1

I have an app, browser shell and I'm executing this command to get list of execuables (List all binaries from $PATH)

compgen -A function -abck | sort | uniq

and when I call this command It return executables but I've got lot of errors from SELinux like this one:

SELinux is preventing bash from getattr access on the file /usr/sbin/chronyd.

allow this access for now by executing:
# ausearch -c 'bash' --raw | audit2allow -M my-bash
# semodule -X 300 -i my-bash.pp

is there a way to prevent that that error? I want my app to work in SELinux as well without any errors out of the box.

I can change PATH or execute some command to check if path can be in PATH variable, which probably /usr/sbin can't be in PATH. Does such command exists? I have this PATH by default:

/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/usr/games

this is the result of sudo ausearch -c 'bash' --raw

type=AVC msg=audit(1506851274.781:2921): avc:  denied  { getattr } for  pid=12298 comm="bash" path="/usr/sbin/xl2tpd" dev="sda1" ino=2239132 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:l2tpd_exec_t:s0 tclass=file permissive=1

and with | audit2why:

type=AVC msg=audit(1506851274.781:2921): avc:  denied  { getattr } for  pid=12298 comm="bash" path="/usr/sbin/xl2tpd" dev="sda1" ino=2239132 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:l2tpd_exec_t:s0 tclass=file permissive=1

    Was caused by:
        Missing type enforcement (TE) allow rule.

        You can use audit2allow to generate a loadable module to allow this access.

is it possible to make my code work wihout the audit2allow?

  • What security context is used for your "browser shell"? Can you provide a precise AVC message from audit log for this specific error? – sebasth Oct 1 '17 at 10:34
  • @sebasth update the question, is that what you wanted? – jcubic Oct 1 '17 at 10:54
2

The default policy shipped with SELinux is designed to allow the typical system access for each application. Unlike your regular login shell, your "web shell" is running in web server context (httpd_t) in which the restrictions for web server apply. Your web server is also running in a permissive domain, which means the policy rules are not enforced, only logged, hence you don't actually see any permission denied errors in your application.

The simplest way to get rid of the message would be following the suggestion to use audit2allow, after which you can set httpd_t back to enforcing mode. audit2allow creates a new rule allowing the specific access for which the deny message was generated for: a rule for httpd_t context permitting getattr to files with l2tpd_exec_t context.

If you plan to keep using a shell from web server, you are likely to see more SELinux permission errors when you do something else the default policy doesn't allow (in httpd_t context).

Ideally, you should create a custom policy with a clear transition path to a (more) permissive domain in which the shell runs. This allows you to run unconfined shell without granting the web server overly permissive access. If it is useful, depends completely on the details how the shell is launched from web server (scripts, etc).

If you decide to keep httpd_t in permissive mode anyways and you do not want any log messages, you can configure the web server to run in unconfined context. Either way, for web server this is practically the same as running SElinux disabled.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.