Which permission to execute a script?
Bruno Wolff III
bruno at wolff.to
Sun Nov 16 07:57:31 UTC 2008
I was making a modified version of the guest policy that needed to be able
to edit and run some perl scripts that also are visible to the web server.
I used the manage_files macro and allowed execute, but I can't run the
script directly. But I can run it via perl.
For example:
[tomarndt at wolff area]$ ./newcheck.pl
-bash: ./newcheck.pl: /usr/bin/perl: bad interpreter: Permission denied
[tomarndt at wolff area]$ perl ./newcheck.pl
Ownership counts:
Ownership of games with owners owning less than 10 new games.
newcheck.pl starts with:
#!/usr/bin/perl
This is the modified policy for tom_t:
policy_module(tom,1.0.0)
########################################
#
# Declarations
#
userdom_restricted_user_template(tom)
require {
type httpd_sys_content_t;
type httpd_sys_script_exec_t;
type postgresql_tmp_t;
type postgresql_t;
}
########################################
#
# tom local policy
#
optional_policy(`
qmail_per_role_template(tom,tom_t,tom_r)
')
manage_dirs_pattern(tom_t, httpd_sys_content_t, httpd_sys_content_t)
manage_files_pattern(tom_t, httpd_sys_content_t, httpd_sys_content_t)
manage_files_pattern(tom_t, httpd_sys_script_exec_t, httpd_sys_script_exec_t)
allow tom_t postgresql_tmp_t:sock_file write;
allow tom_t postgresql_t:unix_stream_socket connectto;
allow tom_t httpd_sys_script_exec_t:file execute;
More information about the fedora-selinux-list
mailing list