playing with unconfined domains and users on Fedora 16

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/02/2012 10:06 AM, Klaus Lichtenwalder wrote:
> On 02.02.2012 15:01, Dominick Grift wrote:
>> On Thu, 2012-02-02 at 14:13 +0100, Klaus Lichtenwalder wrote:
>>> [...] which would render gpg-agent probably useless...
>> 
>> I have not encountered similar avc denials here. I wonder what i
>> am doing differently.
>> 
>> I you are sure you have configured gpg agent properly , then this
>> may indeed be bug in policy.
>> 
>> The SELinux framework aims to make it easy for one to make
>> adjustments to policy.
> 
> Well, gpg-agent "just" is installed and started by the login
> process, with gpg-agent --daemon. The only configuration I was
> doing was settint the ttl time and giving "use-agent" to gnupg2.
> One avc was indeed gone after enabling the bool gpg_agent_env_file.
> But it still stumbles over the socket, which it wants to create in
> $HOME/.gnupg. Guess I'll have a look over the policy, in case I can
> detect something
> 
>> [...] klaus ALL=(ALL) TYPE=unconfined_t ROLE=unconfined_r ALL
>> 
>> if you want to use unconfined_r as you have specified above than
>> you need to map the unconfined_r to the staff_u SELinux user:
>> 
>> semanage user -m -R "staff_r system_r sysadm_r unconfined_r"
>> staff_u
> 
> Thanks, unconfined_r was missing in the semanage command above.
> 
> Still, logging in leaves me with the following denials:
> 
> time->Thu Feb  2 15:40:06 2012 type=SYSCALL
> msg=audit(1328193606.453:145): arch=40000003 syscall=11 success=yes
> exit=0 a0=a064888 a1=a0593d8 a2=a06e958 a3=a0593d8 items=0 
> ppid=3288 pid=3289 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="PreLogin"
> exe="/bin/bash" subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023
> key=(null) type=AVC msg=audit(1328193606.453:145): avc:  denied  {
> entrypoint } for pid=3289 comm="lxdm-binary"
> path="/etc/lxdm/PreLogin" dev=sda3 ino=393588
> scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 
> tcontext=system_u:object_r:etc_t:s0 tclass=file ---- time->Thu Feb
> 2 15:40:06 2012 type=SYSCALL msg=audit(1328193606.472:146):
> arch=40000003 syscall=11 success=yes exit=0 a0=a060525 a1=a057838
> a2=a06e958 a3=bfe1ff76 items=0 ppid=1 pid=3291 auid=1000 uid=1000
> gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000
> fsgid=1000 tty=(none) ses=3 comm="xauth" exe="/usr/bin/xauth"
> subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key=(null) type=AVC
> msg=audit(1328193606.472:146): avc:  denied  { entrypoint } for 
> pid=3291 comm="lxdm-binary" path="/usr/bin/xauth" dev=sda3
> ino=61761 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 
> tcontext=system_u:object_r:xauth_exec_t:s0 tclass=file ---- 
> time->Thu Feb  2 15:40:06 2012 type=SYSCALL
> msg=audit(1328193606.484:147): arch=40000003 syscall=11 success=yes
> exit=0 a0=a056058 a1=a05a568 a2=a06e958 a3=a05a568 items=0 ppid=1
> pid=3294 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000
> egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=3 comm="PostLogin"
> exe="/bin/bash" subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023
> key=(null) type=AVC msg=audit(1328193606.484:147): avc:  denied  {
> entrypoint } for pid=3294 comm="lxdm-binary"
> path="/etc/lxdm/PostLogin" dev=sda3 ino=393585
> scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 
> tcontext=system_u:object_r:etc_t:s0 tclass=file
> 
> Which also seems to point to something missing. I checked all
> labels, but everything seems fine according to policy. Am I correct
> in saying that staff_u:staff_r:staff_t is missing an entrypoint
> rule for etc_t files and xauth_exec_t? The former somehow seems
> mislabeled, as an entrypoint is associated with a _exec_t?
> 
> Thanks, Klaus
> 
> 
> 
> -- selinux mailing list selinux at lists.fedoraproject.org 
> https://admin.fedoraproject.org/mailman/listinfo/selinux

Those files should be labeled bin_t.

I will change the default labeling, any other binary file in that
directory.


Open a bugzilla on the gpg_agent problems.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk8qrPoACgkQrlYvE4MpobOTcgCfaPx1wTb14fK+h1tfWyo2TFQP
fHkAn1ZDOVHkz52KhvbrZyvvUnC4OEQ1
=ZjJY
-----END PGP SIGNATURE-----