6:37 p.m.
Hi folks!
Just wanted to give a heads-up on this: it seems that a recent selinux-
policy update, 3.13.1-269 , introduced a new permission called 'map'.
This seems to have resulted in rather a large amount of new SELinux
denials for this permission in various cases. Some are fairly serious -
e.g. there's a denial for the systemd journal - and in some cases seem
to prevent systems from booting correctly at all.
I've created a tracker bug for now:
https://bugzilla.redhat.com/show_bug.cgi?id=1481454
and intend to mark all the 'map' bugs I find as blocking that tracker.
Petr, Lukas, it'd be great if we could get as many of these cleaned up
as fast as possible; it's been hard to get a decent evaluation of
Rawhide's current state for quite a while, now, due to various
problems, and now *this* problem is making things difficult too.
Of course, for day-to-day Rawhide users, booting with 'enforcing=0' can
work around these issues for now (or you could, I suppose, create a
local policy that just blanket allowed the 'map' permission in all
cases, so all other SELinux restrictions would remain in place).
Thanks!
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net
9:58 a.m.
On 08/15/2017 01:37 AM, Adam Williamson wrote:
Hi folks!
Just wanted to give a heads-up on this: it seems that a recent selinux-
policy update, 3.13.1-269 , introduced a new permission called 'map'.
This seems to have resulted in rather a large amount of new SELinux
denials for this permission in various cases. Some are fairly serious -
e.g. there's a denial for the systemd journal - and in some cases seem
to prevent systems from booting correctly at all.
I've created a tracker bug for now:
https://bugzilla.redhat.com/show_bug.cgi?id=1481454
and intend to mark all the 'map' bugs I find as blocking that tracker.
Petr, Lukas, it'd be great if we could get as many of these cleaned up
as fast as possible; it's been hard to get a decent evaluation of
Rawhide's current state for quite a while, now, due to various
problems, and now *this* problem is making things difficult too.
Of course, for day-to-day Rawhide users, booting with 'enforcing=0' can
work around these issues for now (or you could, I suppose, create a
local policy that just blanket allowed the 'map' permission in all
cases, so all other SELinux restrictions would remain in place).
Thanks!
Hi Adam,
I fixed all BZs from tracker bug. selinux-policy build is in koji:
https://koji.fedoraproject.org/koji/taskinfo?taskID=21243824
Lukas.
--
Lukas Vrabec
Software Engineer, Security Technologies
Red Hat, Inc.
9:59 a.m.
On 08/15/2017 04:58 PM, Lukas Vrabec wrote:
On 08/15/2017 01:37 AM, Adam Williamson wrote:
> Hi folks!
>
> Just wanted to give a heads-up on this: it seems that a recent selinux-
> policy update, 3.13.1-269 , introduced a new permission called 'map'.
> This seems to have resulted in rather a large amount of new SELinux
> denials for this permission in various cases. Some are fairly serious -
> e.g. there's a denial for the systemd journal - and in some cases seem
> to prevent systems from booting correctly at all.
>
> I've created a tracker bug for now:
> https://bugzilla.redhat.com/show_bug.cgi?id=1481454
>
> and intend to mark all the 'map' bugs I find as blocking that tracker.
> Petr, Lukas, it'd be great if we could get as many of these cleaned up
> as fast as possible; it's been hard to get a decent evaluation of
> Rawhide's current state for quite a while, now, due to various
> problems, and now *this* problem is making things difficult too.
>
> Of course, for day-to-day Rawhide users, booting with 'enforcing=0' can
> work around these issues for now (or you could, I suppose, create a
> local policy that just blanket allowed the 'map' permission in all
> cases, so all other SELinux restrictions would remain in place).
>
> Thanks!
>
Hi Adam,
I fixed all BZs from tracker bug. selinux-policy build is in koji:
https://koji.fedoraproject.org/koji/taskinfo?taskID=21243824
Lukas.
--
Lukas Vrabec
Software Engineer, Security Technologies
Red Hat, Inc.
10:25 a.m.
On Tue, 2017-08-15 at 16:58 +0200, Lukas Vrabec wrote:
On 08/15/2017 01:37 AM, Adam Williamson wrote:
> Hi folks!
>
> Just wanted to give a heads-up on this: it seems that a recent selinux-
> policy update, 3.13.1-269 , introduced a new permission called 'map'.
> This seems to have resulted in rather a large amount of new SELinux
> denials for this permission in various cases. Some are fairly serious -
> e.g. there's a denial for the systemd journal - and in some cases seem
> to prevent systems from booting correctly at all.
>
> I've created a tracker bug for now:
> https://bugzilla.redhat.com/show_bug.cgi?id=1481454
>
> and intend to mark all the 'map' bugs I find as blocking that tracker.
> Petr, Lukas, it'd be great if we could get as many of these cleaned up
> as fast as possible; it's been hard to get a decent evaluation of
> Rawhide's current state for quite a while, now, due to various
> problems, and now *this* problem is making things difficult too.
>
> Of course, for day-to-day Rawhide users, booting with 'enforcing=0' can
> work around these issues for now (or you could, I suppose, create a
> local policy that just blanket allowed the 'map' permission in all
> cases, so all other SELinux restrictions would remain in place).
>
> Thanks!
>
Hi Adam,
I fixed all BZs from tracker bug. selinux-policy build is in koji:
https://koji.fedoraproject.org/koji/taskinfo?taskID=21243824
Thanks a lot, we'll see how the next compose goes.
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net
1:46 p.m.
On 08/15/2017 05:25 PM, Adam Williamson wrote:
On Tue, 2017-08-15 at 16:58 +0200, Lukas Vrabec wrote:
> On 08/15/2017 01:37 AM, Adam Williamson wrote:
>> Hi folks!
>>
>> Just wanted to give a heads-up on this: it seems that a recent selinux-
>> policy update, 3.13.1-269 , introduced a new permission called 'map'.
>> This seems to have resulted in rather a large amount of new SELinux
>> denials for this permission in various cases. Some are fairly serious -
>> e.g. there's a denial for the systemd journal - and in some cases seem
>> to prevent systems from booting correctly at all.
>>
>> I've created a tracker bug for now:
>> https://bugzilla.redhat.com/show_bug.cgi?id=1481454
>>
>> and intend to mark all the 'map' bugs I find as blocking that tracker.
>> Petr, Lukas, it'd be great if we could get as many of these cleaned up
>> as fast as possible; it's been hard to get a decent evaluation of
>> Rawhide's current state for quite a while, now, due to various
>> problems, and now *this* problem is making things difficult too.
>>
>> Of course, for day-to-day Rawhide users, booting with 'enforcing=0' can
>> work around these issues for now (or you could, I suppose, create a
>> local policy that just blanket allowed the 'map' permission in all
>> cases, so all other SELinux restrictions would remain in place).
>>
>> Thanks!
>>
>
> Hi Adam,
>
> I fixed all BZs from tracker bug. selinux-policy build is in koji:
> https://koji.fedoraproject.org/koji/taskinfo?taskID=21243824
Thanks a lot, we'll see how the next compose goes.
Okay,
Please let me know ASAP if there will be more issues.
Thanks,
Lukas.
--
Lukas Vrabec
SELinux Solutions
Red Hat, Inc.
1:50 p.m.
Adam Williamson kirjoitti 15.08.2017 klo 02:37:
Of course, for day-to-day Rawhide users, booting with
'enforcing=0' can
work around these issues for now (or you could, I suppose, create a
local policy that just blanket allowed the 'map' permission in all
cases, so all other SELinux restrictions would remain in place).
For those less familiar with SELinux but still using it and wishing to
keep things that way, it would be awesome to have a quick summary (or
just pointer to documentation) on how you do this. It sounds like a
fairly straightforward task to describe if you know your way around SELinux.
Thanks,
- Joonas
2:52 p.m.
On Tue, 2017-08-15 at 21:50 +0300, Joonas Sarajärvi wrote:
Adam Williamson kirjoitti 15.08.2017 klo 02:37:
> Of course, for day-to-day Rawhide users, booting with 'enforcing=0' can
> work around these issues for now (or you could, I suppose, create a
> local policy that just blanket allowed the 'map' permission in all
> cases, so all other SELinux restrictions would remain in place).
For those less familiar with SELinux but still using it and wishing to
keep things that way, it would be awesome to have a quick summary (or
just pointer to documentation) on how you do this. It sounds like a
fairly straightforward task to describe if you know your way around SELinux.
Welp, that's me busted: I would've had to look up specifically how to
do this, and I was too lazy to. :P I do create custom policies very
occasionally, but not often enough to remember exactly how to do it off
the top of my head (I always have to look it up), and I don't think
I've tried one which just blanket allows a permission in *all* cases
before.
The reference I usually start from, FWIW, is:
https://wiki.centos.org/HowTos/SELinux#head-aa437f65e1c7873cddbafd9e9a73b...
There are various other references (mainly in RHEL and SELinux
documentation) that you can find by googling stuff like 'selinux custom
policy', and with the help of those I usually muddle through...
--
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Twitter: AdamW_Fedora | XMPP: adamw AT happyassassin . net
http://www.happyassassin.net
10:37 a.m.
On 08/15/2017 02:50 PM, Joonas Sarajärvi wrote:
Adam Williamson kirjoitti 15.08.2017 klo 02:37:
> Of course, for day-to-day Rawhide users, booting with 'enforcing=0' can
> work around these issues for now (or you could, I suppose, create a
> local policy that just blanket allowed the 'map' permission in all
> cases, so all other SELinux restrictions would remain in place).
For those less familiar with SELinux but still using it and wishing to
keep things that way, it would be awesome to have a quick summary (or
just pointer to documentation) on how you do this. It sounds like a
fairly straightforward task to describe if you know your way around
SELinux.
Thanks,
- Joonas
_______________________________________________
devel mailing list -- devel(a)lists.fedoraproject.org
To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
This would be fairly difficult. Basically the kernel added a new access
check map to verify memory mapped file systems are still accessible by
the process after a policy load. The map access had to be added to all
file access interfaces. Basically lots of rules are written
read_files_pattern(SOURCE_T, TARGET_T)
But read_files_pattern had to have an additional map access added and
then all of the domains get the access.
2442
days inactive
2446
days old
7 comments
4 participants
participants (4)
-
Adam Williamson -
Daniel Walsh -
Joonas Sarajärvi -
Lukas Vrabec