selinux December 2004

selinux@lists.fedoraproject.org

64 participants
82 discussions

Using SELinux on samba mounted directories
by Michael Kraus 22 Dec '04

22 Dec '04

G'day... Previously under RH9, I had mounted a directory from a windows machine, which was web-served by apache. When I tried to do the same under FC3 I found that apache wasn't recognising the directory, and learnt that this was because of SELinux. I tried to "chcon -R -t httpd_sys_content_t <directory>" the directory and found I couldn't. The directory was mounted using smb and an entry in /etc/fstab. Is there a way to edit the /etc/fstab file so that the context is set when the directory is mounted? (I hope this is all making sense, I'm new to all of this.) TIA! Regards, Michael S. E. Kraus B. Info. Tech. (CQU), Dip. Business (Computing) Software Developer Wild Technology Pty Ltd _______________________________ ABN 98 091 470 692 Level 4 Tiara, 306/9 Crystal Street, Waterloo NSW 2017, Australia Telephone 1300-13-9453 | Facsimile 1300-88-9453 http://www.wildtechnology.net The information contained in this email message and any attachments may be confidential information and may also be the subject of client legal - legal professional privilege. If you are not the intended recipient, any use, interference with, disclosure or copying of this material is unauthorised and prohibited. This email and any attachments are also subject to copyright. No part of them may be reproduced, adapted or transmitted without the written permission of the copyright owner. If you have received this email in error, please immediately advise the sender by return email and delete the message from your system.

2 1

Snare, SELinux, NISPOM
by Browder, Tom 21 Dec '04

21 Dec '04

OK, given the current state of things, is anyone satisfying NISPOM auditing requirements on Linux? If so, what are you using for auditing (Linux distribution, add-ons, kernel)? The best I can figure in the short term (right out of the box) is FC 2 and snare 096b with the UT kernel rpms: 2.6.7-1.494.2.2SNARE096b Any better ideas would be appreciated. Thanks. Tom Browder

1 0

RE: No Denial
by Browder, Tom 21 Dec '04

21 Dec '04

> -----Original Message----- > From: fedora-selinux-list-bounces(a)redhat.com > [mailto:fedora-selinux-list-bounces@redhat.com] On Behalf Of > Stephen Smalley > I suspect that you don't actually want SELinux auditing here, > as it is just of MAC permission checks, but instead want > ordinary system call auditing. There is ongoing work to > enhance the existing Linux audit framework and userspace > tools toward that end, see the linux-audit mailing list. I joined, and took a look. With the audit tools, and audit=1, do I need to keep SELinux turned on? Thanks. Tom Browder

2 1

RE: No Denial
by Browder, Tom 20 Dec '04

20 Dec '04

> -----Original Message----- > From: fedora-selinux-list-bounces(a)redhat.com > [mailto:fedora-selinux-list-bounces@redhat.com] On Behalf Of > Stephen Smalley > I suspect that you don't actually want SELinux auditing here, > as it is just of MAC permission checks, but instead want > ordinary system call auditing. There is ongoing work to > enhance the existing Linux audit framework and userspace > tools toward that end, see the linux-audit mailing list. Thanks, Stephen, I'll check it out. In the meantime, I've turned on enforcement and will see if that at least is a temporary fix. A quick test of major programs I use shows no problems. Tom Browder

1 0

RE: No Denial
by Browder, Tom 20 Dec '04

20 Dec '04

> -----Original Message----- > From: fedora-selinux-list-bounces(a)redhat.com > [mailto:fedora-selinux-list-bounces@redhat.com] On Behalf Of > Stephen Smalley > Unless your process has uid 0, then the latter command would > be prevented by ordinary Linux DAC and never reaches the > SELinux permission checks. Hence, you wouldn't see an audit > message for it. The former command would be allowed by Linux > DAC and thus reaches the SELinux checks (and audit). Thanks, Stephen. Actually, I did a 'make load', rotated my logs to clear them out, and then did 'mv /etc/shadow /etc/shadow.save' as a normal user and got a long denial log message (get_attr). Tom Browder

2 1

RE: No Denial
by Browder, Tom 20 Dec '04

20 Dec '04

(It would be nice to be able to choose to get logging of all instances of denial in permissive mode.) But the denial is the same whether I do 'ls /etc/shadow' or 'mv /etc/shadow /etc/shadow.save'. Is there a way to show the different system calls? I'm sure there is, but I'm just getting started in the nitty-gritty of this stuff and a few hints would be appreciated. Here's my situation: I have a customer who wants to audit specific commands on specific files and directories, i.e., who's doing what to whom and when. Is there an "easy" way to do something like that? Thanks, and I'll try not to bug you any more. Tom Browder

2 1

No Denial
by Browder, Tom 20 Dec '04

20 Dec '04

I'm using the default strict policy for FC 3 SELinux for testing and learning. I see denial messages when I do 'ls -l /etc/shadow', but nothing when I try to do 'mv /etc/shadow /etc/shadow.save'. Uh, I think I read somewhere that only one of a message type will be seen in some situations, but I can't find it now. How do I ensure that every instance of a specific denial is seen? Thanks. Tom Browder

2 1

RE: No Denial
by Browder, Tom 20 Dec '04

20 Dec '04

Sorry, I found it--in the Unofficial SELinux FAQ. Tom Browder

1 0

Why does this get denied?
by Andy Smith 20 Dec '04

20 Dec '04

Hi, Firstly apologies if what I'm about to ask is obvious, I'm kind of new to selinux and I'm trying to read the relevant docs but I don't understand something. If what I ask is covered in a document then I'd appreciate a pointer. Okay so I just installed apache from RPM on fedora core 3 and when I try to start it I get the following: # service httpd start Starting httpd: Syntax error on line 266 of /etc/httpd/conf/httpd.conf: DocumentRoot must be a directory In /var/log/messages: Dec 20 16:28:32 becks kernel: audit(1103560112.198:0): avc: denied { search } for pid=27331 exe=/usr/sbin/httpd name=/ dev=dm-1 ino=2 scontext=root:system_r:httpd_t tcontext=system_u:object_r:file_t tclass=dir I am using the targeted policy. Now, the only thing I have changed is, instead of having my document root be /var/www/html I've put it in /data/www. I edited /etc/selinux/targeted/src/policy/file_contexts/program/apache.fc to reflect the fact that my content is in a different place and did do a restorecon to relabel things under /data. What I don't understand is the reference to /. Why is selinux denying httpd searching /? This is a new install and selinux has been enabled from the start so / should be labelled correctly.. What am I missing? Thanks, Andy

2 3

Fedora Targeted List grows on Rawhide.
by Daniel J Walsh 20 Dec '04

20 Dec '04

I have added several targets to Targeted Policy as of selinux-policy-targeted-1.19.14-2. I am attempting to add most of the network daemons to targeted. In order to experiment with this new policy file, you will need to relabel. Or you can just relabel the target you are interested in. The best way to do this is install the policy and then execute rpm -q -l TARGETRPM | restorecon -R -f - Current targets amanda.te apache.te cups.te dhcpd.te dictd.te dovecot.te fingerd.te ftpd.te howl.te i18n_input.te inetd.te innd.te kerberos.te ktalkd.te ldconfig.te lpd.te mailman.te modutil.te mta.te mysqld.te named.te nscd.te ntpd.te portmap.te postgresql.te privoxy.te radius.te radvd.te rpcd.te rshd.te rsync.te samba.te slapd.te snmpd.te spamd.te squid.te stunnel.te syslogd.te tftpd.te winbind.te ypbind.te ypserv.te zebra.te This is not a commitment for this list in FC4, some could be pulled if they don't work well :*). The goal of targeted policy is to protect all network daemons and to allow userspace to run with normal privs. You still need strict policy to confine userspace.

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2004