December 2004 - selinux - Fedora mailing-lists

RE: SELinux on RH3
by Alex Ackerman 17 Dec '04

17 Dec '04

> bounces(a)redhat.com] On Behalf Of Colin Walters > Sent: Friday, December 17, 2004 6:56 PM > To: fedora-selinux-list(a)redhat.com > Subject: Re: SELinux on RH3 > > On Fri, 2004-12-17 at 23:42 +0000, Juan Espino wrote: > > Hello everybody, > > > > I'm new in SELinux world and I want to know if I can install SELinux > > on Red Hat Enterprise 3. Actually I'm using White Box Enterprise and > > I'm really interested if I can run SELinux with this linux > > distribution or if you think maybe change to another distro like > > fedora I really apreciate your recommendation, thanks. > > I would be a lot of work. My suggestion is to just wait for RHEL4. You > can test with Fedora Core 3 in the meantime. RHEL 4 Beta 2 is available for download and it uses SELinux. I've heard (don't quote me) that RHEL 4 will go final Feb/Mar timeframe. Alex Ackerman

1 0

Loadlin
by Moller 17 Dec '04

17 Dec '04

Hello! I want to dualboot FedoraCore3 with Win 98. How do I do it ? Philip

1 0

SELinux... a never ending story!
by Giuseppe Greco 17 Dec '04

17 Dec '04

Hi all, to solve the problems I described in my previous emails, I've backed up my configuration and reinstalled FC3 from scratch. Now I'm not able to run squrrelmail... I always get the following error message: audit(1103219472.797:0): avc: denied { read } for pid=25107 exe=/usr/sbin/httpd name=sh dev=dm-0 ino=96012 scontext=root:system_r:httpd_t tcontext=system_u:object_r:bin_t tclass=lnk_file Any idea how to help a poor desperate? j3d. -- ---------------------------------------- Giuseppe Greco ::agamura:: phone: +41 (0)91 604 67 65 mobile: +41 (0)79 602 99 27 email: giuseppe.greco(a)agamura.com web: www.agamura.com ----------------------------------------

3 8

Problem installing kernel-2.6.9-1.1037_FC4, mkinitrd, ...
by Tom London 17 Dec '04

17 Dec '04

Running strict/enforcing, latest Rawhide. installing today's kernel reports: Installing: kernel 100 % done 1/1 /bin/bash: /root/.bashrc: Permission denied ln: creating symbolic link `/tmp/initrd.L17712/sbin' to `bin': Permission deniedln: creating symbolic link `/tmp/initrd.L17712/sbin/modprobe' to `/sbin/nash': No such file or directory cp: cannot create regular file `/tmp/initrd.L17712/sbin/udev': No such file or directory ln: creating symbolic link `/tmp/initrd.L17712/sbin/udevstart' to `udev': No such file or directory ln: creating symbolic link `/tmp/initrd.L17712/sbin/hotplug' to `/sbin/nash': No such file or directory with the following AVC; Dec 17 08:25:06 fedora kernel: audit(1103300706.529:0): avc: denied { create } for pid=17723 exe=/bin/ln name=sbin scontext=root:sysadm_r:bootloader_t tcontext=root:object_r:bootloader_tmp_t tclass=lnk_file This patch seems to fix it..... tom --- bootloader.te.old 2004-12-17 08:31:33.195853461 -0800 +++ bootloader.te 2004-12-17 08:27:51.453938491 -0800 @@ -29,7 +29,7 @@ allow bootloader_t { initrc_t privfd }:fd use; tmp_domain(bootloader, `, device_type') -allow bootloader_t bootloader_tmp_t:devfile_class_set create_file_perms; +allow bootloader_t bootloader_tmp_t:{ devfile_class_set lnk_file } create_file_perms; read_locale(bootloader_t) -- Tom London

1 0

sql table under fedora core3
by FRANCOIS Dufour 17 Dec '04

17 Dec '04

hi to all ! ive got an jsp aplication running on tomcat4 alredy instaled whit sucess using/local folder i add a couple problem seting it up but now its ok my question is i have my sql table created under window os how do i transfer it (copie it were) so my jsp aplication can find its table under fedora core3 the web app only need mysql running whit its table loaded in as far ive read today its a pyton aplication that control mysql thanks in advance friendly francoisdufour(a)hotmail.com administrateur http://entre-nous.qc.tc

3 3

dhcp_defined
by Karsten Wade 16 Dec '04

16 Dec '04

Both dhcpd.fc and dhcpc.fc have an ifdef statement for `dhcp_defined'. It seems to be related to pump usage in dhcpc.fc. I can't find where dhcp_defined gets set to true or false. What is this for and how is it used? Somehow I feel as if I'm missing something obvious. However, this is the only *_defined I can find in the policy. thx - Karsten -- Karsten Wade, RHCE, Sr. Tech Writer a lemon is just a melon in disguise http://people.redhat.com/kwade/ gpg fingerprint: 2680 DBFD D968 3141 0115 5F1B D992 0E06 AD0E 0C41

2 1

Experimental Version of Dump available.
by Daniel J Walsh 16 Dec '04

16 Dec '04

I have added a new version of dump/restore to Rawhide to allow dumping and restore of Extended Attributes. Any testing you can do with this code would be appreciated. Version dump-0.4b37-2 Dan

1 0

I give up...
by Giuseppe Greco 15 Dec '04

15 Dec '04

Hi all, I think I give up... no way to get my SELinux system working as it should. For the moment, I've just disabled it. I've tried everything, but nothing... What's strange is that I've these problems only on a machine where I updated from FC1 to FC3. Others machines where I installed FC3 from scratch I've no problems at all. j3d. -- ---------------------------------------- Giuseppe Greco ::agamura:: phone: +41 (0)91 604 67 65 mobile: +41 (0)79 602 99 27 email: giuseppe.greco(a)agamura.com web: www.agamura.com ----------------------------------------

4 4

squid.te
by Tom London 13 Dec '04

13 Dec '04

Running strict/enforcing, latest Rawhide squid and initrc needs to create/write /var/log/squid/squid.out, etc Suggest adding: allow { squid_t initrc_t } squid_log_t:dir create_dir_perms; allow { squid_t initrc_t } squid_log_t:file create_file_perms; tom -- Tom London

4 8

disable selinux for httpd
by Arthur Stephens 10 Dec '04

10 Dec '04

Ok I have given up on getting httpd to work under selinux I would like it disabled it for httpd. I know how to do that temporary with setsebool but how does one make that permanent? Maybe when I have some time to spare :) I can come back to it. Arthur Stephens Senior Sales Technician Ptera Wireless Internet astephens(a)ptera.net 509-927-Ptera

9 17

A few policy changes I had to make
by Rodrigo Damazio 09 Dec '04

09 Dec '04

Hello. I started playing with SELinux on FC2, and recently moved to FC3, and I must say it's much better now, with the targeted policy. Congrats on this. I still had to change a few things in my policies, though. Following is a collection of the avc errors justifying my changes. I'm not experienced with SElinux yet, so I may be doing something wrong...please let me know if these changes are correct or not. Also, the unlink allow for httpd_t is because, for some reason, when I try to remove a file from within PHP, it uses httpd_t instead of httpd_sys_script_t . I would also like a rule(which I'm not sure how to write) to allow PHP programs to execute external programs, since I have a script which receives an uploaded file, does a lot of processing with it through external programs, and stores it in the database - when I run that, it gives me avc execute errors trying to run bash and the other utilities. Apache: Nov 12 16:50:46 fireball kernel: audit(1100285446.637:0): avc: denied { connectto } for pid=2522 exe=/usr/sbin/httpd path=/tmp/.s.PGSQL.5432 scontext=user_u:system_r:httpd_t tcontext=user_u:system_r:unconfined_t tclass=unix_stream_socket NTPd: Nov 11 19:51:49 fireball kernel: audit(1100209909.743:0): avc: denied { create } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.745:0): avc: denied { bind } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.745:0): avc: denied { getattr } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.747:0): avc: denied { write } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.749:0): avc: denied { net_admin } for pid=2293 exe=/usr/sbin/ntpd capability=12 scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=capability Nov 11 19:51:49 fireball kernel: audit(1100209909.750:0): avc: denied { nlmsg_read } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket Nov 11 19:51:49 fireball kernel: audit(1100209909.752:0): avc: denied { read } for pid=2293 exe=/usr/sbin/ntpd scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t tclass=netlink_route_socket DHCPd: Nov 12 23:37:25 fireball kernel: audit(1100309845.314:0): avc: denied { create } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.317:0): avc: denied { bind } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.320:0): avc: denied { getattr } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.323:0): avc: denied { write } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.325:0): avc: denied { net_admin } for pid=10002 exe=/usr/sbin/dhcpd capability=12 scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=capability Nov 12 23:37:25 fireball kernel: audit(1100309845.326:0): avc: denied { nlmsg_read } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.327:0): avc: denied { read } for pid=10002 exe=/usr/sbin/dhcpd scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t tclass=netlink_route_socket Nov 12 23:37:25 fireball kernel: audit(1100309845.909:0): avc: denied { unlink } for pid=10008 exe=/usr/sbin/dhcpd name=dhcpd.leases~ dev=hda1 ino=425472 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:file_t tclass=file named: Nov 12 23:41:25 fireball kernel: audit(1100310085.797:0): avc: denied { create } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.798:0): avc: denied { bind } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.799:0): avc: denied { getattr } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.803:0): avc: denied { write } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.806:0): avc: denied { nlmsg_read } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Nov 12 23:41:25 fireball kernel: audit(1100310085.809:0): avc: denied { read } for pid=10183 exe=/usr/sbin/named scontext=root:system_r:named_t tcontext=root:system_r:named_t tclass=netlink_route_socket Thanks, Rodrigo

4 6

not relabeling "/dev/:0".
by Vinicius 09 Dec '04

09 Dec '04

Hello, Is the problem below a SELinux related issue, please? If so, how to resolve this, please? /var/log/messages: "... -:0[3004]: Warning! Could not get current context for /dev/:0, not relabeling. ..." TIA, Vinicius.

5 4

avc: denied ... syslogd and others.
by Vinicius 09 Dec '04

09 Dec '04

Hello, How to resolve the problems below, please? "Dec 8 15:36:59 cviniciusm kernel: audit(1102527416.432:0): avc: denied { read } for pid=2005 exe=/sbin/syslogd name=libc-2.3.3.so dev=hda7 ino=752988 sconte xt=user_u:system_r:syslogd_t tcontext=system_u:object_r:file_t tclass=file Dec 8 15:36:59 cviniciusm kernel: audit(1102527416.432:0): avc: denied { geta ttr } for pid=2005 exe=/sbin/syslogd path=/lib/tls/libc-2.3.3.so dev=hda7 ino=7 52988 scontext=user_u:system_r:syslogd_t tcontext=system_u:object_r:file_t tclas s=file Dec 8 15:36:59 cviniciusm kernel: audit(1102527416.432:0): avc: denied { exec ute } for pid=2005 path=/lib/tls/libc-2.3.3.so dev=hda7 ino=752988 scontext=use r_u:system_r:syslogd_t tcontext=system_u:object_r:file_t tclass=file Dec 8 15:36:59 cviniciusm kernel: audit(1102527416.463:0): avc: denied { appe nd } for pid=2006 exe=/sbin/syslogd name=messages dev=hda7 ino=115590 scontext= user_u:system_r:syslogd_t tcontext=system_u:object_r:file_t tclass=file Dec 8 15:36:59 cviniciusm kernel: audit(1102527416.463:0): avc: denied { ioct l } for pid=2006 exe=/sbin/syslogd path=/var/log/messages dev=hda7 ino=115590 s context=user_u:system_r:syslogd_t tcontext=system_u:object_r:file_t tclass=file Dec 8 15:36:59 cviniciusm kernel: audit(1102527416.576:0): avc: denied { sear ch } for pid=2021 exe=/sbin/portmap name=/ dev=hda7 ino=2 scontext=user_u:syste m_r:portmap_t tcontext=system_u:object_r:file_t tclass=dir Dec 8 15:36:59 cviniciusm kernel: audit(1102527416.576:0): avc: denied { read } for pid=2021 exe=/sbin/portmap name=libnsl-2.3.3.so dev=hda7 ino=753010 scon text=user_u:system_r:portmap_t tcontext=system_u:object_r:file_t tclass=file Dec 8 15:36:59 cviniciusm kernel: audit(1102527416.576:0): avc: denied { geta ttr } for pid=2021 exe=/sbin/portmap path=/lib/libnsl-2.3.3.so dev=hda7 ino=753 010 scontext=user_u:system_r:portmap_t tcontext=system_u:object_r:file_t tclass= file Dec 8 15:36:59 cviniciusm kernel: audit(1102527416.576:0): avc: denied { exec ute } for pid=2021 path=/lib/libnsl-2.3.3.so dev=hda7 ino=753010 scontext=user_ u:system_r:portmap_t tcontext=system_u:object_r:file_t tclass=file" "# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: error (Success) Policy version: 18 Policy from config file:targeted Policy booleans: ... syslogd_disable_trans inactive ..." TIA, Vinicius.

2 4

Looking for a simple project
by W. Michael Petullo 09 Dec '04

09 Dec '04

I am looking for a simple project to use as an example of Java GNOME development. Because I am interested in SELinux, I thought that I could write a GNOME application that was SELinux-related. I am looking for an application that would take about one month to write (working on it part-time). Only the GUI needs to be written in Java. One idea I had was an application that would help parse AVC messages in a system's log files. The program would categorize AVC messages by criteria like scontext and present a expandable list of categories. The categories could be expanded to reveal AVC messages. This might help when debugging a SELinux policy. So, does anyone have any suggestions? As I mentioned, my goal is really to demonstrate the use of Java GNOME, but I would like to do something useful. I would like to hear if there is anything anyone wants to see. -- Mike

2 1

cups wants to write to /usr/lib/python2.4/.../printconf_tui.pyo, etc
by Tom London 08 Dec '04

08 Dec '04

Running strict/enforcing, latest Rawhide. When logging in, cups, running in cupsd_config_t wants to write /usr/lib/python/site-packages/printconf_tui.pyo, and /usr/share/printconf/util/printconf_tui.pyo. Strict and Permissive avc's shown below. Two things: 1. Didn't these files get moved to /var under an earlier bugzilla? 2. Can we add a 'dontaudit' to cups.te for this: dontaudit cupsd_config_t lib_t:dir write; dontaudit cupsd_config_t usr_t:dir write; tom Strict avcs: Dec 4 10:20:41 fedora kernel: audit(1102184441.369:0): avc: denied { write } for pid=2844 exe=/usr/bin/python name=util dev=hda2 ino=4309019 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=dir Dec 4 10:20:41 fedora kernel: audit(1102184441.619:0): avc: denied { write } for pid=2844 exe=/usr/bin/python name=site-packages dev=hda2 ino=4525331 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:lib_t tclass=dir Permissive avc: Dec 4 10:35:08 fedora kernel: audit(1102185308.369:0): avc: denied { write } for pid=3591 exe=/usr/bin/python name=util dev=hda2 ino=4309019 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=dir Dec 4 10:35:08 fedora kernel: audit(1102185308.370:0): avc: denied { remove_name } for pid=3591 exe=/usr/bin/python name=printconf_tui.pyo dev=hda2 ino=4309180 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=dir Dec 4 10:35:08 fedora kernel: audit(1102185308.370:0): avc: denied { unlink } for pid=3591 exe=/usr/bin/python name=printconf_tui.pyo dev=hda2 ino=4309180 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:printconf_t tclass=file Dec 4 10:35:08 fedora kernel: audit(1102185308.606:0): avc: denied { add_name } for pid=3591 exe=/usr/bin/python name=printconf_tui.pyo scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=dir Dec 4 10:35:08 fedora kernel: audit(1102185308.606:0): avc: denied { create } for pid=3591 exe=/usr/bin/python name=printconf_tui.pyo scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=file Dec 4 10:35:08 fedora kernel: audit(1102185308.606:0): avc: denied { write } for pid=3591 exe=/usr/bin/python path=/usr/share/printconf/util/printconf_tui.pyo dev=hda2 ino=4309025 scontext=system_u:system_r:cupsd_config_t tcontext=system_u:object_r:usr_t tclass=file -- Tom London

3 3

Request
by Mark Stier 08 Dec '04

08 Dec '04

Hello! Could someone please take the strict policy and set a permissive default for unconfigured processes like in the targeted policy? That would be really great. Thanks in advance, Mark -- Signed PGP public key available on key servers.

3 2

Maximum Hardisk for Fedora Core 3
by Foryanto J. Wiguna 08 Dec '04

08 Dec '04

Hello all i just want to know Maximum Hardisk for Fedora Core 3 regards, -Foryanto-

2 1

OpenMosix
by Chak 07 Dec '04

07 Dec '04

Someone had installed OpenMosix on Fedora Core 3??? I cant!!! Any kind of help will be apreciated.

1 0

yum/bootloader avcs?
by Tom London 07 Dec '04

07 Dec '04

Running strict, latest Rawhide. I happened to do today's updates in permissive mode, and got the following avcs: Dec 7 07:40:23 fedora kernel: loop: loaded (max 8 devices) Dec 7 07:41:29 fedora kernel: audit(1102434089.867:0): avc: denied { read } for pid=3863 exe=/bin/bash name=.bashrc dev=hda2 ino=1130588 scontext=root:sysadm_r:bootloader_t tcontext=root:object_r:staff_home_t tclass=file Dec 7 07:41:29 fedora kernel: audit(1102434089.867:0): avc: denied { getattr } for pid=3863 exe=/bin/bash path=/root/.bashrc dev=hda2 ino=1130588 scontext=root:sysadm_r:bootloader_t tcontext=root:object_r:staff_home_t tclass=file Dec 7 07:41:29 fedora kernel: audit(1102434089.957:0): avc: denied { read } for pid=3865 exe=/usr/bin/id name=config dev=hda2 ino=4509759 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:selinux_config_t tclass=file Dec 7 07:41:29 fedora kernel: audit(1102434089.957:0): avc: denied { getattr } for pid=3865 exe=/usr/bin/id path=/etc/selinux/config dev=hda2 ino=4509759 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:selinux_config_t tclass=file The first two of these (ref to /root/.basrc, I believe) is not new, but I don't remember seeing the others. tom -- Tom London

2 1

avc denied from /.autorelabel
by Richard Hally 06 Dec '04

06 Dec '04

Included below are the avc denied messages from trying to do an autorelabel while in enforcing mode with the strict policy. there are also messages about line 64 of rc.sysinit: permission denied. Looks like sysinit(initrc_t) is trying to write to /selinux/enforce with out being allowed to do so. Thus setfiles can not read file_contexts. HTH Richard Hally Dec 6 05:53:56 new2 kernel: audit(1102330419.769:0): avc: denied { write } for pid=213 exe=/bin/bash name=enforce dev=selinuxfs ino=4 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:security_t tclass=file Dec 6 05:53:56 new2 kernel: audit(1102330419.769:0): avc: denied { write } for pid=213 exe=/bin/bash name=enforce dev=selinuxfs ino=4 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:security_t tclass=file Dec 6 05:53:56 new2 kernel: audit(1102330420.005:0): avc: denied { read } for pid=1279 exe=/usr/sbin/setfiles name=file_contexts dev=dm-0 ino=3998097 scontext=system_u:system_r:initrc_t tcontext=root:object_r:file_context_t tclass=file Dec 6 05:53:56 new2 kernel: audit(1102330420.026:0): avc: denied { write } for pid=213 exe=/bin/bash name=enforce dev=selinuxfs ino=4 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:security_t tclass=file Dec 6 05:53:56 new2 kernel: audit(1102330420.026:0): avc: denied { write } for pid=213 exe=/bin/bash name=enforce dev=selinuxfs ino=4 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:security_t tclass=file

2 1

http startup problem
by Arthur Stephens 06 Dec '04

06 Dec '04

I do not know if this a SELinux problem or httpd problem. Upgraded to the latest SELinux and now httpd fails with the following message Dec 6 20:13:03 webmail kernel: audit(1102392783.654:0): avc: denied { unlink } for pid=2005 exe=/usr/sbin/httpd name=ssl_mutex.2005 dev=dm-0 ino=228205 scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_log_t tclass=file Dec 6 20:13:04 webmail httpd: httpd startup succeeded Dec 6 20:13:04 webmail kernel: audit(1102392784.995:0): avc: denied { unlink } for pid=2006 exe=/usr/sbin/httpd name=ssl_mutex.2005 dev=dm-0 ino=228205 scontext=root:system_r:httpd_t tcontext=root:object_r:httpd_log_t tclass=file The httpd error log shows [Mon Dec 06 20:13:04 2004] [error] (17)File exists: Cannot create SSLMutex with file `/etc/httpd/logs/ssl_mutex.2005' Configuration Failed ls -Z of the directory shows the ssl_mutex... is being created incorrectly? -rw-r--r-- root root system_u:object_r:httpd_log_t ssl_error_log.2 -rw-r--r-- root root root:object_r:httpd_log_t ssl_mutex.2005 -rw-r--r-- root root system_u:object_r:httpd_log_t ssl_request_log I am confused on where to fix this. Arthur Stephens Sales Technician Ptera Wireless Internet astephens(a)ptera.net 509-927-Ptera

2 1

Understanding SELinux
by Giuseppe Greco 06 Dec '04

06 Dec '04

Hi all, I've lots of problems related to SELinux on FC3... I get tonnes of messages like ... audit(1102179993.228:0): avc: denied { append } for pid=2624 exe=/sbin/syslogd name=boot.log dev=md-6 ino=128104 scontex=root:system_r:syslogd_t tcontext=system_u:object_r:file_t tclass=file syslog: /var/log/boot.log: Permissin denied ... Same problem with dhcpd, portmap, etc. I've tried this [root@murphy etc]# ls -alZ /var/log/boot.log -rw------- root root /var/log/boot.log ... and then this [root@murphy etc]# chcon -t var_log_t /var/log/boot.log but I always get the error message "chcon: can't apply partial context to unlabeled file boot.log" What I'm trying to understand is why system files like this are not already labeled as they should, and what I've to do to get my boxes working without complying... Thanks for helping a poor novice, j3d. -- ---------------------------------------- Giuseppe Greco ::agamura:: phone: +41 (0)91 604 67 65 mobile: +41 (0)76 390 60 32 email: giuseppe.greco(a)agamura.com web: www.agamura.com ----------------------------------------

3 8

perl/cgi script problem
by Arthur Stephens 06 Dec '04

06 Dec '04

Ok I thought I had this SELinux thing figured out atleast a little. Finally got httpd to startup. But now I have perl/cgi script problems. When trying to access my Genesis WebAuthoring System the script works in the /cgi-bin/genesis/ directory displaying the login screen but when I go to log in I get this error message. Error: could not write to file '/var/www/pteraweb/cgi-bin/genesis/script_data/accounts/.webauth_tokens' - Permission denied - Permission denied Plus these on the console Dec 2 21:04:37 webmail kernel: audit(1102050277.791:0): avc: denied { search } for pid=2359 exe=/usr/bin/perl name=sys dev=proc ino=-268435431 scontext=root:system_r:httpd_sys_script_t tcontext=system_u:object_r:sysctl_t tclass=dir Dec 2 21:04:54 webmail kernel: audit(1102050294.906:0): avc: denied { search } for pid=2360 exe=/usr/bin/perl scontext=root:system_r:httpd_sys_script_t tcontext=system_u:object_r:sysctl_kernel_t tclass=dir Dec 2 21:04:54 webmail kernel: audit(1102050294.906:0): avc: denied { search } for pid=2360 exe=/usr/bin/perl name=sys dev=proc ino=-268435431 scontext=root:system_r:httpd_sys_script_t tcontext=system_u:object_r:sysctl_t tclass=dir Dec 2 21:04:55 webmail kernel: audit(1102050295.132:0): avc: denied { write } for pid=2360 exe=/usr/bin/perl name=.webauth_tokens dev=dm-0 ino=228251 scontext=root:system_r:httpd_sys_script_t tcontext=system_u:object_r:httpd_sys_content_t tclass=file Oh I know what this means so I added this to my custom.fc /var/www/.*/cgi-bin(/.*)? system-u:object_r:httpd_sys_script_exec_t which is what I saw in file_contexts for /var/www/cgi-bin make load fixfiles relabel The log shows it relabled everything. But now I get... Dec 3 13:42:38 webmail kernel: audit(1102110158.398:0): avc: denied { search } for pid=1873 exe=/usr/bin/perl name=sys dev=proc ino=-268435431 scontext=user_u:system_r:httpd_sys_script_t tcontext=system_u:object_r:sysctl_t tclass=dir Dec 3 13:42:47 webmail kernel: audit(1102110167.739:0): avc: denied { search } for pid=1874 exe=/usr/bin/perl scontext=user_u:system_r:httpd_sys_script_t tcontext=system_u:object_r:sysctl_kernel_t tclass=dir Dec 3 13:42:47 webmail kernel: audit(1102110167.740:0): avc: denied { search } for pid=1874 exe=/usr/bin/perl name=sys dev=proc ino=-268435431 scontext=user_u:system_r:httpd_sys_script_t tcontext=system_u:object_r:sysctl_t tclass=dir Dec 3 13:42:47 webmail kernel: audit(1102110167.964:0): avc: denied { write } for pid=1874 exe=/usr/bin/perl name=.webauth_tokens dev=dm-0 ino=228251 scontext=user_u:system_r:httpd_sys_script_t tcontext=system_u:object_r:httpd_sys_script_exec_t tclass=file So I ran out of what I know to do or maybe I messed things up. Arthur Stephens Sales Technician Ptera Wireless Internet astephens(a)ptera.net 509-927-Ptera

4 8

rpm -V selinux-policy-targeted
by Joe Orton 03 Dec '04

03 Dec '04

Should I expect output like this from rpm -V from a fresh install, even if I haven't touched the policy myself? [root@blane ~]# rpm -V selinux-policy-targeted .......TC c /etc/selinux/targeted/contexts/default_contexts .......TC c /etc/selinux/targeted/contexts/default_type .......TC c /etc/selinux/targeted/contexts/failsafe_context ..5....TC c /etc/selinux/targeted/contexts/files/file_contexts .......TC c /etc/selinux/targeted/contexts/files/media .......TC c /etc/selinux/targeted/contexts/initrc_context .......TC c /etc/selinux/targeted/contexts/removable_context .......TC c /etc/selinux/targeted/contexts/userhelper_context .......TC c /etc/selinux/targeted/contexts/users/root ..5....T. c /etc/selinux/targeted/policy/policy.18 Since policy/policy.18 is marked %config(noreplace) the new policy.18 file is installed as policy.18.rpmnew and hence it seems manual intervention is needed to load the new policy, it's not a simple rpm -U or up2date run away - is this desirable? joe

4 13

Bind and selinux
by Rogelio J. Baucells 03 Dec '04

03 Dec '04

Hi, I have a server running FC3 + selinux (targeted) and I had some problems with bind and dynamic DNS updates. This is how I fix it. The first thing I noticed is that the named server was not able to create the Journal files for the zones I was trying to update # ls -l /var/named/chroot/var total 24 drwxr-x--- 4 root named 4096 Dec 1 14:42 named drwxrwx--- 3 root named 4096 Nov 16 11:50 run drwxrwx--- 2 named named 4096 Mar 13 2003 tmp because the user "named" (the one running the daemon) did not have access to create new files inside the named folder. I think this is a problem in the bind-chroot rmp package. I ran the following command to give the user named access to create new files inside the named folder # chmod 770 /var/named/chroot/var/named # ls -l /var/named/chroot/var total 24 drwxrwx--- 4 root named 4096 Dec 1 14:42 named drwxrwx--- 3 root named 4096 Nov 16 11:50 run drwxrwx--- 2 named named 4096 Mar 13 2003 tmp That fixed the problem. Now selinux!!! When I try to update one of the zones I get the following error in /var/log/messages ---------------------------------------------------------------------- Dec 1 14:56:01 server named[22580]: client 127.0.0.1#32867: updating zone 'example.com/IN': adding an RR Dec 1 14:56:01 server named[22580]: client 127.0.0.1#32867: updating zone 'example.com/IN': adding an RR Dec 1 14:56:01 server named[22580]: journal file example.com.zone.jnl does not exist, creating it Dec 1 14:56:01 server named[22580]: example.com.zone.jnl: create: permission denied Dec 1 14:56:01 server kernel: audit(1101930961.025:0): avc: denied { write } for pid=22581 exe=/usr/sbin/named name=named dev=dm-0 ino=293768 scontext=root:system_r:named_t tcontext=system_u:object_r:named_zone_t tclass=dir Dec 1 14:56:01 server named[22580]: client 127.0.0.1#32867: updating zone 'example.com/IN': error: journal open failed: unexpected error ---------------------------------------------------------------------- I ran the "Security Level Configuration" tool and enabled "Allow named to overwrite master zone files" and that fixed the problem. Without the ACL modifications of the folder /var/named/chroot/var/named the setting in the "Security Level Configuration" is useless. I hope this information helps somebody having the same problems... RJB

7 12

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2004