EPrints and SELinux - Revision history

Drn@ecs.soton.ac.uk: /* eprints.te */

2025-07-31T17:44:18Z

eprints.te

← Older revision		Revision as of 17:44, 31 July 2025
Line 136:		Line 136:
	type shadow_t;		type shadow_t;
	type unconfined_service_t;		type unconfined_service_t;
			type unreserved_port_t;
	type usr_t;		type usr_t;
	type var_run_t;		type var_run_t;

Drn@ecs.soton.ac.uk: /* eprints.te */

2025-07-31T17:43:18Z

eprints.te

← Older revision		Revision as of 17:43, 31 July 2025
Line 131:		Line 131:
	type httpd_t;		type httpd_t;
	type ldap_port_t;		type ldap_port_t;
			type lib_t;
	type init_t;		type init_t;
	type mysqld_t;		type mysqld_t;
	type shadow_t;		type shadow_t;
	type unconfined_service_t;		type unconfined_service_t;
			type usr_t;
	type var_run_t;		type var_run_t;
	class dir { add_name remove_name setattr };		class dir { add_name remove_name setattr };

Drn@ecs.soton.ac.uk: /* eprints.te */

2025-07-31T17:40:31Z

eprints.te

Drn@ecs.soton.ac.uk: /* eprints.te */

2025-07-31T17:40:13Z

eprints.te

← Older revision		Revision as of 17:40, 31 July 2025
Line 122:		Line 122:

	=== eprints.te ===		=== eprints.te ===
	module eprints 1.2;		module eprints 1.4;

	require {		require {
	~~type cgroup_t;~~
	~~type fusefs_t;~~
	~~type http_port_t;~~
	type httpd_sys_content_t;		type httpd_sys_content_t;
	type httpd_sys_rw_content_t;		type httpd_sys_rw_content_t;
Line 133:		Line 130:
	type httpd_sys_script_t;		type httpd_sys_script_t;
	type httpd_t;		type httpd_t;
			type ldap_port_t;
	type init_t;		type init_t;
	~~type modules_object_t;~~
	~~type mysqld_db_t;~~
	~~type mysqld_etc_t;~~
	type mysqld_t;		type mysqld_t;
	~~type mysqld_var_run_t;~~
	~~type nrpe_t;~~
	type shadow_t;		type shadow_t;
	~~type smtp_port_t;~~
	type unconfined_service_t;		type unconfined_service_t;
	type var_run_t;		type var_run_t;
	class dir { add_name ~~create getattr open read~~ remove_name ~~rmdir search~~ setattr ~~write~~ };		class dir { add_name remove_name setattr };
	class file { create execute execute_no_trans getattr ioctl ~~map~~ open read ~~rename~~ unlink write };		class file { create execute execute_no_trans getattr ioctl open read unlink write };
	class lnk_file { ~~getattr~~ read };		class lnk_file { read };
	class sock_file { write };		class sock_file { write };
	class tcp_socket{ name_connect };		class tcp_socket{ name_connect };
Line 153:		Line 145:

	# Required by the HTTP webserver		# Required by the HTTP webserver
	~~allow httpd_t http_port_t:tcp_socket { name_connect };~~
	~~allow httpd_t httpd_sys_content_t:dir { add_name create remove_name setattr write };~~
	~~allow httpd_t httpd_sys_content_t:file { create rename unlink write };~~
	~~allow httpd_t smtp_port_t:tcp_socket { name_connect };~~
	~~allow httpd_t unconfined_service_t:dir { getattr };~~

	~~# Requiired by init processes~~
	allow init_t httpd_sys_content_t:file { create execute execute_no_trans ioctl open read };		allow init_t httpd_sys_content_t:file { create execute execute_no_trans ioctl open read };
	allow init_t httpd_sys_rw_content_t:dir { add_name remove_name };		allow init_t httpd_sys_rw_content_t:dir { add_name remove_name };
	allow init_t httpd_sys_rw_content_t:file { ioctl open read unlink write };		allow init_t httpd_sys_rw_content_t:file { create ioctl open read unlink write };
			allow init_t mysqld_t:unix_stream_socket { connectto };

			# Required by init processes
			allow init_t httpd_sys_content_t:file { create execute execute_no_trans ioctl open read };
			allow init_t httpd_sys_rw_content_t:dir { add_name remove_name };
			allow init_t httpd_sys_rw_content_t:file { create ioctl open read unlink write };
	allow init_t mysqld_t:unix_stream_socket { connectto };		allow init_t mysqld_t:unix_stream_socket { connectto };

	~~# Required for Icinga NRPE checks~~
	~~allow nrpe_t httpd_sys_content_t:dir { read };~~
	~~allow nrpe_t httpd_sys_content_t:file { getattr };~~
	~~allow nrpe_t httpd_sys_rw_content_t:dir { search };~~
	~~allow nrpe_t httpd_sys_rw_content_t:file { getattr open read };~~
	~~allow nrpe_t modules_object_t:dir { search };~~
	~~allow nrpe_t modules_object_t:file { getattr };~~
	~~allow nrpe_t modules_object_t:lnk_file { getattr read };~~
	~~allow nrpe_t mysqld_t:unix_stream_socket { connectto };~~
	~~allow nrpe_t mysqld_db_t:dir { search };~~
	~~allow nrpe_t mysqld_etc_t:dir { getattr open read search };~~
	~~allow nrpe_t mysqld_etc_t:file { getattr open read };~~
	~~allow nrpe_t mysqld_var_run_t:sock_file { write };~~

	# Only needed for coversheets, considering commenting out otherwise.		# Only needed for coversheets, considering commenting out otherwise.
			allow httpd_t lib_t:dir { setattr };
	allow httpd_t shadow_t:file { getattr open read };		allow httpd_t shadow_t:file { getattr open read };
			allow httpd_t usr_t:file { write };
			allow httpd_t unreserved_port_t:tcp_socket { name_connect };
			allow init_t httpd_sys_content_t:lnk_file { read };
			allow init_t httpd_sys_rw_content_t:file { create };
			allow init_t httpd_sys_rw_content_t:lnk_file { read };

	# Only needed for Shibboleth authentication, consider commenting out otherwise.		# Only needed for Shibboleth authentication, consider commenting out otherwise.
	allow httpd_t var_run_t:sock_file { write };		allow httpd_t var_run_t:sock_file { write };
			allow httpd_t unconfined_service_t:unix_stream_socket { connectto };
	# Only ~~needed~~ for ~~SSH FuseFS~~, consider ~~commeting~~ out otherwise.
	allow httpd_t ~~fusefs_t:dir { add_name create read remove_name rmdir setattr write };~~		# Only need for LDAP authentication, consider commenting out otherwise.
	~~allow httpd_t fusefs_t~~:~~file~~ { ~~create getattr ioctl map open read rename unlink write~~ };		allow httpd_t ldap_port_t:tcp_socket { name_connect };

	=== redeploy_policy.sh ===		=== redeploy_policy.sh ===

Drn@ecs.soton.ac.uk: /* eprints.fc */

2025-07-31T17:28:26Z

eprints.fc

← Older revision		Revision as of 17:28, 31 July 2025
Line 119:		Line 119:
	/opt/eprints3/tmp(/.*)? unconfined_u:object_r:httpd_sys_rw_content_t:s0		/opt/eprints3/tmp(/.*)? unconfined_u:object_r:httpd_sys_rw_content_t:s0
	/opt/eprints3/var(/.*)? unconfined_u:object_r:httpd_sys_rw_content_t:s0		/opt/eprints3/var(/.*)? unconfined_u:object_r:httpd_sys_rw_content_t:s0
			/opt/eprints.*/ingredients/coversheets/bin/stitchPDFs unconfined_u:object_r:httpd_sys_script_exec_t:s0

	=== eprints.te ===		=== eprints.te ===

Drn@ecs.soton.ac.uk: /* Apache Configuration */

2025-07-31T17:27:17Z

Apache Configuration

← Older revision		Revision as of 17:27, 31 July 2025
Line 6:		Line 6:

	== Apache Configuration ==		== Apache Configuration ==
	* Set the httpd user and group to <tt>apache</tt> in '''/etc/httpd/conf/httpd.conf'''. (If you are running SELinux on a Debian/Ubuntu flavour of Linux, then the user and group will need to be set to <tt>www-data</tt>).		* Set the httpd user and group to <tt>apache</tt> in '''/etc/httpd/conf/httpd.conf'''. (If you are running SELinux on a Debian/Ubuntu flavour of Linux, then the user and group will need to be set to <tt>www-data</tt> and the file you will need to edit is ''/etc/apache2/apache2.conf'').
	User apache		User apache
	Group apache		Group apache

Drn@ecs.soton.ac.uk: Added noted about either or for settings or policy file

2025-07-31T17:25:05Z

Added noted about either or for settings or policy file

← Older revision		Revision as of 17:25, 31 July 2025
Line 1:		Line 1:
	This page is intended to write a rough set of instructions for how to get a CentOS 7 system setup with SELinux enforcing so EPrints 3.4 (with site_lib) runs without any issues. ~~This guidance will~~ be ~~applicable to other versions of CentOS as well as RHEL~~ and ~~Fedora~~. ~~Furthermore, it may~~ be ~~applicable for enabling~~ SELinux ~~on other Linux operatings ystems~~.		This page is intended to write a rough set of instructions for how to get a RHEL / Fedora / CentOS / Rocky Linux system setup with SELinux enforcing so EPrints 3.4 (with site_lib) runs without any issues.

			It should be noted that the '''Changing Directory Permissions and SELinux Contexts''', '''Setting SELinux Booleans''' and '''Extra settings for...''' sections can be ignored if you deploy the [[#Policy file\|EPrints SELinux policy file]] instead.

	'''N.B. All commands described below need to be run as the root user or using sudo.'''		'''N.B. All commands described below need to be run as the root user or using sudo.'''

Drn@ecs.soton.ac.uk: /* Policy file */

2025-07-31T17:19:59Z

Policy file

← Older revision		Revision as of 17:19, 31 July 2025
Line 91:		Line 91:

	== Policy file ==		== Policy file ==
			Using an EPrints SELinux policy file may be easier than running the myriad of commands described above.

	First install the following packages:		First install the following packages:
	yum install checkpolicy policycoreutils-python		yum install checkpolicy policycoreutils-python

Drn@ecs.soton.ac.uk: /* Setting SELinux Booleans */

2025-07-31T17:18:30Z

Setting SELinux Booleans

← Older revision		Revision as of 17:18, 31 July 2025
Line 34:		Line 34:

	== Setting SELinux Booleans ==		== Setting SELinux Booleans ==
			These SELinux booleans are tailored towards RHEL-based Linux. If you are running SELinux on a Debian/Ubuntu flavour of Linux they are likely to be different.

	You will definitely need to modify the SELinux boolean so that Apache (httpd) to be able to send email:		You will definitely need to modify the SELinux boolean so that Apache (httpd) to be able to send email:
	setsebool -P httpd_can_sendmail 1		setsebool -P httpd_can_sendmail 1

Drn@ecs.soton.ac.uk: /* System Users and Groups */

2025-07-31T17:15:15Z

System Users and Groups

← Older revision		Revision as of 17:15, 31 July 2025
Line 9:		Line 9:

	== System Users and Groups ==		== System Users and Groups ==
	* Add eprints to the apache group and apache to the eprints group (so that '''/etc/group''' for these looks something like the following, order does not matter):		* Add <tt>eprints</tt> to the <tt>apache</tt> group and <tt>apache</tt> to the <tt>eprints</tt> group (so that '''/etc/group''' for these looks something like the following, order does not matter):
	apache:x:48:eprints		apache:x:48:eprints
	eprints:x:1000:apache		eprints:x:1000:apache
			If you are running a Debian/Ubuntu flavour of Linux, rather than <tt>apache</tt>, this will be <tt>www-data</tt>.

	== Changing Directory Permissions and SELinux Contexts ==		== Changing Directory Permissions and SELinux Contexts ==

← Older revision		Revision as of 17:40, 31 July 2025
Line 143:		Line 143:
	class unix_stream_socket { connectto };		class unix_stream_socket { connectto };
	}		}

	# Required by the HTTP webserver		# Required by the HTTP webserver
	allow init_t httpd_sys_content_t:file { create execute execute_no_trans ioctl open read };		allow init_t httpd_sys_content_t:file { create execute execute_no_trans ioctl open read };
Line 149:		Line 149:
	allow init_t httpd_sys_rw_content_t:file { create ioctl open read unlink write };		allow init_t httpd_sys_rw_content_t:file { create ioctl open read unlink write };
	allow init_t mysqld_t:unix_stream_socket { connectto };		allow init_t mysqld_t:unix_stream_socket { connectto };

	# Required by init processes		# Required by init processes
	allow init_t httpd_sys_content_t:file { create execute execute_no_trans ioctl open read };		allow init_t httpd_sys_content_t:file { create execute execute_no_trans ioctl open read };
Line 155:		Line 155:
	allow init_t httpd_sys_rw_content_t:file { create ioctl open read unlink write };		allow init_t httpd_sys_rw_content_t:file { create ioctl open read unlink write };
	allow init_t mysqld_t:unix_stream_socket { connectto };		allow init_t mysqld_t:unix_stream_socket { connectto };

	# Only needed for coversheets, considering commenting out otherwise.		# Only needed for coversheets, considering commenting out otherwise.
	allow httpd_t lib_t:dir { setattr };		allow httpd_t lib_t:dir { setattr };
Line 164:		Line 164:
	allow init_t httpd_sys_rw_content_t:file { create };		allow init_t httpd_sys_rw_content_t:file { create };
	allow init_t httpd_sys_rw_content_t:lnk_file { read };		allow init_t httpd_sys_rw_content_t:lnk_file { read };

	# Only needed for Shibboleth authentication, consider commenting out otherwise.		# Only needed for Shibboleth authentication, consider commenting out otherwise.
	allow httpd_t var_run_t:sock_file { write };		allow httpd_t var_run_t:sock_file { write };
	allow httpd_t unconfined_service_t:unix_stream_socket { connectto };		allow httpd_t unconfined_service_t:unix_stream_socket { connectto };

	# Only need for LDAP authentication, consider commenting out otherwise.		# Only need for LDAP authentication, consider commenting out otherwise.
	allow httpd_t ldap_port_t:tcp_socket { name_connect };		allow httpd_t ldap_port_t:tcp_socket { name_connect };