Re: Fixing denials
John Griffiths via selinux <[email protected]> Wed, 15 Jan 2025 12:13:16 -0500
| Newsgroups | gmane.linux.redhat.fedora.selinux |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============8067819670370754310==
Content-Type: multipart/alternative;
boundary="------------0BDgusFW708kqgBCSDIDSYAn"
Content-Language: en-US
This is a multi-part message in MIME format.
--------------0BDgusFW708kqgBCSDIDSYAn
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
When I try
ps -o pid,command,context -C postgres
I only get the header.
PID COMMAND CONTEXT
The postgresql service uses the command "postmaster," a symbolic link to
"postgres" to start the postgres processes on my system.
I had to use:
ps -o pid,command,context -C postmaster
and got:
PID COMMAND CONTEXT
1365 /usr/bin/postmaster -D /var system_u:system_r:postgresql_t:s0
1464 postgres: logger system_u:system_r:postgresql_t:s0
1485 postgres: checkpointer system_u:system_r:postgresql_t:s0
1486 postgres: background writer system_u:system_r:postgresql_t:s0
1487 postgres: walwriter system_u:system_r:postgresql_t:s0
1488 postgres: autovacuum launch system_u:system_r:postgresql_t:s0
1489 postgres: stats collector system_u:system_r:postgresql_t:s0
1490 postgres: logical replicati system_u:system_r:postgresql_t:s0
The command could change depending on how you start postgresql. I start
it as a service and the service uses postmaster.
systemctl status postgresql.service
●postgresql.service - PostgreSQL database server
Loaded: loaded (/usr/lib/systemd/system/postgresql.service;
enabled; preset: disabled)
Active: active (running)since Sun 2025-01-12 16:13:40 EST; 2
days ago
Main PID: 1365 (postmaster)
Tasks: 8 (limit: 202619)
Memory: 93.3M
CPU: 2min 4.734s
CGroup: /system.slice/postgresql.service
├─1365 /usr/bin/postmaster -D /var/lib/pgsql/data
├─1464 "postgres: logger "
├─1485 "postgres: checkpointer "
├─1486 "postgres: background writer "
├─1487 "postgres: walwriter "
├─1488 "postgres: autovacuum launcher "
├─1489 "postgres: stats collector "
└─1490 "postgres: logical replication launcher "
John
On 1/15/25 10:43, Sam Morris via selinux wrote:
> On 13/01/2025 14:09, justina colmena ~biz via selinux wrote:
>> Why is PostgreSQL running in unconfined_service_t,
>
> I don't think any replies to your message have addressed this. but...
>
> time->Mon Jan 13 13:36:10 2025
> type=AVC msg=audit(1736775370.067:3485): avc: denied { connectto } for
> pid=1425 comm="php-fpm" path="/run/postgresql/.s.PGSQL.5432"
> scontext=system_u:system_r:httpd_t:s0
> tcontext=system_u:system_r:unconfined_service_t:s0
> tclass=unix_stream_socket
> permissive=1
>
> I think this is telling you that the socket file context is
> "system_u:system_r:unconfined_service_t:s0". It doesn't necessarily
> mean that postgresql is running with that context, though 'ps -o
> pid,command,context -C postgres' should confirm.
>
> On my system:
>
> # semanage fcontext -l | grep /run/postgresql
> /run/postgresql(/.*)? all files
> system_u:object_r:postgresql_var_run_t:s0
>
> ... so figuring out why your socket is labelled incorrectly would be
> the first thing I'd investigate.
>
> If postgresql was really running as unconfined_service_t then I'd
> debug the type transition process explained at
> <https://wiki.gentoo.org/wiki/SELinux/Tutorials/How_does_a_process_get_into_a_certain_context>.
> Once postgresql is running in the expected context & the socket file
> has the right label, then I'd resume configuring the system so that
> processes running as httpd_t can connect to it.
>
--------------0BDgusFW708kqgBCSDIDSYAn
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
When I try<br>
<blockquote>ps -o pid,command,context -C postgres<br>
</blockquote>
I only get the header.<br>
<blockquote> <span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">PID COMMAND
CONTEXT<br>
</span></span></blockquote>
<span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">The postgresql
service uses the command "postmaster," a symbolic link to
"postgres" to start the postgres processes on my system.<br>
<br>
I had to use:<br>
</span></span>
<blockquote><span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">ps -o
pid,command,context -C postmaster<br>
</span></span></blockquote>
<span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">and got:<br>
</span></span>
<blockquote><span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;"> PID COMMAND
CONTEXT
</span><br>
1365 /usr/bin/postmaster -D /var
system_u:system_r:postgresql_t:s0
<br>
1464 postgres: logger
system_u:system_r:postgresql_t:s0
<br>
1485 postgres: checkpointer
system_u:system_r:postgresql_t:s0
<br>
1486 postgres: background writer
system_u:system_r:postgresql_t:s0
<br>
1487 postgres: walwriter
system_u:system_r:postgresql_t:s0
<br>
1488 postgres: autovacuum launch
system_u:system_r:postgresql_t:s0
<br>
1489 postgres: stats collector
system_u:system_r:postgresql_t:s0
<br>
1490 postgres: logical replicati
system_u:system_r:postgresql_t:s0<br>
</span></blockquote>
The command could change depending on how you start postgresql. I
start it as a service and the service uses postmaster.<br>
<blockquote><span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">systemctl
status postgresql.service </span><br>
<span
style="font-weight:bold;color:#54ff54;background-color:#ffffff;">●</span><span
style="color:#000000;background-color:#ffffff;">
postgresql.service - PostgreSQL database server
</span><br>
Loaded: loaded (/usr/lib/systemd/system/postgresql.service;
<span
style="font-weight:bold;color:#54ff54;background-color:#ffffff;">enabled</span><span
style="color:#000000;background-color:#ffffff;">; preset: </span><span
style="font-weight:bold;color:#d7d75f;background-color:#ffffff;">disabled</span><span
style="color:#000000;background-color:#ffffff;">)
</span><br>
Active: <span
style="font-weight:bold;color:#54ff54;background-color:#ffffff;">active
(running)</span><span
style="color:#000000;background-color:#ffffff;"> since Sun
2025-01-12 16:13:40 EST; 2 days ago
</span><br>
Main PID: 1365 (postmaster)
<br>
Tasks: 8 (limit: 202619)
<br>
Memory: 93.3M
<br>
CPU: 2min 4.734s
<br>
CGroup: /system.slice/postgresql.service
<br>
├─<span
style="color:#8a8a8a;background-color:#ffffff;">1365
/usr/bin/postmaster -D /var/lib/pgsql/data</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
├─<span
style="color:#8a8a8a;background-color:#ffffff;">1464
"postgres: logger "</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
├─<span
style="color:#8a8a8a;background-color:#ffffff;">1485
"postgres: checkpointer "</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
├─<span
style="color:#8a8a8a;background-color:#ffffff;">1486
"postgres: background writer "</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
├─<span
style="color:#8a8a8a;background-color:#ffffff;">1487
"postgres: walwriter "</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
├─<span
style="color:#8a8a8a;background-color:#ffffff;">1488
"postgres: autovacuum launcher "</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
├─<span
style="color:#8a8a8a;background-color:#ffffff;">1489
"postgres: stats collector "</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
└─<span
style="color:#8a8a8a;background-color:#ffffff;">1490
"postgres: logical replication launcher "</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<br>
</span></blockquote>
John<br>
<br>
<div class="moz-cite-prefix">On 1/15/25 10:43, Sam Morris via
selinux wrote:<br>
</div>
<blockquote type="cite"
cite="mid:[email protected]">On
13/01/2025 14:09, justina colmena ~biz via selinux wrote:
<br>
<blockquote type="cite">Why is PostgreSQL running in
unconfined_service_t,
<br>
</blockquote>
<br>
I don't think any replies to your message have addressed this.
but...
<br>
<br>
time->Mon Jan 13 13:36:10 2025
<br>
type=AVC msg=audit(1736775370.067:3485): avc: denied { connectto
} for
<br>
pid=1425 comm="php-fpm" path="/run/postgresql/.s.PGSQL.5432"
<br>
scontext=system_u:system_r:httpd_t:s0
<br>
tcontext=system_u:system_r:unconfined_service_t:s0
tclass=unix_stream_socket
<br>
permissive=1
<br>
<br>
I think this is telling you that the socket file context is
"system_u:system_r:unconfined_service_t:s0". It doesn't
necessarily mean that postgresql is running with that context,
though 'ps -o pid,command,context -C postgres' should confirm.
<br>
<br>
On my system:
<br>
<br>
# semanage fcontext -l | grep /run/postgresql
<br>
/run/postgresql(/.*)? all files
system_u:object_r:postgresql_var_run_t:s0
<br>
<br>
... so figuring out why your socket is labelled incorrectly would
be the first thing I'd investigate.
<br>
<br>
If postgresql was really running as unconfined_service_t then I'd
debug the type transition process explained at
<a class="moz-txt-link-rfc2396E" href="https://wiki.gentoo.org/wiki/SELinux/Tutorials/How_does_a_process_get_into_a_certain_context"><https://wiki.gentoo.org/wiki/SELinux/Tutorials/How_does_a_process_get_into_a_certain_context></a>.
Once postgresql is running in the expected context & the
socket file has the right label, then I'd resume configuring the
system so that processes running as httpd_t can connect to it.
<br>
<br>
</blockquote>
<br>
</body>
</html>
--------------0BDgusFW708kqgBCSDIDSYAn--
--===============8067819670370754310==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlbGlu
dXggbWFpbGluZyBsaXN0IC0tIHNlbGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKVG8gdW5z
dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byBzZWxpbnV4LWxlYXZlQGxpc3RzLmZlZG9yYXByb2pl
Y3Qub3JnCkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0
Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRw
czovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBB
cmNoaXZlczogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L3Nl
bGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKRG8gbm90IHJlcGx5IHRvIHNwYW0sIHJlcG9y
dCBpdDogaHR0cHM6Ly9wYWd1cmUuaW8vZmVkb3JhLWluZnJhc3RydWN0dXJlL25ld19pc3N1ZQo=
--===============8067819670370754310==--