I began playing with RPM based OSes and I am really impressed.

  1. Amazon Linux doesn't include setroubleshoot in any of their repos. I want to use official repos for everything, otherwise I would just jump ship. I checked the logs and didn't see a "SELinux is preventing" error, but maybe I don't know what to look for.

  2. $_POST variables work when setenforce is set to permissive.

  3. My code works on Debian systems. My website is reachable on Amazon Linux but won't redirect correctly.

  4. I'm using httpd (what RPM calls apache2). apachectl configtest returns Syntax OK.

This is my code. It is index.php

<form action="index.php" method="post">
    <input type="text" name="username">
    <input type="password" name="password">
    <input type="hidden" name="hidden_value" value="true">
    <input type="submit">
</form>

And then on the same page, I write some php.

<?php
if(isset($_POST['hidden_value']){

    /* Do the rest of your authentication math */

}
?>

Index.php redirects to index.php, and the $_POST variables handle the redirects. However, it only works when I set SELinux to permissive. I'd like to arm SELinux.

PS It does redirect, but it redirects with the $_POST variable unset.

  • Have you tested with the authentication routines actually removed? It might be php/httpd trying to access directories it's not allowed to. – Ulrich Schwarz Dec 7 at 8:12
  • Please post the SELinux messages from /var/log/audit/audit.log when trying to access the variable. This will provide a more clear picture. – hargut Dec 7 at 8:16
  • @ Mr. Schwarz How do I discover whether this is the case? – Cookie Dec 7 at 8:16
  • @ hargut. That folder does not exist in /var/log – Cookie Dec 7 at 8:19
  • 1
    Here is an overview on the available http related SELinux booleans: dwalsh.fedorapeople.org/SELinux/httpd_selinux.html Did you already enable httpd_enable_cgi? – hargut Dec 7 at 8:20

Thanks to Ulrich Schwarz and hargut for pointing me in the right direction. It was in fact a boolean. I enabled httpd_enable_cgi as suggested, and it still didn't work. Then I looked at the list of booleans using

sudo getsebool -a | grep httpd

That's how I found out that there is a boolean called

httpd_can_network_connect_db

and that it was turned off.

I turned it on by using

sudo setsebool httpd_can_network_connect_db=1

If anyone uses MySql and is migrating from Debian to a Security Enhanced system, this is prerequisite. So much to learn about SELinux. Thanks again.

Make sure to check /var/log/audit/audit.log for selinux warnings. It might suggest what policy to enable.

Otherwise, you can set SELinux in permissive mode and then use the aforementioned logfile to build a custom policy encompassing all the needs of your application. In order to do this, set SELinux in permissive mode, use all the features of your code and then use the audit2allow to generate a custom policy.

You can then bundle and distribute the policy file with your code so that SELinux will allow all and only the special permissions that your code needs:

# generate a custom policy
grep "AVC" /var/log/audit/audit.log | audit2allow -M yourapp
# install that policy
semodule -i yourapp.pp 

Whatever you do, don't go in production with SELinux turned off!

Consider watching this awesome intro to SELinux: https://www.youtube.com/watch?v=_WOKRaM-HI4

  • awesome. Thanks. – Cookie Dec 7 at 9:12

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.