Bug 1260306
| Summary: | Improper SELinux contexts for nagios cgi executables | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Sachi <xcorat> | ||||
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Jan Zarsky <jzarsky> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.3 | CC: | lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde, xcorat | ||||
| Target Milestone: | rc | Keywords: | SELinux | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.13.1-66.el7 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2016-11-04 02:21:54 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Sachi
2015-09-05 20:22:27 UTC
Created attachment 1070529 [details]
sealert log
*** Bug 1260303 has been marked as a duplicate of this bug. *** # sesearch -s httpd_t -t httpd_sys_content_t -c file -p execute -A -C
Found 1 semantic av rules:
DT allow httpd_t httpdcontent : file { ioctl read write create getattr setattr lock append unlink link rename execute open } ; [ httpd_enable_cgi httpd_unified && httpd_builtin_scripting && ]
#
Which of following booleans are enabled on your machine?
* httpd_enable_cgi
* httpd_unified
* httpd_builtin_scripting
$ getsebool httpd_enable_cgi httpd_enable_cgi --> on $ getsebool httpd_unified httpd_unified --> off $ getsebool httpd_builtin_scripting httpd_builtin_scripting --> on it says sesearch - command not found! nvm, didn't know I had to install setools-console.
# sesearch -s httpd_t -t httpd_sys_content_t -c file -p execute -A -C
Found 1 semantic av rules:
DT allow httpd_t httpdcontent : file { ioctl read write create getattr setattr lock append unlink link rename execute open } ; [ httpd_enable_cgi httpd_unified && httpd_builtin_scripting && ]
Alright, setting the boolean httpd_unified --> on works. So that is the solution? (Sorry when I posted this on stackof I was said to file a bug report!) Yes, the enabling of httpd_unified boolean is the solution, but I must admit that the boolean documentation needs some improvements. I don't understand the purpose of the boolean either :-)
# man httpd_selinux | col -b | grep -C 2 unified
If you want to unify HTTPD handling of all content files, you must turn
on the httpd_unified boolean. Disabled by default.
setsebool -P httpd_unified 1
#
Where is statusjson.cgi located? You could also change a labeling for it. httpd_unified boolean is powerfull. Yes, I had changed the context on those files to "httpd_sys_script_exec_t", and it worked. What should be the best solution? (In reply to Sachi from comment #10) > Yes, I had changed the context on those files to "httpd_sys_script_exec_t", > and it worked. What should be the best solution? Yes, this is a better solution. We could also think about a new policy but if it works correct, it is fine to have httpd_sys_script_exec_t labeling. Ok, that's kool. Thx. This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune with any questions Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2283.html |