Selinux 阻止 Node 服务通过 systemd 单元文件启动

Posted 2023-04-12

【中文标题】Selinux 阻止 Node 服务通过 systemd 单元文件启动

【英文标题】：Selinux is blocking Node service from starting via systemd unit file

【发布时间】：2020-05-17 08:52:41

【问题描述】：

当我使用“npm run server”手动启动它时，我有一个运行良好的 NodeJS 应用程序。 我的应用程序在 Linux Centos8 上运行。 如果我通过下面的单元文件将应用程序作为服务启动，那么它不会在 setenforce=1 时启动（selinux 正在执行）。 如果我使用 setenforce=0 切换 selinux，则服务在执行时启动 "systemctl 开始翻译表"

这是位于 /etc/systemd/system/translationtable.service 中的 mij unitfile：

[Unit]
Description=TranslationtableService
After=network.target

[Service]
WorkingDirectory=/opt/nodejs/translationtable
ExecStart=/usr/bin/npm run server
Type=simple
User=sa-builder
Group=sa-builder
[Install]
WantedBy=multi-user.target

这是我在启动服务后遇到的错误： systemctl 状态转换表

translationtable.service - TranslationtableService
   Loaded: loaded (/etc/systemd/system/translationtable.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sun 2020-05-17 10:32:04 CEST; 4s ago
  Process: 11815 ExecStart=/usr/bin/npm run server (code=exited, status=203/EXEC)
 Main PID: 11815 (code=exited, status=203/EXEC)

May 17 10:32:04 ac8app01.myexample.nl systemd[1]: Started TranslationtableService.
May 17 10:32:04 ac8app01.myexample.nl systemd[1]: translationtable.service: Main process exited, code=exited, status=203/EXEC
May 17 10:32:04 ac8app01.myexample.nl systemd[1]: translationtable.service: Failed with result 'exit-code'.
[root@ac8app01 translationtable]# vi /etc/systemd/system/translationtable.service
[root@ac8app01 translationtable]# systemctl status translationtable
  translationtable.service - TranslationtableService
   Loaded: loaded (/etc/systemd/system/translationtable.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sun 2020-05-17 10:32:04 CEST; 8min ago
  Process: 11815 ExecStart=/usr/bin/npm run server (code=exited, status=203/EXEC)
 Main PID: 11815 (code=exited, status=203/EXEC)

May 17 10:32:04 ac8app01.myexample.nl systemd[1]: Started TranslationtableService.
May 17 10:32:04 ac8app01.myexample.nl systemd[1]: translationtable.service: Main process exited, code=exited, status=203/EXEC
May 17 10:32:04 ac8app01.myexample.nl systemd[1]: translationtable.service: Failed with result 'exit-code'.

我的应用程序在 /opt/nodejs/translationtable

我尝试了很多事情，例如将上下文添加到 selinux 作为幸运的一击：

semanage fcontext -a --type httpd_sys_rw_content_t '/usr/bin/npm(/.*)?'
chcon -R -t httpd_sys_content_t /usr/bin/npm
chcon -R -t httpd_sys_rw_content_t /usr/bin/npm

semanage fcontext -a --type httpd_sys_rw_content_t '/opt/nodejs/translationtable(/.*)?'
chcon -R -t httpd_sys_content_t /opt/nodejs/translationtable
chcon -R -t httpd_sys_rw_content_t /opt/nodejs/translationtable

我还添加了我的 /var/log/audit/audit.log 文件的上下文，其中有很多关于 selinux 上下文的拒绝：

type=SERVICE_START msg=audit(1589712010.061:95): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=translationtable comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'^]UID="root" AUID="unset"
type=AVC msg=audit(1589712010.091:96): avc:  denied   read  for  pid=1974 comm="(npm)" name="npm" dev="dm-0" ino=50690435 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=lnk_file permissive=1
type=SYSCALL msg=audit(1589712010.091:96): arch=c000003e syscall=59 success=yes exit=0 a0=55c7f2a8e1e0 a1=55c7f29fc8f0 a2=55c7f2aaad70 a3=55c7f2852010 items=0 ppid=1 pid=1974 auid=4294967295 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm="npm" exe="/usr/bin/node" subj=system_u:system_r:init_t:s0 key=(null)^]ARCH=x86_64 SYSCALL=execve AUID="unset" UID="sa-builder" GID="sa-builder" EUID="sa-builder" SUID="sa-builder" FSUID="sa-builder" EGID="sa-builder" SGID="sa-builder" FSGID="sa-builder"
type=PROCTITLE msg=audit(1589712010.091:96): proctitle=2F7573722F62696E2F6E6F6465002F7573722F62696E2F6E706D0072756E00736572766572
type=AVC msg=audit(1589712010.876:97): avc:  denied   execmem  for  pid=1974 comm="npm" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=process permissive=1
type=SYSCALL msg=audit(1589712010.876:97): arch=c000003e syscall=10 success=yes exit=0 a0=84f68104000 a1=7b000 a2=5 a3=0 items=0 ppid=1 pid=1974 auid=4294967295 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm="npm" exe="/usr/bin/node" subj=system_u:system_r:init_t:s0 key=(null)^]ARCH=x86_64 SYSCALL=mprotect AUID="unset" UID="sa-builder" GID="sa-builder" EUID="sa-builder" SUID="sa-builder" FSUID="sa-builder" EGID="sa-builder" SGID="sa-builder" FSGID="sa-builder"
type=PROCTITLE msg=audit(1589712010.876:97): proctitle=2F7573722F62696E2F6E6F6465002F7573722F62696E2F6E706D0072756E00736572766572
type=AVC msg=audit(1589712011.007:98): avc:  denied   getattr  for  pid=1974 comm="npm" path="/usr/bin/npm" dev="dm-0" ino=50690435 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=lnk_file permissive=1
type=SYSCALL msg=audit(1589712011.007:98): arch=c000003e syscall=332 success=yes exit=0 a0=ffffff9c a1=7ffcbba58e78 a2=100 a3=fff items=0 ppid=1 pid=1974 auid=4294967295 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm="npm" exe="/usr/bin/node" subj=system_u:system_r:init_t:s0 key=(null)^]ARCH=x86_64 SYSCALL=statx AUID="unset" UID="sa-builder" GID="sa-builder" EUID="sa-builder" SUID="sa-builder" FSUID="sa-builder" EGID="sa-builder" SGID="sa-builder" FSGID="sa-builder"
type=PROCTITLE msg=audit(1589712011.007:98): proctitle=2F7573722F62696E2F6E6F6465002F7573722F62696E2F6E706D0072756E00736572766572
type=AVC msg=audit(1589712012.976:99): avc:  denied   read  for  pid=1974 comm="npm" name="translationtable" dev="dm-0" ino=51493520 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:httpd_sys_rw_content_t:s0 tclass=dir permissive=1
type=SYSCALL msg=audit(1589712012.976:99): arch=c000003e syscall=257 success=yes exit=18 a0=ffffff9c a1=55e9fe518330 a2=90800 a3=0 items=0 ppid=1 pid=1974 auid=4294967295 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm="npm" exe="/usr/bin/node" subj=system_u:system_r:init_t:s0 key=(null)^]ARCH=x86_64 SYSCALL=openat AUID="unset" UID="sa-builder" GID="sa-builder" EUID="sa-builder" SUID="sa-builder" FSUID="sa-builder" EGID="sa-builder" SGID="sa-builder" FSGID="sa-builder"
type=PROCTITLE msg=audit(1589712012.976:99): proctitle="npm"
type=AVC msg=audit(1589712012.995:100): avc:  denied   read  for  pid=1974 comm="npm" name="package.json" dev="dm-0" ino=51493542 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:httpd_sys_rw_content_t:s0 tclass=file permissive=1
type=AVC msg=audit(1589712012.995:100): avc:  denied   open  for  pid=1974 comm="npm" path="/opt/nodejs/translationtable/package.json" dev="dm-0" ino=51493542 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:httpd_sys_rw_content_t:s0 tclass=file permissive=1
type=SYSCALL msg=audit(1589712012.995:100): arch=c000003e syscall=257 success=yes exit=19 a0=ffffff9c a1=7ffcbba556e8 a2=80000 a3=0 items=0 ppid=1 pid=1974 auid=4294967295 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm="npm" exe="/usr/bin/node" subj=system_u:system_r:init_t:s0 key=(null)^]ARCH=x86_64 SYSCALL=openat AUID="unset" UID="sa-builder" GID="sa-builder" EUID="sa-builder" SUID="sa-builder" FSUID="sa-builder" EGID="sa-builder" SGID="sa-builder" FSGID="sa-builder"
type=PROCTITLE msg=audit(1589712012.995:100): proctitle=2F7573722F62696E2F6E6F6465002F7573722F62696E2F6E706D0072756E00736572766572
type=AVC msg=audit(1589712013.025:101): avc:  denied   getattr  for  pid=1974 comm="npm" path="/opt/nodejs/translationtable/package.json" dev="dm-0" ino=51493542 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:httpd_sys_rw_content_t:s0 tclass=file permissive=1
type=SYSCALL msg=audit(1589712013.025:101): arch=c000003e syscall=332 success=yes exit=0 a0=13 a1=55e9fc9d1339 a2=1000 a3=fff items=0 ppid=1 pid=1974 auid=4294967295 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) ses=4294967295 comm="npm" exe="/usr/bin/node" subj=system_u:system_r:init_t:s0 key=(null)^]ARCH=x86_64 SYSCALL=statx AUID="unset" UID="sa-builder" GID="sa-builder" EUID="sa-builder" SUID="sa-builder" FSUID="sa-builder" EGID="sa-builder" SGID="sa-builder" FSGID="sa-builder"
type=PROCTITLE msg=audit(1589712013.025:101): proctitle=2F7573722F62696E2F6E6F6465002F7573722F62696E2F6E706D0072756E00736572766572

似乎没有任何效果，我对 selinux 感到非常头疼。 有人有想法吗？

【参考方案1】：

检查 /var/log/messages 中的错误和建议。 示例：

SELinux is preventing /usr/lib/systemd/systemd from <permission> on file <file>
For complete SELinux messages run: sealert -l <some-id>

然后您可以运行 sealert 命令来获取有关问题的详细信息以及如何纠正它。 （ausearch/audit2allow 命令将在 sealert 的详细信息输出中）