Bug 243302 - mailgraph: SELinux context changes required
Summary: mailgraph: SELinux context changes required
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: mailgraph (Show other bugs)
(Show other bugs)
Version: 7
Hardware: All Linux
low
low
Target Milestone: ---
Assignee: Bernard Johnson
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-06-08 13:39 UTC by Matthew Gillen
Modified: 2007-11-30 22:12 UTC (History)
1 user (show)

Fixed In Version: 1.14-1.fc7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-11-16 00:35:15 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Te file (739 bytes, application/octet-stream)
2007-06-18 21:04 UTC, Daniel Walsh
no flags Details
Interface File (3.28 KB, application/octet-stream)
2007-06-18 21:04 UTC, Daniel Walsh
no flags Details
File context file (290 bytes, application/octet-stream)
2007-06-18 21:04 UTC, Daniel Walsh
no flags Details

Description Matthew Gillen 2007-06-08 13:39:24 UTC
Description of problem:
Mailgraph doesn't have SELinux contexts set correctly, and therefore when
SELinux is active, mailgraph won't work through apache.

Version-Release number of selected component (if applicable):
mailgraph-1.12-5.fc7

How reproducible:


Steps to Reproduce:
1. Enable SELinux on Fedora7.
2. Go to mailgraph url
  
Actual results:
Blank page

Expected results:
The normal mailgraph pages

Additional info:
Here's what I did to make it work:
chcon -t httpd_sys_script_exec_t /usr/share/mailgraph/mailgraph.cgi
chcon -R -t httpd_sys_script_ra_t /var/cache/mailgraph
chcon -R -t httpd_sys_script_ra_t /var/lib/mailgraph

I'm not sure how to set SELinux file contexts in an RPM spec file, or I would
have just posted the changes needed for the SPEC file.

Comment 1 Bernard Johnson 2007-06-18 19:08:49 UTC
Dan-

What is the current preferred way to fix this?

http://fedoraproject.org/wiki/PackagingDrafts/SELinux
a) file a bug against selinux-policy to include changes for this program
b) create a selinux subpackage
c) scriptlets - this makes rpmlint scream
d) other



Comment 2 Daniel Walsh 2007-06-18 20:16:50 UTC
Create a selinux subpackage and policy for this app.

If you use system-config-selinux go to policy modules and attempt to generate a
policy for this.  It is faily easy if you follow the instructions.

Comment 3 Matthew Gillen 2007-06-18 20:35:14 UTC
The changes are just file-context changes, not actual additional permissions
that httpd needs, so I'm not sure what a policy module would do for you. 
Specifically, you /could/ write a policy to give httpd additional permissions
for the original file contexts, but that would be a "bad thing", since I think
the original file context is default_t or something, and that would defeat a lot
of the protections that the httpd policy offers.

The better solution I think is to just ship a fixed file contexts for those
files to fit the existing httpd policy module.  Maybe I'm misinterpreting your
words, and this is actually what you meant.

In any event, is the way to do this to create a
/etc/selinux/targeted/contexts/files/file_contexts.mailgraph file that gets
installed with the rpm?

Thanks.



Comment 4 Daniel Walsh 2007-06-18 21:04:02 UTC
Created attachment 157328 [details]
Te file

Yes There are two possible solutions, one we label the files in such a way that
any random cgi script would have ra_sys_content_t to them, or we create a new
policy that would isolate and protect the data from other cgi scripts.	I think
this is the preferable solution, from a security standpoint.

Comment 5 Daniel Walsh 2007-06-18 21:04:23 UTC
Created attachment 157330 [details]
Interface File

Comment 6 Daniel Walsh 2007-06-18 21:04:39 UTC
Created attachment 157331 [details]
File context file

Comment 7 Bernard Johnson 2007-06-25 18:01:38 UTC
Dan, I was following the instructions at
http://fedoraproject.org/wiki/PackagingDrafts/SELinux/PolicyModules.

Under the "scriptlets" section, there is a note regarding condrestart and some
additional scripting that needs to be done.  I was not entirely clear on this
area, so I was hoping you could take a look at the changes I made before I push
anything out:

http://cvs.fedora.redhat.com/viewcvs/rpms/mailgraph/devel/mailgraph.spec?root=extras&r1=1.3&r2=1.4

Comment 8 Daniel Walsh 2007-07-10 14:31:39 UTC
I would eliminate the whole varient part.  You are not going to ship a different
version for strict/targeted/mls.  You will ship the same policy for all three.

Remove
	 # Explicitly allow transitions into the new domain
  	 /usr/sbin/setsebool %{name}_disable_trans 0 &> /dev/null || :
Disable_trans does not exist in FC7 and beyond.

I think you need a condrestart at the end of post.

BTW Did you write policy for the mailgraph executable?  The policy I sent was
only for cgi?  
In the postun since we do not have disable_trans, the equivalent would be 

chcon -t bin_t /usr/sbin/mailgraph
service ... condrestart




Comment 9 Bernard Johnson 2007-07-12 17:16:16 UTC
(In reply to comment #8)
> Remove
> 	 # Explicitly allow transitions into the new domain
>   	 /usr/sbin/setsebool %{name}_disable_trans 0 &> /dev/null || :
> Disable_trans does not exist in FC7 and beyond.
>
> In the postun since we do not have disable_trans, the equivalent would be 
> 
> chcon -t bin_t /usr/sbin/mailgraph
> service ... condrestart

Should the rpmlint error just be ignored?

E: mailgraph forbidden-selinux-command-in-%postun chcon



Comment 10 Daniel Walsh 2007-07-13 11:25:36 UTC
Well since you currently do not have policy for   /usr/sbin/mailgraph this is
not a problem.  Although, we might want to lookinto confining it.  

But you bring up a good point which we really do not have a good solution to.

The best approach would be

if XYZ Running:
     service XYZ stop
semodule -r XYZ
if XYZ was Running
     service XYZ start

chcon in the post scripts are frowned upon, since they usually will not survive
relabel and checking the file context versus the default will indicate problems.

Comment 11 Fedora Update System 2007-11-06 16:18:03 UTC
mailgraph-1.14-1.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mailgraph'

Comment 12 Fedora Update System 2007-11-09 23:57:11 UTC
mailgraph-1.14-1.fc7 has been pushed to the Fedora 7 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mailgraph'

Comment 13 Fedora Update System 2007-11-16 00:35:10 UTC
mailgraph-1.14-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Fedora Update System 2007-11-16 00:42:24 UTC
mailgraph-1.14-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.