On 03/05/2010 02:32 PM, Daniel B. Thurman wrote:
>> On 03/05/2010 01:08 PM, Daniel B. Thurman wrote:
>>
>>> Seems to me, that httpd should not be looking at
>>> /usr/share/snmp/.../.index
>>> files? Notice that the .index file appears and for some reason httpd
>>> thinks
>>> it should be looking at it!?!? I don't know what to make of it.
>>>
>>> Here is what I got from selinuxtool:
>>> ================================================
>>> Summary:
>>>
>>> SELinux is preventing /usr/sbin/httpd "write" access to
>>> /usr/share/snmp/mibs/.index.
>>>
>>> Detailed Description:
>>>
>>> SELinux denied access requested by httpd. /usr/share/snmp/mibs/.index
>>> may be a
>>> mislabeled. /usr/share/snmp/mibs/.index default SELinux type is
>>> snmpd_var_lib_t,
>>> but its current type is usr_t. Changing this file back to the default
>>> type, may
>>> fix your problem.
>>>
>>> File contexts can be assigned to a file in the following ways.
>>>
>>> * Files created in a directory receive the file context of the
>>> parent
>>> directory by default.
>>> * The SELinux policy might override the default label inherited
>>> from the
>>> parent directory by specifying a process running in context A
>>> which
>>> creates
>>> a file in a directory labeled B will instead create the file with
>>> label C.
>>> An example of this would be the dhcp client running with the
>>> dhclient_t type
>>> and creating a file in the directory /etc. This file would
>>> normally
>>> receive
>>> the etc_t type due to parental inheritance but instead the file is
>>> labeled
>>> with the net_conf_t type because the SELinux policy specifies
>>> this.
>>> * Users can change the file context on a file using tools such as
>>> chcon, or
>>> restorecon.
>>>
>>> This file could have been mislabeled either by user error, or if an
>>> normally
>>> confined application was run under the wrong domain.
>>>
>>> However, this might also indicate a bug in SELinux because the file
>>> should not
>>> have been labeled with this type.
>>>
>>> If you believe this is a bug, please file a bug report against this
>>> package.
>>>
>>> Allowing Access:
>>>
>>> You can restore the default system context to this file by executing the
>>> restorecon command. restorecon '/usr/share/snmp/mibs/.index', if this
>>> file is a
>>> directory, you can recursively restore using restorecon -R
>>> '/usr/share/snmp/mibs/.index'.
>>>
>>> Fix Command:
>>>
>>> /sbin/restorecon '/usr/share/snmp/mibs/.index'
>>>
>>> Additional Information:
>>>
>>> Source Context system_u:system_r:httpd_t:s0
>>> Target Context unconfined_u:object_r:usr_t:s0
>>> Target Objects /usr/share/snmp/mibs/.index [ file ]
>>> Source httpd
>>> Source Path /usr/sbin/httpd
>>> Port<Unknown>
>>> Host gold.cdkkt.com
>>> Source RPM Packages httpd-2.2.14-1.fc12
>>> Target RPM Packages
>>> Policy RPM selinux-policy-3.6.32-89.fc12
>>> Selinux Enabled True
>>> Policy Type targeted
>>> Enforcing Mode Enforcing
>>> Plugin Name restorecon
>>> Host Name gold.cdkkt.com
>>> Platform Linux gold.cdkkt.com
>>> 2.6.31.12-174.2.22.fc12.i686
>>> #1 SMP Fri Feb 19 19:26:06 UTC 2010
>>> i686 i686
>>> Alert Count 1
>>> First Seen Tue 02 Mar 2010 02:35:14 PM PST
>>> Last Seen Tue 02 Mar 2010 02:35:14 PM PST
>>> Local ID 985d0293-7cc2-401b-85b0-d8273b14364e
>>> Line Numbers
>>>
>>> Raw Audit Messages
>>>
>>> node=gold.cdkkt.com type=AVC msg=audit(1267569314.169:39991): avc:
>>> denied { write } for pid=2133 comm="httpd" name=".index" dev=sdb8
>>> ino=520318 scontext=system_u:system_r:httpd_t:s0
>>> tcontext=unconfined_u:object_r:usr_t:s0 tclass=file
>>>
>>> node=gold.cdkkt.com type=SYSCALL msg=audit(1267569314.169:39991):
>>> arch=40000003 syscall=5 success=no exit=-13 a0=bfe6fa10 a1=8241 a2=1b6
>>> a3=b7181e7f items=0 ppid=1 pid=2133 auid=4294967295 uid=0 gid=0 euid=0
>>> suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295
>>> comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0
>>> key=(null)
>>>
>>>
>>> --
>>> selinux mailing list
>>> selinux@xxxxxxxxxxxxxxxxxxxxxxx
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>
>>>
>>>
>> That file is owned by snmp
>>
>> I think some snmp library is causing httpd to write there.
>>
>> The problem is that it is mislabeled.
>>
>> matchpathcon /usr/share/snmp/mibs/.index
>> /usr/share/snmp/mibs/.index system_u:object_r:snmpd_var_lib_t:s0
>>
>> If you fix the label, I believe the avc will go away.
>>
> 1) How did the label get set this way in the first place?
> 2) Perhaps I should do:
> # touch /.autorelabel OR
> restorecon -R /
> And that should update the latest policies on all (mislabled) files?
>
> For now, I did:
> # chcon -u system_u -t snmpd_var_lib_t /usr/share/snmp/mibs/.index
>
> --
> selinux mailing list
> selinux@xxxxxxxxxxxxxxxxxxxxxxx
> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>
>
No just the restorecon will be fine. That file probably did not exist
originally and some unconfined app created it with the wrong label.
Once you run restorecon on it, the label should stay. If it becomes
mislabeled again, please contact me.
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
