Bug 539519
| Summary: | SELinux is preventing /usr/sbin/httpd from using potentially mislabeled files /var/run/pcscd.pub. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | andy york <soylentman> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 12 | CC: | contact, dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:e63977691cf891f1646e418626c912992facd1f30318e9a287ff96c6d9960824 | ||
| Fixed In Version: | 3.6.32-49.fc12 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-12-01 16:40:44 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Why is apache looking at /var/run/pcscd.pub? Are you using some kind of public key tool? No idea. Just installed F12 clean after botched upgrade. Was able to restore some html stuff from backup. May be a Wordpress issue of some kind. Saved "/var/run/pcscd.pub" as "/var/run/pcscd.pub.old" and deleted it with no effect noticed. Hope that helps. It is being triggered by WP-Stats Wordpress plugin. I think it is causing httpd to do a listing of all files in /var/run, which is causing the problem. I think if you removed the file all together it would probably fix the avc. You can add these rules for now using # grep avc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Will be dontaudited. Fixed in selinux-policy-3.6.32-48.fc12.noarch Did that... got same warning plus a new one for /var/run/pcscd.pid Deleted both files /var/run/pcscd.pub and /var/run/pcscd.pid and seems to be fine now. Don't know where those file(s) originated... just installed F12 clean. Thanks for your help and patience. selinux-policy-3.6.32-49.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-49.fc12 selinux-policy-3.6.32-49.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12131 selinux-policy-3.6.32-49.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. I get this bug on my apache local-only server. I'm using Fedora 16 up-to-date. I don't run any blog on it, just a little localwebsite html/php/mysql generating invoices, quotes, etc... SELinux is 3.10.0 I didn't notice any effect of this bug on my activity. It is probably caused by an authorization tool looking at your smart card services. Since you are most likely not using smartcard for authorization, I don't think this is a problem. Thank you for your answer. |
Summary: SELinux is preventing /usr/sbin/httpd from using potentially mislabeled files /var/run/pcscd.pub. Detailed Description: [httpd has a permissive type (httpd_t). This access was not denied.] SELinux has denied the httpd access to potentially mislabeled files /var/run/pcscd.pub. This means that SELinux will not allow httpd to use these files. If httpd should be allowed this access to these files you should change the file context to one of the following types, net_conf_t, sysctl_crypto_t, public_content_t, sysctl_kernel_t, httpd_modules_t, user_tmp_t, textrel_shlib_t, httpd_suexec_exec_t, application_exec_type, mailman_cgi_exec_t, rpm_script_tmp_t, httpd_squid_htaccess_t, httpd_munin_htaccess_t, mailman_archive_t, etc_runtime_t, ld_so_t, user_home_t, httpd_var_lib_t, httpd_var_run_t, bin_t, cert_t, httpd_t, lib_t, usr_t, httpd_awstats_htaccess_t, httpd_rotatelogs_exec_t, httpd_user_htaccess_t, chroot_exec_t, httpd_keytab_t, public_content_rw_t, httpd_bugzilla_htaccess_t, etcfile, mailman_data_t, httpd_apcupsd_cgi_htaccess_t, system_dbusd_var_lib_t, httpd_cvs_htaccess_t, httpd_git_htaccess_t, httpd_sys_htaccess_t, squirrelmail_spool_t, httpd_exec_t, httpd_lock_t, httpd_log_t, httpd_prewikka_htaccess_t, httpd_rw_content, krb5_conf_t, httpd_ro_content, ld_so_cache_t, locale_t, httpd_unconfined_script_exec_t, etc_t, fonts_t, calamaris_www_t, proc_t, httpd_cache_t, httpd_tmpfs_t, src_t, sysfs_t, iso9660_t, krb5_keytab_t, var_lib_t, httpd_config_t, fail2ban_var_lib_t, udev_tbl_t, httpd_tmp_t, shell_exec_t, httpd_w3c_validator_htaccess_t, mysqld_etc_t, cvs_data_t, httpd_helper_exec_t, dbusd_etc_t, logfile, httpd_squirrelmail_t, httpd_php_exec_t, httpd_nagios_htaccess_t, samba_var_t, lib_t, httpd_nagios_content_ra_t, httpd_nagios_content_rw_t, httpd_nagios_content_t, httpd_w3c_validator_content_t, httpd_sys_content_ra_t, httpd_sys_content_rw_t, httpd_sys_content_rw_t, httpd_cvs_content_ra_t, httpd_cvs_content_rw_t, httpd_git_content_ra_t, httpd_git_content_rw_t, httpd_git_content_t, httpd_user_content_t, httpd_squid_content_ra_t, httpd_squid_content_rw_t, httpd_prewikka_content_t, httpd_munin_content_t, httpd_squid_content_t, httpd_awstats_script_exec_t, httpd_apcupsd_cgi_content_t, httpd_nagios_script_exec_t, httpd_apcupsd_cgi_content_ra_t, httpd_apcupsd_cgi_content_rw_t, httpd_cvs_content_t, httpd_sys_content_t, httpd_sys_content_t, httpd_munin_script_exec_t, httpd_awstats_content_ra_t, httpd_awstats_content_rw_t, httpd_w3c_validator_script_exec_t, httpd_prewikka_content_ra_t, httpd_prewikka_content_rw_t, httpd_user_script_exec_t, httpd_bugzilla_content_t, httpd_bugzilla_script_exec_t, krb5_host_rcache_t, httpd_apcupsd_cgi_script_exec_t, httpd_squid_script_exec_t, httpd_w3c_validator_content_ra_t, httpd_w3c_validator_content_rw_t, httpd_sys_script_exec_t, httpd_awstats_content_t, httpd_user_content_ra_t, httpd_user_content_rw_t, httpd_git_script_exec_t, httpd_cvs_script_exec_t, httpdcontent, httpd_prewikka_script_exec_t, httpd_munin_content_ra_t, httpd_munin_content_rw_t, root_t, httpd_bugzilla_content_ra_t, httpd_bugzilla_content_rw_t. Many third party apps install html files in directories that SELinux policy cannot predict. These directories have to be labeled with a file context which httpd can access. Allowing Access: If you want to change the file context of /var/run/pcscd.pub so that the httpd daemon can access it, you need to execute it using semanage fcontext -a -t FILE_TYPE '/var/run/pcscd.pub'. where FILE_TYPE is one of the following: net_conf_t, sysctl_crypto_t, public_content_t, sysctl_kernel_t, httpd_modules_t, user_tmp_t, textrel_shlib_t, httpd_suexec_exec_t, application_exec_type, mailman_cgi_exec_t, rpm_script_tmp_t, httpd_squid_htaccess_t, httpd_munin_htaccess_t, mailman_archive_t, etc_runtime_t, ld_so_t, user_home_t, httpd_var_lib_t, httpd_var_run_t, bin_t, cert_t, httpd_t, lib_t, usr_t, httpd_awstats_htaccess_t, httpd_rotatelogs_exec_t, httpd_user_htaccess_t, chroot_exec_t, httpd_keytab_t, public_content_rw_t, httpd_bugzilla_htaccess_t, etcfile, mailman_data_t, httpd_apcupsd_cgi_htaccess_t, system_dbusd_var_lib_t, httpd_cvs_htaccess_t, httpd_git_htaccess_t, httpd_sys_htaccess_t, squirrelmail_spool_t, httpd_exec_t, httpd_lock_t, httpd_log_t, httpd_prewikka_htaccess_t, httpd_rw_content, krb5_conf_t, httpd_ro_content, ld_so_cache_t, locale_t, httpd_unconfined_script_exec_t, etc_t, fonts_t, calamaris_www_t, proc_t, httpd_cache_t, httpd_tmpfs_t, src_t, sysfs_t, iso9660_t, krb5_keytab_t, var_lib_t, httpd_config_t, fail2ban_var_lib_t, udev_tbl_t, httpd_tmp_t, shell_exec_t, httpd_w3c_validator_htaccess_t, mysqld_etc_t, cvs_data_t, httpd_helper_exec_t, dbusd_etc_t, logfile, httpd_squirrelmail_t, httpd_php_exec_t, httpd_nagios_htaccess_t, samba_var_t, lib_t, httpd_nagios_content_ra_t, httpd_nagios_content_rw_t, httpd_nagios_content_t, httpd_w3c_validator_content_t, httpd_sys_content_ra_t, httpd_sys_content_rw_t, httpd_sys_content_rw_t, httpd_cvs_content_ra_t, httpd_cvs_content_rw_t, httpd_git_content_ra_t, httpd_git_content_rw_t, httpd_git_content_t, httpd_user_content_t, httpd_squid_content_ra_t, httpd_squid_content_rw_t, httpd_prewikka_content_t, httpd_munin_content_t, httpd_squid_content_t, httpd_awstats_script_exec_t, httpd_apcupsd_cgi_content_t, httpd_nagios_script_exec_t, httpd_apcupsd_cgi_content_ra_t, httpd_apcupsd_cgi_content_rw_t, httpd_cvs_content_t, httpd_sys_content_t, httpd_sys_content_t, httpd_munin_script_exec_t, httpd_awstats_content_ra_t, httpd_awstats_content_rw_t, httpd_w3c_validator_script_exec_t, httpd_prewikka_content_ra_t, httpd_prewikka_content_rw_t, httpd_user_script_exec_t, httpd_bugzilla_content_t, httpd_bugzilla_script_exec_t, krb5_host_rcache_t, httpd_apcupsd_cgi_script_exec_t, httpd_squid_script_exec_t, httpd_w3c_validator_content_ra_t, httpd_w3c_validator_content_rw_t, httpd_sys_script_exec_t, httpd_awstats_content_t, httpd_user_content_ra_t, httpd_user_content_rw_t, httpd_git_script_exec_t, httpd_cvs_script_exec_t, httpdcontent, httpd_prewikka_script_exec_t, httpd_munin_content_ra_t, httpd_munin_content_rw_t, root_t, httpd_bugzilla_content_ra_t, httpd_bugzilla_content_rw_t. You can look at the httpd_selinux man page for additional information. Additional Information: Source Context system_u:system_r:httpd_t:s0 Target Context system_u:object_r:pcscd_var_run_t:s0 Target Objects /var/run/pcscd.pub [ file ] Source httpd Source Path /usr/sbin/httpd Port <Unknown> Host (removed) Source RPM Packages httpd-2.2.13-4.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.32-41.fc12 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name httpd_bad_labels Host Name (removed) Platform Linux (removed) 2.6.31.5-127.fc12.x86_64 #1 SMP Sat Nov 7 21:11:14 EST 2009 x86_64 x86_64 Alert Count 3 First Seen Fri 20 Nov 2009 01:05:04 AM EST Last Seen Fri 20 Nov 2009 01:05:10 AM EST Local ID 2f3aec94-1fe4-440e-83d9-0feff7bfe643 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1258697110.90:42): avc: denied { getattr } for pid=3882 comm="httpd" path="/var/run/pcscd.pub" dev=dm-0 ino=5246158 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:pcscd_var_run_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1258697110.90:42): arch=c000003e syscall=4 success=yes exit=128 a0=7fa934a16a3f a1=7fff8558ed50 a2=7fff8558ed50 a3=7fff8558eae0 items=0 ppid=3872 pid=3882 auid=4294967295 uid=48 gid=490 euid=48 suid=48 fsuid=48 egid=490 sgid=490 fsgid=490 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) Hash String generated from selinux-policy-3.6.32-41.fc12,httpd_bad_labels,httpd,httpd_t,pcscd_var_run_t,file,getattr audit2allow suggests: #============= httpd_t ============== allow httpd_t pcscd_var_run_t:file getattr;