Bug 139895 - httpd cannot connect to postgresql database using sockets
httpd cannot connect to postgresql database using sockets
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
3
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2004-11-18 12:56 EST by Johannes Schmid
Modified: 2007-11-30 17:10 EST (History)
0 users

See Also:
Fixed In Version: RHBA-2005-251
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-04-11 17:50:55 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Johannes Schmid 2004-11-18 12:56:03 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.3)
Gecko/20040910

Description of problem:
When using PHP and using the pg_pconnect function to connect to a
PostgreSQL database without specifying a host (thus using a socket for
the connection), the current selinux targeted policy denies access to
this socket.

I tested both the policy that comes with FC3 and the latest version I
downloaded from ftp://people.redhat.com/dwalsh/SELinux/FC3

The audit message I get is:
avc:  denied  { connectto } for  pid=2244 exe=/usr/sbin/httpd
path=/tmp/.s.PGSQL.5432 scontext=user_u:system_r:httpd_t
tcontext=user_u:system_r:unconfined_t tclass=unix_stream_socket


The PHP script used for testing is:
<?php
pg_pconnect('dbname=test');
?>


Version-Release number of selected component (if applicable):
selinux-policy-targeted-1.17.30-2.31

How reproducible:
Always

Steps to Reproduce:
1. create a postgresql database test
2. execute above php script
    

Actual Results:  access to database is denied; PHP error message is:
pg_pconnect(): Unable to connect to PostgreSQL server: could not
connect to server: Is the server running locally and accepting
connections on Unix domain socket "/tmp/.s.PGSQL.5432"?

Expected Results:  a successful connection to postgresql server
Comment 1 Daniel Walsh 2004-11-18 13:28:08 EST
Try rpm -q -l postgresql | restorecon -R -n -f -
service postgresql service
service httpd restart
Comment 2 Johannes Schmid 2004-11-18 13:40:03 EST
although I totally forgot to do that (shame on me), it has no effect.

I still get the exact same error.

I additionally tried an
  restorecon -R /tmp
(as that's where the socket is located, just to make sure). Still the
same error.
Comment 3 Daniel Walsh 2004-11-18 13:54:43 EST
Can you show me 

ls -lZ /usr/bin/postgres

and

ps -eZ | grep postgres

Comment 4 Daniel Walsh 2004-11-18 14:41:11 EST
My mistake, I just tried this on FC3 with 2.31 and it seems to work.

rpm -q -l postgresql-server | restorecon -R -n -f -
service postgresql service
service httpd restart

Comment 5 Johannes Schmid 2004-11-19 05:14:46 EST
I just tried to do the same, but it still does not work. Still getting

avc: denied { connectto } for  pid=2995 exe=/usr/sbin/httpd
path=/tmp/.s.PGSQL.5432 scontext=root:system_r:httpd_t
tcontext=root:system_r:unconfined_t tclass=unix_stream_socket

after doing

rpm -q -l postgresql-server | restorecon -R -n -f -
service postgresql restart
service httpd restart

# ls -lZ /usr/bin/postgresq
-rwxr-xr-x  root   root   system_u:object_r:bin_t    /usr/bin/postgres


# ps aeZ |grep postgres
root:system_r:unconfined_t       2966 pts/0    S      0:00
   /usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data [...]
root:system_r:unconfined_t       2968 pts/0    S      0:00
   postgres: stats buffer process
root:system_r:unconfined_t       2969 pts/0    S      0:00
   postgres: stats collector process
root:system_r:unconfined_t       3005 pts/0    S      0:00
   postgres: apache test 127.0.0.1 idle


I hope this helps :)
Comment 6 Daniel Walsh 2004-11-19 09:17:34 EST
That makes no sence.

If you have selinux-policy-targeted-1.17.30-2.31 installed

/usr/bin/postgress should be system_u:object_r:postgresql_exec_t

Do you have selinux-policy-targeted-sources-1.17.30-2.31 installed?

If so could you do a 

make -C /etc/selinux/targeted/src/policy load

Then try the restorecon stuff?

Comment 7 Johannes Schmid 2004-11-19 11:22:37 EST
# rpm -q selinux-policy-targeted
selinux-policy-targeted-1.17.30-2.31

# rpm -i selinux-policy-targeted-sources-1.17.30-2.31.noarch.rpm

happend during RPM install (afaik), but I did it anyway:
# make -C /etc/selinux/targeted/src/policy load
[...]

# rpm -q -l postgresql-server | restorecon -R -n -f -
# service postgresql restart
# service httpd restart

# ls -lZ /usr/bin/postgres
-rwxr-xr-x  root   root   system_u:object_r:bin_t   /usr/bin/postgres

--> and, of course, it did not work :-)

Now, what I did is this: instead of restorecon -R -n, I tried
# rpm -q -l postgresql-server | restorecon -R -f -
# ls -lZ /usr/bin/postgres
-rwxr-xr-x  root     root     system_u:object_r:postgresql_exec_t
/usr/bin/postgres

and this did seem to work!

Just to be on the safe side, I also did:
# rpm -q -l php | restorecon -R -f -
# rpm -q -l php-pgsql | restorecon -R -f -
# rpm -q -l postgresql | restorecon -R -f -
# rpm -q -l httpd | restorecon -R -f -


Now it seems to work a little bit better. Instead of the denied
"connectto" I get an

avc:  denied  { write } for  pid=3091 exe=/usr/sbin/httpd
name=.s.PGSQL.5432 dev=hda3 ino=22635 scontext=root:system_r:httpd_t
tcontext=root:object_r:postgresql_tmp_t tclass=sock_file

Comment 8 Daniel Walsh 2004-11-19 11:43:43 EST
I am sorry, I am such an idiot, restorecon -n tells it not to make the
change.  I should have typed 
restorecon -v.

Could you do a setenforce 0 and try to access the database.

Dan
Comment 9 Johannes Schmid 2004-11-19 15:33:14 EST
Sorry, unfortunately I'm in GMT+1 (Germany) and my FC3 installation is
in the office (and I alread left the office). So I can't test it right
now but it'll be the first thing I'll do monday morning.
Comment 10 Johannes Schmid 2004-11-20 15:50:07 EST
I just had a chance to try it, so here's the result:

using setenforce 0 (of course) leads to a successful conntect to the
postgresql database.

Here are the selinux messages that were spit out during that process:
avc:  denied  { write } for  pid=2821 exe=/usr/sbin/httpd
name=.s.PGSQL.5432 dev=hda3 ino=22635 scontext=root:system_r:httpd_t
tcontext=root:object_r:postgresql_tmp_t tclass=sock_file
avc:  denied  { connectto } for  pid=2821 exe=/usr/sbin/httpd
path=/tmp/.s.PGSQL.5432 scontext=root:system_r:httpd_t
tcontext=root:system_r:postgresql_t tclass=unix_stream_socket


I'm an absolute newbie to this selinux stuff, but after changing line
297 of your apache.te from
allow httpd_t tmp_t:sock_file rw_file_perms;
to
allow httpd_t postgresql_tmp_t:sock_file rw_file_perms;
at least the first message disappeard again ("denied { write }").

I guess that there should be somewhere an assignment that says that
postgresql_tmp_t is of type tmp_t.

When I also add the following line, everything works fine:
allow httpd_t postgresql_t:unix_stream_socket { connectto };


Hope this helps.
Comment 11 Daniel Walsh 2004-11-20 23:17:43 EST
Fixed in policy-1.19.4-1
Comment 12 Phil Anderson 2004-12-23 08:06:39 EST
Confirmed fixed in (at least) selinux-policy-targeted-1.17.30-2.60
Comment 13 Tim Powers 2005-06-09 09:05:53 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2005-251.html

Note You need to log in before you can comment on or make changes to this bug.