selinux December 2004

selinux@lists.fedoraproject.org

64 participants
82 discussions

Re: httpd avc denied problem
by Arthur Stephens 02 Dec '04

02 Dec '04

>> I am new to SELinux and Fedora 3 - setting up a replacement server for the one that got hacked >> I transfered our websites over and discovered I had to have them all under /usr/www/ >>Who or what does tell you this should be this way? /usr/ is the wrong >>place. Ok I moved everything under /var/www.. ran fixfiles changed everything under httpd.conf to point to /var/www/... I got the same error messages just different directories Being desperate to get this working I copied the error_log from a directory that was working ran fixfiles and got avc: denied { append } (13)Permission denied: httpd: could not open error log file /var/www/spokanewines.com/logs/error_log. Unable to open logs [root@webmail ~]# cd /var/www/spokanewines.com/logs/ [root@webmail logs]# ls -alZ drwxr-xr-x root root system_u:object_r:httpd_sys_content_t . drwxrwxrwx root root system_u:object_r:httpd_sys_content_t .. -rw-r--r-- root root system_u:object_r:httpd_sys_content_t access_log -rw-r--r-- root root system_u:object_r:httpd_sys_content_t error_log I tried to run system-config-securitylevel but there are no references to Boolean options for Apache HTTP just firewall options. Arthur Stephens Sales Technician Ptera Wireless Internet astephens(a)ptera.net 509-927-Ptera ----- Original Message ----- From: "Alexander Dalloz" <ad+lists(a)uni-x.org> To: "For users of Fedora Core releases" <fedora-list(a)redhat.com> Sent: Monday, November 29, 2004 11:25 AM Subject: Re: httpd avc denied problem > -- > fedora-list mailing list > fedora-list(a)redhat.com > To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list

5 16

lpoptions, printing from firefox. mozilla_macros.te?
by Tom London 02 Dec '04

02 Dec '04

Running strict/enforcing, latest Rawhide. Each time I boot, /etc/cups/lpoptions appears to be created with the 'wrong' type: cupsd_etc_t instead of cupsd_rw_etc_t. Printing from firefox produces the following avc's complaining about accessing /etc/cups/lpoptions in either case. Does mozilla_macros.te need: ifdef(`cups.te', ` allow $1_mozilla_t cupsd_etc_t:dir search; +allow user_mozilla_t cupsd_rw_etc_t:file read; ') I'm still working on figuring out why lpoptions is getting the wrong type..... tom Dec 2 07:27:56 fedora kernel: audit(1102001276.342:0): avc: denied { read } for pid=3363 exe=/usr/lib/firefox-1.0/firefox-bin name=lpoptions dev=hda2 ino=4474994 scontext=user_u:user_r:user_mozilla_t tcontext=system_u:object_r:cupsd_rw_etc_t tclass=file Dec 2 07:27:56 fedora kernel: audit(1102001276.695:0): avc: denied { read } for pid=3363 exe=/usr/lib/firefox-1.0/firefox-bin name=lpoptions dev=hda2 ino=4474994 scontext=user_u:user_r:user_mozilla_t tcontext=system_u:object_r:cupsd_rw_etc_t tclass=file Dec 2 07:28:00 fedora kernel: audit(1102001280.378:0): avc: denied { read } for pid=3363 exe=/usr/lib/firefox-1.0/firefox-bin name=lpoptions dev=hda2 ino=4474994 scontext=user_u:user_r:user_mozilla_t tcontext=system_u:object_r:cupsd_rw_etc_t tclass=file -- Tom London

1 0

firefox and /usr/tmp
by Tom London 02 Dec '04

02 Dec '04

Running strict/enforcing, latest Rawhide, selinux-policy-strict-1.19.8-4 Starting firefox produces: Dec 1 18:49:33 fedora kernel: audit(1101955773.849:0): avc: denied { read } for pid=4652 exe=/usr/lib/firefox-1.0/firefox-bin name=tmp dev=hda2 ino=4112455 scontext=user_u:user_r:user_mozilla_t tcontext=system_u:object_r:tmp_t tclass=lnk_file on attempted read of /usr/tmp (link to /var/tmp) Should there be a dontaudit user_mozilla_t tmp_t:lnk_file read; in mozilla_macros.te ? -- Tom London

3 3

use can_network_XXX() in inetd.te, ssh.te, rhgb.te, rpcd.te...?
by Tom London 01 Dec '04

01 Dec '04

Running strict/enforcing off of latest Rawhide Several problems after latest update, mostly like: Nov 30 20:14:43 fedora kernel: audit(1101874483.584:0): avc: denied { accept } for pid=3656 exe=/usr/sbin/sshd lport=22 scontext=root:system_r:sshd_t tcontext=root:system_r:sshd_t tclass=tcp_socket or Nov 30 19:17:04 fedora kernel: audit(1101871024.847:0): avc: denied { listen } for pid=2251 exe=/usr/sbin/xinetd lport=113 scontext=system_u:system_r:inetd_t tcontext=system_u:system_r:inetd_t tclass=tcp_socket Nov 30 19:17:04 fedora xinetd[2251]: service auth, accept: Permission denied (errno = 13) or Nov 30 19:16:51 fedora kernel: audit(1101871006.547:0): avc: denied { listen } for pid=1959 exe=/sbin/rpc.statd lport=32768 scontext=system_u:system_r:rpcd_t tcontext=system_u:system_r:rpcd_t tclass=tcp_socket or Nov 30 19:42:36 fedora kernel: audit(1101843722.414:0): avc: denied { connect } for pid=1198 exe=/usr/bin/rhgb scontext=system_u:system_r:rhgb_t tcontext=system_u:system_r:rhgb_t tclass=tcp_socket Nov 30 19:42:36 fedora kernel: audit(1101843722.421:0): avc: denied { connect } for pid=1198 exe=/usr/bin/rhgb scontext=system_u:system_r:rhgb_t tcontext=system_u:system_r:rhgb_t tclass=tcp_socket etc. I added something like 'allow XXX self:tcp_socket {listen accept}' or 'allow XXX self:tcp_socket {connect}' to get the daemons up and running, but shouldn't these guys use the can_network_tcp(), can_network_client(), or can_network_server()? Are patches needed, or is this in the works? tom -- Tom London

2 2

kernel fails to install
by Tom London 01 Dec '04

01 Dec '04

Running strict/enforcing off of Rawhide. Doing yesterday's updates, the kernel failed to install to /boot. That is, no files installed under /boot, but worked OK installing files to /lib/modules. I did an rpm -e, setenforce 0; rpm -ivh, and got the following: w Nov 30 19:36:32 fedora kernel: audit(1101872192.328:0): avc: denied { read } for pid=3647 exe=/bin/bash name=.bashrc dev=hda2 ino=1196086 scontext=root:sysadm_r:bootloader_t tcontext=root:object_r:staff_home_t tclass=file Nov 30 19:36:32 fedora kernel: audit(1101872192.328:0): avc: denied { getattr } for pid=3647 exe=/bin/bash path=/root/.bashrc dev=hda2 ino=1196086 scontext=root:sysadm_r:bootloader_t tcontext=root:object_r:staff_home_t tclass=file Nov 30 19:36:32 fedora kernel: audit(1101872192.337:0): avc: denied { read } for pid=3649 exe=/usr/bin/id name=config dev=hda2 ino=4509759 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:selinux_config_t tclass=file Nov 30 19:36:32 fedora kernel: audit(1101872192.338:0): avc: denied { getattr } for pid=3649 exe=/usr/bin/id path=/etc/selinux/config dev=hda2 ino=4509759 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:selinux_config_t tclass=file Nov 30 19:36:32 fedora kernel: audit(1101872192.501:0): avc: denied { execute } for pid=3647 exe=/bin/bash name=colorls.sh dev=hda2 ino=4474159 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:etc_t tclass=file Nov 30 19:36:32 fedora kernel: audit(1101872192.530:0): avc: denied { execute } for pid=3662 exe=/bin/bash name=consoletype dev=hda2 ino=2310212 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:consoletype_exec_t tclass=file Nov 30 19:36:32 fedora kernel: audit(1101872192.530:0): avc: denied { execute_no_trans } for pid=3662 exe=/bin/bash path=/sbin/consoletype dev=hda2 ino=2310212 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:consoletype_exec_t tclass=file Nov 30 19:36:32 fedora kernel: audit(1101872192.530:0): avc: denied { read } for pid=3662 exe=/bin/bash path=/sbin/consoletype dev=hda2 ino=2310212 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:consoletype_exec_t tclass=file allow bootloader_t consoletype_exec_t:file { execute execute_no_trans read }; allow bootloader_t etc_t:file execute; allow bootloader_t selinux_config_t:file { getattr read }; allow bootloader_t staff_home_t:file { getattr read }; -- Tom London

2 2

SELinux/httpd integration
by Joe Orton 01 Dec '04

01 Dec '04

I think one thing that would help would be making the sets of example httpd module configurations self-documentating w.r.t. SELinux for some of the modules. So for instance, how do I get Subversion/mod_dav_svn working with an SELinux-enabled httpd? Can we make it such that an SVN repos is as easy to set up as: # cd /src/svn # svnadmin create mystuff # vi /etc/httpd/conf.d/subversion.conf - uncomment the defaults? even with SELinux enabled? The commented default in subversion.conf here could be: <Location /repos> DAV svn SVNParentPath /srv/svn </Location> A more generic example would be if we provide a /srv/www directory or something to which the httpd domain is allowed read+write access by default; somewhere to put the PHP webapps. Does this make sense? joe

6 22

init labeling question for targeted policy
by Karsten Wade 01 Dec '04

01 Dec '04

My question about the targeted policy presumes that init re-execs itself after loading the policy, whereby it picks up the unconfined_t domain from the policy, as defined by a rule in /etc/selinux/targeted/src/policy/domains/unconfined.te. role system_r types unconfined_t; What rule tells init to re-exec itself in the targeted policy? Or is init doing something differently now? Here is how far I've gotten in figuring this out. In the strict policy there is an explicit transition rule for init. The file programs/misc/kernel.te has this rule: domain_auto_trans(kernel_t, init_exec_t, init_t) In the targeted policy, kernel.te is in domains/misc/unused, so is not called into play. Correct? The transition behavior certainly isn't used, i.e., init transitions to unconfined_t instead of init_t. Therefore, I'm looking for a default behavior that init falls back on since it doesn't have specific SELinux coverage. In macros/global_macros.te the macro domain_auto_trans(init_t, $1_exec_t, $1_t) is defined. However, I don't find that macro used, i.e., domain_auto_trans(init_t) or somesuch. In addition, I'm not even sure that init would be in the domain init_t to qualify for this macro since in targeted it's in unconfined_t. In define(`unconfined_domain', there is this rule: allow $1 self:process transition; That says that init is allowed to transition to itself, but it doesn't tell init to do the transition and seems otherwise unrelated. Which one of these paths, if any, is leading in the right direction? thx - Karsten -- Karsten Wade, RHCE, Tech Writer a lemon is just a melon in disguise http://people.redhat.com/kwade/ gpg fingerprint: 2680 DBFD D968 3141 0115 5F1B D992 0E06 AD0E 0C41

4 8

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2004