Latex Lamp I Selinux

[gotrunks]

Witam wszystkich!

 

Mam drobny problem z Latexem i Selinuxem, otóż w aplikacji php wywoływany jest przez execa:

latex -output-format=pdf jakistam.tex

 

i w tym momencie SeLinux krzyczy:

SELinux is preventing /usr/bin/pdftex from read access on the plik /var/lib/texmf/ls-R.

Plugin: catchall 
należy zezwolić pdftex na dostęp read w ls-R fileJeśli aby pdftex powinno mieć domyślnie read dostęp do ls-R file.
Proszę to zgłosić jako błąd.
Można utworzyć lokalny moduł polityki, aby umożliwić ten dostęp.
Allow this access for now by executing:
# grep latex /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

 

Na CentOSach miewiałem podobne problem ale utworzenie lokalnego modułu polityki selinuxa pomagało, na fedorze nie chce ;/ Będę wdzięczny za wskazówki.

 

Dodam, że aplikacja phpa działa rzecz jasna na apachu jako vhost z suExeciem.

[Gość]

Wklej log z /var/log/audit/audit.log:

# grep latex /var/log/audit/audit.log

[gotrunks]

Nie było mnie jakiś czas, ale problem wciąż istnieje. Log audit produkuje dość sporo podczas tego błędu:

 

type=AVC msg=audit(1296582203.904:77): avc:  denied  { read } for  pid=3873 comm="latex" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582203.904:77): arch=40000003 syscall=33 success=no exit=-13 a0=910e530 a1=4 a2=971118 a3=910e530 items=0 ppid=3486 pid=3873 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="latex" exe="/usr/bin/pdftex" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582204.093:78): avc:  denied  { read } for  pid=3883 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582204.093:78): arch=40000003 syscall=33 success=no exit=-13 a0=9f2e568 a1=4 a2=971118 a3=9f2e568 items=0 ppid=3882 pid=3883 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582204.247:79): avc:  denied  { read } for  pid=3888 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582204.247:79): arch=40000003 syscall=33 success=no exit=-13 a0=9fe1560 a1=4 a2=971118 a3=9fe1560 items=0 ppid=3887 pid=3888 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582204.450:80): avc:  denied  { read } for  pid=3892 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582204.450:80): arch=40000003 syscall=33 success=no exit=-13 a0=9a2b560 a1=4 a2=971118 a3=9a2b560 items=0 ppid=3885 pid=3892 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582204.615:81): avc:  denied  { read } for  pid=3893 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582204.615:81): arch=40000003 syscall=33 success=no exit=-13 a0=8248568 a1=4 a2=971118 a3=8248568 items=0 ppid=3876 pid=3893 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582204.773:82): avc:  denied  { read } for  pid=3896 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582204.773:82): arch=40000003 syscall=33 success=no exit=-13 a0=9db0568 a1=4 a2=971118 a3=9db0568 items=0 ppid=3876 pid=3896 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582204.886:83): avc:  denied  { read } for  pid=3898 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582204.886:83): arch=40000003 syscall=33 success=no exit=-13 a0=8367570 a1=4 a2=971118 a3=8367570 items=0 ppid=3897 pid=3898 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582205.139:84): avc:  denied  { read } for  pid=3907 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582205.139:84): arch=40000003 syscall=33 success=no exit=-13 a0=83a8cd8 a1=4 a2=971118 a3=83a8cd8 items=0 ppid=3906 pid=3907 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582205.250:85): avc:  denied  { read } for  pid=3910 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582205.250:85): arch=40000003 syscall=33 success=no exit=-13 a0=8806b78 a1=4 a2=971118 a3=8806b78 items=0 ppid=3909 pid=3910 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582205.453:86): avc:  denied  { read } for  pid=3914 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582205.453:86): arch=40000003 syscall=33 success=no exit=-13 a0=9cd8b78 a1=4 a2=971118 a3=9cd8b78 items=0 ppid=3913 pid=3914 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582205.619:87): avc:  denied  { read } for  pid=3916 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582205.619:87): arch=40000003 syscall=33 success=no exit=-13 a0=93e4b78 a1=4 a2=971118 a3=93e4b78 items=0 ppid=3915 pid=3916 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582205.750:88): avc:  denied  { read } for  pid=3918 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582205.750:88): arch=40000003 syscall=33 success=no exit=-13 a0=9b10b78 a1=4 a2=971118 a3=9b10b78 items=0 ppid=3917 pid=3918 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582205.956:89): avc:  denied  { read } for  pid=3922 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582205.956:89): arch=40000003 syscall=33 success=no exit=-13 a0=934eb78 a1=4 a2=971118 a3=934eb78 items=0 ppid=3921 pid=3922 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1296582206.123:90): avc:  denied  { read } for  pid=3924 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file
type=SYSCALL msg=audit(1296582206.123:90): arch=40000003 syscall=33 success=no exit=-13 a0=8d55b78 a1=4 a2=971118 a3=8d55b78 items=0 ppid=3923 pid=3924 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm="kpsewhich" exe="/usr/bin/kpsewhich" subj=unconfined_u:system_r:httpd_t:s0 key=(null)

 

Tutaj jeszcze raz problem jaki wypisuje SELinux:

 

SELinux is preventing /usr/bin/pdftex from read access on the plik /var/lib/texmf/ls-R.

*****  Wtyczka catchall (100. zaufania) sugeruje *****************************

Jeśli aby pdftex powinno mieć domyślnie read dostęp do ls-R file.
Wtedy proszę to zgłosić jako błąd.
Można utworzyć lokalny moduł polityki, aby umożliwić ten dostęp.
Wykonać
można tymczasowo zezwolić na ten dostęp wykonując polecenia:
# grep latex /var/log/audit/audit.log | audit2allow -M moja_polityka
# semodule -i moja_polityka.pp

Additional Information:
Kontekst źródłowy             unconfined_u:system_r:httpd_t:s0
Kontekst docelowy             unconfined_u:object_r:tetex_data_t:s0
Obiekty docelowe              /var/lib/texmf/ls-R [ file ]
Źródło                        latex
Ścieżka źródłowa              /usr/bin/pdftex
Port                          <Nieznane>
Komputer                      mikelap.workgroup
Źródłowe pakiety RPM          texlive-2007-56.fc14
Docelowe pakiety RPM          texlive-texmf-2007-36.fc14
Pakiet RPM polityki           selinux-policy-3.9.7-25.fc14
SELinux jest włączony         True
Typ polityki                  targeted
Tryb wymuszania               Enforcing
Nazwa komputera               mikelap.workgroup
Platforma                     Linux mikelap.workgroup 2.6.35.10-74.fc14.i686 #1
                             SMP Thu Dec 23 16:17:40 UTC 2010 i686 i686
Liczba alarmów                84
Po raz pierwszy               wto, 25 sty 2011, 22:47:42
Po raz ostatni                wto, 1 lut 2011, 18:43:26
Lokalny identyfikator         9d6661f9-c6a6-4fa1-855e-4bb45cc4aac0

Surowe komunikaty audytu
type=AVC msg=audit(1296582206.123:90): avc:  denied  { read } for  pid=3924 comm="kpsewhich" name="ls-R" dev=dm-0 ino=401841 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:tetex_data_t:s0 tclass=file


type=SYSCALL msg=audit(1296582206.123:90): arch=i386 syscall=access success=no exit=EACCES a0=8d55b78 a1=4 a2=971118 a3=8d55b78 items=0 ppid=3923 pid=3924 auid=500 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=2 comm=kpsewhich exe=/usr/bin/kpsewhich subj=unconfined_u:system_r:httpd_t:s0 key=(null)

Hash: latex,httpd_t,tetex_data_t,file,read

audit2allow

#============= httpd_t ==============
allow httpd_t tetex_data_t:file read;

audit2allow -R

#============= httpd_t ==============
allow httpd_t tetex_data_t:file read;