Icingaweb2: [dev.icinga.com #8270] Add SELinux policy for Icinga Web 2

[icinga-migration]

This issue has been migrated from Redmine: https://dev.icinga.com/issues/8270

Created by gbeutner on 2015-01-24 10:18:27 +00:00

Assignee: _elippmann_
Status: _Resolved_ (closed on _2016-12-13 12:50:03 +00:00_)
Target Version: _2.4.0_
Last Update: _2016-12-13 12:50:03 +00:00 (in Redmine)_

---

Requirements

• SELinux policy
• Package(s)
• Documentation

Original description

The install wizard tells me that the /etc/icingaweb2 directory is not writable:

The current configuration directory is not writable: /etc/icingaweb2

However, by using the command the wizard gave me earlier (icingacli setup config directory --group apache) I would expect that the directory permissions are set up properly.

Changesets

_2016-12-12 11:48:33 +00:00_ by _dgoetz_ e6cce0837664785c812712013ed002d89e737da8

Add SELinux policy

Signed-off-by: Eric Lippmann <[email protected]>

refs #8270

_2016-12-12 13:26:14 +00:00_ by _elippmann_ 0bdf4040c50056a4d7da115dc9cab000a81cb162

RPM: Add selinux subpackage

refs #8270

_2016-12-13 11:31:51 +00:00_ by _elippmann_ eed1d7ab68de59eb274f1b0d0e3ba94b798226f8

Merge branch 'feature/selinux-8270'

resolves #8270

_2016-12-13 12:24:34 +00:00_ by _elippmann_ 6c039445f252248f3762f3a8b78f82ac7b925c1c

RPM: Fix missing scriplets dependecies for selinux

refs #8270

[icinga-migration]

Updated by jmeyer on 2015-01-26 06:55:18 +00:00

• Status changed from _New_ to _Feedback_
• Assigned to set to _gbeutner_

Please show the ouput of..

ls -alF /etc/icingaweb2/

..after using the icingacli to set up the directory.

[icinga-migration]

Updated by elippmann on 2015-01-29 22:42:04 +00:00

• Assigned to changed from _gbeutner_ to _jmeyer_

Hi,

What's the status on this? This was caused by SELinux, right?

[icinga-migration]

Updated by jmeyer on 2015-01-30 06:34:04 +00:00

• Assigned to changed from _jmeyer_ to _elippmann_

Yes, you're right, i've missed that.. should this be fixed before beta #2?

[icinga-migration]

Updated by elippmann on 2015-03-31 13:52:18 +00:00

• Subject changed from _Incorrect directory permissions for /etc/icingaweb2_ to _SELinux enabled distros cause installation failures_
• Status changed from _Feedback_ to _New_
• Assigned to deleted elippmann
• Target Version set to _2.0.0-rc1_

[icinga-migration]

Updated by jmeyer on 2015-06-11 07:44:53 +00:00

• Target Version changed from _2.0.0-rc1_ to _261_

[icinga-migration]

Updated by mjentsch on 2015-06-22 08:38:14 +00:00

I've noticed this issue on Fedora22 too. Running the following command fixed it:

semanage fcontext -a httpd_sys_rw_content_t "/etc/icingaweb2"
restorecon -Rv "/etc/icingaweb2"

[icinga-migration]

Updated by mjentsch on 2015-06-22 08:53:05 +00:00

• Assigned to set to _mjentsch_

[icinga-migration]

Updated by mfriedrich on 2015-06-22 09:10:12 +00:00

Please don't. Assign the issue to Dirk for providing a general SELinux policy for Icinga Web 2.

[icinga-migration]

Updated by mjentsch on 2015-06-22 09:15:45 +00:00

• Assigned to deleted mjentsch

[icinga-migration]

Updated by dgoetz on 2015-06-23 13:42:49 +00:00

Added an initial policy in a feature branch. Policy uses its own apache content template and a boolean to disallow apache managing icingaweb2 configuration if wanted.

[icinga-migration]

Updated by mfriedrich on 2015-06-23 13:50:35 +00:00

• Tracker changed from _Bug_ to _Feature_
• Subject changed from _SELinux enabled distros cause installation failures_ to _Add SELinux policy for icingaweb2_
• Status changed from _New_ to _Assigned_
• Assigned to set to _dgoetz_

Hi Dirk,

I've talked with Johannes about that, and therefore you'll have the issue assigned. Please do your best :)

Once the policy is ready we can poke Shawn to go for EPEL/Fedora in a separate issue.

Kind regards,
Michael

[icinga-migration]

Updated by mfriedrich on 2015-06-23 13:51:21 +00:00

• Description updated

[icinga-migration]

Updated by elippmann on 2015-07-17 09:48:06 +00:00

• Target Version changed from _261_ to _2.0.0_

[icinga-migration]

Updated by elippmann on 2015-08-31 09:25:39 +00:00

• Status changed from _Assigned_ to _Feedback_

Hi dirk,

What's the status here? Is the policy ready?

Best,
Eric

[icinga-migration]

Updated by bamapookie on 2015-09-28 13:31:11 +00:00

I noticed another issue with the current release version where SELinux was preventing LDAP validation from occurring. Once I changed to permissive mode, the UI would allow me to create the resource.

[icinga-migration]

Updated by dgoetz on 2015-09-29 08:23:28 +00:00

Can you please try setting the boolean "httpd_can_connect_ldap" to on?

setsebool httpd_can_connect_ldap 1

If this solves the problem make it permanent with:

setsebool -P httpd_can_connect_ldap 1

[icinga-migration]

Updated by elippmann on 2015-10-01 21:50:29 +00:00

• Target Version changed from _2.0.0_ to _273_

[icinga-migration]

Updated by elippmann on 2015-10-01 21:51:07 +00:00

We'll release a separate RPM for SELinux shortly after releasing Web 2.0.0.

[icinga-migration]

Updated by elippmann on 2015-11-20 13:10:50 +00:00

• Target Version changed from _273_ to _Backlog_

[icinga-migration]

Updated by and on 2016-01-12 08:49:20 +00:00

this works for me on RHEL7
# chcon -R -t httpd_sys_rw_content_t /etc/icingaweb2/
for connection to a remote database
# /usr/sbin/setsebool -P httpd_can_network_connect 1

[icinga-migration]

Updated by dgoetz on 2016-01-12 09:54:47 +00:00

httpd_can_network_connect allows connection to all ports, using httpd_can_network_connect_db allows connection only to database ports which would typically be what you want..

[icinga-migration]

Updated by dgoetz on 2016-11-11 15:10:07 +00:00

Pushed an improved version which adds some more file contexts in preparation and documentation to the branch 'feature/selinux-8270' (which I also rebased).

[icinga-migration]

Updated by elippmann on 2016-12-13 11:08:57 +00:00

• Subject changed from _Add SELinux policy for icingaweb2_ to _Add SELinux policy for Icinga Web 2_
• Status changed from _Feedback_ to _Assigned_
• Assigned to changed from _dgoetz_ to _elippmann_
• Target Version changed from _Backlog_ to _2.4.0_

[icinga-migration]

Updated by elippmann on 2016-12-13 12:50:03 +00:00

• Status changed from _Assigned_ to _Resolved_
• Done % changed from _0_ to _100_

Applied in changeset eed1d7ab68de59eb274f1b0d0e3ba94b798226f8.

[anrajme]

To make your changes permanent :
semanage fcontext -a -t httpd_sys_rw_content_t '/etc/icingaweb2(/.*)?'
restorecon -RFvv /etc/icingaweb2
/usr/sbin/setsebool -P httpd_can_network_connect 1