Description of problem: Mailgraph doesn't have SELinux contexts set correctly, and therefore when SELinux is active, mailgraph won't work through apache. Version-Release number of selected component (if applicable): mailgraph-1.12-5.fc7 How reproducible: Steps to Reproduce: 1. Enable SELinux on Fedora7. 2. Go to mailgraph url Actual results: Blank page Expected results: The normal mailgraph pages Additional info: Here's what I did to make it work: chcon -t httpd_sys_script_exec_t /usr/share/mailgraph/mailgraph.cgi chcon -R -t httpd_sys_script_ra_t /var/cache/mailgraph chcon -R -t httpd_sys_script_ra_t /var/lib/mailgraph I'm not sure how to set SELinux file contexts in an RPM spec file, or I would have just posted the changes needed for the SPEC file.
Dan- What is the current preferred way to fix this? http://fedoraproject.org/wiki/PackagingDrafts/SELinux a) file a bug against selinux-policy to include changes for this program b) create a selinux subpackage c) scriptlets - this makes rpmlint scream d) other
Create a selinux subpackage and policy for this app. If you use system-config-selinux go to policy modules and attempt to generate a policy for this. It is faily easy if you follow the instructions.
The changes are just file-context changes, not actual additional permissions that httpd needs, so I'm not sure what a policy module would do for you. Specifically, you /could/ write a policy to give httpd additional permissions for the original file contexts, but that would be a "bad thing", since I think the original file context is default_t or something, and that would defeat a lot of the protections that the httpd policy offers. The better solution I think is to just ship a fixed file contexts for those files to fit the existing httpd policy module. Maybe I'm misinterpreting your words, and this is actually what you meant. In any event, is the way to do this to create a /etc/selinux/targeted/contexts/files/file_contexts.mailgraph file that gets installed with the rpm? Thanks.
Created attachment 157328 [details] Te file Yes There are two possible solutions, one we label the files in such a way that any random cgi script would have ra_sys_content_t to them, or we create a new policy that would isolate and protect the data from other cgi scripts. I think this is the preferable solution, from a security standpoint.
Created attachment 157330 [details] Interface File
Created attachment 157331 [details] File context file
Dan, I was following the instructions at http://fedoraproject.org/wiki/PackagingDrafts/SELinux/PolicyModules. Under the "scriptlets" section, there is a note regarding condrestart and some additional scripting that needs to be done. I was not entirely clear on this area, so I was hoping you could take a look at the changes I made before I push anything out: http://cvs.fedora.redhat.com/viewcvs/rpms/mailgraph/devel/mailgraph.spec?root=extras&r1=1.3&r2=1.4
I would eliminate the whole varient part. You are not going to ship a different version for strict/targeted/mls. You will ship the same policy for all three. Remove # Explicitly allow transitions into the new domain /usr/sbin/setsebool %{name}_disable_trans 0 &> /dev/null || : Disable_trans does not exist in FC7 and beyond. I think you need a condrestart at the end of post. BTW Did you write policy for the mailgraph executable? The policy I sent was only for cgi? In the postun since we do not have disable_trans, the equivalent would be chcon -t bin_t /usr/sbin/mailgraph service ... condrestart
(In reply to comment #8) > Remove > # Explicitly allow transitions into the new domain > /usr/sbin/setsebool %{name}_disable_trans 0 &> /dev/null || : > Disable_trans does not exist in FC7 and beyond. > > In the postun since we do not have disable_trans, the equivalent would be > > chcon -t bin_t /usr/sbin/mailgraph > service ... condrestart Should the rpmlint error just be ignored? E: mailgraph forbidden-selinux-command-in-%postun chcon
Well since you currently do not have policy for /usr/sbin/mailgraph this is not a problem. Although, we might want to lookinto confining it. But you bring up a good point which we really do not have a good solution to. The best approach would be if XYZ Running: service XYZ stop semodule -r XYZ if XYZ was Running service XYZ start chcon in the post scripts are frowned upon, since they usually will not survive relabel and checking the file context versus the default will indicate problems.
mailgraph-1.14-1.fc8 has been pushed to the Fedora 8 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update mailgraph'
mailgraph-1.14-1.fc7 has been pushed to the Fedora 7 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update mailgraph'
mailgraph-1.14-1.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
mailgraph-1.14-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.