Fedora Core 5 Tomcat 4 problems

Fedora Core 5 Tomcat 4 problems

[Michael K. Smith]

Hello All:

I am attempting to start Tomcat 4 using an rc script that uses the
unprivileged user "tomcat" to run the application.  The relevant line is:

su -l tomcat -p -s /bin/bash -c /usr/local/tomcat/bin/startup.sh

In addition, the tomcat user has /sbin/nologin in the password file.

Steps to make it work:

1) Set SELinux to permissive and reboot
2) Take resultant AVC messages and create local policy
3) Load policy, set SELinux to enforcing and reboot

If I leave SELinux in permissive the tomcat script works just fine and, if I
allow root to run tomcat that works as well.  I would like to have the
security of SELinux and an unprivileged user running Tomcat, so any help
would be greatly appreciated.

Below is a copy of the local.te file that was generated from the AVC
messages in /var/log/messages after setting to permissive.  The Tomcat
directory is /usr/local/tomcat and shows as:

drwxr-xr-x  tomcat   tomcat   user_u:object_r:usr_t
jakarta-tomcat-4.1.31

lrwxrwxrwx  root     root     user_u:object_r:usr_t            tomcat ->
/usr/local/jakarta-tomcat-4.1.31

Thanks in advance,

Mike


module local 1.0;

require {
        class lnk_file read;
        class dir { getattr search };
        class security compute_av;
        class file { execmod getattr read };

        type initrc_su_t;
        type usr_t;
        type file_t;
        type hald_t;
        type initrc_su_t;
        type initrc_t;
        type locale_t;
        type mysqld_db_t;
        type pam_console_t;
        type security_t;
        type semanage_t;
        type user_home_t;
        type initrc_t;
        type locale_t;
 };

allow initrc_su_t usr_t:lnk_file read;
allow hald_t mysqld_db_t:dir getattr;
allow initrc_su_t security_t:security compute_av;
allow pam_console_t file_t:dir search;
allow initrc_t user_home_t:file execmod;
allow semanage_t locale_t:file { getattr read };


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Stephen Smalley]

On Wed, 2006-05-24 at 09:20 -0700, Michael K. Smith wrote:
> Hello All:
> 
> I am attempting to start Tomcat 4 using an rc script that uses the
> unprivileged user "tomcat" to run the application.  The relevant line is:
> 
> su -l tomcat -p -s /bin/bash -c /usr/local/tomcat/bin/startup.sh
> 
> In addition, the tomcat user has /sbin/nologin in the password file.
> 
> Steps to make it work:
> 
> 1) Set SELinux to permissive and reboot
> 2) Take resultant AVC messages and create local policy
> 3) Load policy, set SELinux to enforcing and reboot

Rebooting shouldn't be strictly necessary in the above sequence.

> If I leave SELinux in permissive the tomcat script works just fine and, if I
> allow root to run tomcat that works as well.  I would like to have the
> security of SELinux and an unprivileged user running Tomcat, so any help
> would be greatly appreciated.
> 
> Below is a copy of the local.te file that was generated from the AVC
> messages in /var/log/messages after setting to permissive.  The Tomcat
> directory is /usr/local/tomcat and shows as:
> 
> drwxr-xr-x  tomcat   tomcat   user_u:object_r:usr_t
> jakarta-tomcat-4.1.31
> 
> lrwxrwxrwx  root     root     user_u:object_r:usr_t            tomcat ->
> /usr/local/jakarta-tomcat-4.1.31

This should really be in a different type than just usr_t.

> Thanks in advance,
> 
> Mike
> 
> 
> module local 1.0;
> 
> require {
>         class lnk_file read;
>         class dir { getattr search };
>         class security compute_av;
>         class file { execmod getattr read };
> 
>         type initrc_su_t;
>         type usr_t;
>         type file_t;
>         type hald_t;
>         type initrc_su_t;
>         type initrc_t;
>         type locale_t;
>         type mysqld_db_t;
>         type pam_console_t;
>         type security_t;
>         type semanage_t;
>         type user_home_t;
>         type initrc_t;
>         type locale_t;
>  };
> 
> allow initrc_su_t usr_t:lnk_file read;

su checking for the home directory.

> allow hald_t mysqld_db_t:dir getattr;
> allow initrc_su_t security_t:security compute_av;

pam_rootok permission check from su.

> allow pam_console_t file_t:dir search;
> allow initrc_t user_home_t:file execmod;

Can we see the full avc message for the execmod denial?

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Michael K. Smith]

Hello Stephen:


On 5/24/06 10:02 AM, "Stephen Smalley" <sds@tycho.nsa.gov> wrote:

> On Wed, 2006-05-24 at 09:20 -0700, Michael K. Smith wrote:
>> Hello All:
>> 
>> I am attempting to start Tomcat 4 using an rc script that uses the
>> unprivileged user "tomcat" to run the application.  The relevant line is:
>> 
>> su -l tomcat -p -s /bin/bash -c /usr/local/tomcat/bin/startup.sh
>> 
>> In addition, the tomcat user has /sbin/nologin in the password file.
>> 
>> Steps to make it work:
>> 
>> 1) Set SELinux to permissive and reboot
>> 2) Take resultant AVC messages and create local policy
>> 3) Load policy, set SELinux to enforcing and reboot
> 
> Rebooting shouldn't be strictly necessary in the above sequence.
> 

Sadly, it's necessary to confirm whether or not the rc script will fire at
boot.  If I run the script after the system has booted everything works just
fine.

<snip>
>> 
>> Below is a copy of the local.te file that was generated from the AVC
>> messages in /var/log/messages after setting to permissive.  The Tomcat
>> directory is /usr/local/tomcat and shows as:
>> 
>> drwxr-xr-x  tomcat   tomcat   user_u:object_r:usr_t
>> jakarta-tomcat-4.1.31
>> 
>> lrwxrwxrwx  root     root     user_u:object_r:usr_t            tomcat ->
>> /usr/local/jakarta-tomcat-4.1.31
> 
> This should really be in a different type than just usr_t.
> 
I set it to system_u:object_r:user_home_t to match the HTTP directory but
that didn't change the initial behavior.

<snip>
> 
> Can we see the full avc message for the execmod denial?

Absolutely.

May 27 08:03:57 bmedia kernel: audit(1117206233.280:4): avc:  denied  { read
} for  pid=1813 comm="su" name="tomcat" dev=sda6 ino=98262
scontext=system_u:system_r:initrc_su_t:s0 tcontext=user_u:object_r:usr_t:s0
tclass=lnk_file


Thanks again,

Mike


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Stephen Smalley]

On Wed, 2006-05-24 at 10:06 -0700, Michael K. Smith wrote:
> Sadly, it's necessary to confirm whether or not the rc script will fire at
> boot.  If I run the script after the system has booted everything works just
> fine.

Hmmm...it should run in the same context in both cases (i.e. initrc_t)
so that manual execution of the rc script yields the expected behavior.
If I create a script in /etc/init.d and restorecon it, executing it
manually does run it in initrc_t as expected here.

> > Can we see the full avc message for the execmod denial?
> 
> Absolutely.
> 
> May 27 08:03:57 bmedia kernel: audit(1117206233.280:4): avc:  denied  { read
> } for  pid=1813 comm="su" name="tomcat" dev=sda6 ino=98262
> scontext=system_u:system_r:initrc_su_t:s0 tcontext=user_u:object_r:usr_t:s0
> tclass=lnk_file

Not that one - the execmod denial, please.  Might help to boot with
audit=1 as well to get the full syscall audit record for it.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Michael K. Smith]

On 5/24/06 11:38 AM, "Stephen Smalley" <sds@tycho.nsa.gov> wrote:

> On Wed, 2006-05-24 at 11:26 -0700, Michael K. Smith wrote:
>> Hi Again:
>> 
>> I'm not seeing any execmod messages in any log.  Have I missed a config
>> parameter that would enable those messages?
> 
> In your original posting to the list, you listed your local policy
> module, and it contained this rule (among others):
> allow initrc_t user_home_t:file execmod;
> 
> Assuming you used audit2allow to generate that policy module, that means
> that audit2allow found an avc message in your log (messages* if not
> running auditd, audit.log* if running auditd) that indicated an execmod
> denial (i.e. a text relocation in a shared library).
> 
> Now, possibly this was not related to the actual problem in su you
> reported and was just leftover in your log from something else.   Ditto
> for the hald_t rule, the pam_console_t rule, and the semanage_t rule.
> In which case only the two rules for initrc_su_t are relevant here, and
> one of those is due to usr_t being on that symlink and home directory.
> The other one (compute_av failure) should likely be allowed in the
> upstream policy, as su -> pam_rootok does need to check a permission to
> see whether the caller is allowed to skip normal password authentication
> (yes if uid 0 and in an authorized domain, no otherwise).

Back on list.  I have downloaded and installed the reference policy from
Sourceforge and now have a policy.conf file that I can use.  What would the
appropriate rule be for addressing the compute_av failure?

May 27 08:49:31 bmedia kernel: audit(1117208968.030:5): avc:  denied  {
compute_av } for  pid=1815 comm="su"
scontext=system_u:system_r:initrc_su_t:s0
tcontext=system_u:object_r:security_t:s0 tclass=security


Thanks,

Mike


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Russell Coker]

On Thursday 25 May 2006 02:20, "Michael K. Smith" <mksmith@adhost.com> wrote:
> I am attempting to start Tomcat 4 using an rc script that uses the
> unprivileged user "tomcat" to run the application.  The relevant line is:
>
> su -l tomcat -p -s /bin/bash -c /usr/local/tomcat/bin/startup.sh

The tomcat start script is broken, it should be using runuser instead.  Change 
it to use runuser instead of su (runuser takes the same parameters so it's an 
easy change) and many of the problems you list will go away.

Also please file a bug report requesting that runuser be used.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Stephen Smalley]

On Wed, 2006-05-24 at 14:34 -0700, Michael K. Smith wrote:
> Back on list.  I have downloaded and installed the reference policy from
> Sourceforge and now have a policy.conf file that I can use.  What would the
> appropriate rule be for addressing the compute_av failure?
> 
> May 27 08:49:31 bmedia kernel: audit(1117208968.030:5): avc:  denied  {
> compute_av } for  pid=1815 comm="su"
> scontext=system_u:system_r:initrc_su_t:s0
> tcontext=system_u:object_r:security_t:s0 tclass=security

You already added this rule via your local module, i.e.
	allow initrc_su_t security_t:security { compute_av };

audit2allow converts audit messages to allow rules for you.

No need to build a custom policy for that purpose.  I mentioned the
upstream policy because while you can fix this via your local module in
the short term, it should be fixed by the upstream policy for everyone
going forward.   Then you can later drop the rule from your local module
when you update to a version that includes it already.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Stephen Smalley]

On Thu, 2006-05-25 at 13:23 +1000, Russell Coker wrote:
> On Thursday 25 May 2006 02:20, "Michael K. Smith" <mksmith@adhost.com> wrote:
> > I am attempting to start Tomcat 4 using an rc script that uses the
> > unprivileged user "tomcat" to run the application.  The relevant line is:
> >
> > su -l tomcat -p -s /bin/bash -c /usr/local/tomcat/bin/startup.sh
> 
> The tomcat start script is broken, it should be using runuser instead.  Change 
> it to use runuser instead of su (runuser takes the same parameters so it's an 
> easy change) and many of the problems you list will go away.
> 
> Also please file a bug report requesting that runuser be used.

Has runuser been upstreamed, or generally ported to other distros yet?
Or is it still Fedora-specific?

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Christopher J. PeBenito]

On Wed, 2006-05-24 at 13:02 -0400, Stephen Smalley wrote:
> On Wed, 2006-05-24 at 09:20 -0700, Michael K. Smith wrote:
> > I am attempting to start Tomcat 4 using an rc script that uses the
> > unprivileged user "tomcat" to run the application.

> > allow initrc_su_t security_t:security compute_av;
> 
> pam_rootok permission check from su.

I have added this to su domains in reference policy.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Michael Smith]

On 5/25/06 6:16 AM, "Christopher J. PeBenito" <cpebenito@tresys.com> wrote:

> On Wed, 2006-05-24 at 13:02 -0400, Stephen Smalley wrote:
>> On Wed, 2006-05-24 at 09:20 -0700, Michael K. Smith wrote:
>>> I am attempting to start Tomcat 4 using an rc script that uses the
>>> unprivileged user "tomcat" to run the application.
> 
>>> allow initrc_su_t security_t:security compute_av;
>> 
>> pam_rootok permission check from su.
> 
> I have added this to su domains in reference policy.

Thank you to everyone for the help.  I did the runuser modification and that
did indeed fix the issue.  Once I download the new reference policy I'll
also remove the local policy per Stephen's advice.

Regards,

Mike


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Russell Coker]

On Thursday 25 May 2006 21:35, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On Thu, 2006-05-25 at 13:23 +1000, Russell Coker wrote:
> > On Thursday 25 May 2006 02:20, "Michael K. Smith" <mksmith@adhost.com> 
wrote:
> > > I am attempting to start Tomcat 4 using an rc script that uses the
> > > unprivileged user "tomcat" to run the application.  The relevant line
> > > is:
> > >
> > > su -l tomcat -p -s /bin/bash -c /usr/local/tomcat/bin/startup.sh
> >
> > The tomcat start script is broken, it should be using runuser instead. 
> > Change it to use runuser instead of su (runuser takes the same parameters
> > so it's an easy change) and many of the problems you list will go away.
> >
> > Also please file a bug report requesting that runuser be used.
>
> Has runuser been upstreamed, or generally ported to other distros yet?
> Or is it still Fedora-specific?

It is specific to Fedora.

For Debian the best solution is to modify start-stop-daemon, this is on my 
todo list.  For Gentoo the best solution is to modify the program that they 
use to start daemons (not sure of the name but know that they have one).

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Fedora Core 5 Tomcat 4 problems

[Russell Coker]

On Thursday 25 May 2006 23:16, "Christopher J. PeBenito" 
<cpebenito@tresys.com> wrote:
> On Wed, 2006-05-24 at 13:02 -0400, Stephen Smalley wrote:
> > On Wed, 2006-05-24 at 09:20 -0700, Michael K. Smith wrote:
> > > I am attempting to start Tomcat 4 using an rc script that uses the
> > > unprivileged user "tomcat" to run the application.
> > >
> > > allow initrc_su_t security_t:security compute_av;
> >
> > pam_rootok permission check from su.
>
> I have added this to su domains in reference policy.

It's really not needed.  With runuser there should not be any need for 
initrc_su_t in Fedora.  When I write the necessary code for Debian there will 
be no need for such things in Debian either.  So this may end up being a 
Gentoo-only thing if you do such things in Gentoo.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.