Application Security Labs

cyberfarer

The SELinux lab is not working for me. SELinux shows an error on /usr/bin/ls /home but allows /etc/passwd.

 

lee42x

If you could let me know which lab step is giving you problems. 

kanner

I confirm this problem too. This is in Lab7.4 (9th list item).

for me the SELinux restricted mode didn't prevent reading /etc/passwd with cgi-script, but "ls /home" was denied in default CentOS VM taken from Linux Foundation resources.

lee42x

Hi, Thank you for letting us know there is an issue. It seems updates have caused a portion of this exercise work differently. The focus of the exercise is to see selinux stop the cgi-script from doing something it is not supposed to. It appears that the cgi-script has the requied access rights to read the /etc/passwd file, as should every process.  So if we edit out the "cat  /etc/passwd" out of our password.sh scriot and focus on the  "ls -la /home" component we can see that SElinux does indeed stop the cgi script from listing the contents. There is an "setroubleshoot" message in /var/log/messages describing that SElinux prevented the command from exicuting.  Set SElinux mode back to "permissive" with the command "setenforce 0" and the cgi script can access the /home directory. 

Thanks.