[ale] SElinux, Fedora3, and postgresql

[James P. Kinney III]

On Fri, 2004-11-26 at 18:26, James P. Kinney III wrote:
> On Fri, 2004-11-26 at 14:28, Chris Ricker wrote:
> > On Fri, 26 Nov 2004, James P. Kinney III wrote:
> > 
> > > What a combination. My head hurts.
> > > 
> > > I would _like_ to keep the selinux turned on but I can't get the policy
> > > set right to allow access to the postgresql socket from a cgi script.=20
> > > 
> > > Google turns up no specific data on postgresql (other than Gentoo has a
> > > million setups that don't work with Selinux). The Selinux site on NSA
> > > covers up through FC2. Fedors mailing list has no info on Postgresql.
> > > 
> > > Any security gurus schlogging their way through SELinux and has some
> > > wisdom to share?
> > 
> > What point are you at? Getting avc: denied errors? Are you running strict or 
> > targeted policy?
> yep. Targeted policy.
> 
> Nov 26 13:52:08 camelot kernel: audit(1101495128.034:0): avc:  denied  {
> search } for  pid=3879 exe=/usr/bin/perl
> scontext=root:system_r:httpd_sys_script_t
> tcontext=system_u:object_r:sysctl_kernel_t tclass=dir
> Nov 26 13:52:08 camelot kernel: audit(1101495128.034:0): avc:  denied  {
> search } for  pid=3879 exe=/usr/bin/perl name=sys dev=proc
> ino=4026531865 scontext=root:system_r:httpd_sys_script_t
> tcontext=system_u:object_r:sysctl_t tclass=dir
> Nov 26 13:52:08 camelot kernel: audit(1101495128.150:0): avc:  denied  {
> write } for  pid=3879 exe=/usr/bin/perl name=.s.PGSQL.5432 dev=hda2
> ino=3342343 scontext=root:system_r:httpd_sys_script_t
> tcontext=root:object_r:tmp_t tclass=sock_file

Success! Found the tool audit2allow and added the following to the
policy.conf file:

#line 83
allow httpd_sys_script_t port_type:{ tcp_socket udp_socket } { send_msg
recv_msg };
#line 83
allow httpd_sys_script_t sysctl_kernel_t:dir search;
#line 83
allow httpd_sys_script_t sysctl_t:dir search;
#line 83
allow httpd_sys_script_t tmp_t:sock_file write;
#line 83
allow httpd_sys_script_t httpd_sys_content_t:lnk_file read;
#line 83
allow httpd_sys_script_t sysctl_kernel_t:file read;
#line 83
allow httpd_sys_script_t unconfined_t:unix_stream_socket connectto;


NOTE** This allows sql-ledger to run on FC3. I have NOT done a full
policy analysis to determine if this opens up more than I want to have
open.
> 
> > 
> > later,
> > chris
> > _______________________________________________
> > Ale mailing list
> > Ale at ale.org
> > http://www.ale.org/mailman/listinfo/ale
> > 
> > !DSPAM:41a78416159041402011530!
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO & Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
http://www.localnetsolutions.com

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
<jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part