Bug 539519

Summary: SELinux is preventing /usr/sbin/httpd from using potentially mislabeled files /var/run/pcscd.pub.
Product: [Fedora] Fedora Reporter: andy york <soylentman>
Component: selinux-policyAssignee: Daniel Walsh <dwalsh>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 12CC: contact, dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: setroubleshoot_trace_hash:e63977691cf891f1646e418626c912992facd1f30318e9a287ff96c6d9960824
Fixed In Version: 3.6.32-49.fc12 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-12-01 16:40:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description andy york 2009-11-20 13:21:48 UTC
Summary:

SELinux is preventing /usr/sbin/httpd from using potentially mislabeled files
/var/run/pcscd.pub.

Detailed Description:

[httpd has a permissive type (httpd_t). This access was not denied.]

SELinux has denied the httpd access to potentially mislabeled files
/var/run/pcscd.pub. This means that SELinux will not allow httpd to use these
files. If httpd should be allowed this access to these files you should change
the file context to one of the following types, net_conf_t, sysctl_crypto_t,
public_content_t, sysctl_kernel_t, httpd_modules_t, user_tmp_t, textrel_shlib_t,
httpd_suexec_exec_t, application_exec_type, mailman_cgi_exec_t,
rpm_script_tmp_t, httpd_squid_htaccess_t, httpd_munin_htaccess_t,
mailman_archive_t, etc_runtime_t, ld_so_t, user_home_t, httpd_var_lib_t,
httpd_var_run_t, bin_t, cert_t, httpd_t, lib_t, usr_t, httpd_awstats_htaccess_t,
httpd_rotatelogs_exec_t, httpd_user_htaccess_t, chroot_exec_t, httpd_keytab_t,
public_content_rw_t, httpd_bugzilla_htaccess_t, etcfile, mailman_data_t,
httpd_apcupsd_cgi_htaccess_t, system_dbusd_var_lib_t, httpd_cvs_htaccess_t,
httpd_git_htaccess_t, httpd_sys_htaccess_t, squirrelmail_spool_t, httpd_exec_t,
httpd_lock_t, httpd_log_t, httpd_prewikka_htaccess_t, httpd_rw_content,
krb5_conf_t, httpd_ro_content, ld_so_cache_t, locale_t,
httpd_unconfined_script_exec_t, etc_t, fonts_t, calamaris_www_t, proc_t,
httpd_cache_t, httpd_tmpfs_t, src_t, sysfs_t, iso9660_t, krb5_keytab_t,
var_lib_t, httpd_config_t, fail2ban_var_lib_t, udev_tbl_t, httpd_tmp_t,
shell_exec_t, httpd_w3c_validator_htaccess_t, mysqld_etc_t, cvs_data_t,
httpd_helper_exec_t, dbusd_etc_t, logfile, httpd_squirrelmail_t,
httpd_php_exec_t, httpd_nagios_htaccess_t, samba_var_t, lib_t,
httpd_nagios_content_ra_t, httpd_nagios_content_rw_t, httpd_nagios_content_t,
httpd_w3c_validator_content_t, httpd_sys_content_ra_t, httpd_sys_content_rw_t,
httpd_sys_content_rw_t, httpd_cvs_content_ra_t, httpd_cvs_content_rw_t,
httpd_git_content_ra_t, httpd_git_content_rw_t, httpd_git_content_t,
httpd_user_content_t, httpd_squid_content_ra_t, httpd_squid_content_rw_t,
httpd_prewikka_content_t, httpd_munin_content_t, httpd_squid_content_t,
httpd_awstats_script_exec_t, httpd_apcupsd_cgi_content_t,
httpd_nagios_script_exec_t, httpd_apcupsd_cgi_content_ra_t,
httpd_apcupsd_cgi_content_rw_t, httpd_cvs_content_t, httpd_sys_content_t,
httpd_sys_content_t, httpd_munin_script_exec_t, httpd_awstats_content_ra_t,
httpd_awstats_content_rw_t, httpd_w3c_validator_script_exec_t,
httpd_prewikka_content_ra_t, httpd_prewikka_content_rw_t,
httpd_user_script_exec_t, httpd_bugzilla_content_t,
httpd_bugzilla_script_exec_t, krb5_host_rcache_t,
httpd_apcupsd_cgi_script_exec_t, httpd_squid_script_exec_t,
httpd_w3c_validator_content_ra_t, httpd_w3c_validator_content_rw_t,
httpd_sys_script_exec_t, httpd_awstats_content_t, httpd_user_content_ra_t,
httpd_user_content_rw_t, httpd_git_script_exec_t, httpd_cvs_script_exec_t,
httpdcontent, httpd_prewikka_script_exec_t, httpd_munin_content_ra_t,
httpd_munin_content_rw_t, root_t, httpd_bugzilla_content_ra_t,
httpd_bugzilla_content_rw_t. Many third party apps install html files in
directories that SELinux policy cannot predict. These directories have to be
labeled with a file context which httpd can access.

Allowing Access:

If you want to change the file context of /var/run/pcscd.pub so that the httpd
daemon can access it, you need to execute it using semanage fcontext -a -t
FILE_TYPE '/var/run/pcscd.pub'.
where FILE_TYPE is one of the following: net_conf_t, sysctl_crypto_t,
public_content_t, sysctl_kernel_t, httpd_modules_t, user_tmp_t, textrel_shlib_t,
httpd_suexec_exec_t, application_exec_type, mailman_cgi_exec_t,
rpm_script_tmp_t, httpd_squid_htaccess_t, httpd_munin_htaccess_t,
mailman_archive_t, etc_runtime_t, ld_so_t, user_home_t, httpd_var_lib_t,
httpd_var_run_t, bin_t, cert_t, httpd_t, lib_t, usr_t, httpd_awstats_htaccess_t,
httpd_rotatelogs_exec_t, httpd_user_htaccess_t, chroot_exec_t, httpd_keytab_t,
public_content_rw_t, httpd_bugzilla_htaccess_t, etcfile, mailman_data_t,
httpd_apcupsd_cgi_htaccess_t, system_dbusd_var_lib_t, httpd_cvs_htaccess_t,
httpd_git_htaccess_t, httpd_sys_htaccess_t, squirrelmail_spool_t, httpd_exec_t,
httpd_lock_t, httpd_log_t, httpd_prewikka_htaccess_t, httpd_rw_content,
krb5_conf_t, httpd_ro_content, ld_so_cache_t, locale_t,
httpd_unconfined_script_exec_t, etc_t, fonts_t, calamaris_www_t, proc_t,
httpd_cache_t, httpd_tmpfs_t, src_t, sysfs_t, iso9660_t, krb5_keytab_t,
var_lib_t, httpd_config_t, fail2ban_var_lib_t, udev_tbl_t, httpd_tmp_t,
shell_exec_t, httpd_w3c_validator_htaccess_t, mysqld_etc_t, cvs_data_t,
httpd_helper_exec_t, dbusd_etc_t, logfile, httpd_squirrelmail_t,
httpd_php_exec_t, httpd_nagios_htaccess_t, samba_var_t, lib_t,
httpd_nagios_content_ra_t, httpd_nagios_content_rw_t, httpd_nagios_content_t,
httpd_w3c_validator_content_t, httpd_sys_content_ra_t, httpd_sys_content_rw_t,
httpd_sys_content_rw_t, httpd_cvs_content_ra_t, httpd_cvs_content_rw_t,
httpd_git_content_ra_t, httpd_git_content_rw_t, httpd_git_content_t,
httpd_user_content_t, httpd_squid_content_ra_t, httpd_squid_content_rw_t,
httpd_prewikka_content_t, httpd_munin_content_t, httpd_squid_content_t,
httpd_awstats_script_exec_t, httpd_apcupsd_cgi_content_t,
httpd_nagios_script_exec_t, httpd_apcupsd_cgi_content_ra_t,
httpd_apcupsd_cgi_content_rw_t, httpd_cvs_content_t, httpd_sys_content_t,
httpd_sys_content_t, httpd_munin_script_exec_t, httpd_awstats_content_ra_t,
httpd_awstats_content_rw_t, httpd_w3c_validator_script_exec_t,
httpd_prewikka_content_ra_t, httpd_prewikka_content_rw_t,
httpd_user_script_exec_t, httpd_bugzilla_content_t,
httpd_bugzilla_script_exec_t, krb5_host_rcache_t,
httpd_apcupsd_cgi_script_exec_t, httpd_squid_script_exec_t,
httpd_w3c_validator_content_ra_t, httpd_w3c_validator_content_rw_t,
httpd_sys_script_exec_t, httpd_awstats_content_t, httpd_user_content_ra_t,
httpd_user_content_rw_t, httpd_git_script_exec_t, httpd_cvs_script_exec_t,
httpdcontent, httpd_prewikka_script_exec_t, httpd_munin_content_ra_t,
httpd_munin_content_rw_t, root_t, httpd_bugzilla_content_ra_t,
httpd_bugzilla_content_rw_t. You can look at the httpd_selinux man page for
additional information.

Additional Information:

Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:pcscd_var_run_t:s0
Target Objects                /var/run/pcscd.pub [ file ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           httpd-2.2.13-4.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-41.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   httpd_bad_labels
Host Name                     (removed)
Platform                      Linux (removed) 2.6.31.5-127.fc12.x86_64 #1
                              SMP Sat Nov 7 21:11:14 EST 2009 x86_64 x86_64
Alert Count                   3
First Seen                    Fri 20 Nov 2009 01:05:04 AM EST
Last Seen                     Fri 20 Nov 2009 01:05:10 AM EST
Local ID                      2f3aec94-1fe4-440e-83d9-0feff7bfe643
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1258697110.90:42): avc:  denied  { getattr } for  pid=3882 comm="httpd" path="/var/run/pcscd.pub" dev=dm-0 ino=5246158 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:pcscd_var_run_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1258697110.90:42): arch=c000003e syscall=4 success=yes exit=128 a0=7fa934a16a3f a1=7fff8558ed50 a2=7fff8558ed50 a3=7fff8558eae0 items=0 ppid=3872 pid=3882 auid=4294967295 uid=48 gid=490 euid=48 suid=48 fsuid=48 egid=490 sgid=490 fsgid=490 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)



Hash String generated from  selinux-policy-3.6.32-41.fc12,httpd_bad_labels,httpd,httpd_t,pcscd_var_run_t,file,getattr
audit2allow suggests:

#============= httpd_t ==============
allow httpd_t pcscd_var_run_t:file getattr;

Comment 1 Daniel Walsh 2009-11-20 13:31:02 UTC
Why is apache looking at /var/run/pcscd.pub?

Are you using some kind of public key tool?

Comment 2 andy york 2009-11-21 14:49:21 UTC
No idea. Just installed F12 clean after botched upgrade. Was able to restore some html stuff from backup. May be a Wordpress issue of some kind. Saved "/var/run/pcscd.pub" as "/var/run/pcscd.pub.old" and deleted it with no effect noticed. Hope that helps.

Comment 3 andy york 2009-11-23 03:07:31 UTC
It is being triggered by WP-Stats Wordpress plugin.

Comment 4 Daniel Walsh 2009-11-23 16:23:18 UTC
I think it is causing httpd to do a listing of all files in /var/run, which is causing the problem.

I think if you removed the file all together it would probably fix the avc.

Comment 5 Daniel Walsh 2009-11-23 16:26:32 UTC
You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Will be dontaudited.


Fixed in selinux-policy-3.6.32-48.fc12.noarch

Comment 6 andy york 2009-11-23 19:47:28 UTC
Did that... got same warning plus a new one for /var/run/pcscd.pid
Deleted both files /var/run/pcscd.pub and /var/run/pcscd.pid and seems to be fine now. Don't know where those file(s) originated... just installed F12 clean. Thanks for your help and patience.

Comment 7 Fedora Update System 2009-11-23 23:37:55 UTC
selinux-policy-3.6.32-49.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-49.fc12

Comment 8 Fedora Update System 2009-11-25 15:20:54 UTC
selinux-policy-3.6.32-49.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12131

Comment 9 Fedora Update System 2009-12-02 04:32:25 UTC
selinux-policy-3.6.32-49.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Pierre-Antoine Roiron 2012-03-19 08:46:05 UTC
I get this bug on my apache local-only server. I'm using Fedora 16 up-to-date. I don't run any blog on it, just a little localwebsite html/php/mysql generating invoices, quotes, etc...
SELinux is 3.10.0
I didn't notice any effect of this bug on my activity.

Comment 11 Daniel Walsh 2012-03-19 15:01:49 UTC
It is probably caused by an authorization tool looking at your smart card services.

Since you are most likely not using smartcard for authorization, I don't think this is a problem.

Comment 12 Pierre-Antoine Roiron 2012-03-19 16:09:58 UTC
Thank you for your answer.