1

As qemu & KVM are working fine with SELinux out of the box I'd like to enable SELinux to improve guest isolation on my CentOS 6 server. The problem is that I'm using a 3rd parity virtualization managment software that requires SELinux to be disabled. As they will never implement that I'm now trying to get this working on my own...

While I was able to fix all libvirt/qemu related issues (changing default image/lvm location and fixing another issue with audit2allow) I got stuck with the custom lighttpd they're using to process various managment tasks.

I tried to add a custom rule with audit2allow but that didn't work at all. So as I'm not a SELinux expert I'm just looking for a way to

  • just put lighttpd in permissive mode (so it can do whatever neccessary)
  • enforce SELinux only for the qemu/libvirt processes running the VMs

I already found this in the semanage manpage and I think that it might be a solution semanage permissive -a TYPE http_r command but this just returns: /usr/sbin/semanage: bad option

I assume this is because they're not running the stock lighttpd from the CentOS repo and so the policy for lighty is missing.

Here's a short snippet from the audit.log

type=SYSCALL msg=audit(1393761691.786:1259): arch=c000003e syscall=9
success=yes exit=140369999609856 a0=0 a1=1fa588 a2=5 a3=802 items=0
ppid=1 pid=8532 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4294967295
comm="php" exe="/usr/bin/php" subj=system_u:system_r:httpd_t:s0
key=(null) type=AVC msg=audit(1393761691.813:1260): avc:  denied  {
name_connect } for  pid=8532 comm="php" dest=5656
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket type=SYSCALL
msg=audit(1393761691.813:1260): arch=c000003e syscall=42 success=no
exit=-115 a0=4 a1=7fffa6ed55f0 a2=10 a3=0 items=0 ppid=1 pid=8532
auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 tty=(none) ses=4294967295 comm="php"
exe="/usr/bin/php" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1393761691.969:1261): avc:  denied  { nlmsg_write }
for  pid=8552 comm="tc" scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_route_socket
5
  • what 3rd party solution specifically requires disabling SEL?
    – dyasny
    Mar 3, 2014 at 1:17
  • SolusVM. While the software is quite ok those guys don't have security in mind. Once we've had an issue with node-syncing their support disabled the whole firewall to "fix" the problem ... Mar 3, 2014 at 7:44
  • 1
    why use them then? There's perfectly good oVirt and proxmox available, and if you need support, what can be better than RHEV?
    – dyasny
    Mar 3, 2014 at 15:00
  • 1
    Well, that's good to hear. Now I can strike SolusVM off my shopping list. Mar 4, 2014 at 0:20
  • Well it isn't that bad after all. You just have to take care of some security aspects (SELinux ^^) yourself. Some other popular products (like cPanel) don't work with SELinux either. I think I might give oVirt a try somewhen in the near future. Mar 4, 2014 at 8:11

1 Answer 1

2

The command you are looking for is

semanage permissive -a httpd_t

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .