Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The heartbeat type polling tool nanny (part of Piranha / Linux Virtual Server / LVS / IPVS) is being denied access to my "sendprogram" scripts by SELinux. Setting the context alone is not sufficient. There are four different scripts mainly using curl.

What is the best way to allow a context to execute scripts that could require a broad range of permissions?


Originally unconfined_u:system_r:piranha_lvs_t:s0 was denied execute. I used audit2allow and after a couple of attempts the policy looks rather large and I get the feeling I am doing it wrong...

grep nanny /var/log/audit/audit.log | audit2allow -m piranha_nannymonitorscripts > piranha_nannymonitorscripts.te
tail -n20 /var/log/audit/audit.log | audit2allow -m piranha_nannymonitorscripts > piranha_nannymonitorscripts.te

Eventually resulted in

    module piranha_nannymonitorscripts 1.0;

require {
        type tmp_t;
        type cert_t;
        type usr_t;
        type urandom_device_t;
        type sysctl_net_t;
        type piranha_lvs_t;
        class process sigkill;
        class chr_file read;
        class capability dac_override;
        class file write;
        class lnk_file read;
        class dir { read write search };
}

#============= piranha_lvs_t ==============
allow piranha_lvs_t cert_t:file write;
allow piranha_lvs_t self:capability dac_override;
allow piranha_lvs_t self:process sigkill;
allow piranha_lvs_t sysctl_net_t:dir search;
#!!!! The source type 'piranha_lvs_t' can write to a 'dir' of the following types:
# var_run_t, piranha_lvs_var_run_t, root_t

allow piranha_lvs_t tmp_t:dir { read write };
#!!!! This avc can be allowed using the boolean 'global_ssp'

allow piranha_lvs_t urandom_device_t:chr_file read;
allow piranha_lvs_t usr_t:lnk_file read;
share|improve this question
1  
Run audit2allow to create a custom module to allow those scripts to be executed. –  topdog Sep 19 '12 at 6:26
    
It did improve things but the scripts calls curl and that seems to be denied. I don't think I should continue blindly adding to the policy? –  KCD Sep 20 '12 at 0:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.