Package: selinux-policy-default
Version: 2:2.20161023.1-9
Severity: important
Dear Maintainer,
I 've configured my server as LAMP server for wordpress hosting.
I installed ex versions of packages:
***
root@vps:~# dpkg -l | grep "apache\|mysql\|mariadb\|php\|wordpress"
ii apache2 2.4.25-3+deb9u9 amd64
Apache HTTP Server
ii apache2-bin 2.4.25-3+deb9u9 amd64
Apache HTTP Server (modules and other binary files)
ii apache2-data 2.4.25-3+deb9u9 all
Apache HTTP Server (common files)
ii apache2-doc 2.4.25-3+deb9u9 all
Apache HTTP Server (on-site documentation)
ii apache2-utils 2.4.25-3+deb9u9 amd64
Apache HTTP Server (utility programs for web servers)
ii libapache2-mod-php 1:7.0+49 all
server-side, HTML-embedded scripting language (Apache 2 module) (default)
ii libapache2-mod-php7.0 7.0.33-0+deb9u7 amd64
server-side, HTML-embedded scripting language (Apache 2 module)
ii libdbd-mysql-perl 4.041-2 amd64
Perl5 database interface to the MariaDB/MySQL database
ii libmariadbclient18:amd64 10.1.44-0+deb9u1 amd64
MariaDB database client library
ii libphp-phpmailer 5.2.14+dfsg-2.3+deb9u1 all
full featured email transfer class for PHP
ii mariadb-client-10.1 10.1.44-0+deb9u1 amd64
MariaDB database client binaries
ii mariadb-client-core-10.1 10.1.44-0+deb9u1 amd64
MariaDB database core client binaries
ii mariadb-common 10.1.44-0+deb9u1 all
MariaDB common metapackage
ii mariadb-server 10.1.44-0+deb9u1 all
MariaDB database server (metapackage depending on the latest version)
ii mariadb-server-10.1 10.1.44-0+deb9u1 amd64
MariaDB database server binaries
ii mariadb-server-core-10.1 10.1.44-0+deb9u1 amd64
MariaDB database core server files
ii mysql-common 5.8+1.0.2 all
MySQL database common files, e.g. /etc/mysql/my.cnf
ii php-common 1:49 all
Common files for PHP packages
ii php-gd 1:7.0+49 all
GD module for PHP [default]
ii php-getid3 1.9.12+dfsg-1 all
scripts to extract information from multimedia files
ii php-mysql 1:7.0+49 all
MySQL module for PHP [default]
ii php7.0-cli 7.0.33-0+deb9u7 amd64
command-line interpreter for the PHP scripting language
ii php7.0-common 7.0.33-0+deb9u7 amd64
documentation, examples and common module for PHP
ii php7.0-gd 7.0.33-0+deb9u7 amd64
GD module for PHP
ii php7.0-json 7.0.33-0+deb9u7 amd64
JSON module for PHP
ii php7.0-mysql 7.0.33-0+deb9u7 amd64
MySQL module for PHP
ii php7.0-opcache 7.0.33-0+deb9u7 amd64
Zend OpCache module for PHP
ii php7.0-readline 7.0.33-0+deb9u7 amd64
readline module for PHP
ii python3-pymysql 0.7.10-1 all
Pure-Python MySQL Driver - Python 3.x
ii wordpress 4.7.5+dfsg-2+deb9u6 all
weblog manager
ii wordpress-l10n 4.7.5+dfsg-2+deb9u6 all
weblog manager - language files
ii wordpress-theme-twentyseventeen 4.7.5+dfsg-2+deb9u6 all
weblog manager - twentyseventeen theme files
***
I endabled next systemd units:
***
root@vps:~# systemctl list-units | grep "apache\|mysql\|mariadb\|php"
apache2.service loaded
active running The Apache HTTP Server
mariadb.service loaded
active running MariaDB 10.1.44 database server
phpsessionclean.timer loaded
active waiting Clean PHP session files every 30 mins
***
So, by default mariaDB configured to interact by unix socked.
After start MariaDB, it creates expected socket:
***
root@vps:~# ls -la /var/run/mysqld/
total 0
drwxr-xr-x. 2 mysql root 40 Jun 15 01:52 .
drwxr-xr-x. 26 root root 800 Jun 15 01:25 ..
root@vps:~# systemctl start mariadb
root@vps:~# ls -lZ /run/mysqld/
total 4
-rw-rw----. 1 mysql mysql system_u:object_r:mysqld_var_run_t:s0 5 Jun 15 01:52
mysqld.pid
srwxrwxrwx. 1 mysql mysql system_u:object_r:mysqld_var_run_t:s0 0 Jun 15 01:52
mysqld.sock
root@vps:~# systemctl status mariadb
● mariadb.service - MariaDB 10.1.44 database server
Loaded: loaded (/lib/systemd/system/mariadb.service; enabled; vendor preset:
enabled)
Active: active (running) since Mon 2020-06-15 01:52:51 MSK; 19s ago
Docs: man:mysqld(8)
https://mariadb.com/kb/en/library/systemd/
Process: 3136 ExecStartPost=/bin/sh -c systemctl unset-environment
_WSREP_START_POSITION (code=exited, status=0/SUCCESS)
Process: 3134 ExecStartPost=/etc/mysql/debian-start (code=exited,
status=0/SUCCESS)
Process: 3030 ExecStartPre=/bin/sh -c [ ! -e /usr/bin/galera_recovery ] &&
VAR= || VAR=`/usr/bin/galera_recovery`; [ $? -eq 0 ] && systemctl
set-environment _WSREP_START_POSITION=$VAR || exit 1 (code=exited,
status=0/SUCCESS
Process: 3025 ExecStartPre=/bin/sh -c systemctl unset-environment
_WSREP_START_POSITION (code=exited, status=0/SUCCESS)
Process: 3022 ExecStartPre=/usr/bin/install -m 755 -o mysql -g root -d
/var/run/mysqld (code=exited, status=0/SUCCESS)
Main PID: 3107 (mysqld)
Status: "Taking your SQL requests now..."
Tasks: 26 (limit: 4915)
CGroup: /system.slice/mariadb.service
└─3107 /usr/sbin/mysqld
Jun 15 01:52:50 vps systemd[1]: Starting MariaDB 10.1.44 database server...
Jun 15 01:52:51 vps mysqld[3107]: 2020-06-15 1:52:51 139931111169408 [Note]
/usr/sbin/mysqld (mysqld 10.1.44-MariaDB-0+deb9u1) starting as process 3107 ...
Jun 15 01:52:51 vps systemd[1]: Started MariaDB 10.1.44 database server.
root@vps:~#
***
But when I am trying to open configured and enabled Wordpress site, it shows me
message "Error establishing a database connection".
And I can see in the audit.log message like this:
***
type=AVC msg=audit(1592175454.425:292): avc: denied { execmem } for pid=774
comm="apache2" scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=process permissive=0
type=AVC msg=audit(1592175454.429:293): avc: denied { execmem } for pid=774
comm="apache2" scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=process permissive=0
type=AVC msg=audit(1592175454.429:294): avc: denied { execmem } for pid=774
comm="apache2" scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=process permissive=0
type=AVC msg=audit(1592175454.441:295): avc: denied { execmem } for pid=774
comm="apache2" scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:system_r:httpd_t:s0 tclass=process permissive=0
type=AVC msg=audit(1592175454.441:296): avc: denied { connectto } for
pid=774 comm="apache2" path="/run/mysqld/mysqld.sock"
scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:init_t:s0
tclass=unix_stream_socket permissive=0
***
I expected to see "tcontext=system_u:system_r:mysqld_var_run_t:s0" in the
audit.log, since "ls -lZ /run/mysqld/" it shows.
But audit.log shows me "tcontext=<...>:init_t:s0".
So, I have to use audit2allow to allow this work.
***
root@vps:/tmp# cat apache2.te
module apache2 1.0;
require {
type httpd_t;
type init_t;
class unix_stream_socket connectto;
}
#============= httpd_t ==============
#!!!! This avc is allowed in the current policy
allow httpd_t init_t:unix_stream_socket connectto;
***
-- System Information:
Debian Release: 9.12
APT prefers oldstable-updates
APT policy: (500, 'oldstable-updates'), (500, 'oldstable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.9.0-12-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL
set to en_US.UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set
to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages selinux-policy-default depends on:
ii libselinux1 2.6-3+b3
ii libsemanage1 2.6-2
ii libsepol1 2.6-2
ii policycoreutils 2.6-3
ii selinux-utils 2.6-3+b3
Versions of packages selinux-policy-default recommends:
ii checkpolicy 2.6-2
ii setools 4.0.1-6
Versions of packages selinux-policy-default suggests:
pn logcheck <none>
pn syslog-summary <none>
-- no debconf information
