Apache/PHP mail function SELinux permissions
by Ted Rule
I've had a "problem" recently with SELinux permissions related to PHP's
mail functions. These appear to give rise to two different classes of error,
one for read permissions on the httpd_t domain itself, and one for
read/write permission on a file in the httpd_tmp_t domain.
aureport gives this:
$ sudo aureport -a |grep system_mail |head
6. 25/10/09 13:12:48 sendmail user_u:system_r:system_mail_t:s0 11 file
read user_u:system_r:httpd_t:s0 denied 116101
7. 25/10/09 13:15:57 sendmail user_u:system_r:system_mail_t:s0 11 file
read write user_u:object_r:httpd_tmp_t:s0 denied 116102
17. 25/10/09 13:39:46 sendmail user_u:system_r:system_mail_t:s0 11 file
read write user_u:object_r:httpd_tmp_t:s0 denied 116124
23. 25/10/09 13:43:04 sendmail user_u:system_r:system_mail_t:s0 11 file
read write user_u:object_r:httpd_tmp_t:s0 denied 116136
24. 25/10/09 13:43:04 sendmail user_u:system_r:system_mail_t:s0 11 file
read user_u:system_r:httpd_t:s0 denied 116136
30. 25/10/09 13:52:57 sendmail user_u:system_r:system_mail_t:s0 11 file
read write user_u:object_r:httpd_tmp_t:s0 denied 116148
31. 25/10/09 13:52:57 sendmail user_u:system_r:system_mail_t:s0 11 file
read user_u:system_r:httpd_t:s0 denied 116148
39. 25/10/09 14:01:18 sendmail user_u:system_r:system_mail_t:s0 11 file
read write user_u:object_r:httpd_tmp_t:s0 denied 116168
40. 25/10/09 14:01:18 sendmail user_u:system_r:system_mail_t:s0 11 file
read user_u:system_r:httpd_t:s0 denied 116168
48. 25/10/09 14:11:50 sendmail user_u:system_r:system_mail_t:s0 11 file
read write user_u:object_r:httpd_tmp_t:s0 denied 116181
Policy on the Apache hosts currently uses selinux-policy-2.4.6-203.el5
Looking in more detail at ausearch we see that the httpd_t related avc
is apparently related to an "eventpoll" file descriptor, whilst the
httpd_tmp_t
avc is probably for a file created by php in /tmp.
Looking at the php source code itself, I see that it is simply opening a
temporary file containing the body of the Email and pouring it via a
pipe into an instance of sendmail via popen().
As such, it seems likely that both classes of avc's are simply file
descriptors "leaking" into the popen'ed child process running in the
system_mail_t domain.
Sadly, for other reasons, the Apache hosts are still in permissive, so
it's currently unclear to me whether the PHP mail function would fail
completely if either
of these permissions are denied in enforcing mode, but it makes me
wonder whether there would be any sense in a wider solution to leaky
descriptors which caused popen() itself to close all file descriptors
other than STDIN/STDOUT/STDERR if the popen'ed executable implies a
domain transition. Alternatively, one might envisage a set of selinux
booleans which allowed a more granular control of leaked descriptors
outside of STDIN/STDOUT/STDERR.
The other potential policy improvement would be for system_mail_t to
simply "dontaudit" denials relating to eventpoll class file descriptors
and temporary files in context *_tmp_t.
time->Sun Oct 25 13:12:48 2009
type=SYSCALL msg=audit(1256476368.217:116101): arch=40000003 syscall=11
success=yes exit=0 a0=97e5ff0 a1=97e5798 a2=97e5600 a3=40 items=0
ppid=20809 pid=22040 auid=500 uid=48 gid=48 euid=
48 suid=48 fsuid=48 egid=51 sgid=51 fsgid=51 tty=(none) ses=11966
comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
subj=user_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1256476368.217:116101): avc: denied { read } for
pid=22040 comm="sendmail" path="eventpoll:[129640960]" dev=eventpollfs
ino=129640960 scontext=user_u:system_r:system
_mail_t:s0 tcontext=user_u:system_r:httpd_t:s0 tclass=file
----
time->Sun Oct 25 13:15:57 2009
type=SYSCALL msg=audit(1256476557.234:116102): arch=40000003 syscall=11
success=yes exit=0 a0=9ab7ff0 a1=9ab7798 a2=9ab7600 a3=40 items=0
ppid=21767 pid=22099 auid=500 uid=48 gid=48 euid=
48 suid=48 fsuid=48 egid=51 sgid=51 fsgid=51 tty=(none) ses=11966
comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
subj=user_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1256476557.234:116102): avc: denied { read write }
for pid=22099 comm="sendmail"
path=2F746D702F2E7863616368652E302E302E313032353230323336322E6C6F636B202864656C65746
56429 dev=dm-3 ino=97922 scontext=user_u:system_r:system_mail_t:s0
tcontext=user_u:object_r:httpd_tmp_t:s0 tclass=file
----
time->Sun Oct 25 13:39:46 2009
type=SYSCALL msg=audit(1256477986.012:116124): arch=40000003 syscall=11
success=yes exit=0 a0=97f1ff0 a1=97f1798 a2=97f1600 a3=40 items=0
ppid=23457 pid=23560 auid=500 uid=48 gid=48 euid=
48 suid=48 fsuid=48 egid=51 sgid=51 fsgid=51 tty=(none) ses=11966
comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
subj=user_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1256477986.012:116124): avc: denied { read write }
for pid=23560 comm="sendmail"
path=2F746D702F2E7863616368652E302E302E313032353230323336322E6C6F636B202864656C65746
56429 dev=dm-3 ino=97922 scontext=user_u:system_r:system_mail_t:s0
tcontext=user_u:object_r:httpd_tmp_t:s0 tclass=file
----
time->Sun Oct 25 13:43:04 2009
type=SYSCALL msg=audit(1256478184.954:116136): arch=40000003 syscall=11
success=yes exit=0 a0=8f48ff0 a1=8f48798 a2=8f48600 a3=40 items=0
ppid=23048 pid=23802 auid=500 uid=48 gid=48 euid=
48 suid=48 fsuid=48 egid=51 sgid=51 fsgid=51 tty=(none) ses=11966
comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
subj=user_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1256478184.954:116136): avc: denied { read } for
pid=23802 comm="sendmail" path="eventpoll:[129701955]" dev=eventpollfs
ino=129701955 scontext=user_u:system_r:system
_mail_t:s0 tcontext=user_u:system_r:httpd_t:s0 tclass=file
type=AVC msg=audit(1256478184.954:116136): avc: denied { read write }
for pid=23802 comm="sendmail"
path=2F746D702F2E7863616368652E302E302E313032353230323336322E6C6F636B202864656C65746
56429 dev=dm-3 ino=97922 scontext=user_u:system_r:system_mail_t:s0
tcontext=user_u:object_r:httpd_tmp_t:s0 tclass=file
----
time->Sun Oct 25 13:52:57 2009
type=SYSCALL msg=audit(1256478777.377:116148): arch=40000003 syscall=11
success=yes exit=0 a0=945bff0 a1=945b798 a2=945b600 a3=40 items=0
ppid=24396 pid=24439 auid=500 uid=48 gid=48 euid=
48 suid=48 fsuid=48 egid=51 sgid=51 fsgid=51 tty=(none) ses=11966
comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
subj=user_u:system_r:system_mail_t:s0 key=(null)
type=AVC msg=audit(1256478777.377:116148): avc: denied { read } for
pid=24439 comm="sendmail" path="eventpoll:[129734033]" dev=eventpollfs
ino=129734033 scontext=user_u:system_r:system
_mail_t:s0 tcontext=user_u:system_r:httpd_t:s0 tclass=file
type=AVC msg=audit(1256478777.377:116148): avc: denied { read write }
for pid=24439 comm="sendmail"
path=2F746D702F2E7863616368652E302E302E313032353230323336322E6C6F636B202864656C65746
56429 dev=dm-3 ino=97922 scontext=user_u:system_r:system_mail_t:s0
tcontext=user_u:object_r:httpd_tmp_t:s0 tclass=file
----
--
Ted Rule
Director, Layer3 Systems Ltd
Layer3 Systems Limited is registered in England. Company no 3130393
W: http://www.layer3.co.uk/
13 years, 9 months
Apparent memory leak in libselinux
by Ed Swierk
When I run the following on a F12 system booted with selinux=0, the
tcmalloc heap checker complains about a leak somewhere in libselinux:
$ HEAPCHECK=normal LD_PRELOAD=/usr/lib64/libtcmalloc.so.0
/usr/bin/python -c 'import _ssl'
Leak check _main_ detected leaks of 120 bytes in 1 objects
The 1 largest leaks:
Leak of 120 bytes in 1 objects allocated from:
@ 0x3bf9866589 _IO_getdelim
@ 0x3bfb40ca53 set_selinuxmnt
@ 0x3bfb414fe6 string_to_security_class
@ 0x3bfb404cdb _init
@ 0x7fff4bdfa8ed 0x00007fff4bdfa8ed
No leak is detected when I run this with selinux enabled. My system
has libselinux-2.0.87-1.fc12 installed.
--Ed
14 years, 1 month
New "postdrop" denial
by Richard Chapman
I have seen this denial twice in the last few days - and I think it is
new to my system. I'm not sure whether recent updates have caused it -
or whether my system has entered a new phase for some other reason. I
can't think of any obvious changes I have made. Any suggestions would be
welcome:
Summary
SELinux is preventing postdrop (postfix_postdrop_t) "getattr" to
/var/log/httpd/error_log (httpd_log_t).
Detailed Description
[SELinux is in permissive mode, the operation would have been denied but
was permitted due to permissive mode.]
SELinux denied access requested by postdrop. It is not expected that
this access is required by postdrop and this access may signal an
intrusion attempt. It is also possible that the specific version or
configuration of the application is causing it to require additional
access.
Allowing Access
Sometimes labeling problems can cause SELinux denials. You could try to
restore the default system file context for /var/log/httpd/error_log,
restorecon -v '/var/log/httpd/error_log'
If this does not work, there is currently no automatic way to allow this
access. Instead, you can generate a local policy module to allow this
access - see FAQ
<http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385> Or you can
disable SELinux protection altogether. Disabling SELinux protection is
not recommended. Please file a bug report
<http://bugzilla.redhat.com/bugzilla/enter_bug.cgi> against this package.
Additional Information
Source Context: system_u:system_r:postfix_postdrop_t
Target Context: system_u:object_r:httpd_log_t
Target Objects: /var/log/httpd/error_log [ file ]
Source: postdrop
Source Path: /usr/sbin/postdrop
Port: <Unknown>
Host: C5.aardvark.com.au
Source RPM Packages: postfix-2.3.3-2.1.el5_2
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-255.el5_4.4
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: catchall_file
Host Name: C5.aardvark.com.au
Platform: Linux C5.aardvark.com.au 2.6.18-164.11.1.el5 #1 SMP Wed Jan
20 07:32:21 EST 2010 x86_64 x86_64
Alert Count: 4
First Seen: Wed Jan 13 16:49:57 2010
Last Seen: Wed Feb 24 11:42:04 2010
Local ID: f532f021-830c-4b05-8175-8a6887dd132b
Line Numbers:
Raw Audit Messages :
host=C5.aardvark.com.au type=AVC msg=audit(1266982924.689:25356): avc:
denied { getattr } for pid=14542 comm="postdrop"
path="/var/log/httpd/error_log" dev=dm-0 ino=29360282
scontext=system_u:system_r:postfix_postdrop_t:s0
tcontext=system_u:object_r:httpd_log_t:s0 tclass=file
host=C5.aardvark.com.au type=SYSCALL msg=audit(1266982924.689:25356):
arch=c000003e syscall=5 success=yes exit=0 a0=2 a1=7fff9da1f600
a2=7fff9da1f600 a3=0 items=0 ppid=14541 pid=14542 auid=4294967295 uid=48
gid=48 euid=48 suid=48 fsuid=48 egid=90 sgid=90 fsgid=90 tty=(none)
ses=4294967295 comm="postdrop" exe="/usr/sbin/postdrop"
subj=system_u:system_r:postfix_postdrop_t:s0 key=(null)
Thanks
Richard.
14 years, 1 month
dmesg and genfs_contexts
by mark
Folks,
I've just become aware that all our machines seem to be getting a ton
of lines in dmesg:
SELinux: initialized (dev 0:1d, type nfs), uses genfs_contexts
Running current CentOS 5.4. I've googled, and don't find anything
that's current that seems to resolve or explain this.
Clues for the poor?
mark
14 years, 1 month
Setnenforce prevented?
by Dan Thurman
Issuing the following command:
# setenforce 0
Results with log message:
Feb 24 12:04:31 <host> dbus: avc: received setenforce notice (enforcing=0)
Feb 24 12:04:31 <host> dbus: Can't send to audit system: USER_AVC avc:
received setenforce notice (enforcing=0)#012: exe="?" sauid=81
hostname=? addr=? terminal=?
And yet, selinux messages keep popping up where none should be showing?
14 years, 1 month
Dontaudit rule for $HOME/.ssh and samba
by Trevor Hemsley
I am sharing my user home directories to other machines on my LAN using
Samba. I have that all working correctly except for one persistent AVC
that I keep seeing. Now this AVC is correct in that I really do not want
my user's .ssh directories read over SMB so I'd quite like to keep that
as-is. But... I get alerts for this all the time so I'd like to know how
to add a dontaudit rule for it so that access is denied but I don't get
told about it. Ideally I'd like to add a generic rule to catch all
user's not have to add one dontaudit rule per user. Just don't have a
clue where to start and google was not much use on this so would
appreciate some help if anyone has done this before?
SELinux is preventing samba (smbd) "getattr" to /home/$user/.ssh
(sshd_key_t).
Source Context: system_u:system_r:smbd_t
Target Context: user_u:object_r:sshd_key_t
Target Objects: /home/$user/.ssh/config [ file ]
Source: smbd
Source Path: /usr/sbin/smbd
Port: <Unknown>
Host: hostname
Source RPM Packages: samba-3.0.33-3.15.el5_4.1
Target RPM Packages:
Policy RPM: selinux-policy-2.4.6-255.el5_4.4
Selinux Enabled: True
Policy Type: targeted
MLS Enabled: True
Enforcing Mode: Permissive
Plugin Name: samba_share
Host Name: hostname
Platform: Linux hostname 2.6.32.5 #3 SMP Sun Jan 31 03:27:09 GMT 2010
x86_64 x86_64
Alert Count: 1
First Seen: Tue 23 Feb 2010 12:44:47 AM GMT
Last Seen: Tue 23 Feb 2010 12:44:47 AM GMT
Local ID: 5d933e81-2ab5-4529-8dce-9e554a59f0e3
Line Numbers:
Raw Audit Messages :
host=hostname type=AVC msg=audit(1266885887.400:4313): avc: denied {
getattr } for pid=16382 comm="smbd" path="/home/$user/.ssh/config"
dev=dm-4 ino=10453601 scontext=system_u:system_r:smbd_t:s0
tcontext=user_u:object_r:sshd_key_t:s0 tclass=file
host=hostname type=SYSCALL msg=audit(1266885887.400:4313): arch=c000003e
syscall=4 success=yes exit=0 a0=7fff2dc9f270 a1=7fff2dc9e9a0
a2=7fff2dc9e9a0 a3=7fff2dc9ee70 items=0 ppid=4352 pid=16382
auid=4294967295 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=500 sgid=0
fsgid=500 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd"
subj=system_u:system_r:smbd_t:s0 key=(null)
--
Trevor Hemsley
Infrastructure Engineer
.................................................
* C A L Y P S O
* 4th Floor, Tower Point,
44 North Road,
Brighton, BN1 1YR, UK
OFFICE +44 (0) 1273 666 350
FAX +44 (0) 1273 666 351
.................................................
www.calypso.com
This electronic-mail might contain confidential information intended
only for the use by the entity named. If the reader of this message is
not the intended recipient, the reader is hereby notified that any
dissemination, distribution or copying is strictly prohibited.
* P * /*/ Please consider the environment before printing this e-mail /*/
14 years, 1 month
F12: AVCs: sendmail, mounted filesystems, and spamassassin
by Dan Thurman
I am not sure I understand how to interpret AVC errors and
to determine if these AVC complaints need to be handled or
not. Any advice would be appreciated!
I have these in order of most current dates:
====================================
Summary:
SELinux is preventing /usr/bin/perl "execute" access on /usr/bin/python2.6.
Detailed Description:
SELinux denied access requested by spamassassin. It is not expected that
this
access is required by spamassassin and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration
of the
application is causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.
Additional Information:
Source Context unconfined_u:system_r:spamc_t:s0
Target Context system_u:object_r:bin_t:s0
Target Objects /usr/bin/python2.6 [ file ]
Source spamassassin
Source Path /usr/bin/perl
Port <Unknown>
Host gold.cdkkt.com
Source RPM Packages perl-5.10.0-87.fc12
Target RPM Packages python-2.6.2-2.fc12
Policy RPM selinux-policy-3.6.32-89.fc12
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Plugin Name catchall
Host Name gold.cdkkt.com
Platform Linux gold.cdkkt.com
2.6.31.12-174.2.22.fc12.i686
#1 SMP Fri Feb 19 19:26:06 UTC 2010 i686 i686
Alert Count 5
First Seen Mon 22 Feb 2010 04:02:46 PM PST
Last Seen Tue 23 Feb 2010 08:02:17 AM PST
Local ID 080fd1f0-f784-4cd6-b2e3-7ec050a47323
Line Numbers
Raw Audit Messages
node=gold.cdkkt.com type=AVC msg=audit(1266940937.111:59356): avc:
denied { execute } for pid=24253 comm="spamassassin" name="python2.6"
dev=sdb10 ino=97611 scontext=unconfined_u:system_r:spamc_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
node=gold.cdkkt.com type=SYSCALL msg=audit(1266940937.111:59356):
arch=40000003 syscall=11 success=no exit=-13 a0=92c1664 a1=929d99c
a2=bf974eb4 a3=929d99c items=0 ppid=24246 pid=24253 auid=500 uid=500
gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500
tty=(none) ses=1 comm="spamassassin" exe="/usr/bin/perl"
subj=unconfined_u:system_r:spamc_t:s0 key=(null)
==================================
NOTE: The following is one of many AVC complaints
from which it peers into mounted filesystems of different
OSes (F9, F11, Ubuntu, and so on)
How do you prevent SELinux from peering into certain
mounted filesystems it has no business to be doing?
==================================
Summary:
SELinux is preventing /usr/bin/updatedb "getattr" access to
/md/RF11D1/etc/poker-network.
Detailed Description:
SELinux denied access requested by updatedb.
/md/RF11D1/etc/poker-network may be
a mislabeled. /md/RF11D1/etc/poker-network default SELinux type is
default_t,
but its current type is unlabeled_t. Changing this file back to the default
type, may fix your problem.
File contexts can be assigned to a file in the following ways.
* Files created in a directory receive the file context of the parent
directory by default.
* The SELinux policy might override the default label inherited from the
parent directory by specifying a process running in context A which
creates
a file in a directory labeled B will instead create the file with
label C.
An example of this would be the dhcp client running with the
dhclient_t type
and creating a file in the directory /etc. This file would normally
receive
the etc_t type due to parental inheritance but instead the file is
labeled
with the net_conf_t type because the SELinux policy specifies this.
* Users can change the file context on a file using tools such as
chcon, or
restorecon.
This file could have been mislabeled either by user error, or if an normally
confined application was run under the wrong domain.
However, this might also indicate a bug in SELinux because the file
should not
have been labeled with this type.
If you believe this is a bug, please file a bug report against this package.
Allowing Access:
You can restore the default system context to this file by executing the
restorecon command. restorecon '/md/RF11D1/etc/poker-network', if this
file is a
directory, you can recursively restore using restorecon -R
'/md/RF11D1/etc/poker-network'.
Fix Command:
/sbin/restorecon '/md/RF11D1/etc/poker-network'
Additional Information:
Source Context system_u:system_r:locate_t:s0-s0:c0.c1023
Target Context system_u:object_r:unlabeled_t:s0
Target Objects /md/RF11D1/etc/poker-network [ dir ]
Source updatedb
Source Path /usr/bin/updatedb
Port <Unknown>
Host gold.cdkkt.com
Source RPM Packages mlocate-0.22.2-1.fc12
Target RPM Packages
Policy RPM selinux-policy-3.6.32-89.fc12
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Plugin Name restorecon
Host Name gold.cdkkt.com
Platform Linux gold.cdkkt.com
2.6.31.12-174.2.22.fc12.i686
#1 SMP Fri Feb 19 19:26:06 UTC 2010 i686 i686
Alert Count 1
First Seen Tue 23 Feb 2010 03:40:27 AM PST
Last Seen Tue 23 Feb 2010 03:40:27 AM PST
Local ID c9411c07-575a-466d-903f-054169906d38
Line Numbers
Raw Audit Messages
node=gold.cdkkt.com type=AVC msg=audit(1266925227.491:58792): avc:
denied { getattr } for pid=17154 comm="updatedb"
path="/md/RF11D1/etc/poker-network" dev=sda10 ino=413
scontext=system_u:system_r:locate_t:s0-s0:c0.c1023
tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir
node=gold.cdkkt.com type=SYSCALL msg=audit(1266925227.491:58792):
arch=40000003 syscall=196 success=no exit=-13 a0=807709d a1=bf917c00
a2=42cff4 a3=807709d items=0 ppid=17148 pid=17154 auid=0 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1278
comm="updatedb" exe="/usr/bin/updatedb"
subj=system_u:system_r:locate_t:s0-s0:c0.c1023 key=(null)
==================================
Summary:
SELinux is preventing /usr/sbin/sendmail.sendmail "read" access on
/var/log/messages.
Detailed Description:
[sendmail has a permissive type (system_mail_t). This access was not
denied.]
SELinux denied access requested by sendmail. It is not expected that
this access
is required by sendmail and this access may signal an intrusion attempt.
It is
also possible that the specific version or configuration of the
application is
causing it to require additional access.
Allowing Access:
You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.
Additional Information:
Source Context system_u:system_r:system_mail_t:s0-s0:c0.c1023
Target Context system_u:object_r:var_log_t:s0
Target Objects /var/log/messages [ file ]
Source sendmail
Source Path /usr/sbin/sendmail.sendmail
Port <Unknown>
Host gold.cdkkt.com
Source RPM Packages sendmail-8.14.3-8.fc12
Target RPM Packages
Policy RPM selinux-policy-3.6.32-89.fc12
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Plugin Name catchall
Host Name gold.cdkkt.com
Platform Linux gold.cdkkt.com
2.6.31.12-174.2.22.fc12.i686
#1 SMP Fri Feb 19 19:26:06 UTC 2010 i686 i686
Alert Count 3
First Seen Tue 23 Feb 2010 03:37:58 AM PST
Last Seen Tue 23 Feb 2010 03:37:58 AM PST
Local ID c6d1d2d8-7cdd-451a-9647-4a61fbc848c5
Line Numbers
Raw Audit Messages
node=gold.cdkkt.com type=AVC msg=audit(1266925078.757:58778): avc:
denied { read } for pid=16966 comm="sendmail" path="/var/log/messages"
dev=sdb10 ino=54039
scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_log_t:s0 tclass=file
node=gold.cdkkt.com type=AVC msg=audit(1266925078.757:58778): avc:
denied { read } for pid=16966 comm="sendmail" path="/var/log/secure"
dev=sdb10 ino=54090
scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_log_t:s0 tclass=file
node=gold.cdkkt.com type=AVC msg=audit(1266925078.757:58778): avc:
denied { read } for pid=16966 comm="sendmail" path="/var/log/maillog"
dev=sdb10 ino=54091
scontext=system_u:system_r:system_mail_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_log_t:s0 tclass=file
node=gold.cdkkt.com type=SYSCALL msg=audit(1266925078.757:58778):
arch=40000003 syscall=11 success=yes exit=0 a0=97d58a0 a1=97d5928
a2=97d4eb0 a3=97d5928 items=0 ppid=16912 pid=16966 auid=0 uid=0 gid=0
euid=0 suid=0 fsuid=0 egid=486 sgid=486 fsgid=486 tty=(none) ses=1278
comm="sendmail" exe="/usr/sbin/sendmail.sendmail"
subj=system_u:system_r:system_mail_t:s0-s0:c0.c1023 key=(null)
14 years, 1 month
Kernel panic after enabled SELINUXTYPE=strict
by Maurizio D'Antonio
Hi all,
I have installed CentOS 5.4 on the VirtualBox for "play" with SELinux.
After installation, I enabled SELinux with policy in "target mode".
The system is booting without error.
I decided the enable SELINUXTYPE=strict mode, but at first reboot I receive
the following message:
"
Red Hat nash version 5.1.19.6 starting
Unable to load SELinux Policy. Machine is in enforcing mode. Halting now.
Kernel panic - not syncing: Attempted to kill init!
"
The only solution is to disable SELinux at the boot.
[ kernel /vmlinuz-2.6.18-164.el5 ro root=LABEL=/ rhgb quiet selinux=0 ]
What is the problem?
Where I wrong?
Thx
.:M:.
14 years, 2 months
Off-line attacks protection for a domain confined with SELinux
by Roberto Sassu
Hello all
i'm wondering what assumptions must be made in order to assure that the domain
"domX" is the only subject allowed to access a file with type "typeY" in a
system where off-line attacks are possible and an integrity check on files and
labels in the overall filesystem is not applicable due to the high performance
penalty.
These are the hypothesis i think are required:
1) kernel with SELinux, with policy loading and enforcing mode setting
disabled at runtime;
2) there is an integrity system stacked with SELinux which is able to
grant/deny access depending on the hash and the label of files (checks will be
performed only a subset of files, as described in the following points);
3)"local_login_t" is the only domain allowed to change the process label;
4) every file used by the type "local_login_t" is integrity protected (i need
to build a list files used by this process and to specify a valid hash)
5) the regular user which plays with "domX" is mapped with the selinux user
"user_t" (probably i need extra assumptions to protect the mapping);
6) "domX_exec_t" is the only entrypoint for "domX";
7) the label "domX_exec_t" is bound to the executable and its hash (the
association is verified at execution time);
8) the transition "user_t -> domX" has been defined when executing a file
labeled with "domX_exec_t";
9) for now i assume that the user root is not involved in this use case;
10) file labelled with "typeY" are protected and the label is bound to the
hash (the association will be verified at access time);
11) none subject is authorized to relabelfrom "typeY";
Then when defining the rule:
allow domX typeY: file { getattr open read };
can i say that files labelled with typeY can be read only by the process
started from the executable labelled with "domX_exec_t"?
Thanks in advance for replies
14 years, 2 months
How can I start SELinux play machine ?
by Shintaro Fujiwara
Hi, I 'm ready to start SELinux server in my office first time, and I
want to persuade everyone how safe the SELinux server is.
How can I demonstrate administrators and my boss the advantage of
SELinux comparing other servers?
SELinux play machine hit me but is too far or should I just
demonstrate in a certain ocassion for certain purpose?
Thanks in advance.
--
http://sourceforge.net/projects/segatex/ SELinux tool
14 years, 2 months
