Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Asterisk tries to write to the rootfs into / no less. To security auditing software like selinux this looks an awful lot like a breakin attempt, especially since asterisk has multiple internet ports open and may well have been compromised. Version-Release number of selected component (if applicable): asterisk.x86_64 1.6.1.9-1.fc12 @updates asterisk-alsa.x86_64 1.6.1.9-1.fc12 @updates asterisk-voicemail.x86_64 1.6.1.9-1.fc12 @updates asterisk-voicemail-plain.x86_64 1.6.1.9-1.fc12 @updates How reproducible: very Steps to Reproduce: 1. run selinux in enforcing mode with default policy 2. start asterisk with default f12 startup 3. Actual results: Selinux gripes because asterisk tries to write to the rootfs into /. This is not a very good place for asterisk to be keeping private data. Expected results: no gripes and asterisk keeping its private data in ~asterisk and not in the rootfs at /. Additional info: Asterisk may be trying to write the /.asterisk_history file. [root@arbol /]# ll -a / total 146 dr-xr-xr-x. 35 root root 4096 2009-11-28 03:12 . dr-xr-xr-x. 35 root root 4096 2009-11-28 03:12 .. -rw-------. 1 root root 13 2009-11-30 03:07 .asterisk_history -rw-r--r--. 1 root root 0 2009-11-28 03:11 .autofsck drwxr-xr-x. 2 root root 4096 2009-10-29 00:24 backup dr
This is loosely related to Bug 541657 and the discussion of /.asterisk_history
I think that this should already be fixed by asterisk-1.6.1.10-1.fc12, which is in updates-testing. I just requested that asterisk-1.6.1.10-1.fc12 be pushed to updates because there's a new security release (asterisk-1.6.1.11-1.fc12). Basically this is happening because if Asterisk is started up when the current directory is a directory that the Asterisk user cannot access, it changes it's working directory to '/'. I worked around it by adding an explicit 'cd /var/spool/asterisk' to the init script. Digium should probably be notified of this issue and a better fix for this implemented. Also, I see that /.asterisk_history is owned by root. Are you manually running Asterisk as root? The Asterisk packages are set up to run Asterisk as a special Asterisk user to minimize the consequences of any bugs.
I'm starting asterisk in the default way via the startup scripts. Restarts are always via "service astersisk restart". The one time asterisk is invoked as root is when I'm trying to connect up to the running daemon and getting an asterisk shell via 'asterisk -rn'. I can't really su to asterisk because the shell is marked as "nologin". I'm not sure what the lesser of the evils are. Maybe asterisk should have a real shell? I guess I'm not sure what types of exploits that opens up.
Ah, so it's probably the 'asterisk -rn' process that is writing the .asterisk_history file. I'm not sure what to do about that other than to file a bug upstream and see if they can provide a fix.
From the modtime it looks like it may actually have been an invocation of "asterisk -rx 'database put cidname $key \"$myclid\"'" that occurred out of a homegrown script that is run from the daily cron run as user root. Maybe I can avoid the issue by cd-ing to a more reasonable directory in my script.
Yes, cd'ing to a different directory is the easiest workaround.
It appears to me that /usr/sbin/asterisk -rx 'logger reload' from /etc/logrotate.d/asterisk writes to /.asterisk_history. Would setting of HOME here to, say, /usr/share/asterisk help or it writes to cwd? I am not sure what to do with 'asterisk -r' which writes to /root/.asterisk_history. SELinux is not very happy.
Re: comment #2 > I think that this should already be fixed by asterisk-1.6.1.10-1.fc12 ... Well, I have here asterisk-1.6.1.11-1.fc12 and it is not fixed. I added in /etc/logrotate.d/asterisk "HOME=/var/lib/asterisk " before /usr/sbin/asterisk... and with that this writes /var/lib/asterisk/.asterisk_history but selinux is still unhappy(cf. bug 541657). I guess that changing that to "HOME=/var/tmp " would help. There is not much in that history file from logrotate anyway.