Date: Sat, 30 Jun 2018 11:22:43 +0200 From: Lukas Vrabec lvrabec@redhat.com
On 06/29/2018 10:15 PM, mark wrote:
As Lukas suggested, I tried to relabel the file. It didn't work, and the reason is this: we have the web under our own root directory, not under /var/www. We had done an semanage fcontext -e /var/www <ourpath>. When I tried to relabel, it suggested I try to relabel using the
/var/www path, which won't work.
Is there any way around this? /<ourpath>/htdocs/<website>/cgi-bin/data/<the probelematic file>
Could you attach complete outputs from semanage/ls (-Z)/ matchpathcon commands? I would like to reproduce it to help you find issue.
Sorry I couldn't get back to this sooner.
semanage fcontext --modify -t httpd_sys_rw_content_t /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat ValueError: File spec /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat conflicts with equivalency rule '/<actual>/<path>/htdocs /var/www/html'; Try adding '/var/www/html/<website>/cgi-bin/Counter/data/image.dat' instead
ll -Z: -rw-rw-r--. apache imagej unconfined_u:object_r:httpd_sys_script_exec_t:s0 /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat
matchpathcon: /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat system_u:object_r:httpd_sys_script_exec_t:s0
Amd pf course there's no <website> under /var/www/html/
mark
On Wed, Jul 11, 2018 at 11:01:50AM -0400, mark wrote:
Date: Sat, 30 Jun 2018 11:22:43 +0200 From: Lukas Vrabec lvrabec@redhat.com
On 06/29/2018 10:15 PM, mark wrote:
As Lukas suggested, I tried to relabel the file. It didn't work, and the reason is this: we have the web under our own root directory, not under /var/www. We had done an semanage fcontext -e /var/www <ourpath>. When I tried to relcabel, it suggested I try to relabel using the
/var/www path, which won't work.
No, it's telling you that you need to add the file context specification under there, not relabel it.
Is there any way around this? /<ourpath>/htdocs/<website>/cgi-bin/data/<the probelematic file>
Could you attach complete outputs from semanage/ls (-Z)/ matchpathcon commands? I would like to reproduce it to help you find issue.
Sorry I couldn't get back to this sooner.
semanage fcontext --modify -t httpd_sys_rw_content_t /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat ValueError: File spec /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat conflicts with equivalency rule '/<actual>/<path>/htdocs /var/www/html'; Try adding '/var/www/html/<website>/cgi-bin/Counter/data/image.dat' instead
ll -Z: -rw-rw-r--. apache imagej unconfined_u:object_r:httpd_sys_script_exec_t:s0 /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat
You can't add a file context specification under /<actual>/<path>/htdocs because it is an alias/equivalent to /var/www/html. Adding a rule specifically for /<actual>/<path>/htdocs would result in ambiguity.
Based on the equivalence rules, it follows that /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat is equivalent to /var/www/html/<website>/cg-bin/Counter/data/image.dat.
So if you wanted to create a file context specification for your aliased path, you need to create iit using the path of the alias' target. E.g.,
$ semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/[^/]+/cgi-bin/Counter/data/image.dat'
Now `matchpathcon /<actual>/<path>/htdocs/<website>/{..snip..}` should return a context with the correct type.
matchpathcon: /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat system_u:object_r:httpd_sys_script_exec_t:s0
Amd pf course there's no <website> under /var/www/html/
No, and there doesn't have to be. These semanage-fcontext inputs are just regexps to match pathnames, not paths to files on the filesystem. To the SELinux labeling system, your files _are_ under /var/www/html/<website>.
mark _______________________________________________ selinux mailing list -- selinux@lists.fedoraproject.org To unsubscribe send an email to selinux-leave@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.or...
Gary Tierney wrote:
On Wed, Jul 11, 2018 at 11:01:50AM -0400, mark wrote:
Date: Sat, 30 Jun 2018 11:22:43 +0200 From: Lukas Vrabec lvrabec@redhat.com
On 06/29/2018 10:15 PM, mark wrote:
As Lukas suggested, I tried to relabel the file. It didn't work, and the reason is this: we have the web under our own root directory, not under /var/www. We had done an semanage fcontext -e /var/www <ourpath>. When I tried to relcabel, it suggested I try to relabel using the
/var/www path, which won't work.
No, it's telling you that you need to add the file context specification under there, not relabel it.
Ok, now we're to a level of selinux that I don't know.
Is there any way around this?
<snip>
You can't add a file context specification under /<actual>/<path>/htdocs because it is an alias/equivalent to /var/www/html. Adding a rule specifically for /<actual>/<path>/htdocs would result in ambiguity.
Based on the equivalence rules, it follows that /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat is equivalent to /var/www/html/<website>/cg-bin/Counter/data/image.dat.
So if you wanted to create a file context specification for your aliased path, you need to create iit using the path of the alias' target. E.g.,
$ semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/html/[^/]+/cgi-bin/Counter/data/image.dat'
Now `matchpathcon /<actual>/<path>/htdocs/<website>/{..snip..}` should return a context with the correct type.
matchpathcon: /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat system_u:object_r:httpd_sys_script_exec_t:s0
Amd pf course there's no <website> under /var/www/html/
No, and there doesn't have to be. These semanage-fcontext inputs are just regexps to match pathnames, not paths to files on the filesystem. To the SELinux labeling system, your files _are_ under /var/www/html/<website>.
THANK YOU!
One of my goals at work is to reduce noise in /var/log/messages, so I can see what actually matters, and this will shut up one more useless message, so I can get back to seeing attempts to get in from Brazil, and China, and....
The help was very much appreciated.
mark
selinux@lists.fedoraproject.org
-
Gary Tierney -
mark