☰

CentOS - 配置 Puppet 与 SELinux 良好配合

tag-icon • tag-icon centos puppet selinux
CentOS - 配置 Puppet 与 SELinux 良好配合

我每次尝试启动 puppetmasterd 服务时都会遇到问题，收到以下错误消息：

root@service1 ~ # -> /etc/init.d/puppetmaster start
Starting puppetmaster: Could not prepare for execution: Got 1 failure(s) while initializing: change from absent to directory failed: Could not set 'directory on ensure: Permission denied - /etc/puppet/ssl
                                                       [FAILED]

显然，这种情况存在一个已知问题，如下所述错误报告，然而错误报告指出该问题已在 中得到解决selinux-policy-3.9.16-29.fc15，但最新的 CentOS 默认上游版本是3.7.19-155.el6_3.4。因此，我正在尝试找出最佳解决方案。

我可以创建一个本地安全策略以允许 puppetmasterd 获得所需的访问权限，或者继续研究并在默认上游通道之外安装更新版本的 selinux-policy。有人有什么建议吗？请不要建议禁用 SELinux...

- - - 更新 - - -

这是puppet.conf：

[main]
    # The Puppet log directory.
    # The default value is '$vardir/log'.
    logdir = /var/log/puppet

    # Where Puppet PID files are kept.
    # The default value is '$vardir/run'.
    rundir = /var/run/puppet

    # Where SSL certificates are kept.
    # The default value is '$confdir/ssl'.
    ssldir = $vardir/ssl

[master]
    certname=puppetmaster.ownij.lan
    dns_alt_names=puppetmaster.ownij.lan

[agent]
    # The file in which puppetd stores a list of the classes
    # associated with the retrieved configuratiion.  Can be loaded in
    # the separate ``puppet`` executable using the ``--loadclasses``
    # option.
    # The default value is '$confdir/classes.txt'.
    classfile = $vardir/classes.txt

    # Where puppetd caches the local configuration.  An
    # extension indicating the cache format is added automatically.
    # The default value is '$confdir/localconfig'.
    localconfig = $vardir/localconfig

    server=puppetmaster.ownij.lan

以下是审计日志中的拒绝情况：

type=AVC msg=audit(1349751364.985:666): avc:  denied  { search } for  pid=15093 comm="puppetmasterd" name="/" dev=dm-2 ino=2 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
type=SYSCALL msg=audit(1349751364.985:666): arch=c000003e syscall=4 success=no exit=-13 a0=1391420 a1=7fffef09ed10 a2=7fffef09ed10 a3=120c500 items=0 ppid=15092 pid=15093 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=13 comm="puppetmasterd" exe="/usr/bin/ruby" subj=unconfined_u:system_r:puppetmaster_t:s0 key=(null)
type=AVC msg=audit(1349751365.302:667): avc:  denied  { search } for  pid=15093 comm="puppetmasterd" name="/" dev=dm-2 ino=2 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
type=SYSCALL msg=audit(1349751365.302:667): arch=c000003e syscall=4 success=no exit=-13 a0=1d18530 a1=7fffef0d04d0 a2=7fffef0d04d0 a3=8 items=0 ppid=15092 pid=15093 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=13 comm="puppetmasterd" exe="/usr/bin/ruby" subj=unconfined_u:system_r:puppetmaster_t:s0 key=(null)
type=AVC msg=audit(1349751365.465:668): avc:  denied  { search } for  pid=15093 comm="puppetmasterd" name="/" dev=dm-2 ino=2 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
type=SYSCALL msg=audit(1349751365.465:668): arch=c000003e syscall=4 success=no exit=-13 a0=1af3930 a1=7fffef0c5c70 a2=7fffef0c5c70 a3=8 items=0 ppid=15092 pid=15093 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=13 comm="puppetmasterd" exe="/usr/bin/ruby" subj=unconfined_u:system_r:puppetmaster_t:s0 key=(null)
type=AVC msg=audit(1349751365.467:669): avc:  denied  { search } for  pid=15093 comm="puppetmasterd" name="/" dev=dm-2 ino=2 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
type=SYSCALL msg=audit(1349751365.467:669): arch=c000003e syscall=4 success=no exit=-13 a0=1b17aa0 a1=7fffef0c5c70 a2=7fffef0c5c70 a3=8 items=0 ppid=15092 pid=15093 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=13 comm="puppetmasterd" exe="/usr/bin/ruby" subj=unconfined_u:system_r:puppetmaster_t:s0 key=(null)
type=AVC msg=audit(1349751366.401:670): avc:  denied  { write } for  pid=15093 comm="puppetmasterd" name="puppet" dev=dm-0 ino=132035 scontext=unconfined_u:system_r:puppetmaster_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=dir
type=SYSCALL msg=audit(1349751366.401:670): arch=c000003e syscall=83 success=no exit=-13 a0=2d7a400 a1=1f9 a2=2d7a40f a3=7fffef0a6df0 items=0 ppid=15092 pid=15093 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=13 comm="puppetmasterd" exe="/usr/bin/ruby" subj=unconfined_u:system_r:puppetmaster_t:s0 key=(null)

如果我通过 audit2allow，则审计日志如下：

root@service1 ~ # -> fgrep puppetmasterd /var/log/audit/audit.log | audit2allow -m puppetmasterd

module puppetmasterd 1.0;

require {
    type home_root_t;
    type puppetmaster_t;
    type puppet_etc_t;
    type puppet_var_run_t;
    type httpd_sys_content_t;
    class lnk_file { relabelfrom relabelto };
    class file { relabelfrom read getattr open };
    class dir { write read search getattr setattr };
}

#============= puppetmaster_t ==============
allow puppetmaster_t home_root_t:dir { search getattr };
allow puppetmaster_t httpd_sys_content_t:dir read;
allow puppetmaster_t httpd_sys_content_t:file { read getattr open };
#!!!! The source type 'puppetmaster_t' can write to a 'dir' of the following types:
# puppet_log_t, puppet_var_lib_t, puppet_var_run_t, puppetmaster_tmp_t

allow puppetmaster_t puppet_etc_t:dir { write setattr };
allow puppetmaster_t puppet_etc_t:lnk_file { relabelfrom relabelto };
allow puppetmaster_t puppet_var_run_t:file relabelfrom;

答案1

您正在使用默认位置$ssldir- 您的puppet.conf样子是什么样的？

RHEL 衍生产品中 Puppet 的默认部署puppet.conf如下：

[main]
    ssldir = /var/lib/puppet/ssl

如果您将其恢复原位，SELinux 策略应该不会对您的 SSL 目录的位置产生问题。

相关内容