0

I am new to SELiunx concept and as per the RHEL7 > SELinux User's and Administrator's Guide > 3.2. UNCONFINED PROCESSES

Audit log

type=IPC msg=audit(1624375715.312:4225): ouid=0 ogid=0 mode=0666 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
type=PROCTITLE msg=audit(1624375715.312:4225): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=AVC msg=audit(1624375724.580:4226): avc:  denied  { unix_read unix_write } for  pid=25626 comm="httpd" key=1392707921  scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=shm permissive=0
type=SYSCALL msg=audit(1624375724.580:4226): arch=c000003e syscall=29 success=no exit=-13 a0=53030951 a1=4338 a2=1b6 a3=6b items=0 ppid=25612 pid=25626 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)

I have changed the httpd to run in unconfind_t domain but now I am not able to change back the httpd to httpd_t domain.

I made httpd to unconfined_t domain to make shmget function to work, called by one php process hosted by httpd.

[user@rhel7 ~]$ sudo chcon -t bin_t /usr/sbin/httpd
[user@rhel7 ~]$ ls -Z /usr/sbin/httpd
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /usr/sbin/httpd
[user@rhel7 ~]$ systemctl start httpd.service

.....

[root@rhel7 user]# chcon -r system_r -t httpd_t /usr/sbin/httpd
chcon: failed to change context of ‘/usr/sbin/httpd’ to ‘system_u:system_r:httpd_t:s0’: Permission denied
[root@rhel7 user]#
0

You should just be able to run restorecon -v /usr/sbin/httpd to restore it to the default values.

If you want to manually change it then you need to use httpd_exec_t as the type of the file.

0

I had a similar problem that, logged in as root, on RH 8.5, I couldn't change a file to unconfined_t. I realized that using unconfined_t isn't the right way to "fix" problems. The right way would be to either make the files part of an existing, correct type, as the user above suggested, and then use semanage fcontext to make that change persistent, or to define a new type and security policy. In your case, you didn't need a new policy, because httpd_t fits.

I was trying to change the type of a new service to unconfined_t. Again, ideally I should have created a whole new type and policy, but that was beyond the scope of what I could do. But:

chcon -t unconfined_t my_file

was giving permission denied.

For anyone else looking for a solution, what I did was:

# setenforce 0
# chcon -t unconfined_t my_file
# setenforce 1
# getenforce 
Enforcing

I'm not sure this is the right way to do this but it did let me get things done, and later on I'll write a new policy and figure out a type to use for it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.