{"action":"created","issue":{"url":"https://api.github.com/repos/enterprisemediawiki/meza/issues/314","repository_url":"https://api.github.com/repos/enterprisemediawiki/meza","labels_url":"https://api.github.com/repos/enterprisemediawiki/meza/issues/314/labels{/name}","comments_url":"https://api.github.com/repos/enterprisemediawiki/meza/issues/314/comments","events_url":"https://api.github.com/repos/enterprisemediawiki/meza/issues/314/events","html_url":"https://github.com/enterprisemediawiki/meza/issues/314","id":133438065,"node_id":"MDU6SXNzdWUxMzM0MzgwNjU=","number":314,"title":"Set SELinux to \"enforcing\"","user":{"login":"jamesmontalvo3","id":716482,"node_id":"MDQ6VXNlcjcxNjQ4Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/716482?v=4","gravatar_id":"","url":"https://api.github.com/users/jamesmontalvo3","html_url":"https://github.com/jamesmontalvo3","followers_url":"https://api.github.com/users/jamesmontalvo3/followers","following_url":"https://api.github.com/users/jamesmontalvo3/following{/other_user}","gists_url":"https://api.github.com/users/jamesmontalvo3/gists{/gist_id}","starred_url":"https://api.github.com/users/jamesmontalvo3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jamesmontalvo3/subscriptions","organizations_url":"https://api.github.com/users/jamesmontalvo3/orgs","repos_url":"https://api.github.com/users/jamesmontalvo3/repos","events_url":"https://api.github.com/users/jamesmontalvo3/events{/privacy}","received_events_url":"https://api.github.com/users/jamesmontalvo3/received_events","type":"User","site_admin":false},"labels":[{"id":608091129,"node_id":"MDU6TGFiZWw2MDgwOTExMjk=","url":"https://api.github.com/repos/enterprisemediawiki/meza/labels/critical:%20security","name":"critical: security","color":"fc2929","default":false},{"id":609071351,"node_id":"MDU6TGFiZWw2MDkwNzEzNTE=","url":"https://api.github.com/repos/enterprisemediawiki/meza/labels/difficulty:%20hard","name":"difficulty: hard","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-02-13T14:42:37Z","updated_at":"2018-08-15T17:38:48Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"SELinux was set to \"permissive\" due to issues with Parsoid. Several online tutorials state that when installing X software it is assumed SELinux is disabled or permissive. Several other self-described security experts state that you absolutely should have SELinux enforcing for security. Non-RHEL Linux varieties don't even have SELinux, so it seems to me that it's not a strict requirement, but if we can add the security back in, all the better.\n"},"comment":{"url":"https://api.github.com/repos/enterprisemediawiki/meza/issues/comments/413275484","html_url":"https://github.com/enterprisemediawiki/meza/issues/314#issuecomment-413275484","issue_url":"https://api.github.com/repos/enterprisemediawiki/meza/issues/314","id":413275484,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMzI3NTQ4NA==","user":{"login":"djflux","id":5767728,"node_id":"MDQ6VXNlcjU3Njc3Mjg=","avatar_url":"https://avatars3.githubusercontent.com/u/5767728?v=4","gravatar_id":"","url":"https://api.github.com/users/djflux","html_url":"https://github.com/djflux","followers_url":"https://api.github.com/users/djflux/followers","following_url":"https://api.github.com/users/djflux/following{/other_user}","gists_url":"https://api.github.com/users/djflux/gists{/gist_id}","starred_url":"https://api.github.com/users/djflux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djflux/subscriptions","organizations_url":"https://api.github.com/users/djflux/orgs","repos_url":"https://api.github.com/users/djflux/repos","events_url":"https://api.github.com/users/djflux/events{/privacy}","received_events_url":"https://api.github.com/users/djflux/received_events","type":"User","site_admin":false},"created_at":"2018-08-15T17:38:48Z","updated_at":"2018-08-15T17:38:48Z","author_association":"NONE","body":"I've done some research and testing on this issue. I have Type Enforcement file (.te) and Policy Package (.pp) files that adjust the SELinux policy so that an installed monolith MediaWiki works with SELinux set to enforcing. This testing was done with the 31.x branch of meza.\r\n\r\nI used allow2audit to build the .te, .pp, and SELinux modules. (see https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-troubleshooting-fixing_problems#sect-Security-Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow). \r\n\r\nIt looks like .pp files can be created from .te files this way: http://www.unixadmin.net/rhelcentos-7-creating-selinux-policies/ (tools provided by the `checkpolicy` and `policycoreutils-python` RPM packages)\r\n\r\nI've include the .te file contents below for reference.  **NOTE:** There may be a more secure method of allowing all of the Meza components to work in enforcing mode but this method WorksForMe(tm).\r\n\r\nAny recommendations on how to include the .te and/or the .pp file in the meza source and have a variable set the SELinux Type (permissive, enforcing)? Here are some ansible files that could help: https://github.com/MWojtowicz/ansible-semodule\r\n\r\nCheers,\r\nAndy aka Flux\r\n\r\n\r\n```\r\nmodule meza 1.0;\r\n\r\nrequire {\r\n\ttype haproxy_t;\r\n\ttype transproxy_port_t;\r\n\ttype memcache_port_t;\r\n\ttype usr_t;\r\n\ttype mysqld_t;\r\n\ttype httpd_t;\r\n\ttype system_mail_t;\r\n\ttype soundd_port_t;\r\n\ttype sysctl_net_t;\r\n\ttype unreserved_port_t;\r\n\tclass process execmem;\r\n\tclass tcp_socket { name_bind name_connect };\r\n\tclass dir { add_name remove_name rmdir write };\r\n\tclass file { create getattr open read unlink write };\r\n}\r\n\r\n#============= haproxy_t ==============\r\n\r\n#!!!! This avc can be allowed using the boolean 'haproxy_connect_any'\r\nallow haproxy_t soundd_port_t:tcp_socket name_connect;\r\n\r\n#!!!! This avc can be allowed using the boolean 'haproxy_connect_any'\r\nallow haproxy_t transproxy_port_t:tcp_socket name_bind;\r\n\r\n#!!!! This avc can be allowed using one of the these booleans:\r\n#     nis_enabled, haproxy_connect_any\r\nallow haproxy_t unreserved_port_t:tcp_socket name_bind;\r\n\r\n#============= httpd_t ==============\r\n\r\n#!!!! This avc can be allowed using one of the these booleans:\r\n#     httpd_can_network_connect, httpd_can_network_memcache, httpd_can_network_relay\r\nallow httpd_t memcache_port_t:tcp_socket name_connect;\r\n\r\n#!!!! This avc can be allowed using the boolean 'httpd_execmem'\r\nallow httpd_t self:process execmem;\r\n\r\n#!!!! This avc can be allowed using the boolean 'nis_enabled'\r\nallow httpd_t unreserved_port_t:tcp_socket name_bind;\r\n\r\n#============= mysqld_t ==============\r\nallow mysqld_t usr_t:dir { add_name remove_name rmdir write };\r\n\r\n#!!!! WARNING: 'usr_t' is a base type.\r\nallow mysqld_t usr_t:file { create unlink write };\r\n\r\n#============= system_mail_t ==============\r\nallow system_mail_t sysctl_net_t:file { getattr open read };\r\n```"}}
{"actor":{"display_login":"djflux"}}