Sample Header Ad - 728x90

compgen and SELinux

1 vote
1 answer
211 views
I have an app, browser shell and I'm executing this command to get list of execuables (https://unix.stackexchange.com/questions/120786/list-all-binaries-from-path/261971) compgen -A function -abck | sort | uniq and when I call this command It return executables but I've got lot of errors from SELinux like this one: SELinux is preventing bash from getattr access on the file /usr/sbin/chronyd. allow this access for now by executing: # ausearch -c 'bash' --raw | audit2allow -M my-bash # semodule -X 300 -i my-bash.pp is there a way to prevent that that error? I want my app to work in SELinux as well without any errors out of the box. I can change PATH or execute some command to check if path can be in PATH variable, which probably /usr/sbin can't be in PATH. Does such command exists? I have this PATH by default: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/usr/games this is the result of sudo ausearch -c 'bash' --raw type=AVC msg=audit(1506851274.781:2921): avc: denied { getattr } for pid=12298 comm="bash" path="/usr/sbin/xl2tpd" dev="sda1" ino=2239132 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:l2tpd_exec_t:s0 tclass=file permissive=1 and with | audit2why: type=AVC msg=audit(1506851274.781:2921): avc: denied { getattr } for pid=12298 comm="bash" path="/usr/sbin/xl2tpd" dev="sda1" ino=2239132 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:l2tpd_exec_t:s0 tclass=file permissive=1 Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access. is it possible to make my code work wihout the audit2allow?
Asked by jcubic (10310 rep)
Oct 1, 2017, 10:01 AM
Last activity: Oct 1, 2017, 11:58 AM