Red Hat Enterprise Linux 5 Administration Unleashed

472CHAPTER 23Protecting Against Intruders with Security-Enhanced LinuxLISTING 23.4Continueda3=5555cc034e22 items=0 ppid=19307 pid=19315 auid=501 uid=48 gid=48 euid=48suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm=”httpd”exe=”/usr/sbin/httpd” subj=user_u:system_r:httpd_t:s0 key=(null)type=AVC_PATH msg=audit(1173211195.225:286488): path=”/home/html/index.htmlNotice that the end of the message from /var/log/messages in Listing 23.3 gives thesealert -l e2d75f44-7c89-4fc1-a06b-23603ab00af8 command to execute for completeSELinux messages. The sealert command is part of the SELinux Troubleshooting Tool. Ifthe sealert -l command is used, the same information shown in thegraphical program for the SELinux Troubleshooting Tool is displayed to the commandline. The output from our example is shown in Listing 23.5.LISTING 23.5Analysis of AVC MessagesSummarySELinux is preventing the /usr/sbin/httpd from using potentially mislabeledfiles (/home/html/index.html).Detailed DescriptionSELinux has denied /usr/sbin/httpd access to potentially mislabeled file(s)(/home/html/index.html). This means that SELinux will not allow/usr/sbin/httpd to use these files. It is common for users to edit files intheir home directory or tmp directories and then move (mv) them to systemdirectories. The problem is that the files end up with the wrong filecontext which confined applications are not allowed to access.Allowing AccessIf you want /usr/sbin/httpd to access this files, you need to relabel themusing restorecon -v /home/html/index.html. You might want to relabel theentire directory using restorecon -R -v /home/html.Additional InformationSource Contextuser_u:system_r:httpd_tTarget Contextuser_u:object_r:user_home_tTarget Objects /home/html/index.html [ file ]Affected RPM Packageshttpd-2.2.3-6.el5 [application]Policy RPMselinux-policy-2.4.6-22.el5Selinux EnabledTruePolicy TypetargetedMLS EnabledTrueEnforcing ModeEnforcingPlugin Nameplugins.home_tmp_bad_labelsHost Namesmallville