mjhjmtu

I began playing with RPM based OSes and I am really impressed.

1. Amazon Linux doesn't include setroubleshoot in any of their repos. I want to use official repos for everything, otherwise I would just jump ship. I checked the logs and didn't see a "SELinux is preventing" error, but maybe I don't know what to look for.




2. $_POST variables work when setenforce is set to permissive.




3. My code works on Debian systems. My website is reachable on Amazon Linux but won't redirect correctly.




4. I'm using httpd (what RPM calls apache2). apachectl configtest returns Syntax OK.

This is my code. It is index.php

<form action="index.php" method="post">
 <input type="text" name="username">
 <input type="password" name="password">
 <input type="hidden" name="hidden_value" value="true">
 <input type="submit">
</form>

And then on the same page, I write some php.

<?php
if(isset($_POST['hidden_value'])

 /* Do the rest of your authentication math */


?>

Index.php redirects to index.php, and the $_POST variables handle the redirects. However, it only works when I set SELinux to permissive. I'd like to arm SELinux.

PS It does redirect, but it redirects with the $_POST variable unset.

Thanks to Ulrich Schwarz and hargut for pointing me in the right direction. It was in fact a boolean. I enabled httpd_enable_cgi as suggested, and it still didn't work. Then I looked at the list of booleans using

sudo getsebool -a | grep httpd

That's how I found out that there is a boolean called

httpd_can_network_connect_db

and that it was turned off.

I turned it on by using

sudo setsebool httpd_can_network_connect_db=1

If anyone uses MySql and is migrating from Debian to a Security Enhanced system, this is prerequisite. So much to learn about SELinux. Thanks again.

Make sure to check /var/log/audit/audit.log for selinux warnings. It might suggest what policy to enable.

Otherwise, you can set SELinux in permissive mode and then use the aforementioned logfile to build a custom policy encompassing all the needs of your application. In order to do this, set SELinux in permissive mode, use all the features of your code and then use the audit2allow to generate a custom policy.

You can then bundle and distribute the policy file with your code so that SELinux will allow all and only the special permissions that your code needs:

# generate a custom policy
grep "AVC" /var/log/audit/audit.log | audit2allow -M yourapp
# install that policy
semodule -i yourapp.pp 

Whatever you do, don't go in production with SELinux turned off!

Consider watching this awesome intro to SELinux: https://www.youtube.com/watch?v=_WOKRaM-HI4