SELinux errors from WordFence

  • Resolved vernebritton

    (@vernebritton)


    4 years, 7 months ago

    something in WF interacts with sendmail and generates SELinux access errors from time to time … trying to figure out why sendmail would need read/write access to most if not all of the files in /home/blueridge/public_html/wp-content/wflogs/

    at the moment I have all of the wflogs files having the “type” of httpd_sys_rw_content_t

    an example /var/log/messages entry

    Apr 16 12:11:18 vhost95 setroubleshoot: SELinux is preventing sendmail from ‘read, write’ accesses on the file /home/blueridge/public_html/wp-content/wflogs/ips.php. For complete SELinux messages run: sealert -l 732aab86-8c71-4521-96b0-a83cf657464d

    Apr 16 12:11:18 vhost95 python: SELinux is preventing sendmail from ‘read, write’ accesses on the file /home/blueridge/public_html/wp-content/wflogs/ips.php.#012#012***** Plugin restorecon (99.5 confidence) suggests ************************#012#012If you want to fix the label. #012/home/blueridge/public_html/wp-content/wflogs/ips.php default label should be httpd_sys_content_t.#012Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.#012Do#012# /sbin/restorecon -v /home/blueridge/public_html/wp-content/wflogs/ips.php#012#012***** Plugin catchall (1.49 confidence) suggests **************************#012#012If you believe that sendmail should be allowed read write access on the ips.php file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c ‘sendmail’ –raw | audit2allow -M my-sendmail#012# semodule -i my-sendmail.pp#012

    Restorecon wants to change the files to httpd_sys_content_t … but the php modules in WF need httpd_sys_rw_content_t in order to write to them and update them … at least that was the only way I could get WF to work at all …

    thoughts anyone ?

Viewing 4 replies - 1 through 4 (of 4 total)

  • Hey @vernebritton,

    Can you please contact your host to make sure your file descriptors are properly configured? This is a new error for me, but after a little digging I’ve found others have run into this due to them not being properly configured. If this doesn’t help, I’ll bump the developers for their thoughts.

    Please let me know how it goes.

    Thanks,

    Gerroald

    Thread Starter vernebritton

    (@vernebritton)

    Thanks for the response …

    actually I work at the hosting provider as a sysadmin ??

    let me try upping the file descriptors … originally I had in the file /etc/security/limits.d/xxx.conf

    # do it for everything
    * soft nofile 32767
    * hard nofile 32767

    so I changed that to

    # do it for everything
    * soft nofile 65535
    * hard nofile 65535

    and rebooted. Then logged into root as well as other accounts and saw
    ulimit -Hn
    65535

    ulimit -Sn
    65535

    …. at least I think that change will affect all processes … apache, php, sendmail, etc …

    and still am getting the SELinux errors.

    Doing this on a test Linux VM, so I can pretty much adjust anything … suggestions ?

    Verne

    Unfortunately, configuring selinux is a little far outside of what support we can offer here. I can tell you when I managed the blog servers we had selinux set to enforced for all of 30 minutes. There were just too many problems trying to get it to work for WordPress in general (I still have nightmares about uploading media problems!). I believe we wound up setting it to permissive or disabling it. Someone that specializes in setting it up would probably be a better resource.

    Tim

    Thread Starter vernebritton

    (@vernebritton)

    other plugins, and custom/test php code I have written, have no problems sending mail … I even wrote a POC to attach a file … again it works fine and does not generate any error messages …

    … so … your code is doing …. more … or something different

    Verne

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘SELinux errors from WordFence’ is closed to new replies.

Tags