Creating a Systemd Service on SELinux

[Draft]

SELinux

Security enhanced linux
Implements MAC (Mandatory Access Control)
Integration with systemd

Debugging

-- Logs begin at Tue 2021-01-26 23:54:53 CET, end at Wed 2021-02-10
        20:43:39 CET. -- Feb 10 02:49:24 fedora systemd[1]:
        lattice-notes.service: Failed to open
        /home/risto/git/clojure/lattice-notes/lattice-notes.service: Permission
        denied Feb 10 02:50:17 fedora systemd[1]: lattice-notes.service: Failed
        to open /home/risto/git/clojure/lattice-notes/lattice-notes.service:
        Permission denied Feb 10 02:50:23 fedora systemd[1]:
        lattice-notes.service: Failed to open
        /home/risto/git/clojure/lattice-notes/lattice-notes.service: Permission
        denied Feb 10 02:50:47 fedora systemd[1]: Started Lattice Notes Service.
        Feb 10 02:50:47 fedora systemd[567082]: lattice-notes.service: Failed to
        execute command: Permission denied Feb 10 02:50:47 fedora
        systemd[567082]: lattice-notes.service: Failed at step EXEC spawning
        /usr/local/bin/lein: Permission denied Feb 10 02:50:47 fedora
        systemd[1]: lattice-notes.service: Main process exited, code=exited,
        status=203/EXEC Feb 10 02:50:47 fedora systemd[1]:
        lattice-notes.service: Failed with result 'exit-code'. Feb 10 02:50:47
        fedora systemd[1]: lattice-notes.service: Scheduled restart job, restart
        counter is at 1. Feb 10 02:50:47 fedora systemd[1]: Stopped Lattice
        Notes Service. Feb 10 02:50:47 fedora systemd[1]: Started Lattice Notes
        Service. Feb 10 02:50:47 fedora systemd[567084]: lattice-notes.service:
        Failed to execute command: Permission denied Feb 10 02:50:47 fedora
        systemd[567084]: lattice-notes.service: Failed at step EXEC spawning
        /usr/local/bin/lein: Permission denied Feb 10 02:50:47 fedora
        systemd[1]: lattice-notes.service: Main process exited, code=exited,
        status=203/EXEC Feb 10 02:50:47 fedora systemd[1]:
        lattice-notes.service: Failed with result 'exit-code'. Feb 10 02:50:47
        fedora systemd[1]: lattice-notes.service: Scheduled restart job, restart
        counter is at 2. Feb 10 02:50:47 fedora systemd[1]: Stopped Lattice
        Notes Service. Feb 10 02:50:47 fedora systemd[1]: Started Lattice Notes
        Service. Feb 10 02:50:47 fedora systemd[567085]: lattice-notes.service:
        Failed to execute command: Permission denied Feb 10 02:50:47 fedora
        systemd[567085]: lattice-notes.service: Failed at step EXEC spawning
        /usr/local/bin/lein: Permission denied Feb 10 02:50:47 fedora
        systemd[1]: lattice-notes.service: Main process exited, code=exited,
        status=203/EXEC Feb 10 02:50:47 fedora systemd[1]:
        lattice-notes.service: Failed with result 'exit-code'. Feb 10 02:50:47
        fedora systemd[1]: lattice-notes.service: Scheduled restart job, restart
        counter is at 3. Feb 10 02:50:47 fedora systemd[1]: Stopped Lattice
        Notes Service. Feb 10 02:50:47 fedora systemd[1]: Started Lattice Notes
        Service. Feb 10 02:50:47 fedora systemd[567086]: lattice-notes.service:
        Failed to execute command: Permission denied Feb 10 02:50:47 fedora
        systemd[567086]: lattice-notes.service: Failed at step EXEC spawning
        /usr/local/bin/lein: Permission denied Feb 10 02:50:47 fedora
        systemd[1]: lattice-notes.service: Main process exited, code=exited,
        status=203/EXEC Feb 10 02:50:47 fedora systemd[1]:
        lattice-notes.service: Failed with result 'exit-code'. Feb 10 02:50:47
        fedora systemd[1]: lattice-notes.service: Scheduled restart job, restart
        counter is at 4. Feb 10 02:50:47 fedora systemd[1]: Stopped Lattice
        Notes Service. Feb 10 02:50:47 fedora systemd[1]: Started Lattice Notes
        Service. Feb 10 02:50:47 fedora systemd[567087]: lattice-notes.service:
        Failed to execute command: Permission denied Feb 10 02:50:47 fedora
        systemd[567087]: lattice-notes.service: Failed at step EXEC spawning
        /usr/local/bin/lein: Permission denied Feb 10 02:50:47 fedora
        systemd[1]: lattice-notes.service: Main process exited, code=exited,
        status=203/EXEC Feb 10 02:50:47 fedora systemd[1]:
        lattice-notes.service: Failed with result 'exit-code'. Feb 10 02:50:48
        fedora systemd[1]: lattice-notes.service: Scheduled restart job, restart
        counter is at 5. Feb 10 02:50:48 fedora systemd[1]: Stopped Lattice
        Notes Service. Feb 10 02:50:48 fedora systemd[1]: lattice-notes.service:
        Start request repeated too quickly. Feb 10 02:50:48 fedora systemd[1]:
        lattice-notes.service: Failed with result 'exit-code'. Feb 10 02:50:48
        fedora systemd[1]: Failed to start Lattice Notes Service.

Troubleshooting permissions

$ sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux
        SELinux root directory: /etc/selinux Loaded policy name: targetedCurrent
        mode: enforcing Mode from config file: enforcing Policy MLS status:
        enabled Policy deny_unknown status: allowed Memory protection checking:
        actual (secure) Max kernel policy version: 33

$ sudo semanage login -l Login Name SELinux User MLS/MCS Range Service
        __default__ unconfined_u s0-s0:c0.c1023 * root unconfined_u
        s0-s0:c0.c1023 *

SE troubleshoot client tool:

sudo sealert -a /var/log/audit/audit.log > log.txt

SELinux is preventing systemd from read access on the file lattice-notes.service.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd should be allowed read access on the lattice-notes.service file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp


Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                unconfined_u:object_r:user_home_t:s0
Target Objects                lattice-notes.service [ file ]
Source                        systemd
Source Path                   systemd
Port                          &lt;Unknown&gt;
Host                          &lt;Unknown&gt;
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-3.14.6-34.fc33.noarch
Local Policy RPM              selinux-policy-targeted-3.14.6-34.fc33.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     fedora
Platform                      Linux fedora 5.10.10-200.fc33.x86_64 #1 SMP Sun
                              Jan 24 19:58:54 UTC 2021 x86_64 x86_64
Alert Count                   3
First Seen                    2021-02-10 02:49:24 CET
Last Seen                     2021-02-10 02:50:23 CET
Local ID                      c2468530-6a55-4510-b129-03c54b2c43ec

Raw Audit Messages
type=AVC msg=audit(1612921823.529:6869): avc:  denied  { read } for  pid=1 comm="systemd" name="lattice-notes.service" dev="dm-0" ino=248835 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0


Hash: systemd,init_t,user_home_t,file,read

Check context of a file or process

ls -Zps -Z

Change the context

chcon -v --type=bin_t /usr/local/bin/lein

Nginx

https://www.nginx.com/blog/using-nginx-plus-with-selinux/

grep 1613085339.996:834 /var/log/audit/audit.log | audit2why type=AVC
        msg=audit(1613085339.996:834): avc: denied { name_connect } for pid=1910
        comm="nginx" dest=3000 scontext=system_u:system_r:httpd_t:s0
        tcontext=system_u:object_r:ntop_port_t:s0 tclass=tcp_socket permissive=0
        Was caused by: The boolean httpd_can_network_connect was set
        incorrectly. Description: Allow httpd to can network connect Allow
        access by executing: # setsebool -P httpd_can_network_connect 1