我有一个运行脚本的 systemd 服务文件。它被 selinux 阻止：
type=AVC msg=audit(1570329687.437:218): avc: denied { execute } for pid=1079 comm="(index.sh)" name="make_index.sh" dev="md127" ino=4295130138 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=file permissive=1
type=AVC msg=audit(1570329687.437:219): avc: denied { read open } for pid=1079 comm="(index.sh)" path="/srv/www/sites/linux.montclaire.lan/make_index.sh" dev="md127" ino=4295130138 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=file permissive=1
type=AVC msg=audit(1570329687.437:220): avc: denied { execute_no_trans } for pid=1079 comm="(index.sh)" path="/srv/www/sites/linux.montclaire.lan/make_index.sh" dev="md127" ino=4295130138 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=file permissive=1
type=AVC msg=audit(1570329687.450:221): avc: denied { ioctl } for pid=1079 comm="make_index.sh" path="/srv/www/sites/linux.montclaire.lan/make_index.sh" dev="md127" ino=4295130138 ioctlcmd=0x5401 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=file permissive=1
type=AVC msg=audit(1570329691.303:222): avc: denied { create } for pid=1081 comm="make_index.sh" name="index.html" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file permissive=1
type=AVC msg=audit(1570329691.322:223): avc: denied { write } for pid=1081 comm="make_index.sh" name="index.html" dev="md127" ino=4295112722 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file permissive=1
type=AVC msg=audit(1570329691.322:224): avc: denied { open } for pid=1081 comm="make_index.sh" path="/srv/www/sites/linux.montclaire.lan/index.html" dev="md127" ino=4295112722 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file permissive=1
type=AVC msg=audit(1570329691.322:225): avc: denied { append } for pid=1081 comm="make_index.sh" name="index.html" dev="md127" ino=4295112722 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:httpd_sys_content_t:s0 tclass=file permissive=1
所以我创建了一个selinux模块：
module montclaire 1.0;
require {
type httpd_sys_content_t;
type init_t;
class file { append create execute execute_no_trans ioctl open read write };
}
#============= init_t ==============
allow init_t httpd_sys_content_t:file { append create execute execute_no_trans ioctl open read write };
编译并加载它。我的脚本正在使用 selinux 强制运行。
这是正确的做法吗？我在我的系统中设置了一个大漏洞吗？
我的 systemd 服务文件：我作为计时器运行，而不是在启动时运行。
[Unit]
Description=Sync montclaire repositories
ConditionPathExists=/srv/www/sites/linux.montclaire.lan/make_index.sh
[Service]
User=nginx
Type=oneshot
WorkingDirectory=/srv/www/sites/linux.montclaire.lan
ExecStart=/srv/www/sites/linux.montclaire.lan/make_index.sh
有没有办法只允许域init_t访问make_index.sh？通过搜索 init_t 我发现了这个。这是否意味着 init_t 可以转换到这些特定目录和文件“settings.php”？
$sesearch -T -s init_t -t httpd_sys_content_t type_transition init_t httpd_sys_content_t:dir httpd_sys_rw_content_t "smarty"; type_transition init_t httpd_sys_content_t:dir httpd_sys_rw_content_t "升级"; type_transition init_t httpd_sys_content_t:dir httpd_sys_rw_content_t "上传"; type_transition init_t httpd_sys_content_t:dir httpd_sys_rw_content_t "wp-content"; type_transition init_t httpd_sys_content_t:文件 httpd_sys_rw_content_t "settings.php";