Red Hat System Administration II

Instructions

1. From a web browser on the workstation machine, open the http://servera/index.html web page. An error message states that you do not have permission to access the file.

2. Use the ssh command to log in to servera as the student user. Use the sudo -i command to switch to the root user.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...
   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]#

3. Use the less command to view the contents of the /var/log/messages file. You use the / character and search for the sealert text. Press the n key until you reach the last occurrence, because previous exercises might also have generated SELinux messages. Copy the suggested sealert command so that you can use it in the next step. Use the q key to quit the less command.

   [root@servera ~]# less /var/log/messages
   ...output omitted...
   Apr  7 04:52:18 servera setroubleshoot[20715]: SELinux is preventing /usr/sbin/httpd from getattr access on the file /custom/index.html. For complete SELinux messages run: sealert -l 9a96294a-239b-4568-8f1e-9f35b5fb472b
   ...output omitted...

4. Run the suggested sealert command. Note the source context, the target objects, the policy, and the enforcing mode. Find the correct SELinux context label for the file that the httpd service tries to serve.

   1. Run the sealert command.

      The output explains that the /custom/index.html file has an incorrect context label.

      [root@servera ~]# sealert -l 9a96294a-239b-4568-8f1e-9f35b5fb472b
      SELinux is preventing /usr/sbin/httpd from getattr access on the file /custom/index.html.
      
      *****  Plugin catchall_labels (83.8 confidence) suggests   *******************
      
      If you want to allow httpd to have getattr access on the index.html file
      Then you need to change the label on /custom/index.html
      Do
      # semanage fcontext -a -t FILE_TYPE '/custom/index.html'
      where FILE_TYPE is one of the following: NetworkManager_exec_t, NetworkManager_log_t, NetworkManager_tmp_t, abrt_dump_oops_exec_t, abrt_etc_t, abrt_exec_t, abrt_handle_event_exec_t, abrt_helper_exec_t, abrt_retrace_coredump_exec_t, abrt_retrace_spool_t, abrt_retrace_worker_exec_t, abrt_tmp_t, abrt_upload_watch_tmp_t, abrt_var_cache_t, abrt_var_log_t, abrt_var_run_t, accountsd_exec_t, acct_data_t, acct_exec_t, admin_crontab_tmp_t, admin_passwd_exec_t, afs_logfile_t, aide_exec_t, aide_log_t, alsa_exec_t, alsa_tmp_t, amanda_exec_t, amanda_log_t, amanda_recover_exec_t, amanda_tmp_t, amtu_exec_t, anacron_exec_t, anon_inodefs_t
      ...output omitted...
      
      Additional Information:
      Source Context                system_u:system_r:httpd_t:s0
      Target Context                unconfined_u:object_r:default_t:s0
      Target Objects                /custom/index.html [ file ]
      Source                        httpd
      Source Path                   /usr/sbin/httpd
      Port                          <Unknown>
      Host                          servera.lab.example.com
      Source RPM Packages           httpd-2.4.51-7.el9_0.x86_64
      Target RPM Packages
      SELinux Policy RPM            selinux-policy-targeted-34.1.27-1.el9.noarch
      Local Policy RPM              selinux-policy-targeted-34.1.27-1.el9.noarch
      Selinux Enabled               True
      Policy Type                   targeted
      Enforcing Mode                Enforcing
      Host Name                     servera.lab.example.com
      Platform                      Linux servera.lab.example.com
                                    5.14.0-70.2.1.el9_0.x86_64 #1 SMP PREEMPT Wed Mar
                                    16 18:15:38 EDT 2022 x86_64 x86_64
      Alert Count                   4
      First Seen                    2022-04-07 04:51:38 EDT
      Last Seen                     2022-04-07 04:52:13 EDT
      Local ID                      9a96294a-239b-4568-8f1e-9f35b5fb472b
      
      Raw Audit Messages
      type=AVC msg=audit(1649321533.406:1024): avc:  denied  { getattr } for  pid=20464 comm="httpd" path="/custom/index.html" dev="vda4" ino=25571802 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0
      
      ...output omitted...

   2. Verify the SELinux context for the directory from where the httpd service serves the content by default, /var/www/html. The httpd_sys_content_t SELinux context is appropriate for the /custom/index.html file.

      [root@servera ~]# ls -ldZ /var/www/html
      drwxr-xr-x. 2 root root system_u:object_r:httpd_sys_content_t:s0 6 Mar 21 11:47 /var/www/html

5. The Raw Audit Messages section of the sealert command contains information from the /var/log/audit/audit.log file. Use the ausearch command to search the /var/log/audit/audit.log file. The -m option searches on the message type. The -ts option searches based on time. The following entry identifies the relevant process and file that cause the alert. The process is the httpd Apache web server, the file is /custom/index.html, and the context is system_r:httpd_t.

   [root@servera ~]# ausearch -m AVC -ts today
   ...output omitted...
   ----
   time->Thu Apr  7 04:52:13 2022
   type=PROCTITLE msg=audit(1649321533.406:1024): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
   type=SYSCALL msg=audit(1649321533.406:1024): arch=c000003e syscall=262 success=no exit=-13 a0=ffffff9c a1=7fefc403d850 a2=7fefc89bc830 a3=100 items=0 ppid=20461 pid=20464 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
   type=AVC msg=audit(1649321533.406:1024): avc:  denied  { getattr } for  pid=20464 comm="httpd" path="/custom/index.html" dev="vda4" ino=25571802 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0

6. Resolve the issue by applying the httpd_sys_content_t context.

   [root@servera ~]# semanage fcontext -a \
   -t httpd_sys_content_t '/custom(/.*)?'
   [root@servera ~]# restorecon -Rv /custom
   Relabeled /custom from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0
   Relabeled /custom/index.html from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0

7. Again, try to view http://servera/index.html. The This is SERVERA. message is displayed.

8. Return to the workstation machine as the student user.

   [root@servera ~]# exit
   logout
   [student@servera ~]$ exit
   logout
   Connection to servera closed.
   [student@workstation ~]$