Bug 2144514
| Summary: | SELinux is preventing /usr/bin/bash from execute access on the file kitinerary-extractor. | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Brian J. Murrell <brian> | |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | |
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> | |
| Severity: | high | Docs Contact: | ||
| Priority: | low | |||
| Version: | 8.7 | CC: | lvrabec, mmalik, nknazeko, ssekidde | |
| Target Milestone: | rc | Keywords: | Triaged | |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | All | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2155540 (view as bug list) | Environment: | ||
| Last Closed: | 2023-02-01 07:24:25 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2155540 | |||
Brian,
What is the reason having the file labeled as httpd_sys_rw_content_t? Type of the file on the default location is
rhel88# matchpathcon /usr/libexec/kf5/kitinerary-extractor
/usr/libexec/kf5/kitinerary-extractor system_u:object_r:bin_t:s0
and httpd is allowed to execute it:
rhel88# sesearch -A -s httpd_t -t bin_t -c file -p execute
allow httpd_t base_ro_file_type:file { execute execute_no_trans getattr ioctl lock map open read };
allow httpd_t bin_t:file { execute execute_no_trans getattr ioctl lock map open read };
Other than that, you are right, the boolean seems to be quite powerful and not quite well documented:
rhel88# semanage boolean -l | grep -e ^SELinux -e httpd_unified
SELinux boolean State Default Description
httpd_unified (off , off) Unify HTTPD handling of all content files.
It also needs to be troubleshooted why the man page does not mention all httpd booleans.
(In reply to Zdenek Pytela from comment #1) > Brian, Hi Zdenek, > What is the reason having the file labeled as httpd_sys_rw_content_t? I have no reason in particular for that. Isn't that just the default label for that location? > Type > of the file on the default location is > > rhel88# matchpathcon /usr/libexec/kf5/kitinerary-extractor > /usr/libexec/kf5/kitinerary-extractor system_u:object_r:bin_t:s0 Which seems quite reasonable. But do note that the path of this particular kitinerary-extractor is /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin/bin/ as it's bundled (as much as I hate bundling) with nextcloud. I am aware that kf5-kitinerary-0:22.04.1-1.el8.x86_64 exists in EL8 but I really don't know enough about nextcloud apps to know how/if I can use the above RPM and remove it from the Nextcloud app. That's probably not even possible. Perhaps SELinux needs some policy to handle binaries bundled with nextcloud [apps]? I currently have the following 'bin' directories in /var/lib/nextcloud: /var/lib/nextcloud/apps/mail/vendor/cerdic/css-tidy/bin /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin/bin /var/lib/nextcloud/apps/mail/vendor/amphp/process/bin Looks like this is the default: rhel88# matchpathcon /var/lib/nextcloud /var/lib/nextcloud system_u:object_r:httpd_sys_rw_content_t:s0 Unfortunately I am not aware of the package tree content, but I'd expect an equivalency rule, e. g. rhel88# semanage fcontext -a -e /usr/bin /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin rhel88# restorecon -Rv /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin is set to assign proper context to files in the directory provided they should be executed from httpd as if they were on the regular path. It needs to be assessed case by case. Having said that, I don't think there is anything which could be addressed in selinux-policy, but rather in the app or as a local policy at the target system. (In reply to Zdenek Pytela from comment #3) > > Unfortunately I am not aware of the package tree content, I provided a few examples in my previous message. It seems pattern/predictable. > but I'd expect an > equivalency rule, e. g. > > rhel88# semanage fcontext -a -e /usr/bin > /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin Can this be applied as a wildcard with '*/*' or somesuch in place of the 'christophwurst/kitinerary-bin' since all 3 examples found match that pattern? > Having said that, I don't think there is anything which could be addressed > in selinux-policy, but rather in the app I'm afraid I don't know anything about how to distribute selinux policy updates with app RPMs. :-( > or as a local policy at the target > system. Yeah, of course. But then every sysadmin has to [know [how to]] do this. :-( also. (In reply to Brian J. Murrell from comment #4) > (In reply to Zdenek Pytela from comment #3) > > > > Unfortunately I am not aware of the package tree content, > > I provided a few examples in my previous message. It seems > pattern/predictable. > > > but I'd expect an > > equivalency rule, e. g. > > > > rhel88# semanage fcontext -a -e /usr/bin > > /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin > > Can this be applied as a wildcard with '*/*' or somesuch in place of the > 'christophwurst/kitinerary-bin' since all 3 examples found match that > pattern? I also provided just an example. Regular expressions (not wildcards) can be used in the semanage-fcontext command file specification. The actual content of the setting needs to be assessed by someone understanding the content and usage, perhaps making an equivalency of the content root (or all content root patterns) to filesystem root. Software collections may serve as a good example of equivalency rules when the software is installed into /opt. > > Having said that, I don't think there is anything which could be addressed > > in selinux-policy, but rather in the app > > I'm afraid I don't know anything about how to distribute selinux policy > updates with app RPMs. :-( > > > or as a local policy at the target > > system. > > Yeah, of course. But then every sysadmin has to [know [how to]] do this. > :-( also. I think the package vendor should be contacted. (In reply to Zdenek Pytela from comment #5) > I also provided just an example. > Regular expressions (not wildcards) can be used in the semanage-fcontext > command file specification. Ahhh. That's useful to know. Thanks! > I think the package vendor should be contacted. Meaning the nextcloud developers or the person rolling it into an RPM? If the latter, that is me, based on work done by others. (In reply to Brian J. Murrell from comment #6) > (In reply to Zdenek Pytela from comment #5) > > I also provided just an example. > > Regular expressions (not wildcards) can be used in the semanage-fcontext > > command file specification. > > Ahhh. That's useful to know. Thanks! > > > I think the package vendor should be contacted. > > Meaning the nextcloud developers or the person rolling it into an RPM? If > the latter, that is me, based on work done by others. In that case it should not be difficult to include a particular semanage-fcontext command for each subpackage, see semanage fcontext -a -e / "/var/lib/nextcloud/apps/mail/vendor/c/cc" mkdir -p /var/lib/nextcloud/apps/mail/vendor/c/cc/usr/bin touch /var/lib/nextcloud/apps/mail/vendor/c/cc/usr/bin/ls restorecon -Rv /var/lib/nextcloud/apps/mail/vendor Relabeled /var/lib/nextcloud/apps/mail/vendor/c/cc from unconfined_u:object_r:httpd_sys_rw_content_t:s0 to unconfined_u:object_r:root_t:s0 Relabeled /var/lib/nextcloud/apps/mail/vendor/c/cc/usr from unconfined_u:object_r:httpd_sys_rw_content_t:s0 to unconfined_u:object_r:usr_t:s0 Relabeled /var/lib/nextcloud/apps/mail/vendor/c/cc/usr/bin from unconfined_u:object_r:httpd_sys_rw_content_t:s0 to unconfined_u:object_r:bin_t:s0 Relabeled /var/lib/nextcloud/apps/mail/vendor/c/cc/usr/bin/ls from unconfined_u:object_r:httpd_sys_rw_content_t:s0 to unconfined_u:object_r:bin_t:s0 but the actual usage needs to be adjusted based on the subpackage content. As no new information appeared during the past weeks, we are going to close this bug. If you need to pursue this matter further, feel free to reopen this bug and attach the needed information. |
SELinux is preventing /usr/bin/bash from execute access on the file kitinerary-extractor. ***** Plugin catchall_boolean (89.3 confidence) suggests ****************** If you want to unify HTTPD handling of all content files. Then you must tell SELinux about this by enabling the 'httpd_unified' boolean. You can read 'httpd_selinux' man page for more details. Do setsebool -P httpd_unified 1 ***** Plugin catchall (11.6 confidence) suggests ************************** If you believe that bash should be allowed execute access on the kitinerary-extractor file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'sh' --raw | audit2allow -M my-sh # semodule -X 300 -i my-sh.pp Additional Information: Source Context system_u:system_r:httpd_t:s0 Target Context system_u:object_r:httpd_sys_rw_content_t:s0 Target Objects kitinerary-extractor [ file ] Source sh Source Path /usr/bin/bash Port <Unknown> Host server.interlinx.bc.ca Source RPM Packages bash-4.4.20-4.el8_6.x86_64 Target RPM Packages SELinux Policy RPM selinux-policy-targeted-3.14.3-108.el8.noarch Local Policy RPM selinux-policy-targeted-3.14.3-108.el8.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name server.interlinx.bc.ca Platform Linux server.interlinx.bc.ca 4.18.0-372.32.1.el8_6.x86_64 #1 SMP Tue Oct 25 05:53:57 EDT 2022 x86_64 x86_64 Alert Count 2 First Seen 2022-11-21 07:21:34 EST Last Seen 2022-11-21 07:21:34 EST Local ID 1f75424b-3f34-4224-8beb-42ce08c4f6e1 Raw Audit Messages type=AVC msg=audit(1669033294.816:11840): avc: denied { execute } for pid=640400 comm="sh" name="kitinerary-extractor" dev="dm-7" ino=3409397 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=file permissive=0 type=SYSCALL msg=audit(1669033294.816:11840): arch=x86_64 syscall=access success=no exit=EACCES a0=556b86fdb880 a1=1 a2=7ffcedc6a2b0 a3=0 items=0 ppid=447045 pid=640400 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=sh exe=/usr/bin/bash subj=system_u:system_r:httpd_t:s0 key=(null) Hash: sh,httpd_t,httpd_sys_rw_content_t,file,execute While one suggestion is to use the httpd_unified boolean and refers one to the httpd_selinux about it, that manpage doesn't even mention the boolean, so I cannot enable it with any confidence about what it's doing? But one also has to wonder if it's too big of a hammer. For context, this AVC seems to have happened in relation to NextCloud. # debugfs /dev/dm-7 debugfs 1.45.6 (20-Mar-2020) ncheck 3409397 debugfs: ncheck 3409397 Inode Pathname 3409397 /lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin/bin/kitinerary-extractor