Red Hat System Administration II

Instructions

1. Log in to the serverb machine as the student user and switch to the root user.

   [student@workstation ~]$ ssh student@serverb
   ...output omitted...
   [student@serverb ~]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]#

   Hide Solution

2. From a web browser on the workstation machine, view the http://serverb/lab.html web page. You see the error message: You do not have permission to access this resource.

3. Research and identify the SELinux issue that prevents the Apache service from serving web content.

   1. View the contents of the /var/log/messages file. Use the / key and search for the sealert string. Use the q key to quit the less command.

      [root@serverb ~]# less /var/log/messages
      ...output omitted...
      Apr  7 06:16:15 serverb setroubleshoot[26509]: failed to retrieve rpm info for /lab-content/la
      b.html
      Apr  7 06:16:17 serverb setroubleshoot[26509]: SELinux is preventing /usr/sbin/httpd from getattr access on the file /lab-content/lab.html. For complete SELinux messages run: sealert -l 35c9e452-2552-4ca3-8217-493b72ba6d0b
      Apr  7 06:16:17 serverb setroubleshoot[26509]: SELinux is preventing /usr/sbin/httpd from getattr access on the file /lab-content/lab.html
      ...output omitted...

   2. Run the suggested sealert command. Note the source context, the target objects, the policy, and the enforcing mode.

      [root@serverb ~]# sealert -l 35c9e452-2552-4ca3-8217-493b72ba6d0b
      SELinux is preventing /usr/sbin/httpd from getattr access on the file /lab-content/lab.html.
      
      *****  Plugin catchall_labels (83.8 confidence) suggests   *******************
      
      If you want to allow httpd to have getattr access on the lab.html file
      Then you need to change the label on /lab-content/lab.html
      Do
      # semanage fcontext -a -t FILE_TYPE '/lab-content/lab.html'
      where FILE_TYPE is one of the following:
      ...output omitted...
      
      Additional Information:
      Source Context                system_u:system_r:httpd_t:s0
      Target Context                unconfined_u:object_r:default_t:s0
      Target Objects                /lab-content/lab.html [ file ]
      Source                        httpd
      Source Path                   /usr/sbin/httpd
      Port                          <Unknown>
      Host                          serverb.lab.example.com
      Source RPM Packages           httpd-2.4.51-7.el9_0.x86_64
      Target RPM Packages
      SELinux Policy RPM            selinux-policy-targeted-34.1.27-1.el9.noarch
      Local Policy RPM              selinux-policy-targeted-34.1.27-1.el9.noarch
      Selinux Enabled               True
      Policy Type                   targeted
      Enforcing Mode                Enforcing
      Host Name                     serverb.lab.example.com
      Platform                      Linux serverb.lab.example.com
                                    5.14.0-70.2.1.el9_0.x86_64 #1 SMP PREEMPT Wed Mar
                                    16 18:15:38 EDT 2022 x86_64 x86_64
      Alert Count                   8
      First Seen                    2022-04-07 06:14:45 EDT
      Last Seen                     2022-04-07 06:16:12 EDT
      Local ID                      35c9e452-2552-4ca3-8217-493b72ba6d0b
      
      Raw Audit Messages
      type=AVC msg=audit(1649326572.86:407): avc:  denied  { getattr } for  pid=10731 comm="httpd" path="/lab-content/lab.html" dev="vda4" ino=18192752 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0
      
      
      type=SYSCALL msg=audit(1649326572.86:407): arch=x86_64 syscall=newfstatat success=no exit=EACCES a0=ffffff9c a1=7f7c8c0457c0 a2=7f7c887f7830 a3=100 items=0 ppid=10641 pid=10731 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)
      
      Hash: httpd,httpd_t,default_t,file,getattr

   3. The Raw Audit Messages section of the sealert command contains information from the /var/log/audit/audit.log file. Search the /var/log/audit/audit.log file. The -m option searches on the message type. The ts option searches based on time. The following entry identifies the relevant process and file that cause the alert. The process is the httpd Apache web server, the file is /lab-content/lab.html, and the context is system_r:httpd_t.

      [root@serverb ~]# ausearch -m AVC -ts recent
      ...output omitted...
      ----
      time->Thu Apr  7 06:16:12 2022
      type=PROCTITLE msg=audit(1649326572.086:407): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
      type=SYSCALL msg=audit(1649326572.086:407): arch=c000003e syscall=262 success=no exit=-13 a0=ffffff9c a1=7f7c8c0457c0 a2=7f7c887f7830 a3=100 items=0 ppid=10641 pid=10731 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
      type=AVC msg=audit(1649326572.086:407): avc:  denied  { getattr } for  pid=10731 comm="httpd" path="/lab-content/lab.html" dev="vda4" ino=18192752 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0

   Hide Solution

4. Display the SELinux context of the new HTTP document directory and the original HTTP document directory. Resolve the SELinux issue that prevents the Apache server from serving web content.

   1. Compare the SELinux context for the /lab-content and /var/www/html directories.

      [root@serverb ~]# ls -dZ /lab-content /var/www/html
            unconfined_u:object_r:default_t:s0 /lab-content
      system_u:object_r:httpd_sys_content_t:s0 /var/www/html

   2. Create a file context rule that sets the default type to httpd_sys_content_ for the /lab-content directory and all the files in it.

      [root@serverb ~]# semanage fcontext -a \
      -t httpd_sys_content_t '/lab-content(/.*)?'

   3. Correct the SELinux context for the files in the /lab-content directory.

      [root@serverb ~]# restorecon -R /lab-content/

   Hide Solution

5. Verify that the Apache server can now serve web content.

   1. Use your web browser to refresh the http://serverb/lab.html link. If the content is displayed, then your issue is resolved.

      This is the html file for the SELinux final lab on SERVERB.

   Hide Solution

6. Return to the workstation machine as the student user.

   [root@serverb ~]# exit
   logout
   [student@serverb ~]$ exit
   logout
   Connection to serverb closed.
   [student@workstation ~]$

   Hide Solution