I am using CentOS 6 and trying to call sudo in Apache using this command:
exec("sudo -u kouser whoami 2>&1",$output,$code);
However SElinux add a line to output
array(2) {
[0]=>
string(53) "sudo: unable to send audit message: Permission denied"
[1]=>
string(61) "kouser"
}
When I stopped SElinux this line will hidden.
tail /var/log/secure
Mar 1 10:11:44 ERP-Server sudo: apache : TTY=unknown ; PWD=/var/www/html/test ; USER=kouser ; COMMAND=/usr/bin/whoami
Mar 1 10:11:44 ERP-Server sudo: PAM audit_log_acct_message() failed: Permission denied
I don't want to use audit2allow ; it will solve the issue but without me understanding why.
UPDATE
tail /var/log/audit/audit.log
type=CRYPTO_KEY_USER msg=audit(1456820535.260:395): user pid=2580 uid=0 auid=511 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a6:e2:91:a3:bd:bf:85:dd:bb:13:c5:eb:18:23:38:8f direction=? spid=2580 suid=0 exe="/usr/sbin/sshd" hostname=? addr=192.168.0.110 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1456820535.260:396): user pid=2580 uid=0 auid=511 ses=11 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=6b:bb:f8:63:c5:9b:e3:67:e6:f8:c1:5a:cd:2c:72:77 direction=? spid=2580 suid=0 exe="/usr/sbin/sshd" hostname=? addr=192.168.0.110 terminal=? res=success'
type=AVC msg=audit(1456820604.024:397): avc: denied { nlmsg_relay } for pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket
type=SYSCALL msg=audit(1456820604.024:397): arch=c000003e syscall=44 success=no exit=-13 a0=3 a1=7fffea1f4070 a2=78 a3=0 items=0 ppid=2613 pid=2614 auid=4294967295 uid=48 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="sudo" exe="/usr/bin/sudo" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1456820604.025:398): avc: denied { nlmsg_relay } for pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket
type=SYSCALL msg=audit(1456820604.025:398): arch=c000003e syscall=44 success=no exit=-13 a0=8 a1=7fffea1f7c20 a2=6c a3=0 items=0 ppid=2613 pid=2614 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="sudo" exe="/usr/bin/sudo" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1456820604.035:399): avc: denied { nlmsg_relay } for pid=2614 comm="sudo" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:httpd_t:s0 tclass=netlink_audit_socket
type=SYSCALL msg=audit(1456820604.035:399): arch=c000003e syscall=44 success=no exit=-13 a0=8 a1=7fffea1f7c20 a2=70 a3=0 items=0 ppid=2613 pid=2614 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="sudo" exe="/usr/bin/sudo" subj=system_u:system_r:httpd_t:s0 key=(null)
type=AVC msg=audit(1456820604.112:400): avc: denied { write } for pid=2616 comm="setroubleshootd" name="__db.001" dev=dm-0 ino=1971765 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
type=SYSCALL msg=audit(1456820604.112:400): arch=c000003e syscall=2 success=no exit=-13 a0=1913580 a1=2 a2=0 a3=16 items=0 ppid=2615 pid=2616 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 key=(null)
Best Answer
Your problem is being caused because httpd_t does not have suitable rights to access netlink_audit_socket contexts. In this case audit2why(8) is useful
Effectively the default policy doesn't allow what you want to do but it is fairly straightforward to allow it be enabling the relevant boolean.