-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/11/2013 11:34 AM, David Highley wrote:
"Daniel J Walsh wrote:"
>
On 01/09/2013 05:22 PM, Dominick Grift wrote:
>>> On Wed, 2013-01-09 at 13:35 -0800, David Highley wrote:
>>>> "Daniel J Walsh wrote:"
>>>>>
>>> On 01/08/2013 11:28 PM, David Highley wrote:
>>>>>>> I get the following avc from using mythtv's web
interface.
>>>>>>>
>>>>>>> ---- time->Tue Jan 8 19:14:57 2013 type=SYSCALL
>>>>>>> msg=audit(1357701297.336:4077): arch=c000003e syscall=109
>>>>>>> success=no exit=-13 a0=0 a1=0 a2=1340cb0 a3=0 items=0
>>>>>>> ppid=5777 pid=8018 auid=4294967295 uid=48 gid=48 euid=48
>>>>>>> suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none)
>>>>>>> ses=4294967295 comm="mythweb.pl"
exe="/usr/bin/perl"
>>>>>>> subj=system_u:system_r:httpd_sys_script_t:s0 key=(null)
>>>>>>> type=AVC msg=audit(1357701297.336:4077): avc: denied {
>>>>>>> setpgid } for pid=8018 comm="mythweb.pl"
>>>>>>> scontext=system_u:system_r:httpd_sys_script_t:s0
>>>>>>> tcontext=system_u:system_r:httpd_sys_script_t:s0
>>>>>>> tclass=process ---- time->Tue Jan 8 19:17:56 2013
>>>>>>> type=SYSCALL msg=audit(1357701476.763:4085): arch=c000003e
>>>>>>> syscall=109 success=no exit=-13 a0=0 a1=0 a2=22c5b10 a3=0
>>>>>>> items=0 ppid=5774 pid=8113 auid=4294967295 uid=48 gid=48
>>>>>>> euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none)
>>>>>>> ses=4294967295 comm="mythweb.pl"
exe="/usr/bin/perl"
>>>>>>> subj=system_u:system_r:httpd_sys_script_t:s0 key=(null)
>>>>>>> type=AVC msg=audit(1357701476.763:4085): avc: denied {
>>>>>>> setpgid } for pid=8113 comm="mythweb.pl"
>>>>>>> scontext=system_u:system_r:httpd_sys_script_t:s0
>>>>>>> tcontext=system_u:system_r:httpd_sys_script_t:s0
>>>>>>> tclass=process
>>>>>>>
>>>>>>> I checked the script, ls -Z /usr/share/mythweb/mythweb.pl
>>>>>>> -rwxr-xr-x. apache apache
>>>>>>> system_u:object_r:httpd_sys_script_exec_t:s0
>>>>>>> /usr/share/mythweb/mythweb.pl
>>>>>>>
>>>>>>> Should I need to define the following?
>>>>>>>
>>>>>>> require { type httpd_sys_script_t; class process setpgid; }
>>>>>>>
>>>>>>> #============= httpd_sys_script_t ============== allow
>>>>>>> httpd_sys_script_t self:process setpgid; -- selinux mailing
>>>>>>> list selinux(a)lists.fedoraproject.org
>>>>>>>
https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>>>>>
>>> Yes, although I guess the question is whether we should allow this
>>> by default. What risk do we have from allowing cgi script the ability
>>> to call setpgid.
>>>>>
>>>>> The only information I could find were previous
>>>>>
bugzilla.redhat.com reports which seemed to recommend local
>>>>> policy and a 2003 SANS Institute report titled, Global
>>>>> Information Assurance Certification Paper which seemed to
>>>>> indicate allowing it. Oh, and I did ask one of our information
>>>>> assurance people who did not know if there were any issues.
>>>>>
>>>
>>>> we do not have to run mythweb.pl in httpd_sys_script_t domain:
>>>
>>>> echo "policy_module(mymythweb, 1.0.0)
>>>> apache_content_template(mymythweb) allow httpd_mymythweb_script_t
>>>> self:process setpgid;" > mymythweb.te
>>>
>>>> echo "/usr/share/mythweb/mythweb\.pl --
>>>> gen_context(system_u:object_r:httpd_mymythweb_script_exec_t,s0)"
>
>>>> mymythweb.fc
>>>
>>>> make -f /usr/share/selinux/devel/Makefile mymythweb.pp sudo
>>>> semodule mymythweb.pp sudo restorecon -v
>>>> /usr/share/mythweb/mythweb.pl
>>>
>>>
>>>>>
>>>> -- selinux mailing list selinux(a)lists.fedoraproject.org
>>>>
https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>
>>>
>>> -- selinux mailing list selinux(a)lists.fedoraproject.org
>>>
https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>
Seems like an idea, not sure what mythweb does? Where is its content
stored?
> It is the web interface to mythtv which I believe there is all ready
> previous selinux policy for. The scripts are located in
> /usr/share/mythweb. Should I open a bug report? Which approach should I
> recommend in the report?
>
-- selinux mailing list selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
Yes a bug report would be good with a description of what files need to be
written by the cgi scripts.
Basically I would like to write a policy type httpd_mythtv_script_t and then
add appropriate rules and types for files this type might need to write to.
/var/log? /var/lib? /run? /var? ...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
iEYEARECAAYFAlD0Oq0ACgkQrlYvE4MpobMhLwCeO06Rkih99pcwtjqT/ZBw7yPW
0JQAmwWy9sqRSQkX71TTp83uIeQEB2dk
=BSxZ
-----END PGP SIGNATURE-----