Showing posts with label selinux. Show all posts
Showing posts with label selinux. Show all posts

setroubleshoot: SELinux is preventing /sbin/ifconfig from read access on the file /var/run/vmware-active-nics

$ sealert -l 3e0f34bc-787a-4288-bde3-8bca65306491
SELinux is preventing /sbin/ifconfig from read access on the file /var/run/vmware-active-nics.

***** Plugin restorecon (99.5 confidence) suggests *************************

If you want to fix the label.
/var/run/vmware-active-nics default label should be vmware_host_pid_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /var/run/vmware-active-nics

***** Plugin catchall (1.49 confidence) suggests ***************************

If you believe that ifconfig should be allowed read access on the vmware-active-nics file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep /sbin/ifconfig /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

SELinux is preventing /sbin/ifconfig "search" access for ddclient

per https://bugzilla.redhat.com/show_bug.cgi?id=657947

sudo semanage permissive -a ddclient_t

Configure Squirrelmail

Change domain in /etc/squirrelmail/config.php:
$domain = 'mydomain.com';
so the email received will have user@mydomain.com

To use https on apache, add the following to /etc/httpd/conf.d/squirrelmail.conf:
<Location /webmail>RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule .* https://%{HTTP_HOST}:443%{REQUEST_URI} [QSA,R=permanent,L]
</Location>


Finally, selinux settings:
setsebool -P httpd_can_network_connect=1

CentOS Selinux

Install setroubleshoot.noarch to show selinux error messages:
 yum install setroubleshoot-server.noarch setroubleshoot.noarch


Allow Apache to listen to a different port and check which port is selinux allowed:

semanage port -a -t http_port_t -p tcp 81

semanage port -l


selinux also prevent mysqld to start after relocate /var/lib/mysql to /home/mysql:
 chcon -R -t mysqld_var_run_t /home/mysql 
ll -Z .
-rw-rw---- mysql mysql user_u:object_r:mysqld_var_run_t ibdata1
-rw-rw---- mysql mysql user_u:object_r:mysqld_var_run_t ib_logfile0
-rw-rw---- mysql mysql user_u:object_r:mysqld_var_run_t ib_logfile1
drwx------ mysql mysql user_u:object_r:mysqld_var_run_t mysql
drwx------ mysql mysql user_u:object_r:mysqld_var_run_t test

Allow mysqld to use /home/mysql

# cat /tmp/avc
host=tortoise type=AVC msg=audit(1221459330.317:413): avc: denied { create } for pid=7642 comm="mysqld" name="forum_db" scontext=system_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:mysqld_var_run_t:s0 tclass=dir
# audit2allow -M local < /tmp/avc
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i local.pp

# semodule -i local.pp

#audit2allow -M local -i /var/log/audit/audit.log

httpd access denial, change type to httpd_sys_content_t
chcon -R -t httpd_sys_content_t /var/www/html/