Bug 243302

Summary: mailgraph: SELinux context changes required
Product: [Fedora] Fedora Reporter: Matthew Gillen <me>
Component: mailgraphAssignee: Bernard Johnson <bjohnson>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: 7CC: dwalsh
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 1.14-1.fc7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-11-15 19:35:15 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Attachments:
Description Flags
Te file
none
Interface File
none
File context file none

Description Matthew Gillen 2007-06-08 09:39:24 EDT
Description of problem:
Mailgraph doesn't have SELinux contexts set correctly, and therefore when
SELinux is active, mailgraph won't work through apache.

Version-Release number of selected component (if applicable):
mailgraph-1.12-5.fc7

How reproducible:


Steps to Reproduce:
1. Enable SELinux on Fedora7.
2. Go to mailgraph url
  
Actual results:
Blank page

Expected results:
The normal mailgraph pages

Additional info:
Here's what I did to make it work:
chcon -t httpd_sys_script_exec_t /usr/share/mailgraph/mailgraph.cgi
chcon -R -t httpd_sys_script_ra_t /var/cache/mailgraph
chcon -R -t httpd_sys_script_ra_t /var/lib/mailgraph

I'm not sure how to set SELinux file contexts in an RPM spec file, or I would
have just posted the changes needed for the SPEC file.
Comment 1 Bernard Johnson 2007-06-18 15:08:49 EDT
Dan-

What is the current preferred way to fix this?

http://fedoraproject.org/wiki/PackagingDrafts/SELinux
a) file a bug against selinux-policy to include changes for this program
b) create a selinux subpackage
c) scriptlets - this makes rpmlint scream
d) other

Comment 2 Daniel Walsh 2007-06-18 16:16:50 EDT
Create a selinux subpackage and policy for this app.

If you use system-config-selinux go to policy modules and attempt to generate a
policy for this.  It is faily easy if you follow the instructions.
Comment 3 Matthew Gillen 2007-06-18 16:35:14 EDT
The changes are just file-context changes, not actual additional permissions
that httpd needs, so I'm not sure what a policy module would do for you. 
Specifically, you /could/ write a policy to give httpd additional permissions
for the original file contexts, but that would be a "bad thing", since I think
the original file context is default_t or something, and that would defeat a lot
of the protections that the httpd policy offers.

The better solution I think is to just ship a fixed file contexts for those
files to fit the existing httpd policy module.  Maybe I'm misinterpreting your
words, and this is actually what you meant.

In any event, is the way to do this to create a
/etc/selinux/targeted/contexts/files/file_contexts.mailgraph file that gets
installed with the rpm?

Thanks.

Comment 4 Daniel Walsh 2007-06-18 17:04:02 EDT
Created attachment 157328 [details]
Te file

Yes There are two possible solutions, one we label the files in such a way that
any random cgi script would have ra_sys_content_t to them, or we create a new
policy that would isolate and protect the data from other cgi scripts.	I think
this is the preferable solution, from a security standpoint.
Comment 5 Daniel Walsh 2007-06-18 17:04:23 EDT
Created attachment 157330 [details]
Interface File
Comment 6 Daniel Walsh 2007-06-18 17:04:39 EDT
Created attachment 157331 [details]
File context file
Comment 7 Bernard Johnson 2007-06-25 14:01:38 EDT
Dan, I was following the instructions at
http://fedoraproject.org/wiki/PackagingDrafts/SELinux/PolicyModules.

Under the "scriptlets" section, there is a note regarding condrestart and some
additional scripting that needs to be done.  I was not entirely clear on this
area, so I was hoping you could take a look at the changes I made before I push
anything out:

http://cvs.fedora.redhat.com/viewcvs/rpms/mailgraph/devel/mailgraph.spec?root=extras&r1=1.3&r2=1.4
Comment 8 Daniel Walsh 2007-07-10 10:31:39 EDT
I would eliminate the whole varient part.  You are not going to ship a different
version for strict/targeted/mls.  You will ship the same policy for all three.

Remove
	 # Explicitly allow transitions into the new domain
  	 /usr/sbin/setsebool %{name}_disable_trans 0 &> /dev/null || :
Disable_trans does not exist in FC7 and beyond.

I think you need a condrestart at the end of post.

BTW Did you write policy for the mailgraph executable?  The policy I sent was
only for cgi?  
In the postun since we do not have disable_trans, the equivalent would be 

chcon -t bin_t /usr/sbin/mailgraph
service ... condrestart


Comment 9 Bernard Johnson 2007-07-12 13:16:16 EDT
(In reply to comment #8)
> Remove
> 	 # Explicitly allow transitions into the new domain
>   	 /usr/sbin/setsebool %{name}_disable_trans 0 &> /dev/null || :
> Disable_trans does not exist in FC7 and beyond.
>
> In the postun since we do not have disable_trans, the equivalent would be 
> 
> chcon -t bin_t /usr/sbin/mailgraph
> service ... condrestart

Should the rpmlint error just be ignored?

E: mailgraph forbidden-selinux-command-in-%postun chcon

Comment 10 Daniel Walsh 2007-07-13 07:25:36 EDT
Well since you currently do not have policy for   /usr/sbin/mailgraph this is
not a problem.  Although, we might want to lookinto confining it.  

But you bring up a good point which we really do not have a good solution to.

The best approach would be

if XYZ Running:
     service XYZ stop
semodule -r XYZ
if XYZ was Running
     service XYZ start

chcon in the post scripts are frowned upon, since they usually will not survive
relabel and checking the file context versus the default will indicate problems.
Comment 11 Fedora Update System 2007-11-06 11:18:03 EST
mailgraph-1.14-1.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mailgraph'
Comment 12 Fedora Update System 2007-11-09 18:57:11 EST
mailgraph-1.14-1.fc7 has been pushed to the Fedora 7 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mailgraph'
Comment 13 Fedora Update System 2007-11-15 19:35:10 EST
mailgraph-1.14-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 14 Fedora Update System 2007-11-15 19:42:24 EST
mailgraph-1.14-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.