1

I am under Fedora 31 (linux kernel 5.4.13, Nginx 1.16.1, fcgiwrap 1.1.0) running with SELinux in enforcing mode (policy: targeted 3.14.4-44.fc31).

My box hosts a server driven by Nginx. Part of it relies on Perl scripts. Nginx has been configured to hand over CGI execution trough FastCGI with fcgiwrap (connection through a Unix socket /var/run/fcgiwrap/fcgiwrap@0.sock).

Everything has been tested in "Permissive" mode. Then it was switched to "Enforcing" mode. I received a bunch of AVCs which could be handled either changing booleans or creating custom policies as suggested by the audit comments.

However, one AVC cannot be addressed. Journal tells:

 type=AVC msg=audit(1580046727.459:548): avc:  denied  { connectto } for  pid=4619 comm="nginx" path="/run/fcgiwrap/fcgiwrap-0.sock" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=0

Custom policy contains the following:

module nginx 1.0;

require {
    type httpd_t;
    type soundd_port_t;
    type http_port_t;
    type tor_port_t;
    type unconfined_service_t;
    type httpd_user_content_t;
    class tcp_socket { name_bind name_connect };
    class file { getattr read };
    class unix_stream_socket connectto;
}

#============= httpd_t ==============

#!!!! This avc is allowed in the current policy
allow httpd_t http_port_t:tcp_socket name_connect;

#!!!! This avc is allowed in the current policy
allow httpd_t httpd_user_content_t:file { getattr read };
allow httpd_t soundd_port_t:tcp_socket name_bind;

#!!!! This avc is allowed in the current policy
allow httpd_t tor_port_t:tcp_socket name_connect;
allow httpd_t unconfined_service_t:unix_stream_socket connectto;

As can be seen from the auto-generated comments, this custom policy has no effect because it is already included in the global policy.

After I add this module, nothing changes. I still receive AVC alerts suggesting the same fix.

If I revert to "Permissive" or if I set domain httpd in permissive mode, the CGI scripts are executed and I receive the expected output.

ls -Z /var/run/fcgiwrap/fcgiwrap-0.sock returns:

system_u:object_r:httpd_var_run_t:s0 /var/run/fcgiwrap/fcgiwrap-0.sock

I was not able to find where label httpd_var_run_t was used and whether a boolean controlled access to this file type (I'm quite a newbie in SELinux configuration).

How can I grant access to the socket in "Enforcing" mode?

EDIT 2020-01-27

It looks like there is already a transition rule in module apache for:

allow httpd_t unconfined_service_t:unix_stream_socket connectto;

but it is ineffective or another module (which one?) is blocking it. The temporary workaround is to put domain httpd in permissive mode, but I don't like it because any web server is now allowed to do anything.

Any idea why transition is denied?

0

I've not checked or tested this adequately -- in fact I'm pretty sure this alone wont work.

I'm assuming that creation of the path /var/run/fcgiwrap has the directory type unconfined_service_t and I'm not certain if that is actually the case.

However this should get you somewhere started.

policy_module(nginx_local, 31.0.0)

require {
  type httpd_t;
  type unconfined_service_t;
}

stream_connect_pattern(httpd_t, unconfined_service_t, unconfined_service_t, unconfined_service_t)

As for the networking issues, you might just want to switch on the boolean httpd_can_network_connect which should silence a few of those already. Unless you're looking to be specific about it.

In the best and ideal circumstances it would be ideal to make a policy specific for your fcgi proces but thats a much more difficult undertaking, so getting nginx to just interact with unconfined services - whilst less secure - is a lot easier.

1
  • http_can_network_connect is already "on". Directory /var/run/fgcwrap has the same label as the socket irself. This is set by the general labeling policy. What is stream_connect_pattern? It is not suggested by audit2allow. Will it address my connectto denial? – ajlittoz Jan 26 '20 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.