After relabeling the apache2 binary it starts in the proper context, but if
i set the policy to enforcing run_init is giving me a Permission denied
error:
hardened ~ # sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 23
Policy from config file: targeted
hardened ~ # run_init /etc/init.d/apache2 start
Authenticating root.
Password:
execvp: Permission denied
hardened ~ # ls -Z /usr/sbin/run_init
system_u:object_r:run_init_exec_t /usr/sbin/run_init
I found the transition was getting denied in the audit log:
type=AVC msg=audit(1237544556.377:61): avc: denied { transition } for
pid=5172 comm="run_init" path="/usr/sbin/open_init_pty" dev=sda7
ino=14812333 scontext=unconfined_u:unconfined_r:unconfined_t
tcontext=user_u:system_r:initrc_t tclass=process
After running that thru audit2allow and loading the module its still getting
denied. The policy is pretty straight forward:
module runinit 1.0;
require {
class process transition;
type initrc_t;
type unconfined_t;
role unconfined_r;
};
allow unconfined_t initrc_t:process transition;
Again I'm sure its something stupid but I'm not sure whats going on.
Jeff Rooney
[email protected]
On Fri, Mar 20, 2009 at 8:05 AM, Chris PeBenito <[email protected]> wrote:
> On Thu, 2009-03-19 at 17:02 -0500, Jeff Rooney wrote:
> > I just installed a fresh copy of the gentoo and figured I'd give selinux
> a shot and think that I have hammered out most of my issues, but have a
> quick question. I have selinux running in targeted/enforcing mode but for
> some reason apache is staying in the wrong context:
> >
> > # ps fauxZ | grep apache2
> > unconfined_u:unconfined_r:unconfined_t root 7167 0.0 0.0 3836 572
> pts/0 S+ 16:59 0:00 \_ grep --colour=auto apache2
> > user_u:system_r:initrc_t root 7153 0.0 0.0 152376 5912 ?
> Ss 16:55 0:00 /usr/sbin/apache2 -D DEFAULT_VHOST -D INFO -D
> LANGUAGE -D PHP5 -d /usr/lib64/apache2 -f /etc/apache2/httpd.conf -k start
>
> Is /usr/sbin/apache2 httpd_exec_t? If not then `rlpkg apache` and try
> again.
>
> --
> Chris PeBenito
> <[email protected]>
> Developer,
> Hardened Gentoo Linux
>
> Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
> Key fingerprint = B0E6 877A 883F A57A 8E6A CB00 BC8E E42D E6AF 9243
>
