Unable to write Bacula configuration files

gsw-belgium

Hi,

We have deployed the latest Bacularis version via RPM on RHEL 9 in combination with Bacula 15.x. The host is secured with SELinux and running Apache server. When doing a healthcheck in Bacularis we are getting:

May 28 14:59:18 ba1endmz setroubleshoot[11190]: SELinux is preventing /usr/bin/sudo from 'read, write' accesses on the file /var/run/faillock/apache.#012#012*****  Plugin catchall (100. confidence) suggests   **************************#012#012If you believe that sudo should be allowed read write access on the apache file by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'sudo' --raw | audit2allow -M my-sudo#012# semodule -X 300 -i my-sudo.pp#012
May 28 14:59:18 ba1endmz systemd[1]: session-c95.scope: Deactivated successfully.

gani

Hello @gsw-belgium

Welcome to the Bacularis User Group.

This problem with SELinux and sudo seems to be a end result of another error that is not displayed in this log. I mean that the sudo (from unknown reaseon for now) could not be successful and it caused that the faillock took place. If we fix the original problem, then this SELinux error will dissapear automatically, I think.

I would propose to do a test and simulate the execution of the bdirjson command in the way as Bacularis does it. Please adapt this bdirjson command path to your path in system. This command executed on the root account can look as below:

sudo -u apache sudo /usr/sbin/bdirjson

If you use Runas user/group sudo function, then this command can look like here (for bacula user and group):

sudo -u apache sudo -u bacula -g bacula /usr/sbin/bdirjson

Are these command results successful in your system?

I remember similar problem from the past and that time it was caused by some PAM system settings that blocked sudo commands. We will see what is the reason in this case.

At the end I have a question, because you wrote that you are not able to write Bacula configuration files. Does it mean that you are able to read and see the Bacula configuration in Bacularis forms but you are not able to write it?

Best regards,
Marcin Haba (gani)

gsw-belgium

Hi Marcin,

Sorry for the late reply. The sudo configuration is OK. The test command works fine. Example:

[root@ba1endmz]# sudo -u apache sudo /opt/bacula/bin/bdirjson |more
[
{
  "Director": {
    "Name": "ba1endmz-dir",
    "Messages": "Daemon",
    "QueryFile": "/opt/bacula/scripts/query.sql",
    "WorkingDirectory": "/opt/bacula/working",
    "PidDirectory": "/opt/bacula/working",
    "MaximumConcurrentJobs": 20,
  <skipped>

Note that this is a RHEL 9 system that has been hardened with the CIS 2 Level Server benchmark.

The configuration files are now readable and writeable according the Self-Test Healthcheck. Some permissions were initially still wrong. But the faillock error persists when adding an autochanger device for example. Restarting the storage daemon fails with a sudo pass prompt even though the correct commands are in the sudoers config:

Defaults:apache !requiretty
apache ALL = (root) NOPASSWD: /opt/bacula/bin/bconsole
apache ALL = (root) NOPASSWD: /opt/bacula/bin/bdirjson
apache ALL = (root) NOPASSWD: /opt/bacula/bin/bsdjson
apache ALL = (root) NOPASSWD: /opt/bacula/bin/bfdjson
apache ALL = (root) NOPASSWD: /opt/bacula/bin/bbconsjson
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl start bacula-dir
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl stop bacula-dir
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl restart bacula-dir
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl start bacula-sd
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl stop bacula-sd
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl restart bacula-sd
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl start bacula-fd
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl stop bacula-fd
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl stop bacula-fd
apache ALL = (root) NOPASSWD: /opt/bacula/scripts/mtx-changer
apache ALL = (root) NOPASSWD: /opt/bacula/scripts/bacula-ctl-dir
apache ALL = (root) NOPASSWD: /opt/bacula/scripts/bacula-ctl-fd
apache ALL = (root) NOPASSWD: /opt/bacula/scripts/bacula-ctl-sd

gani

Hi @gsw-belgium,

Good to hear that you solved this problem with reading/writing the Bacula configuration.

Thanks for providing the bdirjson output.

For this faillock error when adding an autochanger device, this action requires adding sudo entries for:

1) start/stop/restart Bacula storage daemon - this is needed if you want to be able to execute start/stop/restart Bacula storage daemon (for loading new storage daemon configuration). If you prefer restarting Bacula storage daemon manually in command line, this is fine as well.

To configure this function with the sudo entries, you can go to:

[Main menu] => [Page: API Panel] => [log in to API] => [Page: Settings] => [Page: Actions]

After setting it up and adding appropriate sudo entries, you will be able to start/stop and restart Bacula SD directly on the web interface.

2) In case magnetic tape autochangers or VTLs, the sudo entry is required for mtx-changer script as well if you plan to manage this autochanger via Bacularis (load/unload tapes in slots, bulk label action with/without barcodes, move tapes to I/O ports ...etc.). On the last step of the new tape storage wizard we display information about need of these sudo command. If you don't need this function in Bacularis, then this sudo entry is not needed.

It can look for example like here:

apache ALL = (root) NOPASSWD: /usr/libexec/bacula/mtx-changer

Without configuring sudo for these two functions, this faillock error can appear because Bacularis will try to execute commands that are not configured. This will happen in moments of using these functions, of course, not automatically.

Best regards,
Marcin Haba (gani)

gani

Hi @gsw-belgium,

At the moment I refreshed this page and I am seeing that you edited your message with more details.

For start/stop/restart commands, I have a question:

apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl start bacula-dir
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl stop bacula-dir
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl restart bacula-dir
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl start bacula-sd
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl stop bacula-sd
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl restart bacula-sd
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl start bacula-fd
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl stop bacula-fd
apache ALL = (root) NOPASSWD: /opt/bacula/bin/systemctl stop bacula-fd

Are you sure that the systemctl command in your environment is in /opt/bacula/bin? Normally it is in /usr/bin.

All these commands can be checked by running a test here:

[Main menu] => [Page: API Panel] => [log in to API] => [Page: Settings] => [Page: Actions]

Best regards,
Marcin Haba (gani)

gsw-belgium

Hello Marcin,

That was indeed a really stupid copy/paste error from our end. ouch Of course systemctl is in /usr/bin. I updated the sudo configuration and everything works as expected now.

Thank you very much for your support!