Bug 539519 - SELinux is preventing /usr/sbin/httpd from using potentially mislabeled files /var/run/pcscd.pub.
Summary: SELinux is preventing /usr/sbin/httpd from using potentially mislabeled files...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 12
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:e63977691cf...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-11-20 13:21 UTC by andy york
Modified: 2012-03-19 16:09 UTC (History)
3 users (show)

Fixed In Version: 3.6.32-49.fc12
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-12-01 16:40:44 UTC


Attachments (Terms of Use)

Description andy york 2009-11-20 13:21:48 UTC
Summary:

SELinux is preventing /usr/sbin/httpd from using potentially mislabeled files
/var/run/pcscd.pub.

Detailed Description:

[httpd has a permissive type (httpd_t). This access was not denied.]

SELinux has denied the httpd access to potentially mislabeled files
/var/run/pcscd.pub. This means that SELinux will not allow httpd to use these
files. If httpd should be allowed this access to these files you should change
the file context to one of the following types, net_conf_t, sysctl_crypto_t,
public_content_t, sysctl_kernel_t, httpd_modules_t, user_tmp_t, textrel_shlib_t,
httpd_suexec_exec_t, application_exec_type, mailman_cgi_exec_t,
rpm_script_tmp_t, httpd_squid_htaccess_t, httpd_munin_htaccess_t,
mailman_archive_t, etc_runtime_t, ld_so_t, user_home_t, httpd_var_lib_t,
httpd_var_run_t, bin_t, cert_t, httpd_t, lib_t, usr_t, httpd_awstats_htaccess_t,
httpd_rotatelogs_exec_t, httpd_user_htaccess_t, chroot_exec_t, httpd_keytab_t,
public_content_rw_t, httpd_bugzilla_htaccess_t, etcfile, mailman_data_t,
httpd_apcupsd_cgi_htaccess_t, system_dbusd_var_lib_t, httpd_cvs_htaccess_t,
httpd_git_htaccess_t, httpd_sys_htaccess_t, squirrelmail_spool_t, httpd_exec_t,
httpd_lock_t, httpd_log_t, httpd_prewikka_htaccess_t, httpd_rw_content,
krb5_conf_t, httpd_ro_content, ld_so_cache_t, locale_t,
httpd_unconfined_script_exec_t, etc_t, fonts_t, calamaris_www_t, proc_t,
httpd_cache_t, httpd_tmpfs_t, src_t, sysfs_t, iso9660_t, krb5_keytab_t,
var_lib_t, httpd_config_t, fail2ban_var_lib_t, udev_tbl_t, httpd_tmp_t,
shell_exec_t, httpd_w3c_validator_htaccess_t, mysqld_etc_t, cvs_data_t,
httpd_helper_exec_t, dbusd_etc_t, logfile, httpd_squirrelmail_t,
httpd_php_exec_t, httpd_nagios_htaccess_t, samba_var_t, lib_t,
httpd_nagios_content_ra_t, httpd_nagios_content_rw_t, httpd_nagios_content_t,
httpd_w3c_validator_content_t, httpd_sys_content_ra_t, httpd_sys_content_rw_t,
httpd_sys_content_rw_t, httpd_cvs_content_ra_t, httpd_cvs_content_rw_t,
httpd_git_content_ra_t, httpd_git_content_rw_t, httpd_git_content_t,
httpd_user_content_t, httpd_squid_content_ra_t, httpd_squid_content_rw_t,
httpd_prewikka_content_t, httpd_munin_content_t, httpd_squid_content_t,
httpd_awstats_script_exec_t, httpd_apcupsd_cgi_content_t,
httpd_nagios_script_exec_t, httpd_apcupsd_cgi_content_ra_t,
httpd_apcupsd_cgi_content_rw_t, httpd_cvs_content_t, httpd_sys_content_t,
httpd_sys_content_t, httpd_munin_script_exec_t, httpd_awstats_content_ra_t,
httpd_awstats_content_rw_t, httpd_w3c_validator_script_exec_t,
httpd_prewikka_content_ra_t, httpd_prewikka_content_rw_t,
httpd_user_script_exec_t, httpd_bugzilla_content_t,
httpd_bugzilla_script_exec_t, krb5_host_rcache_t,
httpd_apcupsd_cgi_script_exec_t, httpd_squid_script_exec_t,
httpd_w3c_validator_content_ra_t, httpd_w3c_validator_content_rw_t,
httpd_sys_script_exec_t, httpd_awstats_content_t, httpd_user_content_ra_t,
httpd_user_content_rw_t, httpd_git_script_exec_t, httpd_cvs_script_exec_t,
httpdcontent, httpd_prewikka_script_exec_t, httpd_munin_content_ra_t,
httpd_munin_content_rw_t, root_t, httpd_bugzilla_content_ra_t,
httpd_bugzilla_content_rw_t. Many third party apps install html files in
directories that SELinux policy cannot predict. These directories have to be
labeled with a file context which httpd can access.

Allowing Access:

If you want to change the file context of /var/run/pcscd.pub so that the httpd
daemon can access it, you need to execute it using semanage fcontext -a -t
FILE_TYPE '/var/run/pcscd.pub'.
where FILE_TYPE is one of the following: net_conf_t, sysctl_crypto_t,
public_content_t, sysctl_kernel_t, httpd_modules_t, user_tmp_t, textrel_shlib_t,
httpd_suexec_exec_t, application_exec_type, mailman_cgi_exec_t,
rpm_script_tmp_t, httpd_squid_htaccess_t, httpd_munin_htaccess_t,
mailman_archive_t, etc_runtime_t, ld_so_t, user_home_t, httpd_var_lib_t,
httpd_var_run_t, bin_t, cert_t, httpd_t, lib_t, usr_t, httpd_awstats_htaccess_t,
httpd_rotatelogs_exec_t, httpd_user_htaccess_t, chroot_exec_t, httpd_keytab_t,
public_content_rw_t, httpd_bugzilla_htaccess_t, etcfile, mailman_data_t,
httpd_apcupsd_cgi_htaccess_t, system_dbusd_var_lib_t, httpd_cvs_htaccess_t,
httpd_git_htaccess_t, httpd_sys_htaccess_t, squirrelmail_spool_t, httpd_exec_t,
httpd_lock_t, httpd_log_t, httpd_prewikka_htaccess_t, httpd_rw_content,
krb5_conf_t, httpd_ro_content, ld_so_cache_t, locale_t,
httpd_unconfined_script_exec_t, etc_t, fonts_t, calamaris_www_t, proc_t,
httpd_cache_t, httpd_tmpfs_t, src_t, sysfs_t, iso9660_t, krb5_keytab_t,
var_lib_t, httpd_config_t, fail2ban_var_lib_t, udev_tbl_t, httpd_tmp_t,
shell_exec_t, httpd_w3c_validator_htaccess_t, mysqld_etc_t, cvs_data_t,
httpd_helper_exec_t, dbusd_etc_t, logfile, httpd_squirrelmail_t,
httpd_php_exec_t, httpd_nagios_htaccess_t, samba_var_t, lib_t,
httpd_nagios_content_ra_t, httpd_nagios_content_rw_t, httpd_nagios_content_t,
httpd_w3c_validator_content_t, httpd_sys_content_ra_t, httpd_sys_content_rw_t,
httpd_sys_content_rw_t, httpd_cvs_content_ra_t, httpd_cvs_content_rw_t,
httpd_git_content_ra_t, httpd_git_content_rw_t, httpd_git_content_t,
httpd_user_content_t, httpd_squid_content_ra_t, httpd_squid_content_rw_t,
httpd_prewikka_content_t, httpd_munin_content_t, httpd_squid_content_t,
httpd_awstats_script_exec_t, httpd_apcupsd_cgi_content_t,
httpd_nagios_script_exec_t, httpd_apcupsd_cgi_content_ra_t,
httpd_apcupsd_cgi_content_rw_t, httpd_cvs_content_t, httpd_sys_content_t,
httpd_sys_content_t, httpd_munin_script_exec_t, httpd_awstats_content_ra_t,
httpd_awstats_content_rw_t, httpd_w3c_validator_script_exec_t,
httpd_prewikka_content_ra_t, httpd_prewikka_content_rw_t,
httpd_user_script_exec_t, httpd_bugzilla_content_t,
httpd_bugzilla_script_exec_t, krb5_host_rcache_t,
httpd_apcupsd_cgi_script_exec_t, httpd_squid_script_exec_t,
httpd_w3c_validator_content_ra_t, httpd_w3c_validator_content_rw_t,
httpd_sys_script_exec_t, httpd_awstats_content_t, httpd_user_content_ra_t,
httpd_user_content_rw_t, httpd_git_script_exec_t, httpd_cvs_script_exec_t,
httpdcontent, httpd_prewikka_script_exec_t, httpd_munin_content_ra_t,
httpd_munin_content_rw_t, root_t, httpd_bugzilla_content_ra_t,
httpd_bugzilla_content_rw_t. You can look at the httpd_selinux man page for
additional information.

Additional Information:

Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:pcscd_var_run_t:s0
Target Objects                /var/run/pcscd.pub [ file ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           httpd-2.2.13-4.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-41.fc12
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   httpd_bad_labels
Host Name                     (removed)
Platform                      Linux (removed) 2.6.31.5-127.fc12.x86_64 #1
                              SMP Sat Nov 7 21:11:14 EST 2009 x86_64 x86_64
Alert Count                   3
First Seen                    Fri 20 Nov 2009 01:05:04 AM EST
Last Seen                     Fri 20 Nov 2009 01:05:10 AM EST
Local ID                      2f3aec94-1fe4-440e-83d9-0feff7bfe643
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1258697110.90:42): avc:  denied  { getattr } for  pid=3882 comm="httpd" path="/var/run/pcscd.pub" dev=dm-0 ino=5246158 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:pcscd_var_run_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1258697110.90:42): arch=c000003e syscall=4 success=yes exit=128 a0=7fa934a16a3f a1=7fff8558ed50 a2=7fff8558ed50 a3=7fff8558eae0 items=0 ppid=3872 pid=3882 auid=4294967295 uid=48 gid=490 euid=48 suid=48 fsuid=48 egid=490 sgid=490 fsgid=490 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)



Hash String generated from  selinux-policy-3.6.32-41.fc12,httpd_bad_labels,httpd,httpd_t,pcscd_var_run_t,file,getattr
audit2allow suggests:

#============= httpd_t ==============
allow httpd_t pcscd_var_run_t:file getattr;

Comment 1 Daniel Walsh 2009-11-20 13:31:02 UTC
Why is apache looking at /var/run/pcscd.pub?

Are you using some kind of public key tool?

Comment 2 andy york 2009-11-21 14:49:21 UTC
No idea. Just installed F12 clean after botched upgrade. Was able to restore some html stuff from backup. May be a Wordpress issue of some kind. Saved "/var/run/pcscd.pub" as "/var/run/pcscd.pub.old" and deleted it with no effect noticed. Hope that helps.

Comment 3 andy york 2009-11-23 03:07:31 UTC
It is being triggered by WP-Stats Wordpress plugin.

Comment 4 Daniel Walsh 2009-11-23 16:23:18 UTC
I think it is causing httpd to do a listing of all files in /var/run, which is causing the problem.

I think if you removed the file all together it would probably fix the avc.

Comment 5 Daniel Walsh 2009-11-23 16:26:32 UTC
You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Will be dontaudited.


Fixed in selinux-policy-3.6.32-48.fc12.noarch

Comment 6 andy york 2009-11-23 19:47:28 UTC
Did that... got same warning plus a new one for /var/run/pcscd.pid
Deleted both files /var/run/pcscd.pub and /var/run/pcscd.pid and seems to be fine now. Don't know where those file(s) originated... just installed F12 clean. Thanks for your help and patience.

Comment 7 Fedora Update System 2009-11-23 23:37:55 UTC
selinux-policy-3.6.32-49.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-49.fc12

Comment 8 Fedora Update System 2009-11-25 15:20:54 UTC
selinux-policy-3.6.32-49.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update selinux-policy'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12131

Comment 9 Fedora Update System 2009-12-02 04:32:25 UTC
selinux-policy-3.6.32-49.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Pierre-Antoine Roiron 2012-03-19 08:46:05 UTC
I get this bug on my apache local-only server. I'm using Fedora 16 up-to-date. I don't run any blog on it, just a little localwebsite html/php/mysql generating invoices, quotes, etc...
SELinux is 3.10.0
I didn't notice any effect of this bug on my activity.

Comment 11 Daniel Walsh 2012-03-19 15:01:49 UTC
It is probably caused by an authorization tool looking at your smart card services.

Since you are most likely not using smartcard for authorization, I don't think this is a problem.

Comment 12 Pierre-Antoine Roiron 2012-03-19 16:09:58 UTC
Thank you for your answer.


Note You need to log in before you can comment on or make changes to this bug.