Apache-2.2
在 apache 中使用 Sudo
我正在使用 CentOS 6 並嘗試使用以下命令在 Apache 中呼叫 sudo:
exec("sudo -u kouser whoami 2>&1",$output,$code);
但是 SElinux 在輸出中添加了一行
array(2) { [0]=> string(53) "sudo: unable to send audit message: Permission denied" [1]=> string(61) "kouser" }
當我停止 SElinux 時,這條線將隱藏。
尾 /var/log/secure
Mar 1 10:11:44 ERP-Server sudo: apache : TTY=unknown ; PWD=/var/www/html/test ; USER=kouser ; COMMAND=/usr/bin/whoami Mar 1 10:11:44 ERP-Server sudo: PAM audit_log_acct_message() failed: Permission denied
我不想使用 audit2allow ;它會解決問題,但我不明白為什麼。
更新
尾 /var/log/audit/audit.log
type=CRYPTO_KEY_USER msg=audit(1456820535.260:395): user pid=2580 uid=0 auid=511 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a6:e2:91:a3:bd:bf:85:dd:bb:13:c5:eb:18:23:38:8f direction=? spid=2580 suid=0 exe="/usr/sbin/sshd" hostname=? addr=192.168.0.110 terminal=? res=success' type=CRYPTO_KEY_USER msg=audit(1456820535.260:396): user pid=2580 uid=0 auid=511 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6b:bb:f8:63:c5:9b:e3:67:e6:f8:c1:5a:cd:2c:72:77 direction=? spid=2580 suid=0 exe="/usr/sbin/sshd" hostname=? addr=192.168.0.110 terminal=? res=success' type=AVC msg=audit(1456820604.024:397): avc: denied { nlmsg_relay } for pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket type=SYSCALL msg=audit(1456820604.024:397): arch=c000003e syscall=44 success=no exit=-13 a0=3 a1=7fffea1f4070 a2=78 a3=0 items=0 ppid=2613 pid=2614 auid=4294967295 uid=48 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="sudo" exe="/usr/bin/sudo" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1456820604.025:398): avc: denied { nlmsg_relay } for pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket type=SYSCALL msg=audit(1456820604.025:398): arch=c000003e syscall=44 success=no exit=-13 a0=8 a1=7fffea1f7c20 a2=6c a3=0 items=0 ppid=2613 pid=2614 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="sudo" exe="/usr/bin/sudo" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1456820604.035:399): avc: denied { nlmsg_relay } for pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket type=SYSCALL msg=audit(1456820604.035:399): arch=c000003e syscall=44 success=no exit=-13 a0=8 a1=7fffea1f7c20 a2=70 a3=0 items=0 ppid=2613 pid=2614 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="sudo" exe="/usr/bin/sudo" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1456820604.112:400): avc: denied { write } for pid=2616 comm="setroubleshootd" name="__db.001" dev=dm-0 ino=1971765 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file type=SYSCALL msg=audit(1456820604.112:400): arch=c000003e syscall=2 success=no exit=-13 a0=1913580 a1=2 a2=0 a3=16 items=0 ppid=2615 pid=2616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
您的問題是由於 httpd_t 沒有合適的權限來訪問 netlink_audit_socket 上下文而引起的。在這種情況下,audit2why(8)很有用
type=AVC msg=audit(1456820604.024:397): avc: denied { nlmsg_relay } for pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket Was caused by: The boolean allow_httpd_mod_auth_pam was set incorrectly. Description: Allow Apache to use mod_auth_pam Allow access by executing: # setsebool -P allow_httpd_mod_auth_pam 1
實際上,預設策略不允許您想要做的事情,但允許它啟用相關的布爾值是相當簡單的。