Idiomatic solution for tiny systemd "services"?
On Sun, Feb 15, 2015 at 08:44:07AM -0500, Daniel J Walsh wrote:
On 02/11/2015 08:51 PM, Robin Lee Powell wrote:
> Hey all. I have a tiny web service that I'm running with a ruby
> script in ~/.rvm/ , and I'd like to run it out of systemd (just
> to keep it running always), but init_t can't read or execute
> user_home_t.
>
> Nor can init_t run runcon.
>
> Basically, I can't figure out any way to transition from
> systemd's init_t to my user's type (staff_t).
>
> So what's the idiomatic way to handle that sort of thing?
>
init_t should be transitioning to a context that can read content
in the users homedir. What is the label on the ruby script?
user_home_t; I had no idea what to try.
Which policy are you using?
Whatever comes with F20.
Do you have unconfined.pp disabled?
Yes.
Also do you have the actual avcs you are seeing?
Uh, not anymore I'm afraid; I had to find a workaround and move on.
I can regenerate them if it's important?
--
http://intelligence.org/ : Our last, best hope for a fantastic future.
.i ko na cpedu lo nu stidi vau loi jbopre .i dafsku lu na go'i li'u .e
lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i
na'i li'u .e
lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu
sofybakni li'u
4:21 a.m.
New subject: [selinux] Re: Idiomatic solution for tiny systemd "services"?
On 02/15/2015 06:51 PM, Robin Lee Powell wrote:
On Sun, Feb 15, 2015 at 08:44:07AM -0500, Daniel J Walsh wrote:
> On 02/11/2015 08:51 PM, Robin Lee Powell wrote:
>> Hey all. I have a tiny web service that I'm running with a ruby
>> script in ~/.rvm/ , and I'd like to run it out of systemd (just
>> to keep it running always), but init_t can't read or execute
>> user_home_t.
>>
>> Nor can init_t run runcon.
>>
>> Basically, I can't figure out any way to transition from
>> systemd's init_t to my user's type (staff_t).
>>
>> So what's the idiomatic way to handle that sort of thing?
>>
> init_t should be transitioning to a context that can read content
> in the users homedir. What is the label on the ruby script?
user_home_t; I had no idea what to try.
> Which policy are you using?
Whatever comes with F20.
> Do you have unconfined.pp disabled?
Yes.
> Also do you have the actual avcs you are seeing?
Uh, not anymore I'm afraid; I had to find a workaround and move on.
I can regenerate them if it's important?
How does your unit file look for this service?
12:35 p.m.
New subject: [selinux] Re: Idiomatic solution for tiny systemd "services"?
On Mon, Feb 16, 2015 at 11:21:29AM +0100, Miroslav Grepl wrote:
On 02/15/2015 06:51 PM, Robin Lee Powell wrote:
>On Sun, Feb 15, 2015 at 08:44:07AM -0500, Daniel J Walsh wrote:
>>On 02/11/2015 08:51 PM, Robin Lee Powell wrote:
>>>Hey all. I have a tiny web service that I'm running with a ruby
>>>script in ~/.rvm/ , and I'd like to run it out of systemd (just
>>>to keep it running always), but init_t can't read or execute
>>>user_home_t.
>>>
>>>Nor can init_t run runcon.
>>>
>>>Basically, I can't figure out any way to transition from
>>>systemd's init_t to my user's type (staff_t).
>>>
>>>So what's the idiomatic way to handle that sort of thing?
>>>
>>init_t should be transitioning to a context that can read content
>>in the users homedir. What is the label on the ruby script?
>user_home_t; I had no idea what to try.
>
>>Which policy are you using?
>Whatever comes with F20.
>
>>Do you have unconfined.pp disabled?
>Yes.
>
>>Also do you have the actual avcs you are seeing?
>Uh, not anymore I'm afraid; I had to find a workaround and move on.
>I can regenerate them if it's important?
>
How does your unit file look for this service?
I tried several versions; here's the last of them:
[Unit]
Description=Converts Google Docs files to Archive Of Our Own's input format
[Service]
ExecStart=/home/rlpowell/.rvm/wrappers/ruby-2.2.0@sinatra/ruby
/home/rlpowell/src/gdoc-to-ao3/gdoc-to-ao3.rb -p 9080 -o 192.168.123.133
Restart=always
User=rlpowell
Group=rlpowell
[Install]
WantedBy=multi-user.target
A wide variety of AVCs were caused as I played around with various
options, but it was the execute ones that caused me the most
trouble; here's some example:
type=AVC msg=audit(1423701682.841:7262587): avc: denied { execute_no_trans } for
pid=2299 comm="(ruby)"
path="/home/tmp/rlpowell/rvm/gems/ruby-2.2.0@sinatra/wrappers/ruby"
dev="vdd1" ino=1577409 scontext=system_u:system_r:init_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423701682.844:7262593): avc: denied { execute } for pid=2299
comm="bash" name="ruby" dev="vdd1" ino=1353559
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
type=AVC msg=audit(1423701682.844:7262594): avc: denied { execute_no_trans } for
pid=2299 comm="bash"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/bin/ruby" dev="vdd1"
ino=1353559 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423701992.343:7262805): avc: denied { execute } for pid=2476
comm="runcon" name="ruby" dev="vdd1" ino=1577409
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
type=AVC msg=audit(1423702215.494:7263051): avc: denied { execute } for pid=2646
comm="runcon" name="ruby" dev="vdd1" ino=1577409
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
type=AVC msg=audit(1423703784.821:7264163): avc: denied { execute } for pid=3456
comm="(ruby)" name="ruby" dev="vdd1" ino=1577409
scontext=system_u:system_r:init_t:s0 tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423703784.821:7264163): avc: denied { execute_no_trans } for
pid=3456 comm="(ruby)"
path="/home/tmp/rlpowell/rvm/gems/ruby-2.2.0@sinatra/wrappers/ruby"
dev="vdd1" ino=1577409 scontext=system_u:system_r:init_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423703784.824:7264171): avc: denied { execute } for pid=3456
comm="bash" name="ruby" dev="vdd1" ino=1353559
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
type=AVC msg=audit(1423703784.824:7264172): avc: denied { execute_no_trans } for
pid=3456 comm="bash"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/bin/ruby" dev="vdd1"
ino=1353559 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423703851.301:7264239): avc: denied { execute } for pid=3497
comm="ruby"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/lib/libruby.so.2.2.0"
dev="vdd1" ino=1353561 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423704154.718:7264336): avc: denied { execute } for pid=3587
comm="ruby"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/lib/ruby/2.2.0/x86_64-linux/enc/encdb.so"
dev="vdd1" ino=1718629 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
Once I had those solved, I hit the problem that this script listens
on a high port. Now, I have things configured so that staff_t can
do that, but this wouldn't run as staff_t, so I gave up and used the
ruby "daemons" gem instead.
--
http://intelligence.org/ : Our last, best hope for a fantastic future.
.i ko na cpedu lo nu stidi vau loi jbopre .i dafsku lu na go'i li'u .e
lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i
na'i li'u .e
lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu
sofybakni li'u
1:34 a.m.
New subject: [selinux] Re: Idiomatic solution for tiny systemd "services"?
On Mon, Feb 16, 2015 at 10:35:42AM -0800, Robin Lee Powell wrote:
On Mon, Feb 16, 2015 at 11:21:29AM +0100, Miroslav Grepl wrote:
> On 02/15/2015 06:51 PM, Robin Lee Powell wrote:
> >On Sun, Feb 15, 2015 at 08:44:07AM -0500, Daniel J Walsh wrote:
> >>On 02/11/2015 08:51 PM, Robin Lee Powell wrote:
> >>>Hey all. I have a tiny web service that I'm running with a ruby
> >>>script in ~/.rvm/ , and I'd like to run it out of systemd (just
> >>>to keep it running always), but init_t can't read or execute
> >>>user_home_t.
> >>>
> >>>Nor can init_t run runcon.
> >>>
> >>>Basically, I can't figure out any way to transition from
> >>>systemd's init_t to my user's type (staff_t).
> >>>
> >>>So what's the idiomatic way to handle that sort of thing?
> >>>
> >>init_t should be transitioning to a context that can read content
> >>in the users homedir. What is the label on the ruby script?
> >user_home_t; I had no idea what to try.
> >
> >>Which policy are you using?
> >Whatever comes with F20.
> >
> >>Do you have unconfined.pp disabled?
> >Yes.
> >
> >>Also do you have the actual avcs you are seeing?
> >Uh, not anymore I'm afraid; I had to find a workaround and move on.
> >I can regenerate them if it's important?
> >
> How does your unit file look for this service?
I tried several versions; here's the last of them:
[Unit]
Description=Converts Google Docs files to Archive Of Our Own's input format
[Service]
ExecStart=/home/rlpowell/.rvm/wrappers/ruby-2.2.0@sinatra/ruby
/home/rlpowell/src/gdoc-to-ao3/gdoc-to-ao3.rb -p 9080 -o 192.168.123.133
Restart=always
User=rlpowell
Group=rlpowell
[Install]
WantedBy=multi-user.target
A wide variety of AVCs were caused as I played around with various
options, but it was the execute ones that caused me the most
trouble; here's some example:
type=AVC msg=audit(1423701682.841:7262587): avc: denied { execute_no_trans } for
pid=2299 comm="(ruby)"
path="/home/tmp/rlpowell/rvm/gems/ruby-2.2.0@sinatra/wrappers/ruby"
dev="vdd1" ino=1577409 scontext=system_u:system_r:init_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423701682.844:7262593): avc: denied { execute } for pid=2299
comm="bash" name="ruby" dev="vdd1" ino=1353559
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
type=AVC msg=audit(1423701682.844:7262594): avc: denied { execute_no_trans } for
pid=2299 comm="bash"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/bin/ruby" dev="vdd1"
ino=1353559 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423701992.343:7262805): avc: denied { execute } for pid=2476
comm="runcon" name="ruby" dev="vdd1" ino=1577409
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
type=AVC msg=audit(1423702215.494:7263051): avc: denied { execute } for pid=2646
comm="runcon" name="ruby" dev="vdd1" ino=1577409
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
type=AVC msg=audit(1423703784.821:7264163): avc: denied { execute } for pid=3456
comm="(ruby)" name="ruby" dev="vdd1" ino=1577409
scontext=system_u:system_r:init_t:s0 tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423703784.821:7264163): avc: denied { execute_no_trans } for
pid=3456 comm="(ruby)"
path="/home/tmp/rlpowell/rvm/gems/ruby-2.2.0@sinatra/wrappers/ruby"
dev="vdd1" ino=1577409 scontext=system_u:system_r:init_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423703784.824:7264171): avc: denied { execute } for pid=3456
comm="bash" name="ruby" dev="vdd1" ino=1353559
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
type=AVC msg=audit(1423703784.824:7264172): avc: denied { execute_no_trans } for
pid=3456 comm="bash"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/bin/ruby" dev="vdd1"
ino=1353559 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423703851.301:7264239): avc: denied { execute } for pid=3497
comm="ruby"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/lib/libruby.so.2.2.0"
dev="vdd1" ino=1353561 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
type=AVC msg=audit(1423704154.718:7264336): avc: denied { execute } for pid=3587
comm="ruby"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/lib/ruby/2.2.0/x86_64-linux/enc/encdb.so"
dev="vdd1" ino=1718629 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
Once I had those solved, I hit the problem that this script listens
on a high port. Now, I have things configured so that staff_t can
do that, but this wouldn't run as staff_t, so I gave up and used the
ruby "daemons" gem instead.
And now I'm trying to get parsoid running; same sort of situation.
Here's the AVCs so far:
type=AVC msg=audit(03/02/2015 23:30:11.565:327341) : avc: denied { execmem } for
pid=5114 comm=node scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=process
type=AVC msg=audit(03/02/2015 23:30:11.628:327342) : avc: denied { open } for pid=5114
comm=node path=/srv/parsoid/api/server.js dev="vdb1" ino=1048596
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:var_t:s0 tclass=file
type=AVC msg=audit(03/02/2015 23:30:11.628:327342) : avc: denied { read } for pid=5114
comm=node name=server.js dev="vdb1" ino=1048596
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:var_t:s0 tclass=file
type=AVC msg=audit(03/02/2015 23:30:12.783:327350) : avc: denied { name_bind } for
pid=5114 comm=node src=9999 scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:object_r:jboss_management_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(03/02/2015 23:30:31.592:327354) : avc: denied { setrlimit } for
pid=5133 comm=sh scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=process
and here's the service file:
[Unit]
Description=Mediawiki Parsoid web service on node.js
Documentation=http://www.mediawiki.org/wiki/Parsoid
Wants=local-fs.target network.target
After=local-fs.target network.target
[Unit]
Description=Mediawiki Parsoid web service on node.js
Documentation=http://www.mediawiki.org/wiki/Parsoid
Wants=local-fs.target network.target
After=local-fs.target network.target
[Install]
WantedBy=multi-user.target
[Service]
Type=simple
User=apache
Group=apache
WorkingDirectory=/srv/parsoid
EnvironmentFile=-/etc/parsoid/parsoid.env
ExecStart=/usr/bin/node /srv/parsoid/api/server.js
KillMode=process
Restart=on-success
PrivateTmp=true
StandardOutput=syslog
- ------
It doesn't have to be user Apache.
Any hints?
Is there a more active place I could be asking this question?
7:23 a.m.
New subject: [selinux] Re: Idiomatic solution for tiny systemd "services"?
On 03/03/2015 08:34 AM, Robin Lee Powell wrote:
On Mon, Feb 16, 2015 at 10:35:42AM -0800, Robin Lee Powell wrote:
> On Mon, Feb 16, 2015 at 11:21:29AM +0100, Miroslav Grepl wrote:
>> On 02/15/2015 06:51 PM, Robin Lee Powell wrote:
>>> On Sun, Feb 15, 2015 at 08:44:07AM -0500, Daniel J Walsh wrote:
>>>> On 02/11/2015 08:51 PM, Robin Lee Powell wrote:
>>>>> Hey all. I have a tiny web service that I'm running with a ruby
>>>>> script in ~/.rvm/ , and I'd like to run it out of systemd (just
>>>>> to keep it running always), but init_t can't read or execute
>>>>> user_home_t.
>>>>>
>>>>> Nor can init_t run runcon.
>>>>>
>>>>> Basically, I can't figure out any way to transition from
>>>>> systemd's init_t to my user's type (staff_t).
>>>>>
>>>>> So what's the idiomatic way to handle that sort of thing?
>>>>>
>>>> init_t should be transitioning to a context that can read content
>>>> in the users homedir. What is the label on the ruby script?
>>> user_home_t; I had no idea what to try.
>>>
>>>> Which policy are you using?
>>> Whatever comes with F20.
>>>
>>>> Do you have unconfined.pp disabled?
>>> Yes.
>>>
>>>> Also do you have the actual avcs you are seeing?
>>> Uh, not anymore I'm afraid; I had to find a workaround and move on.
>>> I can regenerate them if it's important?
>>>
>> How does your unit file look for this service?
> I tried several versions; here's the last of them:
>
> [Unit]
> Description=Converts Google Docs files to Archive Of Our Own's input format
>
> [Service]
> ExecStart=/home/rlpowell/.rvm/wrappers/ruby-2.2.0@sinatra/ruby
/home/rlpowell/src/gdoc-to-ao3/gdoc-to-ao3.rb -p 9080 -o 192.168.123.133
> Restart=always
> User=rlpowell
> Group=rlpowell
>
> [Install]
> WantedBy=multi-user.target
>
> A wide variety of AVCs were caused as I played around with various
> options, but it was the execute ones that caused me the most
> trouble; here's some example:
>
> type=AVC msg=audit(1423701682.841:7262587): avc: denied { execute_no_trans } for
pid=2299 comm="(ruby)"
path="/home/tmp/rlpowell/rvm/gems/ruby-2.2.0@sinatra/wrappers/ruby"
dev="vdd1" ino=1577409 scontext=system_u:system_r:init_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
> type=AVC msg=audit(1423701682.844:7262593): avc: denied { execute } for pid=2299
comm="bash" name="ruby" dev="vdd1" ino=1353559
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
> type=AVC msg=audit(1423701682.844:7262594): avc: denied { execute_no_trans } for
pid=2299 comm="bash"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/bin/ruby" dev="vdd1"
ino=1353559 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
> type=AVC msg=audit(1423701992.343:7262805): avc: denied { execute } for pid=2476
comm="runcon" name="ruby" dev="vdd1" ino=1577409
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
> type=AVC msg=audit(1423702215.494:7263051): avc: denied { execute } for pid=2646
comm="runcon" name="ruby" dev="vdd1" ino=1577409
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
> type=AVC msg=audit(1423703784.821:7264163): avc: denied { execute } for pid=3456
comm="(ruby)" name="ruby" dev="vdd1" ino=1577409
scontext=system_u:system_r:init_t:s0 tcontext=staff_u:object_r:user_home_t:s0 tclass=file
> type=AVC msg=audit(1423703784.821:7264163): avc: denied { execute_no_trans } for
pid=3456 comm="(ruby)"
path="/home/tmp/rlpowell/rvm/gems/ruby-2.2.0@sinatra/wrappers/ruby"
dev="vdd1" ino=1577409 scontext=system_u:system_r:init_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
> type=AVC msg=audit(1423703784.824:7264171): avc: denied { execute } for pid=3456
comm="bash" name="ruby" dev="vdd1" ino=1353559
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:user_home_t:s0
tclass=file
> type=AVC msg=audit(1423703784.824:7264172): avc: denied { execute_no_trans } for
pid=3456 comm="bash"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/bin/ruby" dev="vdd1"
ino=1353559 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
> type=AVC msg=audit(1423703851.301:7264239): avc: denied { execute } for pid=3497
comm="ruby"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/lib/libruby.so.2.2.0"
dev="vdd1" ino=1353561 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
> type=AVC msg=audit(1423704154.718:7264336): avc: denied { execute } for pid=3587
comm="ruby"
path="/home/tmp/rlpowell/rvm/rubies/ruby-2.2.0/lib/ruby/2.2.0/x86_64-linux/enc/encdb.so"
dev="vdd1" ino=1718629 scontext=system_u:system_r:initrc_t:s0
tcontext=staff_u:object_r:user_home_t:s0 tclass=file
>
> Once I had those solved, I hit the problem that this script listens
> on a high port. Now, I have things configured so that staff_t can
> do that, but this wouldn't run as staff_t, so I gave up and used the
> ruby "daemons" gem instead.
And now I'm trying to get parsoid running; same sort of situation.
Here's the AVCs so far:
type=AVC msg=audit(03/02/2015 23:30:11.565:327341) : avc: denied { execmem } for
pid=5114 comm=node scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=process
type=AVC msg=audit(03/02/2015 23:30:11.628:327342) : avc: denied { open } for pid=5114
comm=node path=/srv/parsoid/api/server.js dev="vdb1" ino=1048596
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:var_t:s0 tclass=file
type=AVC msg=audit(03/02/2015 23:30:11.628:327342) : avc: denied { read } for pid=5114
comm=node name=server.js dev="vdb1" ino=1048596
scontext=system_u:system_r:initrc_t:s0 tcontext=staff_u:object_r:var_t:s0 tclass=file
type=AVC msg=audit(03/02/2015 23:30:12.783:327350) : avc: denied { name_bind } for
pid=5114 comm=node src=9999 scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:object_r:jboss_management_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(03/02/2015 23:30:31.592:327354) : avc: denied { setrlimit } for
pid=5133 comm=sh scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=process
and here's the service file:
[Unit]
Description=Mediawiki Parsoid web service on node.js
Documentation=http://www.mediawiki.org/wiki/Parsoid
Wants=local-fs.target network.target
After=local-fs.target network.target
[Unit]
Description=Mediawiki Parsoid web service on node.js
Documentation=http://www.mediawiki.org/wiki/Parsoid
Wants=local-fs.target network.target
After=local-fs.target network.target
[Install]
WantedBy=multi-user.target
[Service]
Type=simple
User=apache
Group=apache
WorkingDirectory=/srv/parsoid
EnvironmentFile=-/etc/parsoid/parsoid.env
ExecStart=/usr/bin/node /srv/parsoid/api/server.js
KillMode=process
Restart=on-success
PrivateTmp=true
StandardOutput=syslog
- ------
It doesn't have to be user Apache.
Any hints?
Is there a more active place I could be asking this question?
I apologize, I
overlooked your mail.
So still the question is what a proper domain is for it. We could call
/usr/bin/node /srv/parsoid/api/server.js
from a helper script which could have a label -> httpd_exec_t?
ExecStart=/usr/bin/test_helper_script
3:13 a.m.
New subject: [selinux] Re: Idiomatic solution for tiny systemd "services"?
On Tue, Mar 03, 2015 at 02:23:01PM +0100, Miroslav Grepl wrote:
I apologize, I overlooked your mail.
No problem.
So still the question is what a proper domain is for it. We could
call
/usr/bin/node /srv/parsoid/api/server.js
from a helper script which could have a label -> httpd_exec_t?
ExecStart=/usr/bin/test_helper_script
Oh! Yes, that works very well! Thank you!
I had to turn on httpd_execmem, but enh.
--
http://intelligence.org/ : Our last, best hope for a fantastic future.
.i ko na cpedu lo nu stidi vau loi jbopre .i dafsku lu na go'i li'u .e
lu go'i li'u .i ji'a go'i lu na'e go'i li'u .e lu go'i
na'i li'u .e
lu no'e go'i li'u .e lu to'e go'i li'u .e lu lo mamta be do cu
sofybakni li'u
3339
days inactive
3360
days old
selinux@lists.fedoraproject.org
7 comments
3 participants
participants (3)
-
Daniel J Walsh -
Miroslav Grepl -
Robin Lee Powell