[ 
https://issues.apache.org/jira/browse/AIRAVATA-2691?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16373967#comment-16373967
 ] 

Marcus Christie commented on AIRAVATA-2691:
-------------------------------------------

Here's the SELinux module file generated by {{ausearch -c 'httpd' --raw | 
audit2allow -M my-httpd}}:

{noformat}
[root@pga-scigap-develop tmp]# cat my-httpd.te 

module my-httpd 1.0;

require {
        type var_log_t;
        type httpd_sys_rw_content_t;
        type httpd_config_t;
        type httpd_t;
        type etc_t;
        type var_lib_t;
        class file { relabelfrom write };
}

#============= httpd_t ==============

#!!!! WARNING: 'etc_t' is a base type.
allow httpd_t etc_t:file write;
allow httpd_t httpd_config_t:file write;
allow httpd_t httpd_sys_rw_content_t:file relabelfrom;

#!!!! WARNING 'httpd_t' is not allowed to write or create to var_lib_t.  Change 
the label to httpd_var_lib_t.
#!!!! $ semanage fcontext -a -t httpd_var_lib_t 
/var/lib/letsencrypt/.certbot.lock   
#!!!! $ restorecon -R -v /var/lib/letsencrypt/.certbot.lock
allow httpd_t var_lib_t:file write;
allow httpd_t var_log_t:file write;
{noformat}

Probably only need the line with relabelfrom on it.


> Django: large file uploads fail: unable to "relabelfrom"
> --------------------------------------------------------
>
>                 Key: AIRAVATA-2691
>                 URL: https://issues.apache.org/jira/browse/AIRAVATA-2691
>             Project: Airavata
>          Issue Type: Bug
>            Reporter: Marcus Christie
>            Assignee: Marcus Christie
>            Priority: Major
>
> In Django, by default, files that are larger than 2.5 MB are written to /tmp 
> when they are uploaded. Smaller files are simply held in memory.  When the 
> Django portal then tries to move an uploaded file from /tmp to the 
> gateway-user-data directory it triggers an SELinux error:
> Here's the output of running {{sealert -a /var/log/audit/audit.log}}:
> {noformat}
> SELinux is preventing /usr/sbin/httpd from relabelfrom access on the file 
> geombc.dat.1.
> *****  Plugin catchall (100. confidence) suggests   **************************
> If you believe that httpd should be allowed relabelfrom access on the 
> geombc.dat.1 file by default.
> Then you should report this as a bug.
> You can generate a local policy module to allow this access.
> Do
> allow this access for now by executing:
> # ausearch -c 'httpd' --raw | audit2allow -M my-httpd
> # semodule -i my-httpd.pp
> Additional Information:
> Source Context                system_u:system_r:httpd_t:s0
> Target Context                system_u:object_r:httpd_sys_rw_content_t:s0
> Target Objects                geombc.dat.1 [ file ]
> Source                        httpd
> Source Path                   /usr/sbin/httpd
> Port                          <Unknown>
> Host                          <Unknown>
> Source RPM Packages           httpd-2.4.6-67.el7.centos.6.x86_64
> Target RPM Packages           
> Policy RPM                    selinux-policy-3.13.1-166.el7_4.4.noarch
> Selinux Enabled               True
> Policy Type                   targeted
> Enforcing Mode                Enforcing
> Host Name                     pga-scigap-develop.novalocal
> Platform                      Linux pga-scigap-develop.novalocal
>                               3.10.0-514.21.1.el7.x86_64 #1 SMP Thu May 25
>                               17:04:51 UTC 2017 x86_64 x86_64
> Alert Count                   5
> First Seen                    2018-02-22 19:15:23 UTC
> Last Seen                     2018-02-22 21:52:20 UTC
> Local ID                      210abd1e-8284-43c0-b94c-4741bcc1a037
> Raw Audit Messages
> type=AVC msg=audit(1519336340.609:177951): avc:  denied  { relabelfrom } for  
> pid=16307 comm="httpd" name="geombc.dat.1" dev="sdb" ino=231489026 
> scontext=system_u:system_r:httpd_t:s0 
> tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=file
> type=SYSCALL msg=audit(1519336340.609:177951): arch=x86_64 syscall=setxattr 
> success=no exit=EACCES a0=7fda97ec63c0 a1=7fda9c116f30 a2=7fda9c193d88 a3=21 
> items=0 ppid=24650 pid=16307 auid=4294967295 uid=48 gid=48 euid=48 suid=48 
> fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd 
> exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)
> Hash: httpd,httpd_t,httpd_sys_rw_content_t,file,relabelfrom
> {noformat}
> For now I've been able to work around this by setting FILE_UPLOAD_TEMP_DIR in 
> settings_local.py to a location inside of gateway-user-data.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Reply via email to