1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

SELinux multiple file context specifications by Plesk - specified where?

Discussion in 'Plesk 10.x for Linux Issues, Fixes, How-To' started by bluik, Mar 29, 2012.

  1. bluik

    bluik Basic Pleskian

    14
    85%
    Joined:
    Jul 5, 2011
    Messages:
    40
    Likes Received:
    0
    Bug: SELinux multiple file context specifications by Plesk - specified where?

    PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE
    Parallels Plesk, 10.4.4 MU24, CentOS 5.8, x86_64

    PROBLEM DESCRIPTION
    SELinux floods about "Multiple different specifications" for file contexts.
    File /etc/selinux/targeted/contexts/files/homedir_template contains conflicting specifications:
    Workaround: remove one of the specifications, run genhomedirecon which generates file contexts for user home directories based on the aforementioned template file. Unfortunately I did not record which one I tried removing first; but after some time passed and making modifications in Plesk the duplicate entry appeared again. Nothing else was done with the system except Plesk actions and tuning SELinux policies (no packages installed for example). So I assume Plesk inserted the duplicate entry. I will test leaving one of the specifications in place at a time and see if the another one appears, to find out which one is inserted by Plesk (or perhaps by something else).

    STEPS TO REPRODUCE
    New clean installation of Plesk. Few testing "subscriptions" (example.com, example.org below) created. The problem start even before subscriptions are created because the template applies to root user's home dir or any other users existing on the user.
    Errors appear in /var/log/messages.

    ACTUAL RESULT
    plesk php-cgi: /etc/selinux/targeted/contexts/files/file_contexts: Multiple different specifications for /home/[^/]*/bin(/.*)? (user_u:eek:bject_r:bin_t:s0 and user_u:eek:bject_r:home_bin_t:s0).
    plesk php-cgi: /etc/selinux/targeted/contexts/files/file_contexts: Multiple different specifications for /var/www/vhosts/example.com/web_users/[^/]*/bin(/.*)? (user_u:eek:bject_r:bin_t:s0 and user_u:eek:bject_r:home_bin_t:s0).
    plesk php-cgi: /etc/selinux/targeted/contexts/files/file_contexts: Multiple different specifications for /var/www/vhosts/example.org/web_users/[^/]*/bin(/.*)? (user_u:eek:bject_r:bin_t:s0 and user_u:eek:bject_r:home_bin_t:s0).
    plesk php-cgi: /etc/selinux/targeted/contexts/files/file_contexts: Multiple different specifications for /root/bin(/.*)? (root:eek:bject_r:bin_t:s0 and root:eek:bject_r:home_bin_t:s0).

    EXPECTED RESULT
    Only single file context set, not multiple conflicting specifications

    ANY ADDITIONAL INFORMATION
    selinux-policy-2.4.6-327.el5.noarch
    selinux-policy-targeted-2.4.6-327.el5.noarch
    libsepol-2.0.36-1.el5.art.x86_64 updated from libsepol-1.15.2-3.el5.x86_64 but the errors for both vhost and user home dir bin start before upgrade from stock CentOS 5 libsepol to atomic libsepol.
    Correction: The errors start after Plesk was installed, before I thought they started before Plesk installation. To be more precise they start right after a reboot was done after Plesk was installed.

    Plesk 10.4.4 was installed while SELinux was turned on. In the past Release Notes instructed to turn SELinux off, but for 10.4 no such warning existed unless I overlooked it - please provide a link to one if it exists.
     
    Last edited: Apr 1, 2012
  2. bluik

    bluik Basic Pleskian

    14
    85%
    Joined:
    Jul 5, 2011
    Messages:
    40
    Likes Received:
    0
    Also these commands can't find the specification for the context:

    semanage fcontext -d '/home/[^/]*/bin(/.*)?'
    semanage fcontext -d '/var/www/vhosts/example.com/web_users/[^/]*/bin(/.*)?'
    semanage fcontext -d '/var/www/vhosts/example.org/web_users/[^/]*/bin(/.*)?'
    semanage fcontext -d ' /root/bin(/.*)?'

    Example output:
     
  3. IgorG

    IgorG Forums Analyst Staff Member

    49
    24%
    Joined:
    Oct 27, 2009
    Messages:
    24,557
    Likes Received:
    1,242
    Location:
    Novosibirsk, Russia
  4. bluik

    bluik Basic Pleskian

    14
    85%
    Joined:
    Jul 5, 2011
    Messages:
    40
    Likes Received:
    0
    Yes the issue is similar, but of course the problem does not come from qmail module but something else. See at the bottom of the reply for the Plesk-specific part about vhosts/../web_users.

    I tried to reload vhostmd module and only got the other set of well-known SELinux errors:

    Don't know which other module could be the cause for the conflicts. And even if the module was found out - how to change because these modules are in "compiled" form as far as I know. They cannot be edited.

    >What makes it more difficult to troubleshoot: only some of the vhosts have the error. Most seem to not have
    > this error! I cannot think of anything special about the three vhosts that have this error on
    > web_users/[^/]*/bin(/.*)?. So it looks like somehow Plesk creates file contexts on the fly when vhosts are created.
    >
    Is that a correct assumption?

    Edit: It seems the two vhosts with errors were the only ones with web_users created in Plesk. If a directory is created under some other vhost's web_users, I cannot see error at least yet. I will try to create a web user with Plesk and see.
     
    Last edited: Mar 29, 2012
  5. bluik

    bluik Basic Pleskian

    14
    85%
    Joined:
    Jul 5, 2011
    Messages:
    40
    Likes Received:
    0
    solved

    For anyone else having this problem, solution is to edit:
    /etc/selinux/targeted/contexts/files/homedir_template
    `genhomedircon` creates the file context specifications based on this file. Plesk edits the template file to add subdirectories of domain directories under /var/www/vhosts; but the problem may have been there before Plesk was installed.

    In the case of this server there were two entries like this:

    Remove one and run `genhomedircon` and the warnings are gone.
     
  6. bluik

    bluik Basic Pleskian

    14
    85%
    Joined:
    Jul 5, 2011
    Messages:
    40
    Likes Received:
    0
    It is definitely a bug in Plesk. I had to remove the duplicate line again after making some changes in Plesk.
     
  7. IgorG

    IgorG Forums Analyst Staff Member

    49
    24%
    Joined:
    Oct 27, 2009
    Messages:
    24,557
    Likes Received:
    1,242
    Location:
    Novosibirsk, Russia
    Please update your initial report with all necessary additional details, workaround, etc. and I will forward it to developers as bugreport. Thank you.
     
  8. bluik

    bluik Basic Pleskian

    14
    85%
    Joined:
    Jul 5, 2011
    Messages:
    40
    Likes Received:
    0
    Thanks Igor. I hope I am correct in the above analysis; everything seems to point to problem at Plesk at the moment.
     
  9. IgorG

    IgorG Forums Analyst Staff Member

    49
    24%
    Joined:
    Oct 27, 2009
    Messages:
    24,557
    Likes Received:
    1,242
    Location:
    Novosibirsk, Russia
    Ok. I have submitted your request to developers. Let's wait their answer. I will update thread when I receive it.
     
  10. bluik

    bluik Basic Pleskian

    14
    85%
    Joined:
    Jul 5, 2011
    Messages:
    40
    Likes Received:
    0
    Workaround to keep Plesk from overwriting the file:
    `chattr +i /etc/selinux/targeted/contexts/files/homedir_template`
    (give immutable attribute to the file so it cannot be modified)
     
Loading...