SELinux : Use SETroubleShoot2019/09/28 |
|
To use SETroubleShoot, it's possible to generate additional information for solving SELinux related troubles.
|
|
| [1] |
Messages from SETroubleShoot are sent by Audit Event Dispatcher to [/var/log/messages].
So it needs to run Auditd, refer to here. |
| [2] | SETroubleShoot is installed by default if Base Environment is [Server] or others, but if not, Install it. |
|
[root@dlp ~]# dnf -y install setroubleshoot-server
|
| [3] | Additional logs for AVC denial are recorded to [/var/log/messages] like follows. |
|
[root@dlp ~]# grep -E 'setroubleshoot|preventing' /var/log/messages Sep 28 15:56:23 dlp setroubleshoot[1628]: failed to retrieve rpm info for /var/www/html/cgi-enabled/index.py Sep 28 15:56:23 dlp setroubleshoot[1628]: SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/cgi-enabled/index.py. For complete SELinux messages run: sealert -l 89e97ddd-cfcf-4d3f-aa23-35a3be979d33 Sep 28 15:56:23 dlp platform-python[1628]: SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/cgi-enabled/index.py.#012#012***** Plugin restorecon (99.5 confidence) suggests ************************#012#012If you want to fix the label. #012/var/www/html/cgi-enabled/index.py default label should be httpd_sys_script_exec_t.#012Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.#012Do#012# /sbin/restorecon -v /var/www/html/cgi-enabled/index.py#012#012***** Plugin catchall (1.49 confidence) suggests **************************#012#012If you believe that httpd should be allowed getattr access on the index.py file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'httpd' --raw | audit2allow -M my-httpd#012# semodule -X 300 -i my-httpd.pp#012 |
| [4] | For 2nd line on the example above, a command is given to see more details and it displays logs like follows. |
|
[root@dlp ~]# sealert -l 89e97ddd-cfcf-4d3f-aa23-35a3be979d33
SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/cgi-enabled/index.py.
***** Plugin restorecon (99.5 confidence) suggests ************************
If you want to fix the label.
/var/www/html/cgi-enabled/index.py default label should be httpd_sys_script_exec_t.
Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.
Do
# /sbin/restorecon -v /var/www/html/cgi-enabled/index.py
***** Plugin catchall (1.49 confidence) suggests **************************
If you believe that httpd should be allowed getattr access on the index.py file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'httpd' --raw | audit2allow -M my-httpd
# semodule -X 300 -i my-httpd.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context unconfined_u:object_r:user_home_dir_t:s0
Target Objects /var/www/html/cgi-enabled/index.py [ file ]
Source httpd
Source Path /usr/sbin/httpd
Port <Unknown>
Host dlp.srv.world
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.14.1-61.el8_0.1.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name dlp.srv.world
Platform Linux dlp.srv.world 4.18.0-80.7.1.el8_0.x86_64 #1
SMP Sat Aug 3 15:14:00 UTC 2019 x86_64 x86_64
Alert Count 2
First Seen 2019-09-28 15:56:03 JST
Last Seen 2019-09-28 15:56:03 JST
Local ID 89e97ddd-cfcf-4d3f-aa23-35a3be979d33
Raw Audit Messages
type=AVC msg=audit(1569653763.280:73): avc: denied { getattr } for pid=1378 comm="httpd" path="/var/www/html/cgi-enabled/index.py" dev="dm-0" ino=460792 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=file permissive=0
Hash: httpd,httpd_t,user_home_dir_t,file,getattr
|
| Sponsored Link |