xlxd and SELinux

TL;DR — If you’re not running an xlxd based reflector using SELinux you can skip this post.

I recently migrated the XLX reflector from Debian Stretch to Fedora FC30. Debian is the platform recommended by the software author, but xlxd runs fine under Fedora as well. However, since I’m running with SELinux enabled, there were a couple of issues to tackle.

SELinux tags filesystem elements with a security context and in some cases, xlxd fails to access certain files for which it does not have authorization. There are three files that will require some special attention.

xlxd.pid -- contains the running process number
xlxd.log -- the XML log file used by the dashboard
callinghome.php -- contains the hash value used for registration

In my system, the files are installed in the following directories:

/var/run/xlxd.pid
/var/log/xlxd.log
/var/lib/httpd/xlxd/callinghome.php

I had to create new rules to put the files in the correct security contexts.

semanage fcontext -a -t httpd_sys_content_t /var/log/xlxd.xml
semanage fcontext -a -t httpd_sys_content_t /var/run/xlxd.pid
semanage fcontext -a -t httpd_sys_rw_content_t \
/var/lib/httpd /xlxd/callinghome.php

One issue I discovered is that the contexts do not handle the creation of a new file. For that, I installed restorecond. This system daemon watches for specified files to be created and relabels the security context.

dnf install restorecon

Then, add the 3 fully pathed file names to /etc/selinux/targeted/contexts/files/file_contexts.local. Restart the restorecond service and you’re ready to start the xlxd, httpd, and php-fpm services.

A very useful command is ls -lZ. On an SELinux enabled system it will list the security context labels for each file.

ls -lZ
total 4
-rwxrwxrwx. 1 apache apache system_u:object_r:httpd_sys_rw_content_t:s0 66 May 16 14:12 callinghome.php

Another useful command is restorecon. RTFM.

73