CentOS 8
Sponsored Link

SELinux : Use SETroubleShoot2019/09/28

 
To use SETroubleShoot, it's possible to generate additional information for solving SELinux related troubles.
[1]
Messages from SETroubleShoot are sent by Audit Event Dispatcher to [/var/log/messages].
So it needs to run Auditd, refer to here.
[2] SETroubleShoot is installed by default if Base Environment is [Server] or others, but if not, Install it.
[root@dlp ~]#
dnf -y install setroubleshoot-server
[3] Additional logs for AVC denial are recorded to [/var/log/messages] like follows.
[root@dlp ~]#
grep -E 'setroubleshoot|preventing' /var/log/messages

Sep 28 15:56:23 dlp setroubleshoot[1628]: failed to retrieve rpm info for /var/www/html/cgi-enabled/index.py
Sep 28 15:56:23 dlp setroubleshoot[1628]: SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/cgi-enabled/index.py. For complete SELinux messages run: sealert -l 89e97ddd-cfcf-4d3f-aa23-35a3be979d33
Sep 28 15:56:23 dlp platform-python[1628]: SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/cgi-enabled/index.py.#012#012*****  Plugin restorecon (99.5 confidence) suggests   ************************#012#012If you want to fix the label. #012/var/www/html/cgi-enabled/index.py default label should be httpd_sys_script_exec_t.#012Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.#012Do#012# /sbin/restorecon -v /var/www/html/cgi-enabled/index.py#012#012*****  Plugin catchall (1.49 confidence) suggests   **************************#012#012If you believe that httpd should be allowed getattr access on the index.py file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'httpd' --raw | audit2allow -M my-httpd#012# semodule -X 300 -i my-httpd.pp#012
[4] For 2nd line on the example above, a command is given to see more details and it displays logs like follows.
[root@dlp ~]#
sealert -l 89e97ddd-cfcf-4d3f-aa23-35a3be979d33

SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/www/html/cgi-enabled/index.py.

*****  Plugin restorecon (99.5 confidence) suggests   ************************

If you want to fix the label.
/var/www/html/cgi-enabled/index.py default label should be httpd_sys_script_exec_t.
Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.
Do
# /sbin/restorecon -v /var/www/html/cgi-enabled/index.py

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that httpd should be allowed getattr access on the index.py file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'httpd' --raw | audit2allow -M my-httpd
# semodule -X 300 -i my-httpd.pp


Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                unconfined_u:object_r:user_home_dir_t:s0
Target Objects                /var/www/html/cgi-enabled/index.py [ file ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          <Unknown>
Host                          dlp.srv.world
Source RPM Packages
Target RPM Packages
Policy RPM                    selinux-policy-3.14.1-61.el8_0.1.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     dlp.srv.world
Platform                      Linux dlp.srv.world 4.18.0-80.7.1.el8_0.x86_64 #1
                              SMP Sat Aug 3 15:14:00 UTC 2019 x86_64 x86_64
Alert Count                   2
First Seen                    2019-09-28 15:56:03 JST
Last Seen                     2019-09-28 15:56:03 JST
Local ID                      89e97ddd-cfcf-4d3f-aa23-35a3be979d33

Raw Audit Messages
type=AVC msg=audit(1569653763.280:73): avc:  denied  { getattr } for  pid=1378 comm="httpd" path="/var/www/html/cgi-enabled/index.py" dev="dm-0" ino=460792 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=file permissive=0


Hash: httpd,httpd_t,user_home_dir_t,file,getattr
Matched Content