use o Sudo no apache

Question

Estou usando o CentOS 6 e tentando chamar o sudo no Apache usando este comando:

exec("sudo -u kouser whoami  2>&1",$output,$code);

No entanto, o SElinux adiciona uma linha à saída

array(2) {
  [0]=>
  string(53) "sudo: unable to send audit message: Permission denied"
  [1]=>
  string(61) "kouser"
}

Quando parei o SElinux, esta linha ficará oculta.

cauda / var / log / secure

Mar  1 10:11:44 ERP-Server sudo:   apache : TTY=unknown ; PWD=/var/www/html/test ; USER=kouser ; COMMAND=/usr/bin/whoami
Mar  1 10:11:44 ERP-Server sudo: PAM audit_log_acct_message() failed: Permission denied

Eu não quero usar o audit2allow; isso resolverá o problema, mas sem eu entender o porquê.

ATUALIZAÇÃO

tail /var/log/audit/audit.log

type=CRYPTO_KEY_USER msg=audit(1456820535.260:395): user pid=2580 uid=0 auid=511 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a6:e2:91:a3:bd:bf:85:dd:bb:13:c5:eb:18:23:38:8f direction=? spid=2580 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.110 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1456820535.260:396): user pid=2580 uid=0 auid=511 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6b:bb:f8:63:c5:9b:e3:67:e6:f8:c1:5a:cd:2c:72:77 direction=? spid=2580 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.110 terminal=? res=success'
type=AVC msg=audit(1456820604.024:397): avc:  denied  { nlmsg_relay } for  pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket
type=SYSCALL msg=audit(1456820604.024:397): arch=c000003e syscall=44 success=no exit=-13 a0=3 a1=7fffea1f4070 a2=78 a3=0 items=0 ppid=2613 pid=2614 auid=4294967295 uid=48 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="sudo" exe="/usr/bin/sudo" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1456820604.025:398): avc:  denied  { nlmsg_relay } for  pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket
type=SYSCALL msg=audit(1456820604.025:398): arch=c000003e syscall=44 success=no exit=-13 a0=8 a1=7fffea1f7c20 a2=6c a3=0 items=0 ppid=2613 pid=2614 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="sudo" exe="/usr/bin/sudo" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1456820604.035:399): avc:  denied  { nlmsg_relay } for  pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket
type=SYSCALL msg=audit(1456820604.035:399): arch=c000003e syscall=44 success=no exit=-13 a0=8 a1=7fffea1f7c20 a2=70 a3=0 items=0 ppid=2613 pid=2614 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="sudo" exe="/usr/bin/sudo" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1456820604.112:400): avc:  denied  { write } for  pid=2616 comm="setroubleshootd" name="__db.001" dev=dm-0 ino=1971765 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
type=SYSCALL msg=audit(1456820604.112:400): arch=c000003e syscall=2 success=no exit=-13 a0=1913580 a1=2 a2=0 a3=16 items=0 ppid=2615 pid=2616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)

    

Answer 1

Seu problema está sendo causado porque o httpd_t não possui direitos adequados para acessar os contextos netlink_audit_socket. Nesse caso, audit2why (8) é útil

type=AVC msg=audit(1456820604.024:397): avc:  denied  { nlmsg_relay } for  pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket

        Was caused by:
        The boolean allow_httpd_mod_auth_pam was set incorrectly.
        Description:
        Allow Apache to use mod_auth_pam

        Allow access by executing:
        # setsebool -P allow_httpd_mod_auth_pam 1 

Efetivamente, a política padrão não permite o que você deseja fazer, mas é bastante simples permitir que ela ative o booleano relevante.