Why can't I modify a file whose group I belong to?

NotionCommotion · 01-05-2015, 11:03 AM

I have a file with group write status which belongs to group "phped". I expected to be able to delete it with a user that belongs to the same group, but cannot do so. I later tried to edit it using vi, however, similarly was not able to do so.

Please explain what is happening.

Thank you

Code:

[Michael@devserver child_dir]$ pwd
/var/www/main/user_resources/documents/parent_dir/child_dir
[Michael@devserver child_dir]$ ls -l
total 4
-rwxrwxr-x. 1 phped phped 15 Jan  5 07:02 somefile.php
[Michael@devserver child_dir]$ rm somefile.php
rm: remove write-protected regular file `somefile.php'? y
rm: cannot remove `somefile.php': Permission denied
[Michael@devserver child_dir]$ groups Michael
Michael : Michael www phped
[Michael@devserver child_dir]$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          permissive
Policy version:                 24
Policy from config file:        targeted
[Michael@devserver child_dir]$ cd ..
[Michael@devserver parent_dir]$ ls -l
total 4
drwxrwxr-x. 2 phped phped 4096 Jan  5 08:54 child_dir
[Michael@devserver parent_dir]$

/dev/random · 01-05-2015, 11:24 AM

-rwxrwxr-x. the "." should be a good indaction... Its a SELinux ACL

To remove it run the following in the directory

Code:

find . -print0 |xargs -0 -n 1 sudo setfattr -h -x security.selinux

NotionCommotion · 01-05-2015, 11:45 AM

Quote:

Originally Posted by /dev/random

-rwxrwxr-x. the "." should be a good indaction... Its a SELinux ACL

To remove it run the following is the directory

Code:

find . -print0 |xargs -0 -n 1 sudo setfattr -h -x security.selinux

Ah, so it is a selinux thing. Note my original post I showed how selinux is in permissive mode. Wouldn't this allow it to go through?

I tried your code, and no success.

Code:

[Michael@devserver child_dir]$ find . -print0 |xargs -0 -n 1 sudo setfattr -h -x security.selinux
[sudo] password for Michael:
Michael is not in the sudoers file.  This incident will be reported.
[sudo] password for Michael:

[Michael@devserver child_dir]$ su -
Password:
[root@devserver ~]# cd /var/www/main/user_resources/documents/parent_dir/child_dir
[root@devserver child_dir]# find . -print0 |xargs -0 -n 1 sudo setfattr -h -x security.selinux
setfattr: .: Permission denied
setfattr: ./somefile.php: Permission denied
[root@devserver child_dir]# ls -l
total 4
-rwxrwxr-x. 1 phped phped 15 Jan  5 07:02 somefile.php
[root@devserver child_dir]#

I am not as interested in removing it than I am in understanding what is happening. I looked at files and directories in other areas, and they all have that trailing dot. Meaning they all have selinux ACL?

I just looked at http://wiki.centos.org/HowTos/SELinux, and it appears to confirm that permissive mode should not enforce security policy. Still think it is a selinux issue?

Quote:

Permissive: In Permissive mode, SELinux is enabled but will not enforce the security policy, only warn and log actions. Permissive mode is useful for troubleshooting SELinux issues

Thanks!

/dev/random · 01-05-2015, 11:52 AM

Quote:

Originally Posted by NotionCommotion

Ah, so it is a selinux thing. Note my original post I showed how selinux is in permissive mode. Wouldn't this allow it to go through?

I tried your code, and no success.

Code:

[Michael@devserver child_dir]$ find . -print0 |xargs -0 -n 1 sudo setfattr -h -x security.selinux
[sudo] password for Michael:
Michael is not in the sudoers file.  This incident will be reported.
[sudo] password for Michael:

[Michael@devserver child_dir]$ su -
Password:
[root@devserver ~]# cd /var/www/main/user_resources/documents/parent_dir/child_dir
[root@devserver child_dir]# find . -print0 |xargs -0 -n 1 sudo setfattr -h -x security.selinux
setfattr: .: Permission denied
setfattr: ./somefile.php: Permission denied
[root@devserver child_dir]# ls -l
total 4
-rwxrwxr-x. 1 phped phped 15 Jan  5 07:02 somefile.php
[root@devserver child_dir]#

I am not as interested in removing it than I am in understanding what is happening. I looked at files and directories in other areas, and they all have that trailing dot. Meaning they all have selinux ACL?

I just looked at http://wiki.centos.org/HowTos/SELinux, and it appears to confirm that permissive mode should not enforce security policy. Still think it is a selinux issue?

Thanks!

Yes the trailing dot means SELINUX based ACL (where a + indcates a standard ACL)
Policy and SELINUX ACLS are different, you can't turn off SELINUX ACLS you can remove them from the permissions bits but their not no blaket remove all function.

What dictro are you running?

NotionCommotion · 01-05-2015, 12:00 PM

Quote:

Originally Posted by /dev/random

What dictro are you running?

Centos 6. I still don't understand why selinux would be enforcing if in permissive mode.

Code:

[root@devserver /]# cat /proc/version
Linux version 2.6.32-504.1.3.el6.x86_64 (mockbuild@c6b9.bsys.dev.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-11) (GCC) ) #1 SMP Tue Nov 11 17:57:25 UTC 2014
[root@devserver /]# cat /etc/centos-release
CentOS release 6.6 (Final)
[root@devserver /]#

/dev/random · 01-05-2015, 01:02 PM

Try this disable SELINUX entirely, now do a reboot and see if the permissions are fixed. (see if you can access your files r/w) if you can just get rid of SELINUX entirely, if you want the added nonsense of 'restorecon and all the other wonderful things SELINUX bringd to the table, I myself am not a fan of SELINUX and have often went with (in my opinion better) PaX/GreSecrity patches and tools.

vincix · 01-05-2015, 05:24 PM

Quote:

Originally Posted by /dev/random

Yes the trailing dot means SELINUX based ACL (where a + indcates a standard ACL)
Policy and SELINUX ACLS are different, you can't turn off SELINUX ACLS you can remove them from the permissions bits but their not no blaket remove all function.

What dictro are you running?

Then how come I can edit files (on Centos 6.6) without having modified SELinux in any way and under the same circumstances? (group permissions and that dot at the end of the file when I list them with ls -l) Actually, when I write ls -l, ALL files have a dot at the end. What is that supposed to mean? I've never had any problems with permissions.

@NotionCommotion
I am going to ask you a stupid question: you did login in again, right? Whenever you add a user to a group, you need to relogin in order for /etc/group to be reread, otherwise you don't have the respective permissions.

P.S. My current SELinux mode is 'enforcing'

jpollard · 01-05-2015, 05:57 PM

ACLs are not a SELinux thing. They are a property of the filesystem that the kernel supports. And the "." indicates there is no ACL list.

One thing that can prevent your deletion of /var/www/main/user_resources/documents/parent_dir/child_dir is that you need write access to /var/www/main/user_resources/documents.

This is because you are removing a file name from the directory - and that means you must be able to write to it. You might check that the group permissions (as well as group ownership) of the documents directory permit read/write/search (the x on directories).

NotionCommotion · 01-05-2015, 09:54 PM

Quote:

Originally Posted by vincix

@NotionCommotion
I am going to ask you a stupid question: you did login in again, right? Whenever you add a user to a group, you need to relogin in order for /etc/group to be reread, otherwise you don't have the respective permissions.

I am going to request that they change the name of this forum from Newbie to Idiot. Thank you, I guess I never realized doing so was required, but I am certain I will never forget.

grail · 01-05-2015, 10:10 PM

Don't beat yourself up to badly ... I doubt there is anyone on this forum who has not made a similar oversight in the last couple of months

You are correct though ... you only have to make certain errors once and you have learnt them for a life time

tomiii · 01-06-2015, 02:50 AM

This is not a selinux issue. Removing a file from a directory requires write permission on the directory itself. The permissions on the actual file to be removed are irrelevant. Conceptually, a directory is just a file that contains a list of other filenames. Adding or removing a file in a directory requires write permission to that list of filenames.

vincix · 01-06-2015, 04:18 AM

Quote:

Originally Posted by NotionCommotion

I am going to request that they change the name of this forum from Newbie to Idiot. Thank you, I guess I never realized doing so was required, but I am certain I will never forget.

So was that it?

The reason I gave you that advice was because I myself have made that mistake and I've struggled in vain for a while until I realised that was the problem

NotionCommotion · 01-06-2015, 10:18 AM

Quote:

Originally Posted by vincix

So was that it?

Yup. I appreciate the help.