0

I'm getting a weird SElinux issue where if I restart Nginx with sudo systemctl restart nginx and SElinux is enforcing the server jams up causing the website to crash and the servers CPU hits 70 - 90 percent load. If I restart Nginx with SElinux in permissive mode everything works as expected.

Running the command sudo journalctl -p err -b | grep -i selinux I get 2 SElinux alerts SELinux is preventing /usr/sbin/nginx from execute access on the file /etc/ld.so.cache and SELinux is preventing /usr/sbin/nginx from map access on the chr_file /dev/zero (details below).

/etc/ld.so.cache information:

ls -laZ /etc/ld.so.cache
-rw-r--r--. root root unconfined_u:object_r:ld_so_cache_t:s0 /etc/ld.so.cache

If I run sudo ldconfig a new cachefile is created in /etc/ld.so.cache so ldconfig is running.

ldconfig --version
ldconfig (GNU libc) 2.17

According to the ldconfig_selinux man page ldconfig

The ldconfig processes execute with the ldconfig_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep ldconfig_t

But when I run the above command the grep returns nothing. This may not be significant but thought I should mention it.

I've also tried changing the files permissions to: sudo chmod 0755 /etc/ld.so.cache and sudo chmod 0750 /etc/ld.so.cache which didn't work either.

EDIT: Heres a copy of my Nginx systemd script.

sudo vi /usr/lib/systemd/system/nginx.service

[Unit]
Description=nginx - high performance web server
Documentation=https://nginx.org/en/docs/
After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target
[Service]
Type=forking
PIDFile=/var/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t -c /etc/nginx/nginx.conf
ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s TERM $MAINPID
[Install]
WantedBy=multi-user.target

SElinux alerts:

SELinux is preventing /usr/sbin/nginx from execute access on the file /etc/ld.so.cache.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that nginx should be allowed execute access on the ld.so.cache file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'nginx' --raw | audit2allow -M my-nginx
# semodule -i my-nginx.pp


Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                unconfined_u:object_r:ld_so_cache_t:s0
Target Objects                /etc/ld.so.cache [ file ]
Source                        nginx
Source Path                   /usr/sbin/nginx
Port                          <Unknown>
Host                          di-staging
Source RPM Packages           nginx-1.15.7-1.x86_64
Target RPM Packages           glibc-2.17-260.el7.x86_64
Policy RPM                    selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     di-staging
Platform                      Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
                              Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count                   35
First Seen                    2019-03-02 16:08:25 GMT
Last Seen                     2019-03-07 12:08:18 GMT
Local ID                      2bd8aa83-8ba0-49fa-83f8-7f5924ad194c

Raw Audit Messages
type=AVC msg=audit(1551960498.942:1179942): avc:  denied  { execute } for  pid=28695 comm="nginx" path="/etc/ld.so.cache" dev="sda2" ino=9177558 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:ld_so_cache_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1551960498.942:1179942): arch=x86_64 syscall=mmap per=400000 success=no exit=EACCES a0=0 a1=a942 a2=1 a3=2 items=0 ppid=1 pid=28695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=nginx exe=/usr/sbin/nginx subj=system_u:system_r:httpd_t:s0 key=(null)

Hash: nginx,httpd_t,ld_so_cache_t,file,execute

-----------------------

SELinux is preventing /usr/sbin/nginx from map access on the chr_file /dev/zero.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that nginx should be allowed map access on the zero chr_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'nginx' --raw | audit2allow -M my-nginx
# semodule -i my-nginx.pp


Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:zero_device_t:s0
Target Objects                /dev/zero [ chr_file ]
Source                        nginx
Source Path                   /usr/sbin/nginx
Port                          <Unknown>
Host                          di-staging
Source RPM Packages           nginx-1.15.7-1.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     di-staging
Platform                      Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
                              Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count                   83
First Seen                    2019-03-02 16:08:25 GMT
Last Seen                     2019-03-07 12:08:19 GMT
Local ID                      4155f3e6-d77d-479b-9642-b90b4512e49a

Raw Audit Messages
type=AVC msg=audit(1551960499.20:1179949): avc:  denied  { map } for  pid=28695 comm="nginx" path="/dev/zero" dev="devtmpfs" ino=2053 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:zero_device_t:s0 tclass=chr_file permissive=0


type=SYSCALL msg=audit(1551960499.20:1179949): arch=x86_64 syscall=mmap per=400000 success=no exit=EACCES a0=0 a1=48000 a2=3 a3=1 items=0 ppid=1 pid=28695 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=nginx exe=/usr/sbin/nginx subj=system_u:system_r:httpd_t:s0 key=(null)

Hash: nginx,httpd_t,zero_device_t,chr_file,map

  • tail -f /var/log/audit/audit/log while trying to restart nginx might give you some more information – Raman Sailopal Mar 7 at 13:03
  • @ Raman Sailopal, I dont get any new alerts using tail. I just get the 2 alerts in the OP and lots of SELinux is preventing /usr/sbin/nginx from using the sys_resource capability. alerts but those alerts come from the huge spike in CPU when I restart Nginx and so are a consequence and not the cause. – turrican_34 Mar 7 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.