I have an app, browser shell and I'm executing this command to get list of execuables (https://unix.stackexchange.com/questions/120786/list-all-binaries-from-path/261971)
compgen -A function -abck | sort | uniq
and when I call this command It return executables but I've got lot of errors from SELinux like this one:
SELinux is preventing bash from getattr access on the file /usr/sbin/chronyd.
allow this access for now by executing:
# ausearch -c 'bash' --raw | audit2allow -M my-bash
# semodule -X 300 -i my-bash.pp
is there a way to prevent that that error? I want my app to work in SELinux as well without any errors out of the box.
I can change PATH or execute some command to check if path can be in PATH variable, which probably /usr/sbin can't be in PATH. Does such command exists? I have this PATH by default:
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/usr/games
this is the result of
sudo ausearch -c 'bash' --raw
type=AVC msg=audit(1506851274.781:2921): avc: denied { getattr } for pid=12298 comm="bash" path="/usr/sbin/xl2tpd" dev="sda1" ino=2239132 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:l2tpd_exec_t:s0 tclass=file permissive=1
and with | audit2why
:
type=AVC msg=audit(1506851274.781:2921): avc: denied { getattr } for pid=12298 comm="bash" path="/usr/sbin/xl2tpd" dev="sda1" ino=2239132 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:l2tpd_exec_t:s0 tclass=file permissive=1
Was caused by:
Missing type enforcement (TE) allow rule.
You can use audit2allow to generate a loadable module to allow this access.
is it possible to make my code work wihout the audit2allow
?
Asked by jcubic
(10310 rep)
Oct 1, 2017, 10:01 AM
Last activity: Oct 1, 2017, 11:58 AM
Last activity: Oct 1, 2017, 11:58 AM