LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 03-12-2010, 02:13 AM   #46
rjcroasdale
Member
 
Registered: Mar 2010
Posts: 36

Original Poster
Rep: Reputation: 15

Quote:
Originally Posted by blacky_5251 View Post
Sounds promising. How did it go?
its not gone anywhere yet, i have made a cup of tea

the above post is a summery of what i will do now. ty brb
 
Old 03-12-2010, 02:18 AM   #47
blacky_5251
Member
 
Registered: Oct 2004
Location: Adelaide Hills, South Australia
Distribution: RHEL 5&6 CentOS 5, 6 & 7
Posts: 573

Rep: Reputation: 61
I just finished dinner as well

If you use "audit2allow -M", it should create the .pp file as well as the .te file, so there will me no need to perform the make. Before installing the .pp module, check the .te to see that it contains appropriate (approximately) changes to SELinux. If you don't like something in the .te file, then edit the file to remove the bad stuff and use make to recreate the .pp from the modified .te. When you're happy, then install the module with semodule -i.

TTFN
 
1 members found this post helpful.
Old 03-12-2010, 01:37 PM   #48
rjcroasdale
Member
 
Registered: Mar 2010
Posts: 36

Original Poster
Rep: Reputation: 15
Lightbulb

Quote:
Originally Posted by rjcroasdale View Post
1.learn to use audit
2. get audit to log the postfix avc messages
3. use audit2allow to create a .te file
4. makefile to make a pp
5. semodule it to install it

Okiedoke, audit daemon installed and started "service auditd start" and my audit log filled up straight away, also in the messages log it states that the audit dispacher is initialised...w00t w00t i got audit logs to look at, which are entirely different to the "messages" log, i wonder if they are better..
Code:
Mar 12 19:06:44 HOSTNAME auditd[15512]: Started dispatcher: /sbin/audispd pid: 15514
Mar 12 19:06:44 HOSTNAME audispd: af_unix plugin initialized
Mar 12 19:06:44 HOSTNAME audispd: audispd initialized with q_depth=80 and 1 active plugins
Mar 12 19:06:44 HOSTNAME auditd[15512]: Init complete, auditd 1.7.5 listening for events (startup state enable)
Ok, so the audit log shows avc denied's for ; sendmail, postdrop and clean up...before i build a .te and .pp for insertion in the selinux policy i'm just gonna search the net a bit for these;

Code:
type=AVC msg=audit(1268422255.998:233415): avc:  denied  { connectto } for  pid=16292 comm="sh" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422255.998:233415): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bff401d0 a2=274ff4 a3=7d items=0 ppid=26793 pid=16292 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=9464 comm="sh" exe="/bin/bash" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1268422255.999:233416): avc:  denied  { connectto } for  pid=16292 comm="sh" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422255.999:233416): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bff402e0 a2=274ff4 a3=7d items=0 ppid=26793 pid=16292 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=9464 comm="sh" exe="/bin/bash" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1268422256.000:233417): avc:  denied  { write } for  pid=16292 comm="sendmail" path=2F746D702F5A435544394946335135202864656C6574656429 dev=sda1 ino=3711492 scontext=unconfined_u:system_r:system_mail_t:s0 tcontext=unconfined_u:object_r:httpd_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1268422256.000:233417): arch=40000003 syscall=11 success=yes exit=0 a0=8cd9f98 a1=8cd9760 a2=8cd95c8 a3=0 items=0 ppid=26793 pid=16292 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=9464 comm="sendmail" exe="/usr/sbin/sendmail.postfix" subj=unconfined_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1268422256.006:233418): avc:  denied  { connectto } for  pid=16292 comm="sendmail" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:system_mail_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.006:233418): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfb1badc a2=a61ff4 a3=4 items=0 ppid=26793 pid=16292 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=9464 comm="sendmail" exe="/usr/sbin/sendmail.postfix" subj=unconfined_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1268422256.007:233419): avc:  denied  { connectto } for  pid=16292 comm="sendmail" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:system_mail_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.007:233419): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfb1bbe8 a2=a61ff4 a3=4 items=0 ppid=26793 pid=16292 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=9464 comm="sendmail" exe="/usr/sbin/sendmail.postfix" subj=unconfined_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1268422256.008:233420): avc:  denied  { connectto } for  pid=16292 comm="sendmail" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:system_mail_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.008:233420): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfb1baa4 a2=a61ff4 a3=4 items=0 ppid=26793 pid=16292 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=9464 comm="sendmail" exe="/usr/sbin/sendmail.postfix" subj=unconfined_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1268422256.008:233421): avc:  denied  { connectto } for  pid=16292 comm="sendmail" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:system_mail_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.008:233421): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfb1bbac a2=a61ff4 a3=4 items=0 ppid=26793 pid=16292 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=9464 comm="sendmail" exe="/usr/sbin/sendmail.postfix" subj=unconfined_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1268422256.015:233422): avc:  denied  { connectto } for  pid=16293 comm="postdrop" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:postfix_postdrop_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.015:233422): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf87489c a2=412ff4 a3=4 items=0 ppid=16292 pid=16293 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=90 sgid=90 fsgid=90 tty=(none) ses=9464 comm="postdrop" exe="/usr/sbin/postdrop" subj=unconfined_u:system_r:postfix_postdrop_t:s0 key=(null)
type=AVC msg=audit(1268422256.016:233423): avc:  denied  { connectto } for  pid=16293 comm="postdrop" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:postfix_postdrop_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.016:233423): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf8749a8 a2=412ff4 a3=4 items=0 ppid=16292 pid=16293 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=90 sgid=90 fsgid=90 tty=(none) ses=9464 comm="postdrop" exe="/usr/sbin/postdrop" subj=unconfined_u:system_r:postfix_postdrop_t:s0 key=(null)
type=AVC msg=audit(1268422256.017:233424): avc:  denied  { connectto } for  pid=16293 comm="postdrop" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:postfix_postdrop_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.017:233424): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf874864 a2=412ff4 a3=4 items=0 ppid=16292 pid=16293 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=90 sgid=90 fsgid=90 tty=(none) ses=9464 comm="postdrop" exe="/usr/sbin/postdrop" subj=unconfined_u:system_r:postfix_postdrop_t:s0 key=(null)
type=AVC msg=audit(1268422256.017:233425): avc:  denied  { connectto } for  pid=16293 comm="postdrop" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:postfix_postdrop_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.017:233425): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bf87496c a2=412ff4 a3=4 items=0 ppid=16292 pid=16293 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=90 sgid=90 fsgid=90 tty=(none) ses=9464 comm="postdrop" exe="/usr/sbin/postdrop" subj=unconfined_u:system_r:postfix_postdrop_t:s0 key=(null)
type=AVC msg=audit(1268422256.030:233426): avc:  denied  { connectto } for  pid=16294 comm="cleanup" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:postfix_cleanup_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.030:233426): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfec15ec a2=e08ff4 a3=8 items=0 ppid=16020 pid=16294 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=9573 comm="cleanup" exe="/usr/libexec/postfix/cleanup" subj=unconfined_u:system_r:postfix_cleanup_t:s0 key=(null)
type=AVC msg=audit(1268422256.030:233427): avc:  denied  { connectto } for  pid=16294 comm="cleanup" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:postfix_cleanup_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.030:233427): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfec16f8 a2=e08ff4 a3=8 items=0 ppid=16020 pid=16294 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=9573 comm="cleanup" exe="/usr/libexec/postfix/cleanup" subj=unconfined_u:system_r:postfix_cleanup_t:s0 key=(null)
type=AVC msg=audit(1268422256.032:233428): avc:  denied  { connectto } for  pid=16294 comm="cleanup" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:postfix_cleanup_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.032:233428): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfec15b4 a2=e08ff4 a3=8 items=0 ppid=16020 pid=16294 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=9573 comm="cleanup" exe="/usr/libexec/postfix/cleanup" subj=unconfined_u:system_r:postfix_cleanup_t:s0 key=(null)
type=AVC msg=audit(1268422256.032:233429): avc:  denied  { connectto } for  pid=16294 comm="cleanup" path="/var/run/nscd/socket" scontext=unconfined_u:system_r:postfix_cleanup_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket
type=SYSCALL msg=audit(1268422256.032:233429): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfec16bc a2=e08ff4 a3=8 items=0 ppid=16020 pid=16294 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=9573 comm="cleanup" exe="/usr/libexec/postfix/cleanup" subj=unconfined_u:system_r:postfix_cleanup_t:s0 key=(null)
type=AVC msg=audit(1268422256.033:233430): avc:  denied  { read write } for  pid=16294 comm="cleanup" name="unix.cleanup" dev=sda1 ino=8306741 scontext=unconfined_u:system_r:postfix_cleanup_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1268422256.033:233430): arch=40000003 syscall=5 success=no exit=-13 a0=12f7720 a1=8002 a2=0 a3=8002 items=0 ppid=16020 pid=16294 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=9573 comm="cleanup" exe="/usr/libexec/postfix/cleanup" subj=unconfined_u:system_r:postfix_cleanup_t:s0 key=(null)
type=USER_AVC msg=audit(1268422258.689:233431): user pid=14803 uid=28 auid=0 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='avc:  denied  { shmempwd } for  scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=nscd : exe="?" (sauid=28, hostname=?, addr=?, terminal=?)'
type=USER_AVC msg=audit(1268422258.690:233432): user pid=14803 uid=28 auid=0 ses=4 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='avc:  denied  { getpwd } for  scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=nscd : exe="?" (sauid=28, hostname=?, addr=?, terminal=?)'
BRB

Last edited by rjcroasdale; 03-14-2010 at 09:00 PM.
 
Old 03-14-2010, 08:31 PM   #49
rjcroasdale
Member
 
Registered: Mar 2010
Posts: 36

Original Poster
Rep: Reputation: 15
ok maybe not quite BRB,

here is the audit2allow .te file i want to edit to allow ONLY the postfix functions that are stopping mail from being send with selinux on

Code:
module mypostfix2 1.0;

require {
	type unconfined_t;
	type var_run_t;
	type httpd_t;
	type postfix_smtpd_t;
	type postfix_cleanup_t;
	type system_chkpwd_t;
	type postfix_pickup_t;
	type sshd_t;
	type crond_t;
	type postfix_smtp_t;
	class nscd { shmempwd getpwd shmemgrp getgrp };
	class unix_stream_socket connectto;
	class file { read write };
}
require {
	type unconfined_t;
	type var_run_t;
	type httpd_t;
	type postfix_smtpd_t;
	type postfix_cleanup_t;
	type system_chkpwd_t;
	type postfix_pickup_t;
	type sshd_t;
	type crond_t;
	type postfix_smtp_t;
	class nscd { shmempwd getpwd shmemgrp getgrp };
	class unix_stream_socket connectto;
	class file { read write };
}

#============= crond_t ==============
allow crond_t unconfined_t:nscd { shmemgrp getgrp };

#============= httpd_t ==============
allow httpd_t unconfined_t:unix_stream_socket connectto;

#============= postfix_cleanup_t ==============
allow postfix_cleanup_t unconfined_t:unix_stream_socket connectto;
allow postfix_cleanup_t var_run_t:file { read write };

#============= postfix_pickup_t ==============
allow postfix_pickup_t unconfined_t:unix_stream_socket connectto;

#============= postfix_smtp_t ==============
allow postfix_smtp_t unconfined_t:unix_stream_socket connectto;
allow postfix_smtp_t var_run_t:file { read write };

#============= postfix_smtpd_t ==============
allow postfix_smtpd_t unconfined_t:unix_stream_socket connectto;
allow postfix_smtpd_t var_run_t:file { read write };

#============= sshd_t ==============
allow sshd_t unconfined_t:nscd { shmempwd getpwd };

#============= system_chkpwd_t ==============
allow system_chkpwd_t unconfined_t:unix_stream_socket connectto;

Last edited by rjcroasdale; 03-14-2010 at 08:59 PM.
 
Old 03-14-2010, 08:44 PM   #50
rjcroasdale
Member
 
Registered: Mar 2010
Posts: 36

Original Poster
Rep: Reputation: 15
Me <-- goes to read more about Type Enforcement files :S

Last edited by rjcroasdale; 03-14-2010 at 09:34 PM.
 
Old 03-14-2010, 09:38 PM   #51
rjcroasdale
Member
 
Registered: Mar 2010
Posts: 36

Original Poster
Rep: Reputation: 15
Cleared the audit.log, and sent an email with selinux on to generate the avc messages in audit.log so i can use the command | audit2allow -M mypostfix2 < /var/log/audit/audit.log | to create a .te file to edit;

here is the content of this latest .te file generated by the above command and my cleaned audit.log, can anyone advise me on what i should adjust/remove to allow postfix to sendmail and not compromise my system, thanks;

Code:
module mypostfix2 1.0;

require {
	type unconfined_t;
	type var_run_t;
	type sshd_t;
	type postfix_postdrop_t;
	type httpd_t;
	type system_mail_t;
	type postfix_cleanup_t;
	class nscd { shmempwd getpwd };
	class unix_stream_socket connectto;
	class file { read write };
}
require {
	type unconfined_t;
	type var_run_t;
	type sshd_t;
	type postfix_postdrop_t;
	type httpd_t;
	type system_mail_t;
	type postfix_cleanup_t;
	class nscd { shmempwd getpwd };
	class unix_stream_socket connectto;
	class file { read write };
}

#============= httpd_t ==============
allow httpd_t unconfined_t:unix_stream_socket connectto;

#============= postfix_cleanup_t ==============
allow postfix_cleanup_t unconfined_t:unix_stream_socket connectto;
allow postfix_cleanup_t var_run_t:file { read write };

#============= postfix_postdrop_t ==============
allow postfix_postdrop_t unconfined_t:unix_stream_socket connectto;

#============= sshd_t ==============
allow sshd_t unconfined_t:nscd { shmempwd getpwd };

#============= system_mail_t ==============
allow system_mail_t unconfined_t:unix_stream_socket connectto;

Last edited by rjcroasdale; 03-14-2010 at 09:44 PM.
 
Old 03-14-2010, 09:44 PM   #52
rjcroasdale
Member
 
Registered: Mar 2010
Posts: 36

Original Poster
Rep: Reputation: 15

Ok I just added the whole thing (the above .te file made into a .pp file) to the active selinux modules, and postfix still wont send mail with selinux turned on! OMG!


;[

Last edited by rjcroasdale; 03-14-2010 at 10:04 PM.
 
Old 03-14-2010, 10:14 PM   #53
blacky_5251
Member
 
Registered: Oct 2004
Location: Adelaide Hills, South Australia
Distribution: RHEL 5&6 CentOS 5, 6 & 7
Posts: 573

Rep: Reputation: 61
Crikey, you're not having a good run are you. Maybe you need to relabel?
Code:
touch /.autorelabel
init 6
 
1 members found this post helpful.
Old 03-14-2010, 10:55 PM   #54
blacky_5251
Member
 
Registered: Oct 2004
Location: Adelaide Hills, South Australia
Distribution: RHEL 5&6 CentOS 5, 6 & 7
Posts: 573

Rep: Reputation: 61
I would also remove the module you created. You shouldn't need any of the sshd or httpd stuff in it to get this postfix problem fixed.

Can you post some of the audit.log file that is created when you try to send an email?

Thanks
 
Old 03-14-2010, 11:23 PM   #55
rjcroasdale
Member
 
Registered: Mar 2010
Posts: 36

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by blacky_5251 View Post
I would also remove the module you created. You shouldn't need any of the sshd or httpd stuff in it to get this postfix problem fixed.

Can you post some of the audit.log file that is created when you try to send an email?

Thanks
Yey! My mentor is here, seriously you should get a gold star cos i am such a

yeah it was the first thing i did...removed both modules i added and checked the /etc/selinux/targeted/modules/active/modules folder to make sure they had gone after i did
Code:
semodule -r mypostfix2
because i noticed the ssh being in there.

OH POOSTICKS!

Code:
touch /.autorelabel
init 6
and the SSH disconnected me, the websites are down and refuses to reconnect via ssh!

SV_PANIC-OVER = 1

OK, so 2 mins later and the server is responding again, what do those commands do?

scared me to death!

Last edited by rjcroasdale; 03-14-2010 at 11:35 PM.
 
Old 03-14-2010, 11:33 PM   #56
rjcroasdale
Member
 
Registered: Mar 2010
Posts: 36

Original Poster
Rep: Reputation: 15
postfix starts and sends emails with selinux on !

what did those commands do!

Is my system still secure?
 
Old 03-15-2010, 12:27 AM   #57
blacky_5251
Member
 
Registered: Oct 2004
Location: Adelaide Hills, South Australia
Distribution: RHEL 5&6 CentOS 5, 6 & 7
Posts: 573

Rep: Reputation: 61
Hi Rob,

The first command created an empty file called .autorelabel in the root directory. Nothing sinister there.

The second command (init 6) told the system to change to runlevel 6, which is the reboot level. So it simply rebooted the machine. When the machine rebooted though, it found the .autorelabel file which tells the server to reset the SELinux contexts for all of your files. This basically tells SELinux to start from scratch and relabel each file in terms of what the file can and can't do, based on the SELinux idea of the world. It's like chcon or restorecon, but on a global scale. Use "ls -lZ /pick/any/file/you/like" and you will see the SELinux context values that would have been re-evaluated (and changed if it was wrong) by the relabel at the reboot. Once the relabel has been done, the .autorelabel file is deleted to prevent another relabel when the machine boots next time.

Anyway, it looks like your problem is solved, which is fantastic. Let me know if you want more details about any of this at all.
 
1 members found this post helpful.
Old 03-15-2010, 12:38 AM   #58
rjcroasdale
Member
 
Registered: Mar 2010
Posts: 36

Original Poster
Rep: Reputation: 15
Hi Ian,

Thanks for the info, i panic'd big-time when i got the "connection lost" and "conenction refused" from putty and my websites were not responding, but i didn't know that you could reboot the machine with a command like that now i know.

I do really need to read up more on selinux, i really dont know what
Code:
unconfined_u:object_r:admin_home_t:s0
means....

I'm re-scanning my server for PCI secruity now, and will have to read up on selinux, but yes, it works which is great, just not sure if i've relabeled the files at the same "selinux" security level or not, but that is now a separate issue for me to learn.

Thanks for your help, you are the only one who did! like i said in my post above you are a star, hope to stay in touch, speak soon

Last edited by rjcroasdale; 03-15-2010 at 01:08 AM.
 
Old 03-15-2010, 02:26 AM   #59
blacky_5251
Member
 
Registered: Oct 2004
Location: Adelaide Hills, South Australia
Distribution: RHEL 5&6 CentOS 5, 6 & 7
Posts: 573

Rep: Reputation: 61
To be frank, I don't know what that means either. If I need to learn, I Google it then. The best SELinux command I can give you is something like this:-
Code:
chcon --reference=thisfile someotherfile
    and
chcon -R --reference=thisfile-or-dir someotherdir
This changes the context of files, or directories (recursively with the -R), to that of an existing file. So if you know the context of an existing file or dir is OK, then you can change the context of other files to match it. I use this a lot - especially with web content. For example:-
Code:
chcon -R --reference=/var/www/html /var/www/html/*
Other than that, pay attention to your audit.log file (now that you've got one!).

Best wishes, and hopefully we'll cross paths again. You have my email, so if you get stuck and no-one else is responding (I tend to take vacations from this site), please feel free to contact me directly
 
Old 12-03-2019, 11:17 PM   #60
rjcroasdale
Member
 
Registered: Mar 2010
Posts: 36

Original Poster
Rep: Reputation: 15
Thumbs up

Well this is great, almost 10 years ago. I now know more about SELINUX now and like it very much. Will maybe do a audit profile for some open source software that recommends to turn off selinux. It has to rw allow httpd, httpd_sys_content_rw_t, and a port or two 'tcontext=system_ubject_r:zope_port_t:s0'. Seems like a legit thing to do for their community. Anyway, LQ, Blacky = Ty all. (^_^)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Postfix broke after update, please help! Brandon.Wamboldt Linux - Server 2 12-06-2009 09:41 AM
"../system.h :selinux/selinux.h:no such file or directory" ashmita04 Linux From Scratch 4 02-05-2009 03:36 AM
Postfix: postfix: fatal: chdir(/usr/libexec/postfix) Micro420 Ubuntu 2 07-13-2008 12:21 PM
I think I broke SELinux blanny Linux - Security 1 10-08-2006 12:52 AM
Problem with Postfix and SElinux jc materi Linux - Security 1 06-22-2006 03:02 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 10:35 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration