Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As qemu & KVM are working fine with SELinux out of the box I'd like to enable SELinux to improve guest isolation on my CentOS 6 server. The problem is that I'm using a 3rd parity virtualization managment software that requires SELinux to be disabled. As they will never implement that I'm now trying to get this working on my own...

While I was able to fix all libvirt/qemu related issues (changing default image/lvm location and fixing another issue with audit2allow) I got stuck with the custom lighttpd they're using to process various managment tasks.

I tried to add a custom rule with audit2allow but that didn't work at all. So as I'm not a SELinux expert I'm just looking for a way to

  • just put lighttpd in permissive mode (so it can do whatever neccessary)
  • enforce SELinux only for the qemu/libvirt processes running the VMs

I already found this in the semanage manpage and I think that it might be a solution semanage permissive -a TYPE http_r command but this just returns: /usr/sbin/semanage: bad option

I assume this is because they're not running the stock lighttpd from the CentOS repo and so the policy for lighty is missing.

Here's a short snippet from the audit.log

type=SYSCALL msg=audit(1393761691.786:1259): arch=c000003e syscall=9
success=yes exit=140369999609856 a0=0 a1=1fa588 a2=5 a3=802 items=0
ppid=1 pid=8532 auid=4294967295 uid=500 gid=500 euid=500 suid=500
fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4294967295
comm="php" exe="/usr/bin/php" subj=system_u:system_r:httpd_t:s0
key=(null) type=AVC msg=audit(1393761691.813:1260): avc:  denied  {
name_connect } for  pid=8532 comm="php" dest=5656
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket type=SYSCALL
msg=audit(1393761691.813:1260): arch=c000003e syscall=42 success=no
exit=-115 a0=4 a1=7fffa6ed55f0 a2=10 a3=0 items=0 ppid=1 pid=8532
auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500
sgid=500 fsgid=500 tty=(none) ses=4294967295 comm="php"
exe="/usr/bin/php" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1393761691.969:1261): avc:  denied  { nlmsg_write }
for  pid=8552 comm="tc" scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_route_socket
share|improve this question
    
what 3rd party solution specifically requires disabling SEL? –  dyasny Mar 3 at 1:17
    
SolusVM. While the software is quite ok those guys don't have security in mind. Once we've had an issue with node-syncing their support disabled the whole firewall to "fix" the problem ... –  justlovingIT Mar 3 at 7:44
1  
why use them then? There's perfectly good oVirt and proxmox available, and if you need support, what can be better than RHEV? –  dyasny Mar 3 at 15:00
1  
Well, that's good to hear. Now I can strike SolusVM off my shopping list. –  Michael Hampton Mar 4 at 0:20
    
Well it isn't that bad after all. You just have to take care of some security aspects (SELinux ^^) yourself. Some other popular products (like cPanel) don't work with SELinux either. I think I might give oVirt a try somewhen in the near future. –  justlovingIT Mar 4 at 8:11

1 Answer 1

up vote 2 down vote accepted

The command you are looking for is

semanage permissive -a httpd_t
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.