Summary: SELinux is preventing /bin/bash from using potentially mislabeled files /usr/share/mythtv/mythweather/scripts/us_nws/nwsxml.pl. Detailed Description: SELinux has denied the sh access to potentially mislabeled files /usr/share/mythtv/mythweather/scripts/us_nws/nwsxml.pl. This means that SELinux will not allow httpd to use these files. If httpd should be allowed this access to these files you should change the file context to one of the following types, bin_t, httpd_rotatelogs_exec_t, textrel_shlib_t, chroot_exec_t, httpd_exec_t, ld_so_t, httpd_unconfined_script_exec_t, shell_exec_t, httpd_helper_exec_t, httpd_php_exec_t, httpd_modules_t, httpd_suexec_exec_t, lib_t, application_exec_type, mailman_cgi_exec_t, abrt_helper_exec_t, httpd_nagios_script_exec_t, httpd_sys_content_t, httpd_munin_script_exec_t, httpd_w3c_validator_script_exec_t, httpd_user_script_exec_t, httpd_bugzilla_script_exec_t, httpd_apcupsd_cgi_script_exec_t, httpd_squid_script_exec_t, httpd_sys_script_exec_t, httpd_git_script_exec_t, httpd_cvs_script_exec_t, httpd_prewikka_script_exec_t, httpd_awstats_script_exec_t. Many third party apps install html files in directories that SELinux policy cannot predict. These directories have to be labeled with a file context which httpd can access. Allowing Access: If you want to change the file context of /usr/share/mythtv/mythweather/scripts/us_nws/nwsxml.pl so that the httpd daemon can access it, you need to execute it using semanage fcontext -a -t FILE_TYPE '/usr/share/mythtv/mythweather/scripts/us_nws/nwsxml.pl'. where FILE_TYPE is one of the following: bin_t, httpd_rotatelogs_exec_t, textrel_shlib_t, chroot_exec_t, httpd_exec_t, ld_so_t, httpd_unconfined_script_exec_t, shell_exec_t, httpd_helper_exec_t, httpd_php_exec_t, httpd_modules_t, httpd_suexec_exec_t, lib_t, application_exec_type, mailman_cgi_exec_t, abrt_helper_exec_t, httpd_nagios_script_exec_t, httpd_sys_content_t, httpd_munin_script_exec_t, httpd_w3c_validator_script_exec_t, httpd_user_script_exec_t, httpd_bugzilla_script_exec_t, httpd_apcupsd_cgi_script_exec_t, httpd_squid_script_exec_t, httpd_sys_script_exec_t, httpd_git_script_exec_t, httpd_cvs_script_exec_t, httpd_prewikka_script_exec_t, httpd_awstats_script_exec_t. You can look at the httpd_selinux man page for additional information. Additional Information: Source Context system_u:system_r:httpd_t:s0 Target Context system_u:object_r:usr_t:s0 Target Objects /usr/share/mythtv/mythweather/scripts/us_nws/nwsxm l.pl [ file ] Source sh Source Path /bin/bash Port <Unknown> Host (removed) Source RPM Packages bash-4.0.33-1.fc12 Target RPM Packages mythweather-0.22-2.fc12 Policy RPM selinux-policy-3.6.32-49.fc12 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name httpd_bad_labels Host Name (removed) Platform Linux (removed) 2.6.31.6-145.fc12.x86_64 #1 SMP Sat Nov 21 15:57:45 EST 2009 x86_64 x86_64 Alert Count 2 First Seen Tue 01 Dec 2009 07:33:32 PM PST Last Seen Tue 01 Dec 2009 07:33:32 PM PST Local ID b1f5700a-83be-45f5-968d-ff521fbc0429 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1259724812.817:34914): avc: denied { execute } for pid=2840 comm="sh" name="nwsxml.pl" dev=dm-2 ino=269489 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1259724812.817:34914): arch=c000003e syscall=21 success=no exit=-13 a0=2882650 a1=1 a2=7fff231a68a0 a3=38 items=0 ppid=1992 pid=2840 auid=4294967295 uid=48 gid=489 euid=48 suid=48 fsuid=48 egid=489 sgid=489 fsgid=489 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:httpd_t:s0 key=(null) Hash String generated from selinux-policy-3.6.32-49.fc12,httpd_bad_labels,sh,httpd_t,usr_t,file,execute audit2allow suggests: #============= httpd_t ============== allow httpd_t usr_t:file execute;
You can add these rules for now using # grep avc /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Fixed in selinux-policy-3.6.32-53.fc12.noarch
Dan it is a deeper issue than just this avc. This is a new Fedora rpmfusion package that I'm not sure is correctly configured in that it has a lot of web aspects that are being installed into the /usr/share area instead of the /var/www/html area. Should talk with Jarod Wilson about this application. I have had to do a bunch of labeling and I'm still working on getting the web weather stuff to work with the upgrade to version 0.22. Of course each package update wipes out the fixes I have done.
Sorry I just cut in paste that message. The real fix is to set the labeling: /usr/share/mythtv/mythweather/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0) If you have any other labeling fixes for this, please tell me now and I will get them into the next release.
semanage fcontext -a -t httpd_sys_content_t /usr/share/mythweb/data semanage fcontext -a -t httpd_sys_content_t /usr/share/mythtv/mythweather/scripts
I also jumped the commit button too soon. setsebool httpd_can_network_connect on setsebool httpd_builtin_scripting on setsebool httpd_unified on May also need setsebool httpd_can_network_connect_db on setsebool httpd_use_nfs on Each release of Fedora an the applications seem to require a few different settings as they evolve.
setsebool httpd_can_network_connect_db on Is not required if httpd_can_network_connect is turned on. Do you know what ports mythtv requires to connect to? setsebool httpd_unified on Why do you require this? semanage fcontext -a -t httpd_sys_script_exec_t /usr/share/mythtv/mythweather/scripts If /usr/share/mythweb/data is writable from apache it should be httpd_sys_content_rw_t
Did not know that some selinux booleans were interconnected. I believe mythtv only uses port 80 web connections. I think most web stuff would break if the httpd_unified bool is not on, with my understanding of how selinux labeling works for web content. I agree long term that should not be how things are done. I could run some more tests with httpd_unified off and see what breaks. It is still on by default now.
Sadly yes. But if we can get the content labeled correctly we can give people who want to run at a higher security level the ability to turn off httpd_unified. Which is why I want to know if httpd needs to write to /usr/share/mythweb/data
I will need to do more testing to see if we need httpd write access. I believe the PHP and Perl web content communicates with the mythbackend process which updates the web and mysql database. So it maybe possible to have read only access which would be much better. I will ask the computer tonight and let you know what the answer is.:)
selinux-policy-3.6.32-55.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-55.fc12
I relabelled /usr/share/mythtv/mythweather/scripts to httpd_sys_script_exec_t and turned off sebool httpd_unified and all seems to work. This is good news. I will be testing other systems based on the results of this testing see if we can turn off the unified setting.
I should have also said that I tested with these settings as well: setsebool httpd_can_network_connect_db off setsebool httpd_use_nfs off
Sorry, but it has been a long day. I found that /usr/share/mythweb/data is OK being labelled httpd_sys_content_t which if my memory is correct is read only. In reviewing and testing it appears that the use of this location has changed. It appears to only have symlinks for video, video_covers, and TV channel icons which are all static. The recording and video library storage require the same httpd_sys_content_t if you want to be able to web browse and use other video players.
Found one more file /usr/share/mythweb/mythweb.pl that needed to be labelled httpd_sys_script_exec_t.
Fixed in selinux-policy-3.6.32-56.fc12.noarch
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-12650
selinux-policy-3.6.32-55.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
I think that /usr/share/mythweb/data/tv_icons needs to be labelled httpd_sys_content_rw_t. Apache was throwing me an error before I made this change. Also, did the change of /usr/share/mythweb/data to httpd_sys_content_t and /usr/share/mythweb/mythweb.pl to httpd_sys_script_exec_t make it into the policy rpm? I have selinux-policy-3.6.32-55.fc12.noarch installed and when I do a 'restorecon -R /usr/share/mythweb' both of these entries get reset to usr_t.
Now running with httpd_unified off and /usr/share/mythweb/data/tv_icons are labelled httpd_sys_content_t. I'm seeing no complaints from Apache.