Re: Trying again: why am I getting denials in a directory that has been labeled..

Gary Tierney <[email protected]> Wed, 11 Jul 2018 18:06:45 +0100
Newsgroups	gmane.linux.redhat.fedora.selinux
Message-ID	<[email protected]>
On Wed, Jul 11, 2018 at 11:01:50AM -0400, mark wrote:
>Date: Sat, 30 Jun 2018 11:22:43 +0200
>From: Lukas Vrabec <[email protected]>
>>
>> On 06/29/2018 10:15 PM, mark wrote:
>>
>>> As Lukas suggested, I tried to relabel the file. It didn't work, and
>>> the reason is this: we have the web under our own root directory, not
>>> under /var/www. We had done an semanage fcontext -e /var/www <ourpath>.
>>> When I tried to relcabel, it suggested I try to relabel using the
>> /var/www path,  which won't work.

No, it's telling you that you need to add the file context specification 
under there, not relabel it.

>>>
>>> Is there any way around this?
>>> /<ourpath>/htdocs/<website>/cgi-bin/data/<the probelematic file>
>>
>> Could you attach complete outputs from semanage/ls (-Z)/ matchpathcon
>> commands? I would like to reproduce it to help you find issue.
>
>Sorry I couldn't get back to this sooner.
>
>semanage fcontext --modify -t httpd_sys_rw_content_t
>/<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat
>ValueError: File spec
>/<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat conflicts
>with equivalency rule '/<actual>/<path>/htdocs /var/www/html'; Try adding
>'/var/www/html/<website>/cgi-bin/Counter/data/image.dat' instead
>
>ll -Z:
>-rw-rw-r--. apache imagej unconfined_u:object_r:httpd_sys_script_exec_t:s0
>/<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat
>

You can't add a file context specification under /<actual>/<path>/htdocs
because it is an alias/equivalent to /var/www/html.  Adding a rule 
specifically for /<actual>/<path>/htdocs would result in ambiguity.

Based on the equivalence rules, it follows that
/<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat is 
equivalent to /var/www/html/<website>/cg-bin/Counter/data/image.dat.

So if you wanted to create a file context specification for your aliased 
path, you need to create iit using the path of the alias' target.  E.g.,

$ semanage fcontext -a -t httpd_sys_rw_content_t 
'/var/www/html/[^/]+/cgi-bin/Counter/data/image.dat'

Now `matchpathcon /<actual>/<path>/htdocs/<website>/{..snip..}` should 
return a context with the correct type.

>matchpathcon:
>/<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat	system_u:object_r:httpd_sys_script_exec_t:s0
>
>Amd pf course there's no <website> under /var/www/html/
>

No, and there doesn't have to be.  These semanage-fcontext inputs are 
just regexps to match pathnames, not paths to files on the filesystem.
To the SELinux labeling system, your files _are_ under 
/var/www/html/<website>.

>    mark
>_______________________________________________
>selinux mailing list -- [email protected]
>To unsubscribe send an email to [email protected]
>Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
>List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>List Archives: https://lists.fedoraproject.org/archives/list/[email protected]/message/SDCQW46HZMAZNA6COWGOMOVQWTKC7MSF/

_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]/message/XKEQKODIRIY2DHIORUMIR4QSYQLO7A44/
signature.asc (application/pgp-signature, 488 B)