ChromiumとSELinux
ブラウザでPuppeteerを介してChromiumを実行する必要がありますが、SElinuxアラートがいくつか表示されます。アラート用にaudit2allowモジュールを作成すると、アラートは消えますが、Chromiumはまだ実行されません。 SElinuxをpermissiveモードに戻すとすぐに、Chromiumが再び実行されます。
ここで何をすべきかわかりません。 SElinuxを強制モードで使用できるように、以下のエラーを修正するにはどうすればよいですか？
SElinuxがsemanage permissive -a httpd_tでhttpdモードにあるときにenforcingをpermissiveに設定すると、Chromiumを機能させることもできますが、これは大きなセキュリティ問題だと思いますか？
すべてのSElinuxアラートは/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chromeディレクトリにあるので、これらのディレクトリ/ファイルに特定のラベルを付ける必要があると思いますが、どれですか？
OS：CentOS 7.6
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from using the sys_admin capability.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should have the sys_admin capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'chrome' --raw | audit2allow -M my-chrome
# semodule -i my-chrome.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ capability ]
Source chrome
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 7
First Seen 2019-03-02 16:33:12 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID ff2cf4a9-6788-4027-8986-fc1db4f026b3
Raw Audit Messages
type=AVC msg=audit(1551618018.451:581328): avc: denied { sys_admin } for pid=15865 comm="chrome" capability=21 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=capability permissive=1
type=SYSCALL msg=audit(1551618018.451:581328): Arch=x86_64 syscall=open success=yes exit=ECONNREFUSED a0=559709404bb0 a1=1 a2=20 a3=7ffe9f76fba0 items=0 ppid=15863 pid=15865 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=chrome exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: chrome,httpd_t,httpd_t,capability,sys_admin
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from using the sys_ptrace capability.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should have the sys_ptrace capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'chrome' --raw | audit2allow -M my-chrome
# semodule -i my-chrome.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ capability ]
Source chrome
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 8
First Seen 2019-03-02 16:32:26 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID 195b1636-4c46-47b9-92d2-19323a2e05a8
Raw Audit Messages
type=AVC msg=audit(1551618018.527:581330): avc: denied { sys_ptrace } for pid=15863 comm="chrome" capability=19 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=capability permissive=1
type=SYSCALL msg=audit(1551618018.527:581330): Arch=x86_64 syscall=read success=yes exit=364 a0=70 a1=35eabe34f000 a2=10000 a3=22 items=0 ppid=15848 pid=15863 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=chrome exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: chrome,httpd_t,httpd_t,capability,sys_ptrace
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from create access on the netlink_kobject_uevent_socket labeled httpd_t.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should be allowed create access on netlink_kobject_uevent_socket labeled httpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'Chrome_IOThread' --raw | audit2allow -M my-ChromeIOThread
# semodule -i my-ChromeIOThread.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ netlink_kobject_uevent_socket ]
Source Chrome_IOThread
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 8
First Seen 2019-03-02 16:32:26 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID 9e4b0c7f-78a5-4585-be26-db09f9309f6f
Raw Audit Messages
type=AVC msg=audit(1551618018.602:581331): avc: denied { create } for pid=15863 comm="Chrome_IOThread" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_kobject_uevent_socket permissive=1
type=SYSCALL msg=audit(1551618018.602:581331): Arch=x86_64 syscall=socket success=yes exit=151 a0=10 a1=80803 a2=f a3=35eabe431060 items=0 ppid=15848 pid=15863 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=Chrome_IOThread exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: Chrome_IOThread,httpd_t,httpd_t,netlink_kobject_uevent_socket,create
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from setopt access on the netlink_kobject_uevent_socket labeled httpd_t.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should be allowed setopt access on netlink_kobject_uevent_socket labeled httpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'Chrome_IOThread' --raw | audit2allow -M my-ChromeIOThread
# semodule -i my-ChromeIOThread.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ netlink_kobject_uevent_socket ]
Source Chrome_IOThread
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 8
First Seen 2019-03-02 16:32:26 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID 59f8fbbf-0ce1-4dd3-94ff-8fd5eb13696f
Raw Audit Messages
type=AVC msg=audit(1551618018.603:581332): avc: denied { setopt } for pid=15863 comm="Chrome_IOThread" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_kobject_uevent_socket permissive=1
type=SYSCALL msg=audit(1551618018.603:581332): Arch=x86_64 syscall=setsockopt success=yes exit=0 a0=97 a1=1 a2=1a a3=7fe1ed084420 items=0 ppid=15848 pid=15863 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=Chrome_IOThread exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: Chrome_IOThread,httpd_t,httpd_t,netlink_kobject_uevent_socket,setopt
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from bind access on the netlink_kobject_uevent_socket labeled httpd_t.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should be allowed bind access on netlink_kobject_uevent_socket labeled httpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'Chrome_IOThread' --raw | audit2allow -M my-ChromeIOThread
# semodule -i my-ChromeIOThread.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ netlink_kobject_uevent_socket ]
Source Chrome_IOThread
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 8
First Seen 2019-03-02 16:32:26 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID b50937b0-a30a-4724-8c8d-d50077ae5e1a
Raw Audit Messages
type=AVC msg=audit(1551618018.603:581333): avc: denied { bind } for pid=15863 comm="Chrome_IOThread" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_kobject_uevent_socket permissive=1
type=SYSCALL msg=audit(1551618018.603:581333): Arch=x86_64 syscall=bind success=yes exit=0 a0=97 a1=35eabe384a10 a2=c a3=7fe1ed084420 items=0 ppid=15848 pid=15863 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=Chrome_IOThread exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: Chrome_IOThread,httpd_t,httpd_t,netlink_kobject_uevent_socket,bind
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from getattr access on the netlink_kobject_uevent_socket labeled httpd_t.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should be allowed getattr access on netlink_kobject_uevent_socket labeled httpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'Chrome_IOThread' --raw | audit2allow -M my-ChromeIOThread
# semodule -i my-ChromeIOThread.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ netlink_kobject_uevent_socket ]
Source Chrome_IOThread
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 8
First Seen 2019-03-02 16:32:26 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID 889a731e-830f-4ae8-8a66-bfdb0532629e
Raw Audit Messages
type=AVC msg=audit(1551618018.603:581334): avc: denied { getattr } for pid=15863 comm="Chrome_IOThread" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_kobject_uevent_socket permissive=1
type=SYSCALL msg=audit(1551618018.603:581334): Arch=x86_64 syscall=getsockname success=yes exit=0 a0=97 a1=7fe1ed085490 a2=7fe1ed08548c a3=7fe1ed084420 items=0 ppid=15848 pid=15863 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=Chrome_IOThread exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: Chrome_IOThread,httpd_t,httpd_t,netlink_kobject_uevent_socket,getattr
SElinuxとhttpdを強制モードに保ちながらChromiumを機能させることができましたが、これはChromiumを効果的に許容モードに設定するラベルを使用することを意味します。
httpd_unconfined_script_exec_t
Sudo semanage fcontext -a -t httpd_unconfined_script_exec_t '/var/www/html/node_modules/puppeteer/.local-chromium(/.*)?/chrome-linux/chrome'
Sudo restorecon -R -v '/var/www/html/node_modules/puppeteer/.local-chromium/'
私はまだ誰かからより良い解決策を見つけることを望んでいるので、これを答えとしてマークする前にしばらく待ちます。