https://rt-wiki.bestpractical.com/index.php?action=history&feed=atom&title=SELinux 2026-08-22T05:32:25Z Revision history for this page on the wiki MediaWiki 1.41.1 https://rt-wiki.bestpractical.com/index.php?title=SELinux&diff=3315&oldid=prev 2016-04-06T20:36:22Z

<p>3 revisions imported</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 16:36, 6 April 2016</td> </tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div> </td></tr> <!-- diff cache key bestpractical_mediawiki1459887241:diff:1.41:old-3314:rev-3315 --> </table>

Admin https://rt-wiki.bestpractical.com/index.php?title=SELinux&diff=3314&oldid=prev 2012-07-05T05:57:50Z

<p>added command for RT4 on Scientific Linux 6.2</p> <p><b>New page</b></p><div>== What Is This? ==<br /> <br /> Security-enhanced Linux (SELinux) is an implementation of a mandatory access control mechanism.This<br /> mechanism is in the Linux kernel, checking for allowed operations after standard Linux discretionary<br /> access controls are checked.<br /> <br /> <br /> For more information check the [http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/ SELinux Guide] provided by [[RedHat]].<br /> <br /> == Simple ==<br /> <br /> This cargo-culted command from a Rails tutorial worked for me under RHEL 4:<br /> <br /> chcon -Rv user_u:object_r:httpd_user_content_t /opt/rt3/var/<br /> <br /> The above was all that was required to get RT 3.8 running under [[SELinux]] for me, until the machine became its own (primary, and no longer relaying) mail server. At that point RT began trying to exec sendmail, which in my config was a link since I was running postfix. Notifications went undelivered and messages showed:<br /> <br /> Nov 8 18:48:47 rt kernel: audit(1226188127.916:114): avc: denied { read } for pid=10271 comm=&quot;httpd.worker&quot; name=&quot;sendmail&quot; dev=dm-0 ino=4464227 scontext=user_u:system_r:httpd_t tcontext=user_u:object_r:sbin_t tclass=lnk_file<br /> <br /> My solution was to hardlink /usr/sbin/sendmail.postfix to /usr/sbin/sendmail<br /> <br /> Under Scientific Linux release 6.2 (Carbon) running rt4, the chcon command needed another SELinux context:<br /> chcon -Rv user_u:object_r:httpd_user_content_t:s0 /opt/rt4/var/<br /> <br /> == Thorough ==<br /> <br /> start of information regarding creating a selinux policy for FC4 and RT<br /> <br /> cd /etc/selinux/targeted/src/policy<br /> vi domains/misc/local.te<br /> <br /> <br /> add...<br /> <br /> allow httpd_t httpd_log_t:dir create;<br /> allow httpd_t httpd_tmp_t:sock_file { create setattr unlink write };<br /> allow httpd_t httpd_log_t:sock_file { create setattr unlink write };<br /> <br /> <br /> then<br /> <br /> make load<br /> <br /> <br /> use audit2allow to convert the stuff from dmesg or /var/log/messages to that format.<br /> <br /> also need to figure out how to set the context of files, because the stuff in $RT/var needs to be writable by the httpd_t process.<br /> <br /> Here are my changes for running RT 3.4.5 under FC4 and SE Linux. I have rt installed in /srv/rt3 and mysql in /srv/mysql:<br /> <br /> local.te:<br /> <br /> allow httpd_t httpd_sys_script_t:process { noatsecure rlimitinh siginh };<br /> allow httpd_t nscd_var_run_t:dir search;<br /> <br /> allow httpd_sys_script_t devlog_t:sock_file write;<br /> allow httpd_sys_script_t httpd_log_t:file ioctl;<br /> allow httpd_sys_script_t httpd_sys_script_exec_t:dir read;<br /> allow httpd_sys_script_t httpd_t:unix_stream_socket { accept getattr ioctl shutdown read write };<br /> allow httpd_sys_script_t mail_spool_t:dir search;<br /> allow httpd_sys_script_t mqueue_spool_t:file read;<br /> allow httpd_sys_script_t mysqld_db_t:lnk_file read;<br /> allow httpd_sys_script_t nscd_var_run_t:dir search;<br /> allow httpd_sys_script_t self:unix_dgram_socket { create connect ioctl write };<br /> allow httpd_sys_script_t syslogd_t:unix_dgram_socket sendto;<br /> allow httpd_sys_script_t system_mail_t:process { noatsecure rlimitinh siginh };<br /> allow httpd_sys_script_t var_log_t:file { append ioctl };<br /> <br /> allow system_mail_t httpd_log_t:file { append getattr };<br /> allow system_mail_t httpd_sys_script_t:unix_stream_socket { read write };<br /> allow system_mail_t httpd_t:unix_stream_socket { read write };<br /> allow system_mail_t nscd_var_run_t:dir search;<br /> <br /> <br /> <br /> <br /> local.fc:<br /> <br /> /srv system_u:object_r:root_t<br /> /srv/mysql(/.*)? system_u:object_r:mysqld_db_t<br /> /srv/mysql/mysql\.sock -s system_u:object_r:mysqld_var_run_t<br /> <br /> /srv/rt3 system_u:object_r:httpd_sys_content_t<br /> /srv/rt3/bin(/.*)? system_u:object_r:httpd_sys_script_exec_t<br /> /srv/rt3/etc(/.*)? system_u:object_r:httpd_sys_content_t<br /> /srv/rt3/lib(/.*)? system_u:object_r:httpd_sys_content_t<br /> /srv/rt3/local(/.*)? system_u:object_r:httpd_sys_content_t<br /> /srv/rt3/sbin root:object_r:default_t<br /> /srv/rt3/share(/.*)? system_u:object_r:httpd_sys_content_t<br /> /srv/rt3/var system_u:object_r:httpd_sys_content_t<br /> /srv/rt3/var/mason_data(/.*)? system_u:object_r:httpd_sys_content_t<br /> <br /> == See also ==<br /> <br /> The [[PostQuestionsHere]] page for some [[SELinux]] answers.</div>

161.50.48.2