On 09/23/2017 08:37 AM, hw wrote:
Hi,
how do I allow lighttpd access to a directory like this:
dr-xrwxr-x. lighttpd example unconfined_u:object_r:samba_share_t:s0
files_articles
I tried to create and install a selinux module, and it didn´t work.
The non-working module can not be removed, either:
semodule -r lighttpd-files_articles.pp
libsemanage.semanage_direct_remove_key: Unable to remove module
lighttpd-files_articles.pp at priority 400. (No such file or directory).
semodule: Failed!
Currently, only read access is required. Write access may be
required later.
type=AVC msg=audit(1506168999.456:2350): avc: denied { getattr }
for pid=28956 comm="lighttpd"
path="/srv/data/files_articles/C3E3FC7C-6ABE-11E6-9BF7-9CD580EF3FB5"
dev="sde" ino=22694488368 scontext=system_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file
type=SYSCALL msg=audit(1506168999.456:2350): arch=c000003e syscall=4
success=yes exit=0 a0=55eea817ec80 a1=7ffe668ef300 a2=7ffe668ef300
a3=7ffe668ef270 items=0 ppid=1 pid=28956 auid=4294967295 uid=996
gid=994 euid=996 suid=996 fsuid=996 egid=994 sgid=994 fsgid=994
tty=(none) ses=4294967295 comm="lighttpd" exe="/usr/sbin/lighttpd"
subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1506168999.456:2351): avc: denied { open } for
pid=28956 comm="lighttpd"
path="/srv/data/files_articles/C3E3FC7C-6ABE-11E6-9BF7-9CD580EF3FB5"
dev="sde" ino=22694488368 scontext=system_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file
type=SYSCALL msg=audit(1506168999.456:2351): arch=c000003e syscall=2
success=yes exit=9 a0=55eea817ec80 a1=0 a2=3e a3=7ffe668ef270 items=0
ppid=1 pid=28956 auid=4294967295 uid=996 gid=994 euid=996 suid=996
fsuid=996 egid=994 sgid=994 fsgid=994 tty=(none) ses=4294967295
comm="lighttpd" exe="/usr/sbin/lighttpd"
subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1506168723.591:2342): avc: denied { read } for
pid=28956 comm="lighttpd" name="C3E3FC7C-6ABE-11E6-9BF7-9CD580EF3FB5"
dev="sde" ino=22694488368 scontext=system_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file
type=SYSCALL msg=audit(1506168723.591:2342): arch=c000003e syscall=2
success=no exit=-13 a0=55eea817ec80 a1=0 a2=3e a3=7ffe668ef2a0 items=0
ppid=1 pid=28956 auid=4294967295 uid=996 gid=994 euid=996 suid=996
fsuid=996 egid=994 sgid=994 fsgid=994 tty=(none) ses=4294967295
comm="lighttpd" exe="/usr/sbin/lighttpd"
subj=system_u:system_r:httpd_t:s0 key=(null)
Why isn´t there a simple way to allow access to files as needed?
Being like this, selinux is entirely unmanagable. Does it even do
any more good than it keeps getting in the way?
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos
SELinux is a labelling system, every process has a label, every object
on the system has a label. There are rules in the kernel that allow
access between process labels and system object labels, the kernel
enforces the rules.
Some how this content on your system. /srv/data/files_articles, got
labeled as samba content (samba_share_t). Now you want to share it via
lighthttp (httpd_t). If this content is only to be shared via
lighthttpd, you would need to set the label to something that httpd_t
can read.
man http_selinux (selinux-policy-docs rpm)
Will show you the labels.
httpd_sys_content_t is the usually type for httpd read only content.
httpd_sys_content_rw_t is the type for read/write content. There are
commands in the man page that explain how to change the default labels.
If you need to share this content via httpd and samba there are a couple
of label types public_content_t, which allow you to share content with
multiple services. Also explained in the man page.
audit2allow is usually a secondary thing to use when there is no way to
allow access.
http://danwalsh.livejournal.com/30837.html
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos
