December 2004 - selinux - Fedora mailing-lists

SELinux on RH3
by Juan Espino 17 Feb '05

17 Feb '05

3 3

labelling issues
by Joe Orton 12 Jan '05

12 Jan '05

I've seen a few issues where file labels are getting lost: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=140706 http://bugs.php.net/bug.php?id=30952 and another one reported to the httpd users' list. Is there a known cause of these problems? Is it prelink related, possibly? Regards, joe

3 11

Head-banging targets, please
by David P. Hart 10 Jan '05

10 Jan '05

I need help understanding SELinux! I've read just about every on-line SELinux article I can find, and I am getting progressively more confused as I read more. Following along in these articles on a Fedora Core 3 system, reading documents written for Fedora Core 2 Test 3 and before, is confusing. The older the document, the more my installation fails to match the documentation. I need a starting place, some things to look at once I have my Fedora Core 3 installation running. Some simple things, some that work correctly, some that fail and I can learn how to track down and fix. And, the answers to some basic questions: 1) Why does a Fedora Core 3 installation, with SELinux "Active" or "Warn", not install selinux-policy-targeted-sources? I kept pulling my hair out (little that there is) when trying to find: /etc/selinux/targeted/src/policy All the documents referred to this directory, and it was VERY confusing not to find it. This directory should at least be an empty directory after a fresh install. 2) Are the setools and setools-gui packages required to be used on a SELinux enabled system? If so, why are they not installed when SELinux is installed? In particular, I am very confused about how to create new users and new groups. It looks like I need to update our in-house instructions to use seuseradd, seuserdel, etc. instead of useradd and userdel? 3) Where the heck is the SELinux audit file? Try as much as I could, I can't find it. Every document references it, but none I have found actually refer to it by path/filename. 4) I know you guys discuss policy problems all the time, from the viewpoint of their AVC log events, but I'd like to see what one of these AVC log events looks like on my system. In particular, I have a Fedora Core 3 Workstation installation running the targeted policy in enforcing mode. I'd appreciate a simple test I could perform that would generate an AVC log entry, some idea on how to look for the log entry, and some idea about how to analyze the log entry. I know, blasphemy. But there are three ways that adults learn: 1. Visual: people who learn by seeing it done. 2. Auditory: people who learn by hearing. 3. Kenesthetic: people who learn by doing (touch and body movement). I'm a #3. 5) Does it make sense to have a Workstation installation with the "strict" policy? Under what circumstances? I am putting instructions together for people in my Lab on how to install and use Fedora Core 3. One of the early lessons I want to document is some simple instructions on how to use SELinux. Then, as other instructions are written for other Lab-oriented tasks, I would integrate SELinux into these instructions. The people in the Lab are responsible for maintaining their various computers, so knowledge about SELinux appears necessary. If I can't understand it and explain it to them, things are going to get messy. Thanks for the help. -- David Hart <dhart275(a)offramp.com>

8 10

SELinux error with yum --installroot
by Bob Kashani 07 Jan '05

07 Jan '05

When I run: yum -y --installroot=/testroot groupinstall "Base" I get all kinds of errors like this: error: %post(libuser-0.52.5-1.i386) scriptlet failed, exit status 255 error: %post(gnupg-1.2.6-1.i386) scriptlet failed, exit status 255 If I turn selinux off there are no errors. Any ideas why this is happening? FC3 fully updated. yum-2.1.12-0.fc3 libselinux-1.19.1-8 selinux-policy-targeted-1.17.30-2.58 Bob -- Bob Kashani http://www.ocf.berkeley.edu/~bobk/garnome

4 17

Problems with sudo
by Bogdan Agica 06 Jan '05

06 Jan '05

Hi everybody. First of all, let me introduce myself. My name is Bogdan Agica and I'm in the Linux team for the BitDefender Antivirus. I'm responsible with the SELinux integration of BitDefender and I seem to have some issues with dropping privileges. The startup scripts rely on sudo in order to drop privileges in a standard linux system. I have written the test policy for the postfix agent, which works fine if the programs are started as root (not via the startup scripts); however the final policy is supposed to integrate seamlessly with the product. In the /etc/init.d script, the programs (5 of them) are started by comands like: # sudo -u bitdefender /opt/BitDefender/bin/bdcored start I have looked at the files domains/program/sudo.te and macros/program/sudo_macros.te. Unfortunately, the lack of documentation for the sudo_domain() macro was a problem, so I have some questions: 1. What exactly does the sudo_domain() macro do? 2. Is this the tool that I need? (i have tried to integrate it with the policy, but it resulted in errors) I'm using FC3, and the following packages: # rpm -qa | grep -i selinux selinux-policy-strict-1.19.10-2 selinux-policy-targeted-sources-1.17.30-2.51 selinux-doc-1.14.1-1 libselinux-1.19.1-8 selinux-policy-targeted-1.17.30-2.51 selinux-policy-strict-sources-1.19.10-2 Of course, should anyone want to look at the beta policy that I've written, I can provide it, and the software itself is available on the company's ftp site. TIA, -- Bogdan Agica BitDefender Internal Testing Engineer ------------------------------------- SOFTWIN Data Security Division ------------------------------------- email: bagica(a)bitdefender.com phone: +(4021) 233 18 52; 233 07 80 fax: (+4021) 233.07.63 Bucharest, ROMANIA http://www.bitdefender.com http://www.softwin.ro ------------------------------------- secure your every bit ------------------------------------- -- This message was scanned for spam and viruses by BitDefender. For more information please visit http://www.bitdefender.com/

3 3

SELinux and third party installers
by Mike Hearn 05 Jan '05

05 Jan '05

Hi, I have a couple of questions. The first is that in the FC3 targetted policy, it appears that ldconfig cannot write to user_home_t directories. Why is this? It appears to be a restriction with no purpose, and some programs rely on this to work. In fact I see from the archives that ldconfig not being able to write or search certain directories has come up before. The second question is what impact SELinux will have on third party installers. It seems from the nVidia thread that currently if you copy files onto the system using "cp", this is the wrong way to do it and it will break peoples SELinux setups. This surely cannot be correct: that'd break every pretty much every third party installer (eg Loki Setup, etc) out there! If this is the case and this rather questionable decision is not reversed, is using "install" the correct way to go about things on *every* SELinux enabled distro, or is that a Fedora custom thing? It's a bit worrying how much Fedora SELinux seems to differ from upstream, is this something that will get better with time? thanks -mike

5 23

postgresql pg_dump won't run
by Dr. Michael J. Chudobiak 05 Jan '05

05 Jan '05

Hi, I've just installed selinux on my FC3 server using the targeted policy, and everything went well except that I can no longer run /usr/bin/pg_dumpall as a root cron job for backing up postgresql databases. I get this sort of log message, even if I run pg_dump/pg_dumpall as the postgres user: Dec 30 10:17:01 server2 kernel: audit(1104419821.285:0): avc: denied { execute_no_trans } for pid=24740 exe=/bin/bash path=/usr/bin/pg_dump dev=md0 ino=346137 scontext=user_u:system_r:postgresql_t tcontext=system_u:object_r:postgresql_exec_t tclass=file For now, I've disabled the postgres protection using system-config-security-level, and it works fine - but postgresql is unprotected of course. Is there a way of running pg_dump and pg_dumpall under selinux, without abandoning or rewriting the targeted policy? - Mike

3 5

syslog-ng non-standard install generating AVC
by Steve Friedman 04 Jan '05

04 Jan '05

I recently installed FC3 on a machine (we had previously been using FC1), so this is my first exposure to selinux. Consequently, we are running the targeted policy in permissive mode. We use syslog-ng (rather than sysklogd) and have updated the syslog-ng.conf to monitor/log/distribute log events on a number of other ports beyond the standard syslog distribution. Among other things that we do in syslog-ng include: - open non-standard UDP/TCP ports - open non-standard files - call non-standard routines As a complete newbie to selinux, I don't know whether it is easier/simpler/better/(or even how) to modify the syslog policy or the attributes of the executables/files/directories that it touches. I would appreciate some advice and guidance. AVC log events: Dec 27 04:02:17 gsi10 kernel: audit(1104138137.142:0): avc: denied { write } for pid=16201 exe=/sbin/syslog-ng name=kmsg dev=proc ino=-268435446 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:proc_kmsg_t tclass=file Dec 27 04:02:17 gsi10 kernel: audit(1104138137.145:0): avc: denied { read } for pid=16202 exe=/bin/bash name=mtab dev=dm-0 ino=7146016 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:etc_runtime_t tclass=file Dec 27 04:02:17 gsi10 kernel: audit(1104138137.145:0): avc: denied { getattr } for pid=16202 exe=/bin/bash path=/etc/mtab dev=dm-0 ino=7146016 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:etc_runtime_t tclass=file Dec 27 04:02:17 gsi10 kernel: audit(1104138137.150:0): avc: denied { write } for pid=16202 exe=_executable_1_ name=status dev=dm-0 ino=166481 scontext=system_u:system_r:syslogd_t tcontext=user_u:object_r:usr_t tclass=file Dec 27 04:02:17 gsi10 kernel: audit(1104138137.150:0): avc: denied { getattr } for pid=16202 exe=_executable_1_ path=_file_1_ dev=dm-0 ino=166481 scontext=system_u:system_r:syslogd_t tcontext=user_u:object_r:usr_t tclass=file Dec 27 10:47:27 gsi10 kernel: audit(1104162447.513:0): avc: denied { sys_admin } for pid=16201 exe=/sbin/syslog-ng capability=21 scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:syslogd_t tclass=capability Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { write } for pid=16201 exe=/sbin/syslog-ng name=log dev=dm-0 ino=166417 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=dir Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { add_name } for pid=16201 exe=/sbin/syslog-ng name=e27.log scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=dir Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { create } for pid=16201 exe=/sbin/syslog-ng name=e27.log scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { setattr } for pid=16201 exe=/sbin/syslog-ng name=e27.log dev=dm-0 ino=166450 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { chown } for pid=16201 exe=/sbin/syslog-ng capability=0 scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:syslogd_t tclass=capability Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { fowner } for pid=16201 exe=/sbin/syslog-ng capability=3 scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:syslogd_t tclass=capability Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { fsetid } for pid=16201 exe=/sbin/syslog-ng capability=4 scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:syslogd_t tclass=capability Dec 27 16:16:35 gsi10 kernel: audit(1104182195.160:0): avc: denied { append } for pid=16201 exe=/sbin/syslog-ng path=_file_2_ dev=dm-0 ino=166450 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.318:0): avc: denied { write } for pid=16202 exe=_executable_1_ path=_file_3_ dev=dm-0 ino=166444 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.318:0): avc: denied { getattr } for pid=16202 exe=_executable_1_ path=_file_4_ dev=dm-0 ino=166472 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.318:0): avc: denied { read } for pid=16202 exe=_executable_1_ path=_file_5_ dev=dm-0 ino=166474 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.319:0): avc: denied { remove_name } for pid=16202 exe=_executable_1_ name=delete_next dev=dm-0 ino=166474 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=dir Dec 27 16:16:35 gsi10 kernel: audit(1104182195.319:0): avc: denied { unlink } for pid=16202 exe=_executable_1_ name=delete_next dev=dm-0 ino=166474 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:usr_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.319:0): avc: denied { search } for pid=1633 exe=_executable_1_ name=bin dev=dm-0 ino=1245185 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=dir Dec 27 16:16:35 gsi10 kernel: audit(1104182195.319:0): avc: denied { read } for pid=1633 exe=_executable_1_ name=sh dev=dm-0 ino=3850242 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=lnk_file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.319:0): avc: denied { execute } for pid=1633 exe=_executable_1_ name=bash dev=dm-0 ino=1245248 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.320:0): avc: denied { execute_no_trans } for pid=1633 exe=_executable_1_ path=/bin/bash dev=dm-0 ino=1245248 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.320:0): avc: denied { read } for pid=1633 exe=_executable_1_ path=/bin/bash dev=dm-0 ino=1245248 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.321:0): avc: denied { read } for pid=1633 exe=/bin/bash name=meminfo dev=proc ino=-268435454 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:proc_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.321:0): avc: denied { getattr } for pid=1633 exe=/bin/bash path=/proc/meminfo dev=proc ino=-268435454 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:proc_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.322:0): avc: denied { search } for pid=1633 exe=/bin/bash name=sbin dev=dm-0 ino=7356417 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:sbin_t tclass=dir Dec 27 16:16:35 gsi10 kernel: audit(1104182195.322:0): avc: denied { getattr } for pid=1633 exe=/bin/bash path=/bin/bash dev=dm-0 ino=1245248 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.323:0): avc: denied { getattr } for pid=1633 exe=/bin/bash path=/bin/rm dev=dm-0 ino=1245243 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.323:0): avc: denied { execute } for pid=1633 exe=/bin/bash name=rm dev=dm-0 ino=1245243 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.323:0): avc: denied { execute_no_trans } for pid=1633 exe=/bin/bash path=/bin/rm dev=dm-0 ino=1245243 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=file Dec 27 16:16:35 gsi10 kernel: audit(1104182195.323:0): avc: denied { read } for pid=1633 exe=/bin/bash path=/bin/rm dev=dm-0 ino=1245243 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:bin_t tclass=file Steve Friedman

4 4

What to do after building a kernel.
by Justin Conover 02 Jan '05

02 Jan '05

After I built a new kernel based of of ck-overloaded, I rebooted and a ton of SELinux errors/messages, kept comeing across the screen? What do need to do to make a home-grown-kernel work with SELinux.

4 6

FC3 " avc: denied" issue
by Erwin J. Prinz 30 Dec '04

30 Dec '04

I have a fully upgraded (as of today) FC3 system on which I always could install the NVIDIA drivers. But, to get a successful install after the last upgrade (today) (which included selinux-policy-targeted.noarch 1.17.30-2.58) I now have to "setenforce 0" before installing the NVIDIA drivers. Otherwise, the install fails due to several access denied issues, e.g.: Dec 25 18:51:34 tiger kernel: audit(1104022294.445:0): avc: denied { write } for pid=3956 exe=/sbin/ldconfig path=/var/log/nvidia-installer.log dev=hda6 ino=517383 scontext=root:system_r:ldconfig_t tcontext=system_u:object_r:var_log_t tclass=file Dec 25 18:51:34 tiger kernel: audit(1104022294.801:0): avc: denied { read } for pid=3956 exe=/sbin/ldconfig name=libXvMCNVIDIA.so.1.0.6629 dev=hda4 ino=194830 scontext=root:system_r:ldconfig_t tcontext=root:object_r:lib_t tclass=file Dec 25 18:51:35 tiger kernel: audit(1104022295.012:0): avc: denied { getattr } for pid=3956 exe=/sbin/ldconfig path=/usr/X11R6/lib/libXvMCNVIDIA.so.1.0.6629 dev=hda4 ino=194830 scontext=root:system_r:ldconfig_t tcontext=root:object_r:lib_t tclass=file Dec 25 18:51:38 tiger kernel: audit(1104022298.997:0): avc: denied { getattr } for pid=3956 exe=/sbin/ldconfig path=/usr/lib/libGL.so.1.0.6629 dev=hda4 ino=521611 scontext=root:system_r:ldconfig_t tcontext=root:object_r:lib_t tclass=file/avc The initial context of root is "root:system_r:unconfined_t" and I can't change to "root:sysadm_r:sysadm_t". I did a "fixfiles relabel" and reboot without changing the outcome. I don't think the issue is with the NVIDIA drivers as they worked on FC3 before, and as "setenforce 0" "fixes" the issue. I would appreciate pointers to what could be wrong. Best regards, Erwin

5 13

new kernel, new policy installed as .rpmnew
by Chuck Anderson 30 Dec '04

30 Dec '04

I just yum updated, and got the latest testing kernel and policy files: Install: kernel.i686 0:2.6.9-1.715_FC3 Install: kernel-smp.i686 0:2.6.9-1.715_FC3 [...] Update: selinux-policy-targeted.noarch 0:1.17.30-2.58 Update: selinux-policy-targeted-sources.noarch 0:1.17.30-2.58 [...] Installing: kernel-smp 100 % done 1/160 warning: /etc/selinux/targeted/contexts/files/file_contexts created as /etc/selinux/targeted/contexts/files/file_contexts.rpmnew warning: /etc/selinux/targeted/policy/policy.18 created as /etc/selinux/targeted/policy/policy.18.rpmnew Updating: selinux-policy-targeted 100 % done 2/160 The FAQ says that the policy reloads automatically, and that a manual relabel may be necessary. It doesn't say anything about fixing the filenames that were named .rpmnew. How can the policy automatically reload when the file isn't named correctly? Since policy is tied to the kernel, what happens when I have more than one kernel installed, and I boot an older one from grub?

2 1

.te and .fc files for postfix and fedora
by Diego Woitasen 29 Dec '04

29 Dec '04

Somebody have the policy files for postfix? I tried with Debian ones but fails in policy compilation. Where can i get these files? thanks!!! -- Diego Woitasen <diegows(a)xtech.com.ar> XTECH

2 8

transition problems
by Oleg Museyko 28 Dec '04

28 Dec '04

Hello, Although innd.te is the usual example of policy, i still can't get it start right from the init-script. (Fedora Core 2, policy-sources-1.11.3-3). The problem is near the 'su', IMHO. Namely, when innd runs from script as su -s /bin/bash - news -c /etc/rc.news it obtains context user_u:user_r:user_t and no domain_auto_trans together with default_contexts tuning could resolve it, until i've added the new user: user news roles system_r; After that the context of innd became user_u:system_r:innd_t (not news:system_r:innd_t, as i hoped, but anyway...) Besides, the same problem in other place occured to be more persistent: regular cron job running nntpsend leads to the following (permissive mode): avc: denied { transition } for pid=24801 exe=/bin/su path=/bin/bash dev=sda1 ino=895926 scontext=system_u:system_r:system_crond_su_t tcontext=user_u:sysadm_r:sysadm_t tclass=process avc: denied { siginh } for pid=24801 exe=/bin/bash scontext=system_u:system_r:system_crond_su_t tcontext=user_u:sysadm_r:sysadm_t tclass=process (same for 'rlimitinh' and 'noatsecure'). This caused by su - news -c "unset LANG; unset LC_COLLATE; /usr/lib/news/bin/nntpsend" I've tried to force the domain_auto_trans to initrc_t etc, also added corresponding records to default_contexts system_r:system_crond_su_t system_r:initrc_t but without any effect! (And no conflicts with other policy rules, as far as i could see). I'm eager to get any help on this, please. Also, i'd like to ask the reason of why some file type transitions doesn't work on sockets. E.g., when winbindd (runs in smbd_t) creates the socket in the directory of samba_var_t type and clients try to use it, the log file are full of deny { connectto } unix_stream_socket with smbd_t in tcontext. At the same time the /path/to/socket/file has correct samba_var_t type. The situation doesn't change if i write file_type_auto_trans(smbd_t, samba_var_t, samba_var_t, sock_file) The unix domain socket still has smbd_t, not samba_var_t, when someone tries to 'connectto'. Same situation with some other sockets of different domains. Is it the possible to change this behavior, or unix domain socket always has the type of creating process ? -- Best regards, Oleg

2 2

firefox and timidity...
by Tom London 28 Dec '04

28 Dec '04

Running strict/enforcing, latest Rawhide. If i click on, say, a pdf URL in firefox, I get the following AVC: Dec 28 08:11:05 fedora kernel: audit(1104250265.322:0): avc: denied { getattr } for pid=3067 exe=/usr/lib/firefox-1.0/firefox-bin path=/usr/bin/timidity dev=hda2 ino=427077 scontext=user_u:user_r:user_mozilla_t tcontext=system_u:object_r:timidity_exec_t tclass=file implying that user_mozilla needs allow user_mozilla_t timidity_exec_t:file getattr; If I set permissive mode, I get the same (and only) AVC. Since it doesn't seem to affect anything, my inclination would be to dontaudit user_mozilla_t timidity_exec_t:file getattr; Would this break firefox sounds? Something else? tom -- Tom London

1 0

xfs file system w/ selinux?
by Justin Conover 28 Dec '04

28 Dec '04

Is there any downside to running xfs with selinux? I'm just testing(playing) with test2 and I was thinking of using lvm/xfs/selinux. Choosing xfs because it is a good fs and easier to grow online than ext3. Plus I'm just testing :)

5 5

ldconfig and var?
by Tom London 27 Dec '04

27 Dec '04

Running strict/enforcing, latest Rawhide. Actually during today's 'yum update': Running Transaction Installing: kernel 100 % done 1/39 /bin/bash: /root/.bashrc: Permission denied Updating: guile 100 % done 2/39 /sbin/ldconfig: relative path `2' used to build cache error: %post(guile-1.6.4-16.i386) scriptlet failed, exit status 1 Updating: inews 100 % done 3/39 Log shows the following AVC: Dec 23 07:34:52 fedora kernel: audit(1103816092.011:0): avc: denied { search } for pid=8079 exe=/sbin/ldconfig name=var dev=hda2 ino=4456449 scontext=root:sysadm_r:ldconfig_t tcontext=system_u:object_r:var_t tclass=dir ldconfig.te has: ifdef(`distro_suse', ` # because of libraries in /var/lib/samba/bin allow ldconfig_t { var_t var_lib_t }:dir search; ') For fedora too? guile rpm broken? tom -- Tom London

2 2

initrc, md0, mapper
by Tom London 27 Dec '04

27 Dec '04

Running strict/enforcing, latest rawhide (selinux-policy-strict-1.19.10-1) Booting produces following avc: Dec 3 08:23:45 fedora kernel: audit(1102090997.316:0): avc: denied { create } for pid=1348 exe=/sbin/nash name=md0 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:device_t tclass=blk_file Dec 3 08:23:45 fedora kernel: device-mapper: 4.1.0-ioctl (2003-12-10) initialised: dm(a)uk.sistina.com Dec 3 08:23:45 fedora kernel: audit(1102090997.383:0): avc: denied { create } for pid=1354 exe=/sbin/nash name=mapper scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:device_t tclass=dir Does initrc get create perms for this? tom -- Tom London

2 2

initrc/ptal ...
by Tom London 27 Dec '04

27 Dec '04

Running strict/enforcing off of latest Rawhide: initrc runs hpoj which runs /usr/sbin/ptal-init which produces the following avc's. [I tried changing the type of /usr/sbin/ptal-init to ptal_exec_t, but that didn't work ;-( ] tom Dec 2 06:45:39 fedora kernel: audit(1101998713.227:0): avc: denied { unlink } for pid=1414 exe=/bin/rm name=mlc_usb_PSC_900_Series dev=hda2 ino=38214 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=fifo_file Dec 2 06:45:39 fedora kernel: audit(1101998713.228:0): avc: denied { unlink } for pid=1414 exe=/bin/rm name=mlc_usb_PSC_900_Series__1 dev=hda2 ino=38215 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=fifo_file Dec 2 06:45:39 fedora kernel: audit(1101998713.228:0): avc: denied { unlink } for pid=1414 exe=/bin/rm name=mlc_usb_PSC_900_Series__2 dev=hda2 ino=38216 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=fifo_file Dec 2 06:45:39 fedora kernel: audit(1101998713.228:0): avc: denied { unlink } for pid=1414 exe=/bin/rm name=mlc_usb_PSC_900_Series__3 dev=hda2 ino=38217 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=fifo_file Dec 2 06:45:39 fedora kernel: audit(1101998713.228:0): avc: denied { unlink } for pid=1414 exe=/bin/rm name=mlc_usb_PSC_900_Series__4 dev=hda2 ino=38218 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=fifo_file Dec 2 06:45:39 fedora kernel: audit(1101998713.228:0): avc: denied { unlink } for pid=1414 exe=/bin/rm name=mlc_usb_PSC_900_Series__5 dev=hda2 ino=38219 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=fifo_file Dec 2 06:45:39 fedora kernel: audit(1101998713.228:0): avc: denied { unlink } for pid=1414 exe=/bin/rm name=mlc_usb_PSC_900_Series__6 dev=hda2 ino=38220 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=fifo_file Dec 2 06:45:39 fedora kernel: audit(1101998713.229:0): avc: denied { unlink } for pid=1414 exe=/bin/rm name=mlc_usb_PSC_900_Series__7 dev=hda2 ino=38221 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=fifo_file Dec 2 06:45:39 fedora kernel: audit(1101998713.229:0): avc: denied { unlink } for pid=1414 exe=/bin/rm name=mlc_usb_PSC_900_Series__8 dev=hda2 ino=38222 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=fifo_file Dec 2 06:45:39 fedora kernel: audit(1101998713.229:0): avc: denied { unlink } for pid=1414 exe=/bin/rm name=mlc_usb_PSC_900_Series__9 dev=hda2 ino=38223 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=fifo_file Dec 2 06:45:39 fedora kernel: audit(1101998739.288:0): avc: denied { rmdir } for pid=1980 exe=/bin/rm name=ptal-mlcd dev=hda2 ino=38157 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:ptal_var_run_t tclass=dir -- Tom London

2 2

Yee-HAH! 'smartd' issues 70 avc's when it tries to send mail...
by Valdis.Kletnieks＠vt.edu 27 Dec '04

27 Dec '04

Running Fedora Core Rawhide as of the other night, so fairly recent. Using 'strict/permissive' at the moment... So I set up 'smartd' to monitor the hard drive in my laptop - I *know* there's one bad spot of about 10 blocks long on it, and want to be told if it decides to start getting bigger. And sure enough, at boot it tries to e-mail me and tell me there's bad blocks. Unfortunately, it seems to invoke 'sh -c mail' or something like that, so even the ugly hack of adding an exec_auto_trans(sendmail_t) doesn't look like it will help. Any good ideas on how to deal with this one? (And I have *NO* idea why it pops the first 5-6 while trying to find resolv.conf) Is it trying to open port 25 to send the mail, and if there's no sendmail running, it invokes 'sh -c mail'? If so, the solution (or part of it) would simply be to have smartd start after sendmail does..... Oddly curious - the failed read for pipe:[9756] - both ends appear to be fsdaemon_t ;) The messages (almost 70 of them): Dec 3 11:07:42 turing-police kernel: audit(1102089972.656:0): avc: denied { search } for pid=17328 exe=/usr/sbin/smartd name=/ dev=tmpfs ino=3131 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmpfs_t tclass=dir Dec 3 11:07:42 turing-police kernel: audit(1102089972.697:0): avc: denied { write } for pid=17328 exe=/usr/sbin/smartd name=log dev=tmpfs ino=9084 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmpfs_t tclass=sock_file Dec 3 11:07:42 turing-police kernel: audit(1102089974.784:0): avc: denied { read } for pid=17328 exe=/usr/sbin/smartd name=resolv.conf dev=dm-5 ino=24648 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:net_conf_t tclass=file Dec 3 11:07:42 turing-police kernel: audit(1102089974.784:0): avc: denied { getattr } for pid=17328 exe=/usr/sbin/smartd path=/etc/resolv.conf dev=dm-5 ino=24648 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:net_conf_t tclass=file Dec 3 11:07:42 turing-police kernel: audit(1102089974.839:0): avc: denied { create } for pid=17328 exe=/usr/sbin/smartd scontext=system_u:system_r:fsdaemon_t tcontext=system_u:system_r:fsdaemon_t tclass=unix_stream_socket Dec 3 11:07:42 turing-police kernel: audit(1102089974.839:0): avc: denied { connect } for pid=17328 exe=/usr/sbin/smartd scontext=system_u:system_r:fsdaemon_t tcontext=system_u:system_r:fsdaemon_t tclass=unix_stream_socket Dec 3 11:07:42 turing-police kernel: audit(1102089974.947:0): avc: denied { search } for pid=8202 exe=/usr/sbin/smartd name=bin dev=dm-5 ino=26670 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:bin_t tclass=dir Dec 3 11:07:42 turing-police kernel: audit(1102089974.947:0): avc: denied { read } for pid=8202 exe=/usr/sbin/smartd name=sh dev=dm-5 ino=57489 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:bin_t tclass=lnk_file Dec 3 11:07:42 turing-police kernel: audit(1102089975.002:0): avc: denied { execute } for pid=8202 exe=/usr/sbin/smartd name=bash dev=dm-5 ino=26747 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 3 11:07:42 turing-police kernel: audit(1102089975.002:0): avc: denied { execute_no_trans } for pid=8202 exe=/usr/sbin/smartd path=/bin/bash dev=dm-5 ino=26747 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 3 11:07:42 turing-police kernel: audit(1102089975.058:0): avc: denied { read } for pid=8202 exe=/usr/sbin/smartd path=/bin/bash dev=dm-5 ino=26747 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 3 11:07:42 turing-police kernel: audit(1102089975.089:0): avc: denied { read } for pid=8202 exe=/bin/bash name=meminfo dev=proc ino=-268435454 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:proc_t tclass=file Dec 3 11:07:42 turing-police kernel: audit(1102089975.089:0): avc: denied { getattr } for pid=8202 exe=/bin/bash path=/proc/meminfo dev=proc ino=-268435454 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:proc_t tclass=file Dec 3 11:07:42 turing-police kernel: audit(1102089975.149:0): avc: denied { search } for pid=8202 exe=/bin/bash name=sbin dev=dm-5 ino=47195 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:sbin_t tclass=dir Dec 3 11:07:42 turing-police kernel: audit(1102089975.149:0): avc: denied { getattr } for pid=8202 exe=/bin/bash path=/bin/bash dev=dm-5 ino=26747 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:shell_exec_t tclass=file Dec 3 11:07:42 turing-police kernel: audit(1102089975.213:0): avc: denied { getattr } for pid=17328 exe=/usr/sbin/smartd path=pipe:[9756] dev=pipefs ino=9756 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:system_r:fsdaemon_t tclass=fifo_file Dec 3 11:07:42 turing-police kernel: audit(1102089975.213:0): avc: denied { read } for pid=17328 exe=/usr/sbin/smartd path=pipe:[9756] dev=pipefs ino=9756 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:system_r:fsdaemon_t tclass=fifo_file Dec 3 11:07:42 turing-police kernel: audit(1102089975.280:0): avc: denied { getattr } for pid=8202 exe=/bin/bash path=/bin/mail dev=dm-5 ino=26730 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:bin_t tclass=file Dec 3 11:07:42 turing-police kernel: audit(1102089975.280:0): avc: denied { execute } for pid=8202 exe=/bin/bash name=mail dev=dm-5 ino=26730 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:bin_t tclass=file Dec 3 11:07:42 turing-police kernel: audit(1102089975.346:0): avc: denied { getattr } for pid=7644 exe=/bin/bash path=/tmp dev=dm-10 ino=2 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=dir Dec 3 11:07:42 turing-police kernel: audit(1102089975.346:0): avc: denied { search } for pid=7644 exe=/bin/bash name=/ dev=dm-10 ino=2 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=dir Dec 3 11:07:42 turing-police kernel: audit(1102089975.415:0): avc: denied { write } for pid=7644 exe=/bin/bash name=/ dev=dm-10 ino=2 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089975.449:0): avc: denied { add_name } for pid=7644 exe=/bin/bash name=sh-thd-1102109337 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089975.449:0): avc: denied { create } for pid=7644 exe=/bin/bash name=sh-thd-1102109337 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089975.517:0): avc: denied { write } for pid=7644 exe=/bin/bash path=/tmp/sh-thd-1102109337 dev=dm-10 ino=6150 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089975.567:0): avc: denied { read } for pid=7644 exe=/bin/bash name=sh-thd-1102109337 dev=dm-10 ino=6150 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089975.610:0): avc: denied { remove_name } for pid=7644 exe=/bin/bash name=sh-thd-1102109337 dev=dm-10 ino=6150 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089975.610:0): avc: denied { unlink } for pid=7644 exe=/bin/bash name=sh-thd-1102109337 dev=dm-10 ino=6150 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089975.679:0): avc: denied { execute_no_trans } for pid=7644 exe=/bin/bash path=/bin/mail dev=dm-5 ino=26730 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:bin_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089975.679:0): avc: denied { read } for pid=7644 exe=/bin/bash path=/bin/mail dev=dm-5 ino=26730 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:bin_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089975.783:0): avc: denied { setgid } for pid=7644 exe=/bin/mail capability=6 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:system_r:fsdaemon_t tclass=capability Dec 3 11:07:43 turing-police kernel: audit(1102089975.831:0): avc: denied { ioctl } for pid=7644 exe=/bin/mail path=/tmp/sh-thd-1102109337 (deleted) dev=dm-10 ino=6150 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089975.866:0): avc: denied { ioctl } for pid=7644 exe=/bin/mail path=pipe:[9756] dev=pipefs ino=9756 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:system_r:fsdaemon_t tclass=fifo_file Dec 3 11:07:43 turing-police kernel: audit(1102089975.901:0): avc: denied { getattr } for pid=7644 exe=/bin/mail path=/tmp/Rsx6eaR5 dev=dm-10 ino=6151 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089976.007:0): avc: denied { execute } for pid=13925 exe=/bin/mail name=sendmail dev=dm-1 ino=41557 scontext=system_u:system_r:fsdaemon_t tcontext=root:object_r:sbin_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089976.007:0): avc: denied { execute_no_trans } for pid=13925 exe=/bin/mail path=/usr/sbin/sendmail dev=dm-1 ino=41557 scontext=system_u:system_r:fsdaemon_t tcontext=root:object_r:sbin_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089976.091:0): avc: denied { read } for pid=13925 exe=/bin/mail path=/usr/sbin/sendmail dev=dm-1 ino=41557 scontext=system_u:system_r:fsdaemon_t tcontext=root:object_r:sbin_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089976.683:0): avc: denied { create } for pid=13925 exe=/usr/sbin/sendmail scontext=system_u:system_r:fsdaemon_t tcontext=system_u:system_r:fsdaemon_t tclass=tcp_socket Dec 3 11:07:43 turing-police kernel: audit(1102089976.813:0): avc: denied { search } for pid=13925 exe=/usr/sbin/sendmail name=mail dev=dm-5 ino=43015 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:etc_mail_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089976.865:0): avc: denied { getattr } for pid=13925 exe=/usr/sbin/sendmail path=/etc/mail/submit.cf dev=dm-5 ino=43033 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:etc_mail_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089976.865:0): avc: denied { getattr } for pid=13925 exe=/usr/sbin/sendmail path=/etc/mail dev=dm-5 ino=43015 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:etc_mail_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089976.947:0): avc: denied { read } for pid=13925 exe=/usr/sbin/sendmail name=submit.cf dev=dm-5 ino=43033 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:etc_mail_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089977.097:0): avc: denied { setuid } for pid=13925 exe=/usr/sbin/sendmail capability=7 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:system_r:fsdaemon_t tclass=capability Dec 3 11:07:43 turing-police kernel: audit(1102089977.174:0): avc: denied { search } for pid=13925 exe=/usr/sbin/sendmail name=spool dev=dm-3 ino=34821 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:var_spool_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089977.218:0): avc: denied { search } for pid=13925 exe=/usr/sbin/sendmail name=clientmqueue dev=dm-3 ino=55307 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089977.218:0): avc: denied { getattr } for pid=13925 exe=/usr/sbin/sendmail path=/var/spool/clientmqueue dev=dm-3 ino=55307 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089977.371:0): avc: denied { getattr } for pid=13925 exe=/usr/sbin/sendmail path=/var/spool dev=dm-3 ino=34821 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:var_spool_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089977.466:0): avc: denied { write } for pid=13925 exe=/usr/sbin/sendmail name=clientmqueue dev=dm-3 ino=55307 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089977.509:0): avc: denied { add_name } for pid=13925 exe=/usr/sbin/sendmail name=dfiB3G6HJS013925 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089977.509:0): avc: denied { create } for pid=13925 exe=/usr/sbin/sendmail name=dfiB3G6HJS013925 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089977.580:0): avc: denied { getattr } for pid=13925 exe=/usr/sbin/sendmail path=/var/spool/clientmqueue/dfiB3G6HJS013925 dev=dm-3 ino=55324 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089977.580:0): avc: denied { lock } for pid=13925 exe=/usr/sbin/sendmail path=/var/spool/clientmqueue/dfiB3G6HJS013925 dev=dm-3 ino=55324 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089977.678:0): avc: denied { write } for pid=13925 exe=/usr/sbin/sendmail path=/var/spool/clientmqueue/dfiB3G6HJS013925 dev=dm-3 ino=55324 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089977.771:0): avc: denied { read } for pid=13925 exe=/usr/sbin/sendmail name=dfiB3G6HJS013925 dev=dm-3 ino=55324 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089977.809:0): avc: denied { connect } for pid=13925 exe=/usr/sbin/sendmail scontext=system_u:system_r:fsdaemon_t tcontext=system_u:system_r:fsdaemon_t tclass=tcp_socket Dec 3 11:07:43 turing-police kernel: audit(1102089977.809:0): avc: denied { tcp_send } for pid=13925 exe=/usr/sbin/sendmail saddr=127.0.0.1 src=51192 daddr=127.0.0.1 dest=25 netif=lo scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:netif_lo_t tclass=netif Dec 3 11:07:43 turing-police kernel: audit(1102089977.879:0): avc: denied { tcp_send } for pid=13925 exe=/usr/sbin/sendmail saddr=127.0.0.1 src=51192 daddr=127.0.0.1 dest=25 netif=lo scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:node_lo_t tclass=node Dec 3 11:07:43 turing-police kernel: audit(1102089977.879:0): avc: denied { send_msg } for pid=13925 exe=/usr/sbin/sendmail saddr=127.0.0.1 src=51192 daddr=127.0.0.1 dest=25 netif=lo scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:smtp_port_t tclass=tcp_socket Dec 3 11:07:43 turing-police kernel: audit(1102089977.948:0): avc: denied { tcp_recv } for pid=3 comm=ksoftirqd/0 saddr=127.0.0.1 src=25 daddr=127.0.0.1 dest=51192 netif=lo scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:netif_lo_t tclass=netif Dec 3 11:07:43 turing-police kernel: audit(1102089977.948:0): avc: denied { tcp_recv } for pid=3 comm=ksoftirqd/0 saddr=127.0.0.1 src=25 daddr=127.0.0.1 dest=51192 netif=lo scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:node_lo_t tclass=node Dec 3 11:07:43 turing-police kernel: audit(1102089977.948:0): avc: denied { recv_msg } for pid=3 comm=ksoftirqd/0 saddr=127.0.0.1 src=25 daddr=127.0.0.1 dest=51192 netif=lo scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:smtp_port_t tclass=tcp_socket Dec 3 11:07:43 turing-police kernel: audit(1102089978.263:0): avc: denied { remove_name } for pid=13925 exe=/usr/sbin/sendmail name=tfiB3G6HJS013925 dev=dm-3 ino=55327 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089978.263:0): avc: denied { rename } for pid=13925 exe=/usr/sbin/sendmail name=tfiB3G6HJS013925 dev=dm-3 ino=55327 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089978.263:0): avc: denied { unlink } for pid=13925 exe=/usr/sbin/sendmail name=qfiB3G6HJS013925 dev=dm-3 ino=55326 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=file Dec 3 11:07:43 turing-police kernel: audit(1102089978.366:0): avc: denied { read } for pid=13925 exe=/usr/sbin/sendmail name=clientmqueue dev=dm-3 ino=55307 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:mqueue_spool_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089978.595:0): avc: denied { getattr } for pid=10722 exe=/bin/bash path=/tmp dev=dm-10 ino=2 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089978.633:0): avc: denied { search } for pid=10722 exe=/bin/bash name=/ dev=dm-10 ino=2 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=dir Dec 3 11:07:43 turing-police kernel: audit(1102089978.633:0): avc: denied { write } for pid=10722 exe=/bin/bash name=/ dev=dm-10 ino=2 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=dir Dec 3 11:07:44 turing-police kernel: audit(1102089978.701:0): avc: denied { add_name } for pid=10722 exe=/bin/bash name=sh-thd-1102111169 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=dir Dec 3 11:07:44 turing-police kernel: audit(1102089978.701:0): avc: denied { remove_name } for pid=10722 exe=/bin/bash name=sh-thd-1102111169 dev=dm-10 ino=6150 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmp_t tclass=dir Dec 3 11:36:19 turing-police kernel: audit(1102091779.951:0): avc: denied { search } for pid=16629 exe=/usr/sbin/smartd name=/ dev=tmpfs ino=3131 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmpfs_t tclass=dir Dec 3 11:36:20 turing-police kernel: audit(1102091780.816:0): avc: denied { write } for pid=16629 exe=/usr/sbin/smartd name=log dev=tmpfs ino=9084 scontext=system_u:system_r:fsdaemon_t tcontext=system_u:object_r:tmpfs_t tclass=sock_file

4 5

adds for latest policy...cups.te, udev.te?
by Tom London 25 Dec '04

25 Dec '04

Running strict/enforcing, latest rawhide. Rebooting after updating to latest policy (selinux-policy-strict-1.19.15-7), noticed the following AVCs: Dec 24 11:48:23 fedora kernel: audit(1103917703.356:0): avc: denied { connect } for pid=2679 exe=/usr/sbin/hal_lpadmin scontext=system_u:system_r:cupsd_config_t tcontext=system_u:system_r:cupsd_config_t tclass=tcp_socket and Dec 24 11:50:52 fedora kernel: audit(1103917852.996:0): avc: denied { connect } for pid=3070 exe=/usr/bin/lpoptions scontext=system_u:system_r:cupsd_config_t tcontext=system_u:system_r:cupsd_config_t tclass=tcp_socket Adding the following seems to fix it: allow cupsd_config_t self:tcp_socket connect; Also: Dec 24 11:47:51 fedora kernel: IPv6 over IPv4 tunneling driver Dec 24 11:47:51 fedora kernel: audit(1103888840.733:0): avc: denied { read } for pid=1112 exe=/sbin/pam_console_apply name=mnt dev=hda2 ino=1114113 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:mnt_t tclass=dir Dec 24 11:47:51 fedora kernel: audit(1103888840.736:0): avc: denied { read } for pid=1112 exe=/sbin/pam_console_apply name=mnt dev=hda2 ino=1114113 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:mnt_t tclass=dir Dec 24 11:47:51 fedora kernel: audit(1103888840.737:0): avc: denied { read } for pid=1112 exe=/sbin/pam_console_apply name=mnt dev=hda2 ino=1114113 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:mnt_t tclass=dir Dec 24 11:47:51 fedora last message repeated 3 times Dec 24 11:47:51 fedora kernel: audit(1103888840.738:0): avc: denied { read } for pid=1112 exe=/sbin/pam_console_apply name=mnt dev=hda2 ino=1114113 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:mnt_t tclass=dir Dec 24 11:47:51 fedora last message repeated 4 times Dec 24 11:47:51 fedora kernel: ACPI: Power Button (FF) [PWRF] The following change seems to fix: allow udev_t mnt_t:dir search; to allow udev_t mnt_t:dir r_dir_perms; But I'm not sure why pam_console_apply wants to read /mnt. Should this be a dontaudit? tom -- Tom London

2 2

About security field in struct sk_buff
by Park Lee 24 Dec '04

24 Dec '04

Hi, In /usr/src/linux/security/selinux/include/objsec.h, there seems no SELinux security data structure for struct sk_buff. Does this means that SELinux doesn't use the security field (i.e. the unsigned short security) in struct sk_buff at all? Thank you. ===== Best Regards, Park Lee __________________________________ Do you Yahoo!? The all-new My Yahoo! - What will yours do? http://my.yahoo.com

1 0

Re: system-config-securitylevel error?
by Justin Conover 24 Dec '04

24 Dec '04

I re-enabled SELinux and then did the following: cd /etc/selinux/targeted/src/policy make make relabel reboot /sbin/restorecon -v -R /sbin/fixfiles relabel reboot to init 3 I didn't seen any avc errors so installed the nvidia drivers and then got some errors again Had to do with /sbin/ldconfig And if I go to init 5, gdm loads but users and root get the following error trying to login: Cannot start the session due to some internal errors. So I can't get into X On Fri, 24 Dec 2004 09:41:32 -0600, Justin Conover <justin.conover(a)gmail.com> wrote: > About 2 days ago I did an update and I was getting so many avc errors > and had to get some work done so I dropped SELinux for the moment. I > simply edited /etc/sysconfig/selinux and changed it to "disabled" but > when I run "system-config-securitylevel" I get the following error: > > # system-config-securitylevel > Traceback (most recent call last): > File "/usr/share/system-config-securitylevel/system-config-securitylevel.py", > line 17, in ? > app = securitylevel.childWindow() > File "/usr/share/system-config-securitylevel/securitylevel.py", line > 87, in __init__ > self.trustedList = checklist.CheckList(1) > NameError: global name 'checklist' is not defined > > My systems is the following: > > FC3 x86_64 updated to Rawhide. > > thx, > > btw, I've attached the avc errors out of /var/log/messages If I > decide to turn SELinux back on, what is the best approach as far a > re-labeling: > > /sbin/restorecon -v -R > /sbin/fixfiles relabel > > ? > > >

1 0

'allow XXXX udev_tdb_t:dir r_dir_perms' needed...
by Tom London 23 Dec '04

23 Dec '04

Running strict/enforcing, latest Rawhide.... X fails to come up, etc. Looks like allow XXXX udev_tdb_t:dir r_dir_perms; is needed pretty generally, especially for xdm_t, xdm_server_t, ptal_t, pam_console_t, lvm_t, hald_t, gpm_t, cupsd_t. Even user_t seems to want it for configuring esd. Should this be added to macros somewhere? tom -- Tom London

3 6

FC3 PostgreSQL update
by Troels Arvin 23 Dec '04

23 Dec '04

Hello, I installed the updated PostgreSQL for FC3 today. Before the update, there were no problems, but now - when I try to start PostgreSQL - it fails, and I get the following line in my /var/log/messages: kernel: audit(1103292268.189:0): avc: denied { search } for pid=13607 exe=/usr/bin/postgres name=mnt dev=hda5 ino=179521 scontext=root:system_r:postgresql_t tcontext=system_u:object_r:mnt_t tclass=dir Due to a disk-space problem, my /var/lib/pgsql is a symlink to /mnt/hda1/pgsql My /mnt/hda1 is unlabeled, and I guess this should be changed, but to what? - Should my /mnt/hda1 be labeled system_u:object_r:root_t? How come a PostgreSQL update breaks what used to work? -- Greetings from Troels Arvin, Copenhagen, Denmark

4 4

Where is the SID stored in file system and process respectively?
by Park Lee 23 Dec '04

23 Dec '04

Hi, As we know, In SELinux, when we first access a file, the file system should first send the security context of the file from its extended attribute to security server. the security server will give a SID back to the file for later use. Since then, every time when we access the file, there is no need for the file system to send the security context of the file again. instead, it will send the SID of the file to security server. But, Where is the SID (which is assigned by security server for the file) stored in the file system? and How is the SID calculated? As for process in selinux, Where is the SID (which also is assigned by security server ) stored with the process? Is the security context of the process only exist in the selinux security server and the process only need to deal with the SID that is related to the security context? Will the process itself handle its own security context? Thank you. ===== Best Regards, Park Lee __________________________________ Do you Yahoo!? Dress up your holiday email, Hollywood style. Learn more. http://celebrity.mail.yahoo.com

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2004