allow httpd_sys_script_t file { getattr read };
Not sure about this one. What are the httpd_tmp_t files that gallery is trying to read?
Gallery2 watermark plugin uses graphic packages such as NetPbm, ImageMagick, Dcraw, ffmpeg, GD to convert graphic files and re-write them with a watermark image superimposed on them. The typical AVC for getattr and read are:
Aug 25 18:06:46 gei kernel: audit(1188079606.937:995): avc: denied { getattr } for pid=19252 comm="composite" name="kohokan_com_png" dev=dm-0 ino=2163199 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_tmp_t:s0 tclass=file . . . Aug 25 19:07:04 gei kernel: audit(1188083224.885:1066): avc: denied { read } for pid=19870 comm="pngtopnm" name="kohokan_com_png" dev=dm-0 ino=2163199 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_tmp_t:s0 tclass=file
The kohokan.com.png is a watermark file that is uploaded through the web interface.
#============= httpd_t ============== allow httpd_t public_content_rw_t:dir { write remove_name
add_name }; allow httpd_t public_content_rw_t:file unlink;
Setting the allow_httpd_anon_write boolean should remove the need for these rules.
Thanks. Rules removed and boolean set.
Paul.
Did a re-installation of gallery2 after modifying the policy to remove the unlabeled_t rule and enabling the seboolean allow_httpd_anon_write and removing the two rules allow httpd_t public_content_rw_t:dir { write remove_name add_name }; allow httpd_t public_content_rw_t:file unlink;.
New policy is:
policy_module(gallery, 1.0.3)
require { type tmp_t; type httpd_t; type httpd_tmp_t; type httpd_sys_script_t; class file { read write unlink getattr }; class dir { write remove_name add_name }; }
#============= httpd_sys_script_t ============== allow httpd_sys_script_t httpd_tmp_t:file { getattr read };
#============= httpd_t ============== allow httpd_t tmp_t:file { read getattr };
It is the watermark package that is trying to do things with the unlabeled_t context. Here are the AVCs.
Aug 31 13:01:54 gei kernel: audit(1188579714.051:139): avc: denied { read write } for pid=885 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file Aug 31 13:01:54 gei kernel: audit(1188579714.067:140): avc: denied { read write } for pid=887 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file Aug 31 13:01:54 gei kernel: audit(1188579714.080:141): avc: denied { read write } for pid=889 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file Aug 31 13:01:54 gei kernel: audit(1188579714.093:142): avc: denied { read write } for pid=891 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file Aug 31 13:01:54 gei kernel: audit(1188579714.105:143): avc: denied { read write } for pid=893 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file Aug 31 13:01:54 gei kernel: audit(1188579714.119:144): avc: denied { read write } for pid=895 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file Aug 31 13:01:54 gei kernel: audit(1188579714.132:145): avc: denied { read write } for pid=897 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file Aug 31 13:01:54 gei kernel: audit(1188579714.144:146): avc: denied { read write } for pid=899 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file Aug 31 13:01:54 gei kernel: audit(1188579714.158:147): avc: denied { read write } for pid=901 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file Aug 31 13:01:54 gei kernel: audit(1188579714.171:148): avc: denied { read write } for pid=903 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file Aug 31 13:01:54 gei kernel: audit(1188579714.184:149): avc: denied { read write } for pid=905 comm="sh" name="[eventpoll]" dev=anon_inodefs ino=289 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
So what choices do I have?
Regards, John
John Griffiths wrote:
allow httpd_sys_script_t file { getattr read };
Not sure about this one. What are the httpd_tmp_t files that gallery is trying to read?
Gallery2 watermark plugin uses graphic packages such as NetPbm, ImageMagick, Dcraw, ffmpeg, GD to convert graphic files and re-write them with a watermark image superimposed on them. The typical AVC for getattr and read are:
Aug 25 18:06:46 gei kernel: audit(1188079606.937:995): avc: denied { getattr } for pid=19252 comm="composite" name="kohokan_com_png" dev=dm-0 ino=2163199 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_tmp_t:s0 tclass=file . . . Aug 25 19:07:04 gei kernel: audit(1188083224.885:1066): avc: denied { read } for pid=19870 comm="pngtopnm" name="kohokan_com_png" dev=dm-0 ino=2163199 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_tmp_t:s0 tclass=file
The kohokan.com.png is a watermark file that is uploaded through the web interface.
#============= httpd_t ============== allow httpd_t public_content_rw_t:dir { write remove_name
add_name }; allow httpd_t public_content_rw_t:file unlink;
Setting the allow_httpd_anon_write boolean should remove the need for these rules.
Thanks. Rules removed and boolean set.
Paul.
This is what audit2allow is showing now.
tail -n60 /var/log/messages | audit2allow -m local
module local 1.0;
require { type unlabeled_t; type default_t; type boot_t; type httpd_t; type httpd_sys_script_t; type lost_found_t; class lnk_file read; class dir getattr; class file { read write getattr }; }
#============= httpd_sys_script_t ============== allow httpd_sys_script_t unlabeled_t:file { read write };
#============= httpd_t ============== allow httpd_t boot_t:dir getattr; allow httpd_t default_t:file getattr; allow httpd_t default_t:lnk_file read; allow httpd_t lost_found_t:dir getattr;
It is getting worse.
Regards, John
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
John Griffiths wrote:
This is what audit2allow is showing now.
tail -n60 /var/log/messages | audit2allow -m local
module local 1.0;
require { type unlabeled_t; type default_t; type boot_t; type httpd_t; type httpd_sys_script_t; type lost_found_t; class lnk_file read; class dir getattr; class file { read write getattr }; }
#============= httpd_sys_script_t ============== allow httpd_sys_script_t unlabeled_t:file { read write };
#============= httpd_t ============== allow httpd_t boot_t:dir getattr; allow httpd_t default_t:file getattr; allow httpd_t default_t:lnk_file read; allow httpd_t lost_found_t:dir getattr;
It is getting worse.
Regards, John
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
What OS and what version of policy are you running. You might want to yum update selinux-policy
default_t looks like you added some directory at / and did not label it with httpd_sys_content_t?
The getattr can probably be dontaudit since I doubt your app actually wants to look at these directories.
Daniel J Walsh wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
What OS and what version of policy are you running. You might want to yum update selinux-policy
kernel-2.6.22.2-42.fc6 selinux-policy-2.4.6-80.fc6
I believe these are current for FC6.
I did a forced switch of my syslog and httpd. Then I put selinux into permissive mode. Then, I wiped out my gallery2 and reinstalled. I am doing a multisite gallery2 installation just as a point of reference. I installed every module from the full download. After that I added a few pictures; deleted some. Added pictures from a samba share on the server. Added pictures from a web page. Added a new album and deleted it, added and deleted watermark png graphic files, and generated watermarked pictures and thumbnails. Then I changed the email address of the administrator and enabled email notification of user registrations. I tried to exercise gallery2; I know I did not exercise every branch of code, but I think I did much of what many will do. Then did a
cat /var/log/messages | audit2allow -m gallery2 > ~jrg3/downloads/gallery2/selinux/gallery.te.new
This is the new policy source (I have not implemented it.):
module gallery2 1.0;
require { type mail_spool_t; type unlabeled_t; type acct_data_t; type httpd_sys_script_t; type boot_t; type httpd_t; type default_t; type home_root_t; type var_yp_t; type httpd_tmp_t; type named_zone_t; type samba_share_t; type var_t; type lost_found_t; type xserver_log_t; class lnk_file read; class file { read write getattr }; class dir { read getattr }; }
#============= httpd_sys_script_t ============== allow httpd_sys_script_t httpd_tmp_t:file { read getattr }; allow httpd_sys_script_t unlabeled_t:file { read write }; allow httpd_sys_script_t var_t:file { read getattr };
#============= httpd_t ============== allow httpd_t acct_data_t:dir getattr; allow httpd_t boot_t:dir getattr; allow httpd_t default_t:file getattr; allow httpd_t default_t:lnk_file read; allow httpd_t home_root_t:dir read; allow httpd_t lost_found_t:dir getattr; allow httpd_t mail_spool_t:dir getattr; allow httpd_t mail_spool_t:lnk_file read; allow httpd_t named_zone_t:dir getattr; allow httpd_t samba_share_t:dir getattr; allow httpd_t var_t:dir read; allow httpd_t var_yp_t:dir getattr; allow httpd_t xserver_log_t:dir getattr;
That a comprehensive list of rules.
The installation does a look up of directories as you enter partial paths. It looks for host names. The samba share is in /home/<share>. The shared gallery2 code base is in /var/www. The data store is in /var/www/g2data/<site>, and the gallery2 multisite is in http://<FQHN>/<directory structure>/pictures/.
The context on the shared code base is system_u:object_r:httpd_sys_content_t. There are perl, java script, java applets, and shell scripts in the gallery2 modules. They are also labeled system_u:object_r:httpd_sys_content_t. I suspect they should be system_u:object_r:httpd_sys_script_exec_t. I searched in the selinux wiki but did not find any guidelines for labeling scripts and executables in the html contexts. I would think those files should be treated like cgi but am not clear on that. Would that change things? Is there any guidance on which files should have the context httpd_sys_script_exec_t?
I kept a copies of the messages log file, the httpd access and error logs, so all that information is available.
Thanks for the help.
Regards, John Griffiths
selinux@lists.fedoraproject.org