我需要在浏览器中通过 Puppeteer 运行 Chromium，但我收到了一些 SElinux 警报。如果我audit2allow为警报创建一个模块，警报就会消失，但 Chromium 仍然不会运行。只要我将 SElinux 重新设置为permissive模式，Chromium 就会再次运行。
我不知道该怎么做。如何修复以下错误，以便可以在强制模式下使用 SElinux？
httpd如果我将SElinux 仍处于enforcing模式，设置为宽容，我也可以让 Chromium 正常工作semanage permissive -a httpd_t，但我猜测这是一个很大的安全问题？
所有的 SElinux 警报都在/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome目录中，所以我想我需要给这些目录/文件一个特定的标签，但是哪一个呢？
操作系统：CentOS 7.6
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from using the sys_admin capability.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should have the sys_admin capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'chrome' --raw | audit2allow -M my-chrome
# semodule -i my-chrome.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ capability ]
Source chrome
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 7
First Seen 2019-03-02 16:33:12 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID ff2cf4a9-6788-4027-8986-fc1db4f026b3
Raw Audit Messages
type=AVC msg=audit(1551618018.451:581328): avc: denied { sys_admin } for pid=15865 comm="chrome" capability=21 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=capability permissive=1
type=SYSCALL msg=audit(1551618018.451:581328): arch=x86_64 syscall=open success=yes exit=ECONNREFUSED a0=559709404bb0 a1=1 a2=20 a3=7ffe9f76fba0 items=0 ppid=15863 pid=15865 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=chrome exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: chrome,httpd_t,httpd_t,capability,sys_admin
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from using the sys_ptrace capability.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should have the sys_ptrace capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'chrome' --raw | audit2allow -M my-chrome
# semodule -i my-chrome.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ capability ]
Source chrome
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 8
First Seen 2019-03-02 16:32:26 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID 195b1636-4c46-47b9-92d2-19323a2e05a8
Raw Audit Messages
type=AVC msg=audit(1551618018.527:581330): avc: denied { sys_ptrace } for pid=15863 comm="chrome" capability=19 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=capability permissive=1
type=SYSCALL msg=audit(1551618018.527:581330): arch=x86_64 syscall=read success=yes exit=364 a0=70 a1=35eabe34f000 a2=10000 a3=22 items=0 ppid=15848 pid=15863 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=chrome exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: chrome,httpd_t,httpd_t,capability,sys_ptrace
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from create access on the netlink_kobject_uevent_socket labeled httpd_t.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should be allowed create access on netlink_kobject_uevent_socket labeled httpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'Chrome_IOThread' --raw | audit2allow -M my-ChromeIOThread
# semodule -i my-ChromeIOThread.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ netlink_kobject_uevent_socket ]
Source Chrome_IOThread
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 8
First Seen 2019-03-02 16:32:26 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID 9e4b0c7f-78a5-4585-be26-db09f9309f6f
Raw Audit Messages
type=AVC msg=audit(1551618018.602:581331): avc: denied { create } for pid=15863 comm="Chrome_IOThread" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_kobject_uevent_socket permissive=1
type=SYSCALL msg=audit(1551618018.602:581331): arch=x86_64 syscall=socket success=yes exit=151 a0=10 a1=80803 a2=f a3=35eabe431060 items=0 ppid=15848 pid=15863 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=Chrome_IOThread exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: Chrome_IOThread,httpd_t,httpd_t,netlink_kobject_uevent_socket,create
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from setopt access on the netlink_kobject_uevent_socket labeled httpd_t.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should be allowed setopt access on netlink_kobject_uevent_socket labeled httpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'Chrome_IOThread' --raw | audit2allow -M my-ChromeIOThread
# semodule -i my-ChromeIOThread.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ netlink_kobject_uevent_socket ]
Source Chrome_IOThread
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 8
First Seen 2019-03-02 16:32:26 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID 59f8fbbf-0ce1-4dd3-94ff-8fd5eb13696f
Raw Audit Messages
type=AVC msg=audit(1551618018.603:581332): avc: denied { setopt } for pid=15863 comm="Chrome_IOThread" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_kobject_uevent_socket permissive=1
type=SYSCALL msg=audit(1551618018.603:581332): arch=x86_64 syscall=setsockopt success=yes exit=0 a0=97 a1=1 a2=1a a3=7fe1ed084420 items=0 ppid=15848 pid=15863 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=Chrome_IOThread exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: Chrome_IOThread,httpd_t,httpd_t,netlink_kobject_uevent_socket,setopt
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from bind access on the netlink_kobject_uevent_socket labeled httpd_t.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should be allowed bind access on netlink_kobject_uevent_socket labeled httpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'Chrome_IOThread' --raw | audit2allow -M my-ChromeIOThread
# semodule -i my-ChromeIOThread.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ netlink_kobject_uevent_socket ]
Source Chrome_IOThread
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 8
First Seen 2019-03-02 16:32:26 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID b50937b0-a30a-4724-8c8d-d50077ae5e1a
Raw Audit Messages
type=AVC msg=audit(1551618018.603:581333): avc: denied { bind } for pid=15863 comm="Chrome_IOThread" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_kobject_uevent_socket permissive=1
type=SYSCALL msg=audit(1551618018.603:581333): arch=x86_64 syscall=bind success=yes exit=0 a0=97 a1=35eabe384a10 a2=c a3=7fe1ed084420 items=0 ppid=15848 pid=15863 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=Chrome_IOThread exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: Chrome_IOThread,httpd_t,httpd_t,netlink_kobject_uevent_socket,bind
SELinux is preventing /var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome from getattr access on the netlink_kobject_uevent_socket labeled httpd_t.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that chrome should be allowed getattr access on netlink_kobject_uevent_socket labeled httpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'Chrome_IOThread' --raw | audit2allow -M my-ChromeIOThread
# semodule -i my-ChromeIOThread.pp
Additional Information:
Source Context system_u:system_r:httpd_t:s0
Target Context system_u:system_r:httpd_t:s0
Target Objects Unknown [ netlink_kobject_uevent_socket ]
Source Chrome_IOThread
Source Path /var/www/html/node_modules/puppeteer/.local-
chromium/linux-624492/chrome-linux/chrome
Port <Unknown>
Host di-staging
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-3.13.1-229.el7_6.6.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name di-staging
Platform Linux di-staging 3.10.0-957.el7.x86_64 #1 SMP Thu
Nov 8 23:39:32 UTC 2018 x86_64 x86_64
Alert Count 8
First Seen 2019-03-02 16:32:26 GMT
Last Seen 2019-03-03 13:00:18 GMT
Local ID 889a731e-830f-4ae8-8a66-bfdb0532629e
Raw Audit Messages
type=AVC msg=audit(1551618018.603:581334): avc: denied { getattr } for pid=15863 comm="Chrome_IOThread" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_kobject_uevent_socket permissive=1
type=SYSCALL msg=audit(1551618018.603:581334): arch=x86_64 syscall=getsockname success=yes exit=0 a0=97 a1=7fe1ed085490 a2=7fe1ed08548c a3=7fe1ed084420 items=0 ppid=15848 pid=15863 auid=4294967295 uid=996 gid=993 euid=996 suid=996 fsuid=996 egid=993 sgid=993 fsgid=993 tty=(none) ses=4294967295 comm=Chrome_IOThread exe=/var/www/html/node_modules/puppeteer/.local-chromium/linux-624492/chrome-linux/chrome subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: Chrome_IOThread,httpd_t,httpd_t,netlink_kobject_uevent_socket,getattr
答案1
我已设法使 Chromium 正常工作，同时保持 SElinux 和 httpd 处于强制模式，但这意味着使用一个可以有效地将 Chromium 设置为宽容模式的标签：
httpd_unconfined_script_exec_t
sudo semanage fcontext -a -t httpd_unconfined_script_exec_t '/var/www/html/node_modules/puppeteer/.local-chromium(/.*)?/chrome-linux/chrome'
sudo restorecon -R -v '/var/www/html/node_modules/puppeteer/.local-chromium/'
我会等待一段时间才将其标记为答案，因为我仍然希望从某人那里找到更好的解决方案。