Application Security Labs

If you could let me know which lab step is giving you problems. 

Hi, Thank you for letting us know there is an issue. It seems updates have caused a portion of this exercise work differently. The focus of the exercise is to see selinux stop the cgi-script from doing something it is not supposed to. It appears that the cgi-script has the requied access rights to read the /etc/passwd file, as should every process.  So if we edit out the "cat  /etc/passwd" out of our password.sh scriot and focus on the  "ls -la /home" component we can see that SElinux does indeed stop the cgi script from listing the contents. There is an "setroubleshoot" message in /var/log/messages describing that SElinux prevented the command from exicuting.  Set SElinux mode back to "permissive" with the command "setenforce 0" and the cgi script can access the /home directory. 

Thanks.