Re: Fixing denials

John Griffiths via selinux <[email protected]> Wed, 15 Jan 2025 12:13:16 -0500
Newsgroups gmane.linux.redhat.fedora.selinux
Message-ID <[email protected]>
This is a multi-part message in MIME format.
--===============8067819670370754310==
Content-Type: multipart/alternative;
 boundary="------------0BDgusFW708kqgBCSDIDSYAn"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------0BDgusFW708kqgBCSDIDSYAn
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

When I try

    ps -o pid,command,context -C postgres

I only get the header.

    PID COMMAND                     CONTEXT

The postgresql service uses the command "postmaster," a symbolic link to 
"postgres" to start the postgres processes on my system.

I had to use:

    ps -o pid,command,context -C postmaster

and got:

       PID COMMAND                     CONTEXT
    1365 /usr/bin/postmaster -D /var system_u:system_r:postgresql_t:s0
    1464 postgres: logger            system_u:system_r:postgresql_t:s0
    1485 postgres: checkpointer      system_u:system_r:postgresql_t:s0
    1486 postgres: background writer system_u:system_r:postgresql_t:s0
    1487 postgres: walwriter         system_u:system_r:postgresql_t:s0
    1488 postgres: autovacuum launch system_u:system_r:postgresql_t:s0
    1489 postgres: stats collector   system_u:system_r:postgresql_t:s0
    1490 postgres: logical replicati system_u:system_r:postgresql_t:s0

The command could change depending on how you start postgresql. I start 
it as a service and the service uses postmaster.

    systemctl status postgresql.service
    ●postgresql.service - PostgreSQL database server
         Loaded: loaded (/usr/lib/systemd/system/postgresql.service;
    enabled; preset: disabled)
         Active: active (running)since Sun 2025-01-12 16:13:40 EST; 2
    days ago
       Main PID: 1365 (postmaster)
          Tasks: 8 (limit: 202619)
         Memory: 93.3M
            CPU: 2min 4.734s
         CGroup: /system.slice/postgresql.service
                 ├─1365 /usr/bin/postmaster -D /var/lib/pgsql/data
                 ├─1464 "postgres: logger "
                 ├─1485 "postgres: checkpointer "
                 ├─1486 "postgres: background writer "
                 ├─1487 "postgres: walwriter "
                 ├─1488 "postgres: autovacuum launcher "
                 ├─1489 "postgres: stats collector "
                 └─1490 "postgres: logical replication launcher "

John

On 1/15/25 10:43, Sam Morris via selinux wrote:
> On 13/01/2025 14:09, justina colmena ~biz via selinux wrote:
>> Why is PostgreSQL running in unconfined_service_t,
>
> I don't think any replies to your message have addressed this. but...
>
> time->Mon Jan 13 13:36:10 2025
> type=AVC msg=audit(1736775370.067:3485): avc:  denied  { connectto } for
> pid=1425 comm="php-fpm" path="/run/postgresql/.s.PGSQL.5432"
> scontext=system_u:system_r:httpd_t:s0
> tcontext=system_u:system_r:unconfined_service_t:s0 
> tclass=unix_stream_socket
> permissive=1
>
> I think this is telling you that the socket file context is 
> "system_u:system_r:unconfined_service_t:s0". It doesn't necessarily 
> mean that postgresql is running with that context, though 'ps -o 
> pid,command,context -C postgres' should confirm.
>
> On my system:
>
> # semanage fcontext -l | grep /run/postgresql
> /run/postgresql(/.*)?                              all files 
> system_u:object_r:postgresql_var_run_t:s0
>
> ... so figuring out why your socket is labelled incorrectly would be 
> the first thing I'd investigate.
>
> If postgresql was really running as unconfined_service_t then I'd 
> debug the type transition process explained at 
> <https://wiki.gentoo.org/wiki/SELinux/Tutorials/How_does_a_process_get_into_a_certain_context>. 
> Once postgresql is running in the expected context & the socket file 
> has the right label, then I'd resume configuring the system so that 
> processes running as httpd_t can connect to it.
>

--------------0BDgusFW708kqgBCSDIDSYAn
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    When I try<br>
    <blockquote>ps -o pid,command,context -C postgres<br>
    </blockquote>
    I only get the header.<br>
    <blockquote> <span style="font-family:monospace"><span
          style="color:#000000;background-color:#ffffff;">PID COMMAND
                              CONTEXT<br>
        </span></span></blockquote>
    <span style="font-family:monospace"><span
        style="color:#000000;background-color:#ffffff;">The postgresql
        service uses the command "postmaster," a symbolic link to
        "postgres" to start the postgres processes on my system.<br>
        <br>
        I had to use:<br>
      </span></span>
    <blockquote><span style="font-family:monospace"><span
          style="color:#000000;background-color:#ffffff;">ps -o
          pid,command,context -C postmaster<br>
        </span></span></blockquote>
    <span style="font-family:monospace"><span
        style="color:#000000;background-color:#ffffff;">and got:<br>
      </span></span>
    <blockquote><span style="font-family:monospace"><span
          style="color:#000000;background-color:#ffffff;">   PID COMMAND
                              CONTEXT
        </span><br>
        1365 /usr/bin/postmaster -D /var
        system_u:system_r:postgresql_t:s0
        <br>
        1464 postgres: logger
                   system_u:system_r:postgresql_t:s0
        <br>
        1485 postgres: checkpointer
             system_u:system_r:postgresql_t:s0
        <br>
        1486 postgres: background writer
        system_u:system_r:postgresql_t:s0
        <br>
        1487 postgres: walwriter
                system_u:system_r:postgresql_t:s0
        <br>
        1488 postgres: autovacuum launch
        system_u:system_r:postgresql_t:s0
        <br>
        1489 postgres: stats collector
          system_u:system_r:postgresql_t:s0
        <br>
        1490 postgres: logical replicati
        system_u:system_r:postgresql_t:s0<br>
      </span></blockquote>
    The command could change depending on how you start postgresql. I
    start it as a service and the service uses postmaster.<br>
    <blockquote><span style="font-family:monospace"><span
          style="color:#000000;background-color:#ffffff;">systemctl
          status postgresql.service  </span><br>
        <span
style="font-weight:bold;color:#54ff54;background-color:#ffffff;">●</span><span
          style="color:#000000;background-color:#ffffff;">
          postgresql.service - PostgreSQL database server
        </span><br>
            Loaded: loaded (/usr/lib/systemd/system/postgresql.service;
        <span
style="font-weight:bold;color:#54ff54;background-color:#ffffff;">enabled</span><span
          style="color:#000000;background-color:#ffffff;">; preset: </span><span
style="font-weight:bold;color:#d7d75f;background-color:#ffffff;">disabled</span><span
          style="color:#000000;background-color:#ffffff;">)
        </span><br>
            Active: <span
style="font-weight:bold;color:#54ff54;background-color:#ffffff;">active
          (running)</span><span
          style="color:#000000;background-color:#ffffff;"> since Sun
          2025-01-12 16:13:40 EST; 2 days ago
        </span><br>
          Main PID: 1365 (postmaster)
        <br>
             Tasks: 8 (limit: 202619)
        <br>
            Memory: 93.3M
        <br>
               CPU: 2min 4.734s
        <br>
            CGroup: /system.slice/postgresql.service
        <br>
                    ├─<span
          style="color:#8a8a8a;background-color:#ffffff;">1365
          /usr/bin/postmaster -D /var/lib/pgsql/data</span><span
          style="color:#000000;background-color:#ffffff;">
        </span><br>
                    ├─<span
          style="color:#8a8a8a;background-color:#ffffff;">1464
          "postgres: logger "</span><span
          style="color:#000000;background-color:#ffffff;">
        </span><br>
                    ├─<span
          style="color:#8a8a8a;background-color:#ffffff;">1485
          "postgres: checkpointer "</span><span
          style="color:#000000;background-color:#ffffff;">
        </span><br>
                    ├─<span
          style="color:#8a8a8a;background-color:#ffffff;">1486
          "postgres: background writer "</span><span
          style="color:#000000;background-color:#ffffff;">
        </span><br>
                    ├─<span
          style="color:#8a8a8a;background-color:#ffffff;">1487
          "postgres: walwriter "</span><span
          style="color:#000000;background-color:#ffffff;">
        </span><br>
                    ├─<span
          style="color:#8a8a8a;background-color:#ffffff;">1488
          "postgres: autovacuum launcher "</span><span
          style="color:#000000;background-color:#ffffff;">
        </span><br>
                    ├─<span
          style="color:#8a8a8a;background-color:#ffffff;">1489
          "postgres: stats collector "</span><span
          style="color:#000000;background-color:#ffffff;">
        </span><br>
                    └─<span
          style="color:#8a8a8a;background-color:#ffffff;">1490
          "postgres: logical replication launcher "</span><span
          style="color:#000000;background-color:#ffffff;">
        </span><br>
        <br>
      </span></blockquote>
    John<br>
    <br>
    <div class="moz-cite-prefix">On 1/15/25 10:43, Sam Morris via
      selinux wrote:<br>
    </div>
    <blockquote type="cite"
      cite="mid:[email protected]">On
      13/01/2025 14:09, justina colmena ~biz via selinux wrote:
      <br>
      <blockquote type="cite">Why is PostgreSQL running in
        unconfined_service_t,
        <br>
      </blockquote>
      <br>
      I don't think any replies to your message have addressed this.
      but...
      <br>
      <br>
      time-&gt;Mon Jan 13 13:36:10 2025
      <br>
      type=AVC msg=audit(1736775370.067:3485): avc:  denied  { connectto
      } for
      <br>
      pid=1425 comm="php-fpm" path="/run/postgresql/.s.PGSQL.5432"
      <br>
      scontext=system_u:system_r:httpd_t:s0
      <br>
      tcontext=system_u:system_r:unconfined_service_t:s0
      tclass=unix_stream_socket
      <br>
      permissive=1
      <br>
      <br>
      I think this is telling you that the socket file context is
      "system_u:system_r:unconfined_service_t:s0". It doesn't
      necessarily mean that postgresql is running with that context,
      though 'ps -o pid,command,context -C postgres' should confirm.
      <br>
      <br>
      On my system:
      <br>
      <br>
      # semanage fcontext -l | grep /run/postgresql
      <br>
      /run/postgresql(/.*)?                              all files
      system_u:object_r:postgresql_var_run_t:s0
      <br>
      <br>
      ... so figuring out why your socket is labelled incorrectly would
      be the first thing I'd investigate.
      <br>
      <br>
      If postgresql was really running as unconfined_service_t then I'd
      debug the type transition process explained at
<a class="moz-txt-link-rfc2396E" href="https://wiki.gentoo.org/wiki/SELinux/Tutorials/How_does_a_process_get_into_a_certain_context">&lt;https://wiki.gentoo.org/wiki/SELinux/Tutorials/How_does_a_process_get_into_a_certain_context&gt;</a>.
      Once postgresql is running in the expected context &amp; the
      socket file has the right label, then I'd resume configuring the
      system so that processes running as httpd_t can connect to it.
      <br>
      <br>
    </blockquote>
    <br>
  </body>
</html>

--------------0BDgusFW708kqgBCSDIDSYAn--

--===============8067819670370754310==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlbGlu
dXggbWFpbGluZyBsaXN0IC0tIHNlbGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKVG8gdW5z
dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byBzZWxpbnV4LWxlYXZlQGxpc3RzLmZlZG9yYXByb2pl
Y3Qub3JnCkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0
Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRw
czovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBB
cmNoaXZlczogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L3Nl
bGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKRG8gbm90IHJlcGx5IHRvIHNwYW0sIHJlcG9y
dCBpdDogaHR0cHM6Ly9wYWd1cmUuaW8vZmVkb3JhLWluZnJhc3RydWN0dXJlL25ld19pc3N1ZQo=

--===============8067819670370754310==--