Skip to main content

SElinux is your Friend?

SElinux is much more involved than I originally had assumed. However, it should not be feared.
# sealert -a /var/log/audit/audit.log

[root@desktop9 audit]# ls -lZd /var/www/html/
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/

user : role : type : sens : cat

# audit2allow
Command to convert audit log to policy updates to allow the tasks that were previously denied.

append { selinux | enforcing } = 0 on the kernel line in grub

IF... you happen to disable and re-enable SElinux, it will require a "relabel -RF" of the entire filesystem.

I'm actually becoming enamored with SElinux... seriously cool stuff.

To update your context, you should use
# semanage fcontext -a
and not just chcon. If you happen to do a restorecon using chcon, it will revert the content back to it's original intended context.

# man -k selinux
# man -k _selinux
-- Check out this location
# /etc/selinux/targeted/contexts/files

# gesebool -a
# semanage boolean -l

-- Prep work - copy a directory to /var/www/html and attempt to access it.
# tail /var/log/messages (look for the UUID to review)
# sealert -l a19fa6d0-90d6-4c8c-8d2f-d964d77a5965
# /sbin/restorecon '/var/www/html/web_content/index.html' (fixes the one file)
# semanage fcontext -a -f "" -t httpd_sys_content_t '/var/www/html/web_content/*' (adds context)
# restorecon -RFvv /var/www/html/web_content/ (fixes the entire directory)


< THIS PAGE NEEDS UPDATES >

Comments

Post a Comment

Popular posts from this blog

P2V using dd for KVM-QEMU guest

Preface: I have certainly not exhaustively tested this process.  I had a specific need and found a specific solution that worked. Situation:  I was issued a shiny new laptop running Red Hat Enterprise Linux 7 (with Corp VPN, certs, Authentication configuration, etc...)  The image was great, but I needed more flexibility on my bare metal.  So, my goal was to P2V the corporate image so I could just run it as a VM. * Remove corporate drive and install new SSD * install corp drive in external USB-3 case * Install RHEL 7 on new SSD * dd old drive to a disk-image file in a temp location which will be an image which is the same size as your actual drive (unless you have enough space in your destination to contain a temp and converted image) * convert the raw disk-image to a qcow file while pushing it to the final location - this step should reduce the disk size - however, I believe it will only reduce/collapse zero-byte blocks (not just free space - i.e. if you de...
1 comment
Read more

Sun USS 7100 foo

TIP: put ALL of your LUNs into a designated TARGET and INITIATOR group when you create them.  If you leave them in the "default" group, then everything that does an discovery against the array will find them :-( I'm struggling to recognize a reason that a default should even be present on the array. Also - who, exactly, is Sun trying to kid.  The USS is simply a box.. running Solaris .. with IPMP and ZFS.  Great.  If you have ever attempted to "break-in" or "p0wn" your IBM HMC, you know that there are people out there that can harden a box - then.. there's Sun.  After a recent meltdown at the office I had to get quite intimate with my USS 7110 and learned quite a bit.  Namely: there's a shell ;-) My current irritation is how they attempt to "warn you" away from using the shell (my coverage expired a long time ago to worry about that) and then how they try to hide things, poorly. I was curious as to what version of SunOS it ...
1 comment
Read more

"Error getting authority: Error initializing authority: Could not connect: No such file or directory (g-io-error-quark, 1)"

"Error getting authority: Error initializing authority: Could not connect: No such file or directory (g-io-error-quark, 1)" One issue that may cause this to arise is if you managed to break your /etc/fstab We had an engineer add a line with the intended options of "nfsvers=3" but instead added "-onfsvers=3" and it broke the system fairly catastrophically.
Post a Comment
Read more