Bug 723258

Summary:	SELinux "targeted" policy blocks web access to files in directories named "logs"
Product:	Red Hat Enterprise Linux 6	Reporter:	Robert Vogelgesang <vogel>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.1	CC:	dwalsh, mmalik
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.7.19-104.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	760537 (view as bug list)		Environment:
Last Closed:	2011-12-06 10:09:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Robert Vogelgesang 2011-07-19 14:39:28 UTC

Description of problem:
The current SELinux "targeted" policy blocks web access to files in directories named "logs".  This is caused by the following entry in /etc/selinux/targeted/contexts/files/file_contexts:
/var/www(/.*)?/logs(/.*)?       system_u:object_r:httpd_log_t:s0

This means that access to parts of the normal web space is blocked, and this is without reason, because the default setup has the Apache log files in /var/log/httpd/, which does not match this rule.

An example of a web application that is partially crippled by this policy rule is AjaxPlorer, http://www.ajaxplorer.info/; the logs created by AjaxPlorer cannot be displayed.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.7.19-93.el6_1.2.noarch

How reproducible:
Always

Steps to Reproduce:
1. Install Apache httpd and selinux-policy-targeted on RHEL-6.
2. Create directory /var/www/html/logs/ and some files in it.
3. Try to access the files with a web browser.
  
Actual results:
The access fails.

Expected results:
The files should be processed like any other content in /var/www/html/.

Additional info:
Workaround:
semanage fcontext -a -t  httpd_sys_content_t '/var/www/html(/.*)?/logs(/.*)?'
restorecon -r /var/www/html

Comment 2 Daniel Walsh 2011-07-19 14:53:04 UTC

Sounds fine with me.

Comment 3 Robert Vogelgesang 2011-07-19 15:09:41 UTC

Sorry, what's fine?

Do you mean that it is fine to block access to any directory in the standard web space named "logs", even if we ("we" as in "system developers") do not know what data our users put into these directories _they_ manage?

Or is my workaround fine?

Comment 4 Daniel Walsh 2011-07-19 15:15:31 UTC

Your workaround is fine,  I just added it to Fedora 16.  I am indicating to Miroslav, that I think he should add it to RHEL6.2 policy.

Comment 5 Robert Vogelgesang 2011-07-19 15:32:06 UTC

Ahh, OK, thanks.

But please consider not only /var/www/html/, but /var/www/ as a whole. We frequently mount additional disk space on various directories below of /var/www/, so I'd rather have the rule that causes this problem be removed from the policy.

A different solution would be to add a SELinux boolean that would switch this rule on or off.

Comment 6 Daniel Walsh 2011-07-19 15:40:17 UTC

Well this is actually not a boolean but of labeling.  If you label the logs directory as httpd_logs_t then cgi scripts will not be allowed to read them, if they are labelled httpd_sys_content_t then they will be allowed.

 sesearch -A -s httpd_t -t httpd_log_t -C
Found 5 semantic av rules:
   allow httpd_t file_type : filesystem getattr ; 
   allow daemon logfile : file { ioctl getattr lock append } ; 
   allow httpd_t httpd_log_t : file { ioctl read create getattr lock append open } ; 
   allow httpd_t httpd_log_t : dir { ioctl write getattr setattr lock add_name search open } ; 
   allow httpd_t httpd_log_t : lnk_file { read getattr }

sesearch -A -s httpd_sys_script_t -t httpd_log_t -C
Found 3 semantic av rules:
   allow httpd_sys_script_t logfile : file { ioctl getattr lock append } ; 
   allow httpd_sys_script_t httpd_log_t : file { ioctl getattr lock append open } ; 
   allow httpd_sys_script_t httpd_log_t : dir { getattr search open } ; 


Where as if the content is httpd_sys_content_t there is a lot different access.

Comment 7 Miroslav Grepl 2011-07-20 10:07:32 UTC

Fixed in selinux-policy-3.7.19-104.el6

Comment 10 errata-xmlrpc 2011-12-06 10:09:33 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html