Red Hat Security: Linux in Physical, Virtual, and Cloud

Log in to serverd as student. No password is required.

[student@workstation ~]$ ssh student@serverd
[student@serverd ~]$ 

Use the sudo -i command to switch identity to the root user. Use student as the password.

[student@serverd ~]$ sudo -i
[sudo] password for student: student
[root@serverd ~]# 

Get the current SELinux mode.

[root@serverd ~]# getenforce
Permissive

Edit the /etc/selinux/config file and set the SELINUX variable to enforcing.

[root@serverd ~]# vim /etc/selinux/config
...output omitted...
SELINUX=enforcing
...output omitted...

Use the setenforce command to change the current mode to enforcing. Verify your work with the getenforce command.

[root@serverd ~]# setenforce 1
[root@serverd ~]# getenforce
Enforcing

Because the originally that server was using the enforcing mode, you do not need to reboot serverd.

Try to start the httpd service.

[root@serverd ~]# systemctl start httpd
Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.

As instructed by the error message, run the systemctl status httpd.service command to get more detail.

[root@serverd ~]# systemctl status httpd.service
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Wed 2018-07-25 05:49:17 EDT; 3min 33s ago
     Docs: man:httpd(8)
           man:apachectl(8)
  Process: 2846 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=1/FAILURE)
  Process: 2845 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
 Main PID: 2845 (code=exited, status=1/FAILURE)

Jul 25 05:49:17 serverd.lab.example.com systemd[1]: Starting The Apache HTTP Server...
Jul 25 05:49:17 serverd.lab.example.com httpd[2845]: (13)Permission denied: AH00091: httpd: could not open error log file /etc/httpd/logs/error_log.
Jul 25 05:49:17 serverd.lab.example.com httpd[2845]: AH00015: Unable to open logs
...output omitted...

Collect more clues by inspecting the /etc/httpd/logs directory.

[root@serverd ~]# ls -ld /etc/httpd/logs
lrwxrwxrwx. 1 root root 18 Jul 25 04:28 /etc/httpd/logs -> /custom/httpd_logs

/etc/httpd/logs is a link to a custom directory; the default is usually /var/log/httpd.

Search for SELinux denials in the /var/log/audit/audit.log file.

[root@serverd ~]# grep denied /var/log/audit/audit.log
type=AVC msg=audit(1532512157.422:2686): avc:  denied  { write } for  pid=2845 comm="httpd" name="httpd_logs" dev="vda1" ino=13489 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=dir

You can also use the ausearch command.

[root@serverd ~]# ausearch -m AVC
\----
time->Wed Jul 25 05:49:17 2018
type=PROCTITLE msg=audit(1532512157.422:2686): proctitle=2F7573722F7362696E2F6874747064002D44464F524547524F554E44
type=SYSCALL msg=audit(1532512157.422:2686): arch=c000003e syscall=2 success=no exit=-13 a0=558bf9944c00 a1=80441 a2=1b6 a3=7ffcdc7a4a10 items=0 ppid=1 pid=2845 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1532512157.422:2686): avc:  denied  { write } for  pid=2845 comm="httpd" name="httpd_logs" dev="vda1" ino=13489 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=dir

The message indicates that SELinux denies the httpd process write access to the httpd_logs directory, whose inode number is 13489. This inode number is probably different on your system.

The httpd_logs directory has the wrong SELinux context.

You probably only have one directory named httpd_logs on your system, but because the SELinux message does not give you the full path, you cannot be sure. Use the find command with the -inum option to locate the directory by its inode number.

[root@serverd ~]# find / -inum 13489
/custom/httpd_logs

Remember to replace the inode number in the command with the one you collected in the previous step.

To find out the context type to set on the /custom/httpd_logs directory, retrieve the context type of the default log directory, /var/log/httpd.

[root@serverd ~]# ls -Zd /var/log/httpd
drwx------. root root system_u:object_r:httpd_log_t:s0 /var/log/httpd

Use the semanage fcontext command to add the new rule for /custom/httpd_log.

[root@serverd ~]# semanage fcontext -a -t httpd_log_t \
> '/custom/httpd_logs(/.*)?'
[root@serverd ~]# 

Remember to restore the context of the /custom/httpd_logs directory.

[root@serverd ~]# restorecon -Rv /custom/httpd_logs
restorecon reset /custom/httpd_logs context unconfined_u:object_r:default_t:s0->unconfined_u:object_r:httpd_log_t:s0

Verify that you can now start the httpd service.

[root@serverd ~]# systemctl start httpd
[root@serverd ~]# systemctl is-active httpd
active

Use the curl command to access the index.html page.

[root@serverd ~]# curl http://localhost/index.html
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /index.html
on this server.</p>
</body></html>

The command output indicates that httpd cannot access the index.html file.

Verify that the index.html file exists and has the correct Linux access rights.

[root@serverd ~]# ls -l /var/www/html/index.html
-rw-r--r--. 1 root root 15 Jul 25 04:28 /var/www/html/index.html

The file exists and has the correct access rights.

Search for SELinux denials in the /var/log/audit/audit.log file.

[root@serverd ~]# grep denied /var/log/audit/audit.log
type=AVC msg=audit(1532512157.422:2686): avc:  denied  { write } for  pid=2845 comm="httpd" name="httpd_logs" dev="vda1" ino=13489 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=dir
type=AVC msg=audit(1532514740.732:2735): avc:  denied  { getattr } for  pid=3778 comm="httpd" path="/var/www/html/index.html" dev="vda1" ino=484 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file
type=AVC msg=audit(1532514740.733:2736): avc:  denied  { getattr } for  pid=3778 comm="httpd" path="/var/www/html/index.html" dev="vda1" ino=484 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file

The last message indicates that SELinux denies the httpd process access to the /var/www/html/index.html file.

Review the context type of the /var/www/html/index.html file and its parent directory.

[root@serverd ~]# ls -Z /var/www/html/index.html
-rw-r--r--. root root unconfined_u:object_r:admin_home_t:s0 /var/www/html/index.html
[root@serverd ~]# ls -Zd /var/www/html
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html

index.html does not have the correct context.

You do not need to add a new file context rule because /var/www/html is the default DocumentRoot directory and already has a rule. You only need to relabel index.html.

[root@serverd ~]# restorecon -v /var/www/html/index.html
restorecon reset /var/www/html/index.html context unconfined_u:object_r:admin_home_t:s0->unconfined_u:object_r:httpd_sys_content_t:s0

Confirm that you can now access the index.html page.

[root@serverd ~]# curl http://localhost/index.html
Hello, Student

Change the default mapping between the Linux and the SELinux users. Map the Linux users to the user_u SELinux user.

[root@serverd ~]# semanage login -m -s user_u -r s0 __default__
[root@serverd ~]# 

To prevent users from running programs in /tmp or their home directory, set the SELinux user_exec_content Boolean to off.

[root@serverd ~]# setsebool -P user_exec_content off
[root@serverd ~]# 

Log out of serverd and log in again as student.

[root@serverd ~]# logout
[student@serverd ~]$ logout
[student@workstation ~]$ ssh student@serverd
[student@serverd ~]$ 

Confirm that you can no longer use the sudo -i command.

[student@serverd ~]$ sudo -i
sudo: PERM_SUDOERS: setresuid(-1, 1, -1): Operation not permitted
sudo: no valid sudoers sources found, quitting
sudo: setresuid() [0, 0, 0] -> [1000, -1, -1]: Operation not permitted
sudo: unable to initialize policy plugin
[student@serverd ~]$ 

Confirm that you cannot execute programs in /tmp or /home/student. Use the runme program for that test.

[student@serverd ~]$ /tmp/runme
-bash: /tmp/runme: Permission denied
[student@serverd ~]$ ./runme
-bash: ./runme: Permission denied

Log out of serverd and log in as root.

[student@serverd ~]$ logout
[student@workstation ~]$ ssh root@serverd
[root@serverd ~]# 

Create the operator2 account according to the requirements, and map it to the sysadm_u SELinux user.

[root@serverd ~]# useradd -G wheel -Z sysadm_u operator2
[root@serverd ~]# echo redhat | passwd --stdin operator2
Changing password for user operator2.
passwd: all authentication tokens updated successfully.

Set the ssh_sysadm_login SELinux Boolean to on so that sysadm_u SELinux users can log in using SSH.

[root@serverd ~]# setsebool -P ssh_sysadm_login on
[root@serverd ~]# 

Log out of serverd and log in as operator2.

[root@serverd ~]# logout
[student@workstation ~]$ ssh operator2@serverd
[operator2@serverd ~]$ 

Confirm that you can use the sudo -i command to become root. Use redhat for the password. When done, log out from serverd.

[operator2@serverd ~]$ sudo -i
[sudo] password for operator2: redhat
[root@serverd ~]# logout
[operator2@serverd ~]$ logout
[student@workstation ~]$ 

Replicate the scenario to confirm the described behavior.

Log in to serverd as student. No password is required.

[student@workstation ~]$ ssh student@serverd
[student@serverd ~]$ 

Retrieve the domain type of the bash process.

[student@serverd ~]$ ps -Z $$
LABEL                             PID TTY      STAT   TIME COMMAND
user_u:user_r:user_t:s0         13192 pts/1    Ss     0:00 -bash

Retrieve the context type of the /usr/bin/passwd binary file.

[student@serverd ~]$ ls -Z /usr/bin/passwd
-rwsr-xr-x. root root system_u:object_r:passwd_exec_t:s0 /usr/bin/passwd

Run the passwd command but do not enter any password. Leave the command running; you don't want to change your password, you just want to inspect the context of the process.

[student@serverd ~]$ passwd
Changing password for user student.
Changing password for student.
(current) UNIX password:

Open a new terminal on workstation and log in to serverd as root.

[student@workstation ~]$ ssh root@serverd
[root@serverd ~]# 

Retrieve the context type of the running passwd process.

[root@serverd ~]# ps -Z -C passwd
LABEL                             PID TTY          TIME CMD
user_u:user_r:passwd_t:s0       13491 pts/1    00:00:00 passwd

Install the setools-console package to get the sesearch command.

[root@serverd ~]# yum install setools-console
...output omitted...
Is this ok [y/d/N]: y
...output omitted...
Complete!

Use the sesearch command with the following options:

[root@serverd ~]# sesearch -T -s user_t -t passwd_exec_t
Found 1 semantic te rules:
   type_transition user_t passwd_exec_t : process passwd_t;

You can also combine the sesearch command with grep.

[root@serverd ~]# sesearch -T -s user_t | grep passwd_t
   type_transition user_t passwd_exec_t : process passwd_t;

Redirect the output of one of the previous commands to /home/student/rule. When done, log out from serverd.

[root@serverd ~]# sesearch -T -s user_t -t passwd_exec_t > /home/student/rule
[root@serverd ~]# logout
[student@workstation ~]$ 

In the second terminal, cancel the passwd command and log out from serverd.

^C
[student@serverd ~]$ logout
[student@workstation ~]$