Re: Trying again: why am I getting denials in a directory that has been labeled..

Gary Tierney wrote:
> On Wed, Jul 11, 2018 at 11:01:50AM -0400, mark wrote:
>> Date: Sat, 30 Jun 2018 11:22:43 +0200
>> From: Lukas Vrabec <[email protected]>
>>> On 06/29/2018 10:15 PM, mark wrote:
>>>
>>>> As Lukas suggested, I tried to relabel the file. It didn't work,
>>>> and the reason is this: we have the web under our own root
>>>> directory, not under /var/www. We had done an semanage fcontext -e
>>>> /var/www <ourpath>.
>>>> When I tried to relcabel, it suggested I try to relabel using the
>>> /var/www path,  which won't work.
>
> No, it's telling you that you need to add the file context specification
> under there, not relabel it.

Ok, now we're to a level of selinux that I don't know.
>>>>
>>>> Is there any way around this?
<snip>

> You can't add a file context specification under /<actual>/<path>/htdocs
> because it is an alias/equivalent to /var/www/html.  Adding a rule
> specifically for /<actual>/<path>/htdocs would result in ambiguity.
>
> Based on the equivalence rules, it follows that
> /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat is
> equivalent to /var/www/html/<website>/cg-bin/Counter/data/image.dat.
>
> So if you wanted to create a file context specification for your aliased
> path, you need to create iit using the path of the alias' target.  E.g.,
>
> $ semanage fcontext -a -t httpd_sys_rw_content_t
> '/var/www/html/[^/]+/cgi-bin/Counter/data/image.dat'
>
> Now `matchpathcon /<actual>/<path>/htdocs/<website>/{..snip..}` should
> return a context with the correct type.
>
>> matchpathcon:
>> /<actual>/<path>/htdocs/<website>/cgi-bin/Counter/data/image.dat
>> system_u:object_r:httpd_sys_script_exec_t:s0
>>
>> Amd pf course there's no <website> under /var/www/html/
>
> No, and there doesn't have to be.  These semanage-fcontext inputs are
> just regexps to match pathnames, not paths to files on the filesystem. To
> the SELinux labeling system, your files _are_ under
> /var/www/html/<website>.
>
THANK YOU!

One of my goals at work is to reduce noise in /var/log/messages, so I can
see what actually matters, and this will shut up one more useless message,
so I can get back to seeing attempts to get in from Brazil, and China,
and....

The help was very much appreciated.

       mark
_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]/message/CZC4PMX6KLB6BGJGAZLQUK73O2XNHTOE/