informatica:linux:selinux
Differences
This shows you the differences between two versions of the page.
informatica:linux:selinux [2015/07/14 09:02] – created jose | informatica:linux:selinux [2015/11/18 12:53] (current) – jose | ||
---|---|---|---|
Line 9: | Line 9: | ||
Resultado: | Resultado: | ||
Permissive | Permissive | ||
+ | | ||
+ | Si obtenemos un error raro, por ejemplo apache que no arranca con un módulo nuevo, lo podemos ver en el log messages.\\ | ||
+ | Al final nos indica el comando a lanzar e instrucciones a seguir: | ||
+ | Nov 18 13:01:48 setroubleshoot: | ||
+ | | ||
+ | Si ejecutamos el sealert: | ||
+ | |||
+ | # sealert -l b46cdfd9-3c2e-4440-9967-16811bbfe75f | ||
+ | |||
+ | < | ||
+ | SELinux is preventing / | ||
+ | |||
+ | ***** Plugin restorecon (94.8 confidence) suggests | ||
+ | |||
+ | If you want to fix the label. | ||
+ | / | ||
+ | Then you can run restorecon. | ||
+ | Do | ||
+ | # / | ||
+ | |||
+ | ***** Plugin catchall_labels (5.21 confidence) suggests | ||
+ | |||
+ | If you want to allow httpd to have execute access on the libgcc_s.so.1 file | ||
+ | Then you need to change the label on / | ||
+ | Do | ||
+ | # semanage fcontext -a -t httpd_modules_t '/ | ||
+ | where FILE_TYPE is one of the following: httpd_suexec_exec_t, | ||
+ | Then execute: | ||
+ | restorecon -v '/ | ||
+ | |||
+ | |||
+ | ***** Plugin catchall (1.44 confidence) suggests | ||
+ | |||
+ | If you believe that httpd should be allowed execute access on the libgcc_s.so.1 file by default. | ||
+ | Then you should report this as a bug. | ||
+ | You can generate a local policy module to allow this access. | ||
+ | Do | ||
+ | allow this access for now by executing: | ||
+ | # grep httpd / | ||
+ | # semodule -i mypol.pp | ||
+ | </ | ||
+ | |||
+ | Para ver el contexto de una biblioteca, que no librería, de apache: | ||
+ | # ls -Z / | ||
+ | -rwxr-xr-x. root root system_u: | ||
+ | |||
+ | Le ponemos el contexto: httpd_modules_t | ||
+ | / | ||
+ | semanage fcontext -a -t httpd_modules_t '/ | ||
+ |
informatica/linux/selinux.txt · Last modified: 2015/11/18 12:53 by jose