Hi all,
I have installed awstats (an httpd log file analyzer) from Extras and am having some SELinux issues. I've gotten the same results on FC4 and Rawhide, using current packages and unchanged config files. Below are the steps I went through to get it working. Could someone more knowledgeable provide some feedback on this, or point me in the right direction? Is there a better or more correct way to do this? Is this something that could or should be added to the policy?
/usr/share/awstats/wwwroot/cgi-bin/awstats.pl is run as a CGI script by httpd, but is denied.
# ls -Z /usr/share/awstats/wwwroot/cgi-bin/ -rwxr-xr-x root root system_u:object_r:usr_t awredir.pl -rwxr-xr-x root root system_u:object_r:usr_t awstats.pl
Changing the type gets the script running:
# chcon -t httpd_sys_script_exec_t /usr/share/awstats/wwwroot/cgi-bin/* # ls -Z /usr/share/awstats/wwwroot/cgi-bin/ -rwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t awredir.pl -rwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t awstats.pl
However, the script reports an error.
Error: AWStats database directory defined in config file by 'DirData' parameter (/var/lib/awstats) does not exist or is not writable.
# ls -Z /var/lib ... drwxr-xr-x root root system_u:object_r:var_lib_t awstats ...
Changing the type allows the script to run:
# chcon -t httpd_sys_script_rw_t /var/lib/awstats # ls -Z /var/lib ... drwxr-xr-x root root system_u:object_r:httpd_sys_script_rw_t awstats ...
Any thoughts?
Thanks,
Dear Mickey,
I noticed your post right before going to lunch. I was planning on responding when I got back, but you beat me to the punch! Thanks for your response. I believe that you are 90% of the way to your destination...
# ls -Z /usr/share/awstats/wwwroot/cgi-bin/ -rwxr-xr-x root root system_u:object_r:usr_t awredir.pl -rwxr-xr-x root root system_u:object_r:usr_t awstats.pl
Changing the type gets the script running:
# chcon -t httpd_sys_script_exec_t /usr/share/awstats/wwwroot/cgi-bin/* # ls -Z /usr/share/awstats/wwwroot/cgi-bin/ -rwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t awredir.pl -rwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t awstats.pl
This is correct, so far.
However, the script reports an error.
Error: AWStats database directory defined in config file by 'DirData' parameter (/var/lib/awstats) does not exist or is not writable.
# ls -Z /var/lib ... drwxr-xr-x root root system_u:object_r:var_lib_t awstats ...
Changing the type allows the script to run:
# chcon -t httpd_sys_script_rw_t /var/lib/awstats # ls -Z /var/lib ... drwxr-xr-x root root system_u:object_r:httpd_sys_script_rw_t awstats ...
You have changed the policy on the /var/lib/awstats folder, but not on its contents, as you successfully did on the files in the cgi-bin, above. In the case of the cgi-bin, it seems you achieved this with a wildcard (*). Just chcon the contents (the actual AWStats databases) in /var/lib/awstats, and you'll be good to go. You can do this one file at a time, or by using a wildcard (*) as you did above, or, best of all, recursively through the directory for all time, with:
chcon -R -h -t httpd_sys_script_ra_t /var/lib/awstats
This will make the existing contents of the directory, and any new databases added to the directory in the future (db's for new virtual hosts, for instance) properly permissioned, so long as future files added to the directory are created properly.
(You might note that I recommended chcon'ing your awstats database folder _ra_t, and not _rw_t, as you had done originally. This just removes the right of awstats.pl to ever erase one of the databases.)
This should get your web reporting working. However, it does not resolve the final issue, which I am still working out. There exists an option in the web reporting pages called 'Update Now'. It allows you to update reports from the web server's logs without performing the log parsing from the command line. You must change the directive 'AllowToUpdateStatsFromBrowser' from 0 to 1 in your awstats .conf file to activate this practical feature. However, I have found that the web-based update process needs access to the system's httpd access_log file (usually in /var/log/httpd). I have changed permissions on this file to httpd_sys_script_ra_t, but it was not sufficient to make the update feature work. Hopefully, someone will be able to help here. I'll post if I get the answer.
Finally, I noticed that the changes to policy would not take until I closed the browser window in which I was trying to access AWStats, and reloaded it in a new window.
Hope this helps,
Steven Stromer
Hi,
A few weeks ago, I brought up a problem I was having with SELinux and AWStats. I am hoping that someone may be able to help. From my original post:
There exists an option in the web reporting pages called 'Update Now'. It allows you to update reports from the web server's logs without performing the log parsing from the command line. You must change the directive 'AllowToUpdateStatsFromBrowser' from 0 to 1 in your awstats .conf file to activate this practical feature. However, I have understand that the web-based update process needs access to the system's httpd access_log file (usually in /var/log/httpd). I have changed permissions on this file to httpd_sys_script_ra_t, but it was not sufficient to make the update feature work.
Also, the awstats.pl file has permissions: -rwxr-xr-x root root system_u:object_r:htpd_sys_script_exec_t awstats.pl
I can generate reports from the command line with no problem, but the web based tool returns an error saying that I do not have proper permissions.
I found one reference to another user having the same problem. The posting is minimal, but implies that 'touch /.autorelabel && shutdown -r now' fixed the problem. I basically understand what this command is intended to do, but I am concerned that executing it might do more damage to files that I've chcon'ed in the past, than it will fix.
Any advise would be much appreciated. Please help!
Steven Stromer
Steven Stromer wrote:
Hi,
A few weeks ago, I brought up a problem I was having with SELinux and AWStats. I am hoping that someone may be able to help. From my original post:
There exists an option in the web reporting pages called 'Update Now'. It allows you to update reports from the web server's logs without performing the log parsing from the command line. You must change the directive 'AllowToUpdateStatsFromBrowser' from 0 to 1 in your awstats .conf file to activate this practical feature. However, I have understand that the web-based update process needs access to the system's httpd access_log file (usually in /var/log/httpd). I have changed permissions on this file to httpd_sys_script_ra_t, but it was not sufficient to make the update feature work.
Also, the awstats.pl file has permissions: -rwxr-xr-x root root system_u:object_r:htpd_sys_script_exec_t awstats.pl
I can generate reports from the command line with no problem, but the web based tool returns an error saying that I do not have proper permissions.
I found one reference to another user having the same problem. The posting is minimal, but implies that 'touch /.autorelabel && shutdown -r now' fixed the problem. I basically understand what this command is intended to do, but I am concerned that executing it might do more damage to files that I've chcon'ed in the past, than it will fix.
Any advise would be much appreciated. Please help!
What avc messages are you seeing? You should not need to relabel. But one file may be mislabeled or the policy may not allow it. Look in /var/log/messages or /var/log/audit/audit.log for avc message.
Steven Stromer
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Daniel J Walsh wrote:
Steven Stromer wrote:
Hi,
A few weeks ago, I brought up a problem I was having with SELinux and AWStats. I am hoping that someone may be able to help. From my original post:
There exists an option in the web reporting pages called 'Update Now'. It allows you to update reports from the web server's logs without performing the log parsing from the command line. You must change the directive 'AllowToUpdateStatsFromBrowser' from 0 to 1 in your awstats .conf file to activate this practical feature. However, I have understand that the web-based update process needs access to the system's httpd access_log file (usually in /var/log/httpd). I have changed permissions on this file to httpd_sys_script_ra_t, but it was not sufficient to make the update feature work.
Also, the awstats.pl file has permissions: -rwxr-xr-x root root system_u:object_r:htpd_sys_script_exec_t awstats.pl
I can generate reports from the command line with no problem, but the web based tool returns an error saying that I do not have proper permissions.
I found one reference to another user having the same problem. The posting is minimal, but implies that 'touch /.autorelabel && shutdown -r now' fixed the problem. I basically understand what this command is intended to do, but I am concerned that executing it might do more damage to files that I've chcon'ed in the past, than it will fix.
Any advise would be much appreciated. Please help!
What avc messages are you seeing? You should not need to relabel. But one file may be mislabeled or the policy may not allow it. Look in /var/log/messages or /var/log/audit/audit.log for avc message.
I've looked in both logs. Attempting to use the update feature in AWStats does not write any error messages to either of these log files. There are a few avc messages contained in each of the files, but none pertain to this problem. Is there anywhere else I can look, or does this indicated that the problem is not stemming from an SELinux permission problem? Thanks again for the help!
Steven Stromer wrote:
Daniel J Walsh wrote:
Steven Stromer wrote:
Hi,
A few weeks ago, I brought up a problem I was having with SELinux and AWStats. I am hoping that someone may be able to help. From my original post:
There exists an option in the web reporting pages called 'Update Now'. It allows you to update reports from the web server's logs without performing the log parsing from the command line. You must change the directive 'AllowToUpdateStatsFromBrowser' from 0 to 1 in your awstats .conf file to activate this practical feature. However, I have understand that the web-based update process needs access to the system's httpd access_log file (usually in /var/log/httpd). I have changed permissions on this file to httpd_sys_script_ra_t, but it was not sufficient to make the update feature work.
Also, the awstats.pl file has permissions: -rwxr-xr-x root root system_u:object_r:htpd_sys_script_exec_t awstats.pl
I can generate reports from the command line with no problem, but the web based tool returns an error saying that I do not have proper permissions.
I found one reference to another user having the same problem. The posting is minimal, but implies that 'touch /.autorelabel && shutdown -r now' fixed the problem. I basically understand what this command is intended to do, but I am concerned that executing it might do more damage to files that I've chcon'ed in the past, than it will fix.
Any advise would be much appreciated. Please help!
What avc messages are you seeing? You should not need to relabel. But one file may be mislabeled or the policy may not allow it. Look in /var/log/messages or /var/log/audit/audit.log for avc message.
I've looked in both logs. Attempting to use the update feature in AWStats does not write any error messages to either of these log files. There are a few avc messages contained in each of the files, but none pertain to this problem. Is there anywhere else I can look, or does this indicated that the problem is not stemming from an SELinux permission problem? Thanks again for the help!
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Usually you can see if it is an selinux problable, by temporarily turning off selinux protection.
setenforce 0 Try you http script.
setenforce 1
If it still breaks, it probably is not SELinux fault, if it works, it is probably selinux and you can turn up the auditing by installing policy sources
cd /etc/selinux/targeted/src/policy make enableaudit; make load
Try it out, Look for avc messages.
make clean; make load
To reset to less auditing.
Hi,
I'm packaging Awstats for Extras, but I'm rather unfamiliar with SELinux. Is there something I could add to my package to make these contexts the default ?
Thanks
Aurélien
selinux@lists.fedoraproject.org