Request to upgrade DJango

[Toshio Kuratomi]

On Fri, Apr 20, 2012 at 09:42:26AM -0400, Adam Young wrote:
> 
> One caveat.   Any DJango app (Probably most Python wsgi apps, actually) is
> going to give an AVC Denial warning upon startup.

Only a denial?  ;-)  Do you have selinux in permissive?

> DJango imports Python's UUID
> module which in turn imports ctypes.  Ctypes does dynamic code generation,
> specifically by writing a file andd then trying to execute it, which, as you
> can imagine,  is a pretty big security hole.  Let the wsgi community know that,
> until we have that fixed,  we should not attempt to get rid of the AVC denial
> warning message, but instead should push on the Python upstread to get a fix
> in.  Yes, David Malcolm is aware of it.
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=814391
> 
That's sorta a duplicate of this bug;
https://bugzilla.redhat.com/show_bug.cgi?id=582009

(AFAICS, they're the same, but yours is against RHEL and mine is against
Fedora).

I discussed it with dmalcolm when I opened it in 2010 -- it's not easily
solvable.

* By its nature, libffi needs to generate code that it then executes.
* Because python is interpreted, selinux has no transition to tell it that
  this is a specific program that needs to be able to write and execute
  specific files
* Because the python interpreter is being embedded inside of apache, selinux
  has no way of differentiating it from any other piece of apache.

The way out that I suggested in 2010 was to have a search path.  Python
would loop through the search path to find which directory it could use to
write its temporary files for ffi.  We'd need a way to set this path when
applications start up (maybe in their httpd.conf) as mod_wsgi allows
applications to run as different users than apache (which means that each
wsgi application might need a different ffi directory). The sysadmin or wsgi
application package would be responsible for creating the ffi directory and
setting the appropriate selinux context on it.

dmalcolm might not have liked that idea because of all the visible changes
it would have to do (configuring the directories to search).  Or it might
just have been too much time to expend.  I'm not sure.

btw, the workaround is to set httpd_tmp_exec --> on

-Toshio
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/epel-devel-list/attachments/20120420/bb273211/attachment.sig>