Right way to do CGI that does complicated things?
Robin Lee Powell
rlpowell at digitalkingdom.org
Fri Sep 2 23:33:46 UTC 2011
(Background: My SELinux hosts are all F15, fairly base installation,
with the unconfined module disabled)
I have a host that is for random hackery, and hence is (or at least
is allowed to be) less secure than the others.
I have a user who made a CGI (running under apache; python, in case
that matters) that pulls things from elsewhere on the web and then
sends email with the results.
This generates a pretty large number of AVC denials, which I suppose
is reasonable since that behaviour looks an awful lot like "I just
got hijacked and am now being used for spam distribution".
One thing I was genuinely surprised by though is that the
mail-related denials all came in for httpd_user_script_t , rather
than sendmail_t or something, and that no attempt to transition to
sendmail_t seems to have occured or been denied or anything, as I'd
have expected (it sends mail with /bin/mail ).
FWIW, here's the AVCs:
http://fpaste.org/ZyHg/ (uses date from the input form only)
http://fpaste.org/M9Fq/ (goes out and talks to another website)
I've learned a lot about SELinux recently, but it's all been
piecemeal, so this is more of a "what's the right thing?" question
designed to for me to learn from more than "what's the fastest way
to fix this?".
So, what's the right way to handle this situation?
httpd_user_script_exec_t doesn't do the trick at all (which is
probably good since it turns out user_u can set that with chcon,
which I didn't expect).
Is there some way without installing a module (i.e. with semanage or
similar) to indicate to SELinux "Yeah, this script over here? It
can talk to the web" (or "send email")?
Is there a way to indicate that system-wide without installing a
module? (not that I would, just curious)
If doing it via module, it's best to create a bobs_script_exec_t and
bobs_script_t and do everything for those types, rather than
httpd_user_script_exec_t and friends, right? This means that a user
making a non-trivial CGI has to come talk to me, which is a tad
unfortunate but not horrible.
Thanks for all enlightenment here, and please feel free to go the
"you're thinking about it wrong" route; I'm really wanting to learn.
-Robin
--
http://singinst.org/ : Our last, best hope for a fantastic future.
Lojban (http://www.lojban.org/): The language in which "this parrot
is dead" is "ti poi spitaki cu morsi", but "this sentence is false"
is "na nei". My personal page: http://www.digitalkingdom.org/rlp/
More information about the selinux
mailing list