June 2004 - selinux - Fedora mailing-lists

Re: Turn on SELinux
by chris albert 11 Nov '04

11 Nov '04

On Sat, 2004-06-05 at 09:11, Khurt Williams wrote: >> I installed Fedora Core 2. I did not enable selinux at install. How >> do I now enable it? > >>This may help >>http://people.redhat.com/kwade/fedora-docs/selinux-faq-en/ But it doesn't. I filed a bugzilla request for having post-install-without-selinux selinux installation instructions added to the faq. I used S.Smalley's remark at the end of https://listman.redhat.com/archives/fedora-selinux-list/2004-May/msg00202.h… Chris

5 5

RE: Can not access files in own home directory
by David Balazic 01 Aug '04

01 Aug '04

> From: Russell Coker[SMTP:russell@coker.com.au] > > On Wed, 9 Jun 2004 17:42, David Balazic <david.balazic(a)hermes.si> wrote: > > Because I get a failure right 5 minutes after installation. > > > > I did a SELinux enabled install of FC2 ( Workstation type ). > > In firstboot I created a user. > > This is a known bug, when firstboot creates a user it doesn't give the > correct > type to the home directory files. Running setfiles is the correct thing > to > do. But you don't have to label the entire file system, just the home > directory for the new user. > setfiles requires some "policy" argument, what do I use ? Well, I just run "fixfiles relabel" ( not is runlevel 1, as suggested by Andrew Farris, but level 5, is that a problem ? ). Now login on VCx is OK, but login in X still does not work. Previously it reported that my home dir does not exist, but now after the "fix" , when I enter my username and password an blank blue screen with a mouse pointer ( pointer, not sandwatch ) appears and nothing happens. I waited 30 seconds and switched to VC1 to check out what is happening, but then the screen started to blink. It went black for ~5 seconds, then back to VC1 for a second , then black again and so on. Maybe the X server was restarting. Any clues ? David Balažic

5 4

restorecon vs. setfiles
by Gary Peck 13 Jul '04

13 Jul '04

For some reason restorecon and setfiles have different notions of what context certain files should be. For example: # ls -Z /usr/lib/libz.* -rwxr-xr-x+ root root system_u:object_r:lib_t /usr/lib/libz.a lrwxrwxrwx+ root root system_u:object_r:lib_t /usr/lib/libz.so -> libz.so.1.2.1.1 lrwxrwxrwx root root system_u:object_r:lib_t /usr/lib/libz.so.1 -> libz.so.1.2.1.1 -rwxr-xr-x root root system_u:object_r:shlib_t /usr/lib/libz.so.1.2.1.1 # restorecon -v /usr/lib/libz.* restorecon set context /usr/lib/libz.so->system_u:object_r:shlib_t restorecon set context /usr/lib/libz.so.1->system_u:object_r:shlib_t # setfiles -v /etc/security/selinux/file_contexts /usr/lib/libz.* setfiles: read 1450 specifications setfiles: labeling files under /usr/lib/libz.a setfiles: hash table stats: 1 elements, 1/65536 buckets used, longest chain length 1 setfiles: labeling files under /usr/lib/libz.so setfiles: relabeling /usr/lib/libz.so from system_u:object_r:shlib_t to system_u:object_r:lib_t setfiles: hash table stats: 1 elements, 1/65536 buckets used, longest chain length 1 setfiles: labeling files under /usr/lib/libz.so.1 setfiles: relabeling /usr/lib/libz.so.1 from system_u:object_r:shlib_t to system_u:object_r:lib_t setfiles: hash table stats: 1 elements, 1/65536 buckets used, longest chain length 1 setfiles: labeling files under /usr/lib/libz.so.1.2.1.1 setfiles: hash table stats: 1 elements, 1/65536 buckets used, longest chain length 1 setfiles: Done. So, restorecon thinks that *.so files should be shlib_t, whereas setfiles thinks they should be lib_t. Which one is right and why do they disagree? I thought that they both get their context info from the same place. This is with policy-1.11.3-5 and policycoreutils-1.11-4. gary

5 15

Mozilla accessing java engine yield denials
by Francis K Shim 12 Jul '04

12 Jul '04

Edited to show relevant details more clearly: denied { execute } exe=/bin/bash name=java scontext=user:staff_r:staff_mozilla_t tcontext=system_u:object_r:usr_t tclass=file denied { execute_no_trans } exe=/bin/bash path=/usr/java/j2re1.4.2_01/bin/java scontext=user:staff_r:staff_mozilla_t tcontext=system_u:object_r:usr_t tclass=file denied { search } exe=/usr/java/j2re1.4.2_01/bin/java name=vm scontext=user:staff_r:staff_mozilla_t tcontext=system_u:object_r:sysctl_vm_t tclass=dir -- Francis K Shim <francis.shim(a)sympatico.ca>

3 2

avc denied from postgresql
by Richard Hally 07 Jul '04

07 Jul '04

During bootup the postgresql server fails to start and produced the following avc denied message: Jun 15 05:09:12 new2 su(pam_unix)[2414]: session opened for user postgres by (uid=0) Jun 15 05:09:13 new2 kernel: audit(1087290553.569:0): avc: denied { write } for pid=2445 exe=/usr/bin/postgres name=data dev=hda2 ino=788097 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 15 05:09:14 new2 su(pam_unix)[2414]: session closed for user postgres Jun 15 05:09:15 new2 postgresql: Starting postgresql service: failed This is in enforcing mode with the strict policy selinux-policy-strict-1.13.4-5 Thanks for any help, Richard Hally

7 17

RFE: show change of enforcing state in log ?
by Tom London 07 Jul '04

07 Jul '04

How difficult would it be to add 'old state->new state' to the log on a change in the enforcing state? Currently, 'setenforce' appears to be logged as a toggle.... tom

2 1

kernel-2.6.7-1.439: 'new' AVCs at boot time
by Tom London 29 Jun '04

29 Jun '04

kernel-2.6.7-1.439 produces the AVCs shown below. Appears to be having some problem early on dealing with /proc (or /sys) ? (looks like inode#1121665 is the mount point /proc or /sys on /). This didn't happen with earlier kernels. It appears to cause no problems. tom -------------------------------------------------- Jun 29 07:04:05 vaio kernel: SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts Jun 29 07:04:05 vaio kernel: audit(1088492566.426:0): avc: denied { search } for pid=226 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:05 vaio kernel: audit(1088492566.462:0): avc: denied { search } for pid=231 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:05 vaio kernel: audit(1088492566.500:0): avc: denied { search } for pid=236 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.538:0): avc: denied { search } for pid=241 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.571:0): avc: denied { search } for pid=245 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.611:0): avc: denied { search } for pid=251 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.651:0): avc: denied { search } for pid=257 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.721:0): avc: denied { search } for pid=272 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.756:0): avc: denied { search } for pid=277 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.793:0): avc: denied { search } for pid=282 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.832:0): avc: denied { search } for pid=287 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.855:0): avc: denied { search } for pid=289 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.883:0): avc: denied { search } for pid=293 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.915:0): avc: denied { search } for pid=297 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.954:0): avc: denied { search } for pid=303 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492566.994:0): avc: denied { search } for pid=309 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492567.049:0): avc: denied { search } for pid=318 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492567.072:0): avc: denied { search } for pid=320 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492567.178:0): avc: denied { search } for pid=334 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: audit(1088492567.181:0): avc: denied { search } for pid=332 exe=/bin/bash name=proc dev=hda2 ino=1121665 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:file_t tclass=dir Jun 29 07:04:06 vaio kernel: SELinux: initialized (dev ramfs, type ramfs), uses genfs_contexts

3 2

Re: Has the boot param syntax/semantics changed?
by Tom London 29 Jun '04

29 Jun '04

Yeah, you don't want to set SELINUXTYPE to permissive. That appears to be the same as selecting the 'targeted' policy. (I guess, 'not strict'). (The comment in the config file says SELINUXTYPE can take one of two values, targeted or strict). To select permissive mode, you set SELINUX=permissive. For me, setting SELINUX to permissive is the same as booting with 'enforcing=0'. tom > ------------------------------------------------------------------------ > > * /From/: Bob Gustafson <bobgus rcn com> > > If POLICYTYPE is no longer used, then the file that contains that >deprecated param should be either overwritten during the 'yum update' >process, or a note or message should show up somewhere (visibly) during the >'yum update' process. > >If the user's config file is not changed, but the program changes in the >'yum update', then there is a problem (perhaps even a 'process bug'). > >Is there a 'permissive' value for SELINUXTYPE? > >Using the boot param 'enforcing=0' seems to be different than setting the >SELINUXTYPE=permissive for me. > >enforcing=0 was less permissive... > >BobG > >

3 5

additions to strict policy
by Richard Hally 29 Jun '04

29 Jun '04

Below (and as an attached file) are some policy allow rules to be added to the strict policy. These allow rules were developed by running the latest /devel tree using selinux-policy-strict-sources-1.13.10-3 and putting the resulting avc denied messages through audit2allow. Most are necessary to perform normal operations while in enforcing mode. Some of the rules marked "#from booting" may be candidates for dontaudit rules. Thanks for the help, Richard Hally #from " logrotate -f /etc/logrotate.conf" while root(sysadm_r) allow logrotate_t devpts_t:dir { search }; allow logrotate_t initrc_t:process { transition }; allow logrotate_t mysqld_log_t:file { execute }; allow logrotate_t mysqld_log_t:file { execute_no_trans }; allow logrotate_t privoxy_log_t:file { execute }; allow logrotate_t privoxy_log_t:file { execute_no_trans }; allow logrotate_t selinux_config_t:dir { search }; allow logrotate_t selinux_config_t:file { getattr read }; allow logrotate_t staff_home_dir_t:dir { read search }; allow logrotate_t var_t:file { getattr }; allow logrotate_t var_t:file { read }; # from booting allow lvm_t file_t:dir { getattr read }; allow mount_t ptmx_t:chr_file { read write }; allow mount_t rhgb_gph_t:fd { use }; allow mount_t rhgb_t:unix_stream_socket { read write }; allow rhgb_t staff_home_dir_t:dir { search }; # from booting allow udev_t dbusd_t:unix_stream_socket { connectto }; allow udev_t dbusd_var_run_t:dir { search }; allow udev_t dbusd_var_run_t:sock_file { write }; allow udev_t file_t:dir { search }; # from exe=/usr/bin/mDNSResponder during boot allow user_t dns_port_t:udp_socket { name_bind }; # from starting mozilla as staff_r allow staff_mozilla_t file_t:dir { getattr }; allow staff_mozilla_t staff_home_t:file { unlink }; allow staff_mozilla_t xdm_tmp_t:dir { search }; # from normal gnome session as staff_r allow staff_screensaver_t xdm_tmp_t:dir { search }; allow staff_screensaver_t xdm_tmp_t:sock_file { write }; allow staff_t file_t:dir { getattr }; allow staff_t staff_t:netlink_route_socket { create }; #from starting postgresql server during boot and using postgresql as user. allow initrc_su_t postgresql_db_t:dir { search }; allow user_t postgresql_db_t:dir { add_name getattr read remove_name search write }; allow user_t postgresql_db_t:file { create getattr read rename unlink write }; allow staff_t user_tmp_t:sock_file { write }; allow staff_t user_t:unix_stream_socket { connectto }; #from " logrotate -f /etc/logrotate.conf" while root(sysadm_r) allow logrotate_t devpts_t:dir { search }; allow logrotate_t initrc_t:process { transition }; allow logrotate_t mysqld_log_t:file { execute }; allow logrotate_t mysqld_log_t:file { execute_no_trans }; allow logrotate_t privoxy_log_t:file { execute }; allow logrotate_t privoxy_log_t:file { execute_no_trans }; allow logrotate_t selinux_config_t:dir { search }; allow logrotate_t selinux_config_t:file { getattr read }; allow logrotate_t staff_home_dir_t:dir { read search }; allow logrotate_t var_t:file { getattr }; allow logrotate_t var_t:file { read }; # from booting allow lvm_t file_t:dir { getattr read }; allow mount_t ptmx_t:chr_file { read write }; allow mount_t rhgb_gph_t:fd { use }; allow mount_t rhgb_t:unix_stream_socket { read write }; allow rhgb_t staff_home_dir_t:dir { search }; # from booting allow udev_t dbusd_t:unix_stream_socket { connectto }; allow udev_t dbusd_var_run_t:dir { search }; allow udev_t dbusd_var_run_t:sock_file { write }; allow udev_t file_t:dir { search }; # from exe=/usr/bin/mDNSResponder during boot allow user_t dns_port_t:udp_socket { name_bind }; # from starting mozilla as staff_r allow staff_mozilla_t file_t:dir { getattr }; allow staff_mozilla_t staff_home_t:file { unlink }; allow staff_mozilla_t xdm_tmp_t:dir { search }; # from normal gnome session as staff_r allow staff_screensaver_t xdm_tmp_t:dir { search }; allow staff_screensaver_t xdm_tmp_t:sock_file { write }; allow staff_t file_t:dir { getattr }; allow staff_t staff_t:netlink_route_socket { create }; #from starting postgresql server during boot and using postgresql as user. allow initrc_su_t postgresql_db_t:dir { search }; allow user_t postgresql_db_t:dir { add_name getattr read remove_name search write }; allow user_t postgresql_db_t:file { create getattr read rename unlink write }; allow staff_t user_tmp_t:sock_file { write }; allow staff_t user_t:unix_stream_socket { connectto };

1 0

Re: Has the boot param syntax/semantics changed?
by Tom London 29 Jun '04

29 Jun '04

> > ------------------------------------------------------------------------ > > * /From/: Bob Gustafson <bobgus rcn com> > > ------------------------------------------------------------------------ > [root hoho2 user1]# cat /etc/selinux/config > ># This file controls the state of SELinux on the system. ># SELINUX= can take one of these three values: ># enforcinfg - SELinux security policy is enforced. ># permissive - SELinux prints warnings instead of enforcing. ># disabled - No SELinux policy is loaded. >#SELINUX=disabled >SELINUX=enforcing >SELINUXTYPE=strict >POLICYTYPE=strict >[root hoho2 user1]# > >Then I changed the /etc/selinux/config to the version shown below and rebooted. > >I got far less messages, and I was even able to go to root when clicking on >gnome applications that required higher priority (with above config >contents, whatever I typed was not enough, gnome kept coming back for more) > >[root hoho2 user1]# cat /etc/selinux/config ># This file controls the state of SELinux on the system. ># SELINUX= can take one of these three values: ># enforcinfg - SELinux security policy is enforced. ># permissive - SELinux prints warnings instead of enforcing. ># disabled - No SELinux policy is loaded. >#SELINUX=disabled >SELINUX=enforcing >#SELINUXTYPE=strict >SELINUXTYPE=permissive >POLICYTYPE=strict >[root hoho2 user1]# > >My assumption has been that the boot parameters override the contents of >the /etc/selinux/config file, and that the boot param 'enforcing=0' will >make the selinux a permissive one. > >Have these assumptions changed? > > Well, the names have changed a bit ;) POLICYTYPE is no longer operative, so I think you have booted up in 'targeted' mode, not strict. 'enforcing=0' still works for me. Here is what you need for strict: # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcinfg - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=enforcing # SELINUXTYPE= can take one of these two values: # targeted - Only targeted network daemons are protected. # strict - Full SELinux protection. SELINUXTYPE=strict tom

2 1

Has the boot param syntax/semantics changed?
by Bob Gustafson 28 Jun '04

28 Jun '04

I have been using 'selinux=1 enforcing=0' with the thought that my system will work, but if things are not right, an avc message will appear in my log files. The /etc/selinux/config file had the contents [root@hoho2 user1]# cat /etc/selinux/config # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcinfg - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. #SELINUX=disabled SELINUX=enforcing SELINUXTYPE=strict POLICYTYPE=strict [root@hoho2 user1]# I was dutifully going to 'init 1' and doing 'fixfiles relabel' after every update of policy or selinux related software - and then rebooting. [I still got lots of avc messages] Then I changed the /etc/selinux/config to the version shown below and rebooted. I got far less messages, and I was even able to go to root when clicking on gnome applications that required higher priority (with above config contents, whatever I typed was not enough, gnome kept coming back for more) [root@hoho2 user1]# cat /etc/selinux/config # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcinfg - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. #SELINUX=disabled SELINUX=enforcing #SELINUXTYPE=strict SELINUXTYPE=permissive POLICYTYPE=strict [root@hoho2 user1]# My assumption has been that the boot parameters override the contents of the /etc/selinux/config file, and that the boot param 'enforcing=0' will make the selinux a permissive one. Have these assumptions changed?

1 0

How to properly upgrade policy
by Ivan Gyurdiev 28 Jun '04

28 Jun '04

What's the proper way to upgrade the selinux policy? yum and rpm leave me with .rpmnew files every single time. I assume I'm supposed to manually overwrite the old ones. Is that so? warning: /etc/selinux/strict/contexts/files/file_contexts created as / etc/selinux/strict/contexts/files/file_contexts.rpmnew selinux-policy-strict 39 % done warning: /etc/selinux/strict/policy/ policy.17 created as /etc/selinux/strict/policy/policy.17.rpmnew selinux-policy-strict 100 % done 30/144 warning: /etc/selinux/targeted/contexts/files/file_contexts created as / etc/selinux/targeted/contexts/files/file_contexts.rpmnew selinux-policy-targeted 100 % done 31/144 Do I need to run make relabel?

8 19

VMWare config issue (Newbie)
by Earl 28 Jun '04

28 Jun '04

All, I'm just learning so forgive the trivial nature of the question: FC2, Installed VMWare workstation 4.5x, unable to run configuration script, just "yum-ed" so I'm up to date, relableled, rebooted, still cannot run configuration script... [root@host root]# id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:sysadm_r:sysadm_t [root@host root]# /usr/bin/vmware-config.pl Can't open perl script "/usr/bin/vmware-config.pl": Permission denied [root@host root]# ls -Z /usr/bin/vmware-config.pl -r-xr-xr-x+ root root system_u:object_r:vmware_exec_t /usr/bin/vmware-config.pl Looks like a context problem to me but I am unsure what to change... my context, that of the script itself or modify context files and relabel? I have the docs, have been reading, but I have not been able to understand some of the genreal concepts. Any advice will be appreciated. Earl __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail

6 10

Re: selinux-policy-strict-1.13.9-1, difficulty.
by Tom London 27 Jun '04

27 Jun '04

Yup, selinux-policy-strict-1.13.10-1 works. Thanks! tom

1 0

Policy for webalizer
by Yuichi Nakamura 27 Jun '04

27 Jun '04

Hi. I found that webalizer does not work from cron on FedoraCore2. It seems that there is no policy for webalizer. I wrote policy for webalizer. I tested it from command line and cron. Please use. (1) copy webalizer policies to policy source dir. #cp webalizer.te /etc/security/selinux/src/policy/domains/program #cp webalizer.fc /etc/security/selinux/src/policy/file_contexts/program (2) append the following to /etc/security/selinux/src/policy/domains/program/apache.te . r_dir_file(httpd_t,webalizer_usage_t) (3) reload and relabel #cd /etc/security/selinux/src/policy/ #make reload #setfiles file_contexts/file_contexts /usr/bin /var /etc Thank you. --- Yuichi Nakamura Japan SELinux Users Group(JPSEG) http://www.selinux.gr.jp/

2 2

selinux-policy-strict-1.13.9-1, difficulty.
by Tom London 27 Jun '04

27 Jun '04

I updated to selinux-policy-strict-1.13.9-1 off of the development tree, and immediately had problems: 'su' no longer is accessible graphical login/X no longer works. I bugzilla'ed this (https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=126788) and attached a copy of the AVCs produced when rebooting with 'enforcing=0'. tom

5 7

typo in src/policy/file_contexts/types.fc ???
by Tom London 26 Jun '04

26 Jun '04

I'm not certain about this, but types.fc has an entry: /var/lib(64)?/nfs/rpc_pipes(/*)? <<none>> I don't have such a file/directory, but I do have one called /var/lib/nfs/rpc_pipefs. Should that entry be: /var/lib(64)?/nfs/rpc_pipefs(/*)? <<none>> tom

1 0

avc denied message from booting
by Richard Hally 26 Jun '04

26 Jun '04

Below is part of the syslog messages from booting in enforcing mode with the latest policy. Perhaps it will be useful. Richard Hally Jun 26 04:39:43 new2 rc: Starting readahead: succeeded Jun 26 04:39:44 new2 messagebus: messagebus startup succeeded Jun 26 04:39:45 new2 kernel: audit(1088239185.333:0): avc: denied { read write } for pid=2385 exe=/bin/umount path=/dev/ptmx dev=hda2 ino=1064807 scontext=system_u:system_r:mount_t tcontext=system_u:object_r:ptmx_t tclass=chr_file Jun 26 04:39:45 new2 udev[2511]: creating device node '/dev/vcs3'

1 0

Strict policy test, 1.13.7-1, denies: lvm.static, klogd, udev, httpd, xfs, xorg, dmesg
by Ivan Gyurdiev 26 Jun '04

26 Jun '04

Hi, these are the results of running strict policy selinux. Kernel: 2.6.7-1.448 Selinux-strict: 1.13.7-1 Filesystems: / is xfs, /tmp is tmpfs (is that a problem? xattrs?), /boot is ext3 I relabeled prior to running this test. I know there's a new version released today and I'll try that soon. I'm sorry if any of this are duplicates or have been fixed. ================================================================== audit2allow: allow dmesg_t staff_home_t:file { write }; allow dmesg_t user_home_t:file { write }; allow httpd_t bin_t:dir { getattr }; allow httpd_t httpd_log_t:file { write }; allow httpd_t sbin_t:dir { getattr }; allow httpd_t snmpd_var_lib_t:file { getattr write }; allow klogd_t boot_t:lnk_file { read }; allow lvm_t device_t:file { getattr }; allow lvm_t selinux_config_t:dir { search }; allow udev_t var_lock_t:dir { search }; allow xdm_xserver_t xdm_tmpfs_t:dir { getattr }; allow xfs_t tmpfs_t:dir { search }; ==================================================================== Denies summary - all of those occur during normal startup, and the dmesg ones are me trying to pipe dmesg to a log file in my home folder as root. LVM.STATIC 1) name = selinux tclass = dir denied { search } exe=lvm.static scontext = system_u:system_r:lvm_t tcontext = system_u:object_r:selinux_config_t 2) path = /dev/vcsa01 or /dev/vcsa05 tclass = file denied { getattr } exe=lvm.static scontext = system_u:system_r:lvm_t tcontext = system_u:object_r:device_t KLOGD 3) name = System.map tclass = lnk_file denied { read } exe=/sbin/klogd scontext = system_u:system_r:klog_t tcontext = system_u:object_r:boot_t UDEV 4) name = lock tclass = dir denied { search } exe=/bin/bash scontext = system_u:system_r:udev_t tcontext = system_u:object_r:var_lock_t HTTPD 5) name = /sbin or /usr/sbin tclass = dir denied { getattr } exe = /usr/sbin/httpd scontext = system_u:system_r:httpd_t tcontext = system_u:object_r:sbin_t 6) name = /bin or /usr/bin or /usr/X11R6/bin tclass = dir denied { getattr } exe = /usr/sbin/httpd scontext = system_u:system_r:httpd_t tcontext = system_u:object_r:bin_t 7) name = jk2.shm tclass = file denied { write } exe = /usr/sbin/httpd scontext = system_u:system_r:httpd_t tcontext = system_u:object_r:httpd_log_t 8) path = /usr/share/snmp/mibs/.index tclass = file denied { getattr } exe = /usr/sbin/httpd scontext = system_u:system_r:httpd_t tcontext = system_u:object_r:snmpd_var_lib_t name = .index tclass = file denied { write } exe = /usr/sbin/httpd scontext = system_u:system_r:httpd_t tcontext = system_u:object_r:snmpd_var_lib_t XFS 9) dev = tmpfs tclass = dir denied { search } exe = /usr/X11R6/bin/xfs scontext = system_u:system_r:xfs_t tcontext = system_u:object_r:tmpfs_t Xorg 10) dev = tmpfs path = /tmp/.X11-unix tclass = dir denied { getattr } exe = /usr/X11R6/bin/Xorg scontext = system_u:system_r:xdm_xserver_t tcontext = system_u:object_r:xdm_tmpfs_t Dmesg 11) path = /home/-username-/log tclass = file denied { write } exe = /bin/dmesg scontext = root:system_r:dmesg_t tcontext = root:object_r:user_home_t

1 2

Re: How to properly upgrade policy
by Tom London 25 Jun '04

25 Jun '04

These are VERY nice changes, automating what I've been doing manually. An observation: the package 'install' process has gotten much better with file contexts. Any thoughts on automating the assignment of file contexts to the files created by package scripts (e.g., /boot/grub/grub.conf, depmod files, /etc/selinux/config, ...)? Would be nice to have a 'SELinux package description' that describes the package's desired/default contexts. That would allow inspection prior to install, tools to check consistency with installed file_contexts, etc. 'rpm -q --filecontext' is almost it. Any way to add the other stuff to it, or something like it? tom [Sorry if this is old hat....] Dan Walsh wrote: > Setfiles and restorecon have a new qualifier (-o filename) which will > record the file paths of any files that the tools find with the > incorrect security context. So if you run setfiles -n -v -o > /tmp/badfilecontexts, you would have a report and a file with all the > paths of files with bad file contexts. If everything looks ok, you > could run restorecon -f /tmp/badfilecontexts and clean them up quickly.

2 1

Re: FC2 SELinux Installation issue (Newbie)
by Tom London 25 Jun '04

25 Jun '04

I believe you can boot in permissive mode (without editing the config file) by entering enforcing=0 as a boot parameter. So, this may be simpler.... 1. Boot with 'enforcing=0 single' to get to single-user mode/permissive. 2. 'fixfiles relabel' (or 'make relabel' if needed) 3. Reboot tom > ------------------------------------------------------------------------ > > * /From/: Valdis Kletnieks vt edu > > ------------------------------------------------------------------------ > >Probably a botched relabel. > >1) Boot with 'selinux=0' to disable it entirely. >2) Edit the selinux file and set to 'selinux=permissive'. >3) Reboot. >4) make relabel, then set 'selinux=enforcing' and reboot again. > >

1 0

/u?dev/microcode ?
by Tom London 25 Jun '04

25 Jun '04

A previous posting indicated that /u?dev/microcode should be labeled as system_u:object_r:cpu_device_t. Is this still needed? Added to file_contexts/types.fc? tom

3 3

lack of AVC denied messages
by Richard Hally 25 Jun '04

25 Jun '04

After recent updates Mozilla web browser will not start while in enforcing mode. The troubling thing is that it does not produce any avc denied messages. Further, after switching to permissive mode, starting Mozilla web browser, exiting, generating allow rules from the avc denied messages, incorporating them into the policy, doing a 'make reload' and trying Mozilla again in enforcing mode it still will not start and does not produce and avc denied messages. Considering that the recommended method for generating policy is to "debug it into existence" i.e. run things and look at the avc denied messages, this lack of avc denied message indicates there is something fundamentally wrong here and indicates a mode of failure we may not have considered before. Or is it just a bug? Thanks for any help, Richard Hally kernel 2.6.7.-1.448 selinux-policy-strict-sources-1.13.8-1 sysklogd-1.4.1-20

3 2

typo in new fixifiles
by Tom London 24 Jun '04

24 Jun '04

New fixfiles has lines like: if [ $1 != "" ]; then These produce shell errors. I think they could be: if [ x$1 != "x" ]; then or some such..... tom

2 1

mozilla not starting in enforcing mode
by Richard Hally 24 Jun '04

24 Jun '04

After the most recent update to the strict policy (selinux-policy-strict-1.13.7-1), Mozilla web browser will not start in enforcing mode. It does *not* produce *any* avc denied messages in enforcing mode. Below are the avc denied messages that are produced when it does start in permissive mode: Jun 20 20:31:30 new2 kernel: audit(1087777890.697:0): avc: denied { write } for pid=3471 exe=/usr/lib/mozilla-1.6/mozilla-xremote-client name=X0 dev=hda2 ino=1840568 scontext=richard:staff_r:staff_mozilla_t tcontext=system_u:object_r:xdm_tmp_t tclass=sock_file Jun 20 20:31:34 new2 kernel: audit(1087777894.263:0): avc: denied { unlink } for pid=3457 exe=/usr/lib/mozilla-1.6/mozilla-bin name=.fonts.cache-1 dev=hda2 ino=1091707 scontext=richard:staff_r:staff_mozilla_t tcontext=richard:object_r:staff_home_t tclass=file Here is part of the output from fixfiles relabel prior to testing this problem : /usr/sbin/setfiles: read 1499 specifications /usr/sbin/setfiles: labeling files under / /usr/sbin/setfiles: relabeling /home/richard/.fonts.cache-1 from richard:object_r:staff_mozilla_rw_t to richard:object_r:staff_home_t /usr/sbin/setfiles: relabeling /.autofsck from system_u:object_r:root_t to system_u:object_r:default_t /usr/sbin/setfiles: hash table stats: 374956 elements, 62564/65536 buckets used, longest chain length 15 HTH Richard Hally

5 6

policy problem with netlink sockets
by Richard Hally 23 Jun '04

23 Jun '04

Attached in the 'spew' file is the last 200 lines from doing a make reload of the latest strict policy (selinux-policy-strict-sources-1.13.7-1). Below are some of the avc denied messages generated immediately after the newly made policy was loaded. Does this need to be put into bugzilla? Richard Hally Jun 22 23:37:38 new2 kernel: audit(1087961858.402:0): avc: granted { load_policy } for pid=13433 exe=/usr/sbin/load_policy scontext=root:sysadm_r:load_policy_t tcontext=system_u:object_r:security_t tclass=security Jun 22 23:37:38 new2 kernel: security: 6 users, 7 roles, 1254 types, 1 bools Jun 22 23:37:38 new2 kernel: security: 51 classes, 340144 rules Jun 22 23:41:25 new2 kernel: audit(1087962085.540:0): avc: denied { create } for pid=3051 exe=/usr/bin/gnome-session scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=netlink_route_socket Jun 22 23:41:25 new2 kernel: audit(1087962085.540:0): avc: denied { bind } for pid=3051 exe=/usr/bin/gnome-session scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=netlink_route_socket Jun 22 23:41:25 new2 kernel: audit(1087962085.540:0): avc: denied { getattr } for pid=3051 exe=/usr/bin/gnome-session scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=netlink_route_socket Jun 22 23:41:25 new2 kernel: audit(1087962085.540:0): avc: denied { write } for pid=3051 exe=/usr/bin/gnome-session scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=netlink_route_socket Jun 22 23:41:25 new2 kernel: audit(1087962085.540:0): avc: denied { nlmsg_read } for pid=3051 exe=/usr/bin/gnome-session scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=netlink_route_socket Jun 22 23:41:25 new2 kernel: audit(1087962085.540:0): avc: denied { read } for pid=3051 exe=/usr/bin/gnome-session scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=netlink_route_socket : domains/program/firstboot.te:124:WARNING 'remapping class netlink_dnrt_socket to netlink_socket for policy version 17' at token ';' on line 107984: #line 124 allow firstboot_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux domains/program/hotplug.te:147:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 114418: #line 147 allow hotplug_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_s domains/program/hotplug.te:147:WARNING 'remapping class netlink_firewall_socket to netlink_socket for policy version 17' at token ';' on line 114418: #line 147 allow hotplug_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_s domains/program/hotplug.te:147:WARNING 'remapping class netlink_tcpdiag_socket to netlink_socket for policy version 17' at token ';' on line 114418: #line 147 allow hotplug_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_s domains/program/hotplug.te:147:WARNING 'remapping class netlink_nflog_socket to netlink_socket for policy version 17' at token ';' on line 114418: #line 147 allow hotplug_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_s domains/program/hotplug.te:147:WARNING 'remapping class netlink_xfrm_socket to netlink_socket for policy version 17' at token ';' on line 114418: #line 147 allow hotplug_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_s domains/program/hotplug.te:147:WARNING 'remapping class netlink_selinux_socket to netlink_socket for policy version 17' at token ';' on line 114418: #line 147 allow hotplug_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_s domains/program/hotplug.te:147:WARNING 'remapping class netlink_audit_socket to netlink_socket for policy version 17' at token ';' on line 114418: #line 147 allow hotplug_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_s domains/program/hotplug.te:147:WARNING 'remapping class netlink_ip6fw_socket to netlink_socket for policy version 17' at token ';' on line 114418: #line 147 allow hotplug_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_s domains/program/hotplug.te:147:WARNING 'remapping class netlink_dnrt_socket to netlink_socket for policy version 17' at token ';' on line 114418: #line 147 allow hotplug_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_s domains/program/ifconfig.te:27:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 116234: # for /sbin/ip allow ifconfig_t self:netlink_route_socket { bind create getattr nlmsg_read nlmsg_write read write }; domains/program/inetd.te:127:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 118626: #line 127 allow inetd_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_soc domains/program/inetd.te:127:WARNING 'remapping class netlink_firewall_socket to netlink_socket for policy version 17' at token ';' on line 118626: #line 127 allow inetd_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_soc domains/program/inetd.te:127:WARNING 'remapping class netlink_tcpdiag_socket to netlink_socket for policy version 17' at token ';' on line 118626: #line 127 allow inetd_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_soc domains/program/inetd.te:127:WARNING 'remapping class netlink_nflog_socket to netlink_socket for policy version 17' at token ';' on line 118626: #line 127 allow inetd_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_soc domains/program/inetd.te:127:WARNING 'remapping class netlink_xfrm_socket to netlink_socket for policy version 17' at token ';' on line 118626: #line 127 allow inetd_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_soc domains/program/inetd.te:127:WARNING 'remapping class netlink_selinux_socket to netlink_socket for policy version 17' at token ';' on line 118626: #line 127 allow inetd_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_soc domains/program/inetd.te:127:WARNING 'remapping class netlink_audit_socket to netlink_socket for policy version 17' at token ';' on line 118626: #line 127 allow inetd_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_soc domains/program/inetd.te:127:WARNING 'remapping class netlink_ip6fw_socket to netlink_socket for policy version 17' at token ';' on line 118626: #line 127 allow inetd_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_soc domains/program/inetd.te:127:WARNING 'remapping class netlink_dnrt_socket to netlink_socket for policy version 17' at token ';' on line 118626: #line 127 allow inetd_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_soc domains/program/initrc.te:312:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 120997: allow initrc_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 312 domains/program/initrc.te:312:WARNING 'remapping class netlink_firewall_socket to netlink_socket for policy version 17' at token ';' on line 120997: allow initrc_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 312 domains/program/initrc.te:312:WARNING 'remapping class netlink_tcpdiag_socket to netlink_socket for policy version 17' at token ';' on line 120997: allow initrc_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 312 domains/program/initrc.te:312:WARNING 'remapping class netlink_nflog_socket to netlink_socket for policy version 17' at token ';' on line 120997: allow initrc_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 312 domains/program/initrc.te:312:WARNING 'remapping class netlink_xfrm_socket to netlink_socket for policy version 17' at token ';' on line 120997: allow initrc_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 312 domains/program/initrc.te:312:WARNING 'remapping class netlink_selinux_socket to netlink_socket for policy version 17' at token ';' on line 120997: allow initrc_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 312 domains/program/initrc.te:312:WARNING 'remapping class netlink_audit_socket to netlink_socket for policy version 17' at token ';' on line 120997: allow initrc_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 312 domains/program/initrc.te:312:WARNING 'remapping class netlink_ip6fw_socket to netlink_socket for policy version 17' at token ';' on line 120997: allow initrc_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 312 domains/program/initrc.te:312:WARNING 'remapping class netlink_dnrt_socket to netlink_socket for policy version 17' at token ';' on line 120997: allow initrc_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 312 domains/program/modutil.te:79:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 136851: allow insmod_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 79 domains/program/modutil.te:79:WARNING 'remapping class netlink_firewall_socket to netlink_socket for policy version 17' at token ';' on line 136851: allow insmod_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 79 domains/program/modutil.te:79:WARNING 'remapping class netlink_tcpdiag_socket to netlink_socket for policy version 17' at token ';' on line 136851: allow insmod_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 79 domains/program/modutil.te:79:WARNING 'remapping class netlink_nflog_socket to netlink_socket for policy version 17' at token ';' on line 136851: allow insmod_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 79 domains/program/modutil.te:79:WARNING 'remapping class netlink_xfrm_socket to netlink_socket for policy version 17' at token ';' on line 136851: allow insmod_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 79 domains/program/modutil.te:79:WARNING 'remapping class netlink_selinux_socket to netlink_socket for policy version 17' at token ';' on line 136851: allow insmod_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 79 domains/program/modutil.te:79:WARNING 'remapping class netlink_audit_socket to netlink_socket for policy version 17' at token ';' on line 136851: allow insmod_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 79 domains/program/modutil.te:79:WARNING 'remapping class netlink_ip6fw_socket to netlink_socket for policy version 17' at token ';' on line 136851: allow insmod_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 79 domains/program/modutil.te:79:WARNING 'remapping class netlink_dnrt_socket to netlink_socket for policy version 17' at token ';' on line 136851: allow insmod_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_so #line 79 domains/program/named.te:136:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 143917: allow ndc_t self:netlink_route_socket { bind create getattr nlmsg_read read write }; domains/program/netutils.te:34:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 145163: allow netutils_t self:netlink_route_socket { bind create getattr nlmsg_read nlmsg_write read write }; # Create and use netlink sockets. domains/program/rpm.te:239:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 175440: #line 239 allow rpm_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socke domains/program/rpm.te:239:WARNING 'remapping class netlink_firewall_socket to netlink_socket for policy version 17' at token ';' on line 175440: #line 239 allow rpm_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socke domains/program/rpm.te:239:WARNING 'remapping class netlink_tcpdiag_socket to netlink_socket for policy version 17' at token ';' on line 175440: #line 239 allow rpm_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socke domains/program/rpm.te:239:WARNING 'remapping class netlink_nflog_socket to netlink_socket for policy version 17' at token ';' on line 175440: #line 239 allow rpm_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socke domains/program/rpm.te:239:WARNING 'remapping class netlink_xfrm_socket to netlink_socket for policy version 17' at token ';' on line 175440: #line 239 allow rpm_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socke domains/program/rpm.te:239:WARNING 'remapping class netlink_selinux_socket to netlink_socket for policy version 17' at token ';' on line 175440: #line 239 allow rpm_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socke domains/program/rpm.te:239:WARNING 'remapping class netlink_audit_socket to netlink_socket for policy version 17' at token ';' on line 175440: #line 239 allow rpm_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socke domains/program/rpm.te:239:WARNING 'remapping class netlink_ip6fw_socket to netlink_socket for policy version 17' at token ';' on line 175440: #line 239 allow rpm_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socke domains/program/rpm.te:239:WARNING 'remapping class netlink_dnrt_socket to netlink_socket for policy version 17' at token ';' on line 175440: #line 239 allow rpm_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socke domains/program/rpm.te:239:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 175576: #line 239 allow rpm_script_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu domains/program/rpm.te:239:WARNING 'remapping class netlink_firewall_socket to netlink_socket for policy version 17' at token ';' on line 175576: #line 239 allow rpm_script_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu domains/program/rpm.te:239:WARNING 'remapping class netlink_tcpdiag_socket to netlink_socket for policy version 17' at token ';' on line 175576: #line 239 allow rpm_script_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu domains/program/rpm.te:239:WARNING 'remapping class netlink_nflog_socket to netlink_socket for policy version 17' at token ';' on line 175576: #line 239 allow rpm_script_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu domains/program/rpm.te:239:WARNING 'remapping class netlink_xfrm_socket to netlink_socket for policy version 17' at token ';' on line 175576: #line 239 allow rpm_script_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu domains/program/rpm.te:239:WARNING 'remapping class netlink_selinux_socket to netlink_socket for policy version 17' at token ';' on line 175576: #line 239 allow rpm_script_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu domains/program/rpm.te:239:WARNING 'remapping class netlink_audit_socket to netlink_socket for policy version 17' at token ';' on line 175576: #line 239 allow rpm_script_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu domains/program/rpm.te:239:WARNING 'remapping class netlink_ip6fw_socket to netlink_socket for policy version 17' at token ';' on line 175576: #line 239 allow rpm_script_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu domains/program/rpm.te:239:WARNING 'remapping class netlink_dnrt_socket to netlink_socket for policy version 17' at token ';' on line 175576: #line 239 allow rpm_script_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu domains/program/snort.te:18:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 183684: # use iptable netlink allow snort_t self:netlink_route_socket { bind create getattr nlmsg_read read write }; domains/program/snort.te:19:WARNING 'remapping class netlink_firewall_socket to netlink_socket for policy version 17' at token ';' on line 183685: allow snort_t self:netlink_firewall_socket { bind create getattr nlmsg_read read write }; allow snort_t self:netlink_route_socket { bind create getattr nlmsg_read read write }; domains/program/traceroute.te:33:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 194591: allow traceroute_t self:netlink_route_socket { bind create getattr nlmsg_read read write }; allow traceroute_t self:rawip_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown }; domains/program/unconfined.te:15:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 197331: allow unconfined_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu #line 15 domains/program/unconfined.te:15:WARNING 'remapping class netlink_firewall_socket to netlink_socket for policy version 17' at token ';' on line 197331: allow unconfined_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu #line 15 domains/program/unconfined.te:15:WARNING 'remapping class netlink_tcpdiag_socket to netlink_socket for policy version 17' at token ';' on line 197331: allow unconfined_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu #line 15 domains/program/unconfined.te:15:WARNING 'remapping class netlink_nflog_socket to netlink_socket for policy version 17' at token ';' on line 197331: allow unconfined_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu #line 15 domains/program/unconfined.te:15:WARNING 'remapping class netlink_xfrm_socket to netlink_socket for policy version 17' at token ';' on line 197331: allow unconfined_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu #line 15 domains/program/unconfined.te:15:WARNING 'remapping class netlink_selinux_socket to netlink_socket for policy version 17' at token ';' on line 197331: allow unconfined_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu #line 15 domains/program/unconfined.te:15:WARNING 'remapping class netlink_audit_socket to netlink_socket for policy version 17' at token ';' on line 197331: allow unconfined_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu #line 15 domains/program/unconfined.te:15:WARNING 'remapping class netlink_ip6fw_socket to netlink_socket for policy version 17' at token ';' on line 197331: allow unconfined_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu #line 15 domains/program/unconfined.te:15:WARNING 'remapping class netlink_dnrt_socket to netlink_socket for policy version 17' at token ';' on line 197331: allow unconfined_t domain:{ { tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinu #line 15 domains/program/vmware.te:91:WARNING 'remapping class netlink_route_socket to netlink_socket for policy version 17' at token ';' on line 202339: allow kernel_t self:netlink_route_socket { bind create getattr nlmsg_read nlmsg_write read write }; allow kernel_t self:capability { net_admin }; security: 6 users, 7 roles, 1254 types, 1 bools security: 51 classes, 309579 rules /usr/bin/checkpolicy: policy configuration loaded /usr/bin/checkpolicy: writing binary representation (version 17) to /etc/selinux/strict/policy/policy.17 Building file_contexts ... install -m 644 file_contexts/file_contexts /etc/selinux/strict/contexts/files/file_contexts /usr/sbin/load_policy /etc/selinux/strict/policy/policy.`cat /selinux/policyvers` touch tmp/load [root@new2 policy]#

2 1

Re: FC2 Startup Errors
by Ed Warner 22 Jun '04

22 Jun '04

Message: 10 Date: Tue, 22 Jun 2004 09:07:12 -0400 From: Stephen Smalley <sds(a)epoch.ncsc.mil> Subject: Re: FC2 Startup Errors To: "Fedora SELinux support list for users & developers." <fedora-selinux-list(a)redhat.com> Message-ID: <1087909632.6237.26.camel(a)moss-spartans.epoch.ncsc.mil> Content-Type: text/plain On Tue, 2004-06-22 at 08:54, edwarner99(a)yahoo.com wrote: > I am getting these errors when I reboot FC2. > I don't know what they mean. I have more, but this is > the jist of the errors. > > I can log in as a user, but I have root privileges. > > audit(1087859536.934:0): avc: denied { getattr } for > pid=1 exe=/sbin/init path=/dev/initctl dev=hda2 > ino=73143 scontext=system_u:system_r:kernel_t > tcontext=system_u:object_r:file_t tclass=fifo_file <snip> <snip> Do you want SELinux to be enabled? If so, then run fixfiles relabel to label your filesystems. If not, then edit /etc/sysconfig/selinux accordingly to disable it. I don't have a /etc/sysconfig/selinux, but I do have a /etc/security/selinux What do I have to do to disable? I placed selinux=0 in grub.conf on the kernel line. That seemed to kill everything. Was this the right way? __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - 100MB free storage! http://promotions.yahoo.com/new_mail

1 0

Strange AVC from privoxy write
by Tom London 22 Jun '04

22 Jun '04

Running the latest packages from the development tree. I configured mozilla to connect to privoxy (through the usual port 8118). All works OK until I try to 'add a URL pattern' to one of privoxy's config files through the browser. I get the following AVC (notice the blank space/empty fields): Jun 21 14:20:30 dell kernel: audit(1087852830.344:0): avc: denied { write } for pid=13411 exe=/usr/sbin/privoxy and a privoxy err page reporting the write error. Retrying after 'setenforce 0' produces the same AVC (but the 'write' succeeds). Haven't seen an AVC like this before..... is this the expected behavior? tom

3 6

Re: FC2 Startup Errors
by Ed Warner 22 Jun '04

22 Jun '04

> Message: 10 > Date: Tue, 22 Jun 2004 09:07:12 -0400 > From: Stephen Smalley <sds(a)epoch.ncsc.mil> > Subject: Re: FC2 Startup Errors > To: "Fedora SELinux support list for users & > developers." > <fedora-selinux-list(a)redhat.com> > Message-ID: > <1087909632.6237.26.camel(a)moss-spartans.epoch.ncsc.mil> > Content-Type: text/plain > > On Tue, 2004-06-22 at 08:54, edwarner99(a)yahoo.com > wrote: > > I am getting these errors when I reboot FC2. > > I don't know what they mean. I have more, but this > is > > the jist of the errors. > > > > I can log in as a user, but I have root > privileges. > > > > audit(1087859536.934:0): avc: denied { getattr } > for > > pid=1 exe=/sbin/init path=/dev/initctl dev=hda2 > > ino=73143 scontext=system_u:system_r:kernel_t > > tcontext=system_u:object_r:file_t tclass=fifo_file > <snip> > > The audit message indicates that you are running > with SELinux enabled, > but have not labeled your filesystem. I'm not sure > what you mean by > your statement about root privileges. Do you want > SELinux to be > enabled? If so, then run fixfiles relabel to label > your filesystems. > If not, then edit /etc/sysconfig/selinux accordingly > to disable it. > > -- > Stephen Smalley <sds(a)epoch.ncsc.mil> > National Security Agency After I rebooted, I can run as a user with root privileges. In the logs, it states there is an unknown user -u. I'm a little confused about selinux to begin with. I have read the documents. I run a small lan, so do you suggest I turn off selinux? Thanks, __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - Send 10MB messages! http://promotions.yahoo.com/new_mail

3 2

FC2 Startup Errors
by Ed Warner 22 Jun '04

22 Jun '04

I am getting these errors when I reboot FC2. I don't know what they mean. I have more, but this is the jist of the errors. I can log in as a user, but I have root privileges. audit(1087859536.934:0): avc: denied { getattr } for pid=1 exe=/sbin/init path=/dev/initctl dev=hda2 ino=73143 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:file_t tclass=fifo_file audit(1087859536.934:0): avc: denied { read write } for pid=1 exe=/sbin/init name=initctl dev=hda2 ino=73143 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:file_t tclass=fifo_file audit(1087859538.846:0): avc: denied { getattr } for pid=278 exe=/sbin/initlog path=/dev/log dev=hda2 ino=65553 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:file_t tclass=sock_file audit(1087859538.846:0): avc: denied { write } for pid=278 exe=/sbin/initlog name=log dev=hda2 ino=65553 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:file_t tclass=sock_file audit(1087859538.925:0): avc: denied { syslog_console } for pid=446 exe=/bin/dmesg scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system audit(1087859539.090:0): avc: denied { search } for pid=450 exe=/sbin/sysctl name=net dev= ino=-268435354 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_net_t tclass=dir audit(1087859539.090:0): avc: denied { write } for pid=450 exe=/sbin/sysctl name=ip_forward dev= ino=-268435331 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_net_t tclass=file audit(1087859539.090:0): avc: denied { getattr } for pid=450 exe=/sbin/sysctl path=/proc/sys/net/ipv4/ip_forward dev= ino=-268435331 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_net_t tclass=file audit(1087859539.092:0): avc: denied { search } for pid=450 exe=/sbin/sysctl name=unix dev= ino=-268435042 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_net_unix_t tclass=dir audit(1087859539.093:0): avc: denied { write } for pid=450 exe=/sbin/sysctl name=max_dgram_qlen dev= ino=-268435041 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_net_unix_t tclass=file audit(1087859539.093:0): avc: denied { getattr } for pid=450 exe=/sbin/sysctl path=/proc/sys/net/unix/max_dgram_qlen dev= ino=-268435041 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_net_unix_t tclass=file audit(1087859539.093:0): avc: denied { search } for pid=450 exe=/sbin/sysctl name=vm dev= ino=-268435370 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_vm_t tclass=dir audit(1087859539.093:0): avc: denied { write } for pid=450 exe=/sbin/sysctl name=overcommit_memory dev= ino=-268435369 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_vm_t tclass=file audit(1087859539.093:0): avc: denied { getattr } for pid=450 exe=/sbin/sysctl path=/proc/sys/vm/overcommit_memory dev= ino=-268435369 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_vm_t tclass=file audit(1087859539.093:0): avc: denied { search } for pid=450 exe=/sbin/sysctl name=dev dev= ino=-268435240 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_dev_t tclass=dir audit(1087859539.094:0): avc: denied { write } for pid=450 exe=/sbin/sysctl name=speed_limit_min dev= ino=-268435120 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_dev_t tclass=file audit(1087859539.094:0): avc: denied { getattr } for pid=450 exe=/sbin/sysctl path=/proc/sys/dev/raid/speed_limit_min dev= ino=-268435120 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:sysctl_dev_t tclass=file __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - Send 10MB messages! http://promotions.yahoo.com/new_mail

2 1

Re: yum install policy-sources
by Tom London 21 Jun '04

21 Jun '04

Yeah, its not called that anymore if you are downloading from the development tree. You want 'selinux-policy-strict-sources' or 'selinux-policy-targeted-sources'. tom * /From/: Alexis Wagner <alexis wagner polymtl ca> * /To/: "Fedora SELinux support list for users & developers." <fedora-selinux-list redhat com> * /Subject/: yum install policy-sources * /Date/: Mon, 21 Jun 2004 14:19:45 -0400 ------------------------------------------------------------------------ Hi, I am trying to install policy-sources with yum and I get the following "error" : # yum install policy-sources Gathering header information file(s) from server(s) Server: SELinux repository Server: Fedora Core 2 - Development Tree Finding updated packages Downloading needed headers Cannot find a package matching policy-sources No actions to take I am using this server for SELinux repository in yum.conf : ftp://people.redhat.com/dwalsh/SELinux/Fedora Is there another way to install the latest policy-sources ? Thank you, Alexis Wagner

2 1

yum install policy-sources
by Alexis Wagner 21 Jun '04

21 Jun '04

Hi, I am trying to install policy-sources with yum and I get the following "error" : # yum install policy-sources Gathering header information file(s) from server(s) Server: SELinux repository Server: Fedora Core 2 - Development Tree Finding updated packages Downloading needed headers Cannot find a package matching policy-sources No actions to take I am using this server for SELinux repository in yum.conf : ftp://people.redhat.com/dwalsh/SELinux/Fedora Is there another way to install the latest policy-sources ? Thank you, Alexis Wagner

1 0

update report....(>1000 updates and still ticking!)
by Tom London 21 Jun '04

21 Jun '04

I just completed 'eating' over 1000 updates from the development tree on my 'bleeding edge' SELinux/strict/enforcing system. Updates included new SELinux packages, new kernel, new gnome/kde, ... just about new everything. I detected NO significant SELinux installation issues!!!! This is quite impressive (I'm sure it is the result of much hard work). No packages failed to install, and I as far a I could detect, most packages are labeling correctly. In particular, the dev/MAKEDEV packages appear fixed (no problems in /dev or /udev), the kernel goes in smoothly (/lib/modules/{build,kernel} labeled properly), etc. etc. etc. So far, I've detected only 3 'nits': the mozilla socket issue referred in http://www.redhat.com/archives/fedora-selinux-list/2004-June/msg00235.html, a labeling issue for the mozilla plugin for users of j2sdk, and 'gaim' no longer working properly (fails both in enforcing and permissive mode, so I suspect its not SELinux related). Credit (and a tip of the hat) to the team! tom

1 0

slow to internet response
by david smethurst 21 Jun '04

21 Jun '04

hi all having a problem with the response time in core2 this machine is dual boot and the response time is not the same in the other os, therefore it must be in the se side of the linux as it wasnt there before i installed core2 i did a fresh install what happens is that there is at least a five to ten second gap between the actual response on the router when any html site is selected once it has found that site, ie web mail it changes the pages to the respective request at normal speed changes but that lag is on all new page requests and other core1, windows machines on the same network dont have it i am the only one so far to be using core2 please if you reply you will have to be very informative as to where to find the things that you ask me to forward to you as i am very new to linux, but happily learning everyday thanks david

3 2

mounting ntfs volume
by david smethurst 21 Jun '04

21 Jun '04

hi all what commands do i need to put into, i think fstab to mount a ntfs volume and have read rights at user? umask=0222 doesnt give it to me thanks david

1 0

support for gigabit architecture
by Rajiv 21 Jun '04

21 Jun '04

Dear All, Does fedora kernel support gigabit architecture. I would like to implement a 128-node clustering that is driven by 10-Gigabit switch. Kindly give your suggestions on what swich, and what network card to use in the market. Regards, Rajiv

2 1

Lawrence Bowie <thesource@ldb-jab.org>
by Russell Coker 20 Jun '04

20 Jun '04

<thesource(a)ldb-jab.org>: host mail.ldb-jab.org[216.55.187.221] said: 550 5.0.0 <russell(a)coker.com.au>... We don't accept mail from spammers and freaks (in reply to MAIL FROM command) Lawrence, there's probably not much point in asking questions on this list if you are going to refuse mail from the main people who are involved in working on SE Linux in Fedora. Could someone please forward this message to Lawrence in case he doesn't accept mail from me which comes from the list server. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

2 1

C2 or B1
by Lawrence Bowie 20 Jun '04

20 Jun '04

At this point SELinux does not have official "Orange Book" classification, right? Thanks, LDB

2 1

Re: Where should an RPM install .te/.fc files?
by Jeff Johnson 19 Jun '04

19 Jun '04

Russell Coker wrote: >---------- Forwarded Message ---------- > >Subject: Re: Where should an RPM install .te/.fc files? >Date: Thu, 17 Jun 2004 02:48 >From: "mike(a)flyn.org" <mike(a)flyn.org> >To: fedora-selinux-list(a)redhat.com > > > >>>I maintain an RPM that installs .te and .fc files. In the past, >>>contributing to the system's SELinux policy could be done by installing >>>files in /etc/security/selinux/src/policy (I'm not sure this is right >>>to begin with): >>> >>>%policy >>>%{_sysconfdir}/security/selinux/src/policy/macros/pam_mount_macros.te >>> >>> As noted, the path for installing *.fc and *.te files has changed. Also, the %policy marker to include an absolute path in both the metadata header as well as as a file in the payload is not necessary. The original goal was to have rpm attempt "make reload" as well as setting file contexts, but there are too many unsolved problems trying to install policy piece wise to attempt. >>>However, now policies may be in /etc/selinux/strict/src/policy/ or / >>>etc/selinux/targeted/src/policy/. It is also possible that only one of >>>these directories exists. >>> rpm will create directories in order to install files, so you need not worry about whether the directores exist. That is pure mechanism however, the comments below apply to the intent, rather than the mechanics, of installing *.te and *.fc files. >>> >>> >>I don't think that your macros file fits in with the targetted policy, and >>I think that the general aims of the targetted policy don't involve that >>sort of thing (but this hasn't been considered much so far). >> >>It's probably best to install the files under only the strict directory. >> >>It is also possible that only one of those directories exists. >> >> > >Installing exclusively under the strict policy make sense. The things I am >explicitly allowing should probably already be allowed by the targeted >policy. However, what about the case where a user does not have the strict >policy installed? In this case my RPM will install its policy files to an >otherwise empty policy source tree. This may result in directories like >/etc/selinux/strict being orphans -- not owned by any RPM. Should this be >avoided somehow? > > Even if rpm creates "orphan" directories on the path needed for installing a file, the file context will still be set according to the currently configured regexes. That still isn't quite correct behavior, as "orphan" directories under not under rpm control, so any tools based on paths from an rpmdb will fail to change the "orphan" directory paths. The best way (imho) to add 3rd party *.te and *.fc files to either the targeted or strict trees and avoid "orphan" directories is to add a file dependency on the parent directory. E.g., add Requires: /etc/selinux/targeted/src/pollicy if installing a file into that directory. That will avoid any "orphan" directory problems by forcing the package that owns the directory to be installed first. Note that any dependency on the package that "owns" the directory is sufficient, use a package rather than a file dependency if you wish. There is still the problem of how and when "make reload" is to be done for the tree when there are aadditional *.te and *.fc files being added. Probably the best answer for right now is to attempt the same operation in %post that is attempted by the selinux-policy-{targeted,strict} package itself. There is the erasure reload case that needs to be handled in %postun as well. Make sure you disambiguate erasure from upgrade by testing $1 in the %postun script. Here's what ypbind does, every package with a %preun and/or %postun has examples: if [ "$1" -ge 1 ]; then /sbin/service ypbind condrestart > /dev/null 2>&1 fi exit 0 The $1 argument is the number of instances of the pkg that will be installed after the script is run, $1 == 0 is the pure erasure case, >= 1 is the package upgrade case. 73 de Jeff

1 0

xauth changes XAUTHORITY in su (was Re: up2date/seaudit/... not working (EXPLAINED))
by Tom London 18 Jun '04

18 Jun '04

Nalin, Stephen Smalley's fix (move line in /etc/pam.d/su) fixed much of the problem, but running 'xauth' in another window still changes the setting of XAUTHORITY in the root shell that su spawns.... So, without xauth running, XAUTHORITY gets set to /root/.xauthABCD; with xauth running, XAUTHORITY is unmodified (i.e., its value is /home/USER/.Xauthority). tom [I didn't report that prior to the fix, 'su' was taking 20 seconds to complete after entering the correct password. This delay is now gone.] ------------------------------------------------------------------------ * /From/: Nalin Dahyabhai <nalin redhat com> * /To/: fedora-selinux-list redhat com * /Subject/: Re: up2date/seaudit/... not working (EXPLAINED) * /Date/: Fri, 18 Jun 2004 16:28:15 -0400 ------------------------------------------------------------------------ On Fri, Jun 18, 2004 at 12:00:44PM -0700, Tom London wrote: > Running off of the development tree, I couldn't get graphical apps (like > up2date, seaudit, ...) working when su'ed as root. All of this works > fine on a 'stock FC2' machine (running off > of the base and released-updates trees). > > The problem seems to be that the latest packages cause 'su' to change > the settings of XAUTHORITY environment variable from > 'XAUTHORITY=/home/USER/.Xauthority' to > 'XAUTHORITY=/root/.xauthABCD' (ABCD the usual 'uniqueness' stuff). > > If you manually reset XAUTHORITY back to '/home/USER/.Xauthority', the > apps work > again. > > Here's a bit of added strangeness: if you start 'xauth' in another user > window and then > try 'su -l', XAUTHORITY is not changed in the root shell. No AVCs against > /root/.authABCD either.... > > [On the 'stock FC2' machine, XAUTHORITY is not modified by su.] > > I've bugzilla'ed this > (https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=126300) > against coreutils, but I'm not sure that is the right place (e.g., > pam?). (All my systems > run with SELinux enabled, so I can only assume this is occurring on > SELinux-disabled > systems as well.) > > Can someone explain why 'su' would be changing XAUTHORITY ? The pam_xauth module reads the cookie for the current display for the invoking user and creates a temporary cookie file containing just that cookie for the target user. While this isn't always necessary, if the invoking user's $XAUTHORITY is in an NFS-mounted directory coming from a server which uses root-squashing (and $XAUTHORITY is usually set to ~/.Xauthority, so it happens), it becomes necessary because $XAUTHORITY would otherwise be inaccessible. If for some reason pam_xauth isn't able to do what it attempts to do, it leaves the XAUTHORITY environment variable unchanged, so the behavior you were seeing before was probably a bug of some kind. I'm not sure how running another copy of 'xauth' would affect this, really. xauth locks files when it opens them, but that should cause 'su' to just sit there until the copy of xauth which it started fails, and you didn't mention any such delay. Nalin

1 0

Re: up2date/seaudit/... not working (EXPLAINED)
by Tom London 18 Jun '04

18 Jun '04

That fixed it!!!!! 'su' no longer takes 20 seconds to complete! The root shell still has XAUTHORITY set to /root/.xauthABCD, but commands (like seaudit, up2date) now work. Thanks for the speedy response! tom ------------------------------------------------------------------------ * /From/: Stephen Smalley <sds epoch ncsc mil> * /To/: "Fedora SELinux support list for users & developers." <fedora-selinux-list redhat com> * /Cc/: Russell Coker <russell coker com au>, Daniel J Walsh <dwalsh redhat com> * /Subject/: Re: up2date/seaudit/... not working (EXPLAINED) * /Date/: Fri, 18 Jun 2004 16:24:18 -0400 ------------------------------------------------------------------------ On Fri, 2004-06-18 at 15:00, Tom London wrote: > Running off of the development tree, I couldn't get graphical apps (like > up2date, seaudit, ...) working when su'ed as root. All of this works > fine on a 'stock FC2' machine (running off > of the base and released-updates trees). Try moving the 'pam_selinux.so open multiple' line before the 'pam_xauth.so' line in /etc/pam.d/su. Dan, this is necessary under the current policy to get xauth to run with the right permissions for the new domain. -- Stephen Smalley <sds epoch ncsc mil> National Security Agency

1 0

up2date/seaudit/... not working (EXPLAINED)
by Tom London 18 Jun '04

18 Jun '04

Running off of the development tree, I couldn't get graphical apps (like up2date, seaudit, ...) working when su'ed as root. All of this works fine on a 'stock FC2' machine (running off of the base and released-updates trees). The problem seems to be that the latest packages cause 'su' to change the settings of XAUTHORITY environment variable from 'XAUTHORITY=/home/USER/.Xauthority' to 'XAUTHORITY=/root/.xauthABCD' (ABCD the usual 'uniqueness' stuff). If you manually reset XAUTHORITY back to '/home/USER/.Xauthority', the apps work again. Here's a bit of added strangeness: if you start 'xauth' in another user window and then try 'su -l', XAUTHORITY is not changed in the root shell. No AVCs against /root/.authABCD either.... [On the 'stock FC2' machine, XAUTHORITY is not modified by su.] I've bugzilla'ed this (https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=126300) against coreutils, but I'm not sure that is the right place (e.g., pam?). (All my systems run with SELinux enabled, so I can only assume this is occurring on SELinux-disabled systems as well.) Can someone explain why 'su' would be changing XAUTHORITY ? thanks, tom

3 2

organizing the audit messages
by İsmail İyigünler 18 Jun '04

18 Jun '04

Hi Can we compose the audit messages for building a simple database to find which user with which security context, executed which command and when he/she did this ? How can we build this ? Thanks! ------------------------------------------------- This mail sent through IMP: http://webmail.students.itu.edu.tr

2 1

X-user xauthed to execute a "root"/system level configuration helper yield denials
by Francis K Shim 18 Jun '04

18 Jun '04

Edited to make relevant details clear: execute_no_trans exe=/usr/sbin/userhelper path=/usr/X11R6/bin/xauth scontext=user:staff_r:staff_userhelper_t tcontext=system_u:object_r:xauth_exec_t tclass=file write exe=/usr/X11R6/bin/xauth name=user scontext=user:staff_r:staff_userhelper_t tcontext=user:object_r:staff_home_dir_t tclass=dir add_name exe=/usr/X11R6/bin/xauth name=.Xauthority-c scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=dir create exe=/usr/X11R6/bin/xauth name=.Xauthority-c scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=file link exe=/usr/X11R6/bin/xauth name=.Xauthority-c scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=file write exe=/usr/X11R6/bin/xauth name=.Xauthority scontext=USER:staff_r:staff_userhelper_t tcontext=system_u:object_r:staff_home_xauth_t tclass=file remove_name exe=/usr/X11R6/bin/xauth name=.Xauthority-c scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=dir unlink exe=/usr/X11R6/bin/xauth name=.Xauthority-c scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=file setattr exe=/usr/sbin/userhelper name=.xauthxxxxx scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=file write exe=/usr/X11R6/bin/xauth path=.xauthxxxxx scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=file read exe=/usr/X11R6/bin/xauth name=.xauthxxxxx scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=file getattr exe=/usr/X11R6/bin/xauth path=/home/USER/.xauthgxxxxx scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=file execute_no_trans exe=/usr/sbin/userhelper path=/usr/X11R6/bin/xauth scontext=USER:staff_r:staff_userhelper_t tcontext=system_u:object_r:xauth_exec_t tclass=file write exe=/usr/X11R6/bin/xauth name=.Xauthority scontext=USER:staff_r:staff_userhelper_t tcontext=system_u:object_r:staff_home_xauth_t tclass=file read exe=/sbin/iptables path=/var/run/sudo/USER/unknown scontext=USER:system_r:iptables_t tcontext=USER:object_r:pam_var_run_t tclass=file read exe=/sbin/hwclock path=/var/run/sudo/USER/unknown scontext=USER:system_r:hwclock_t tcontext=USER:object_r:pam_var_run_t tclass=file execute_no_trans exe=/usr/sbin/userhelper path=/usr/X11R6/bin/xauth scontext=USER:staff_r:staff_userhelper_t tcontext=system_u:object_r:xauth_exec_t tclass=file write exe=/usr/X11R6/bin/xauth name=.Xauthority scontext=USER:staff_r:staff_userhelper_t tcontext=system_u:object_r:staff_home_xauth_t tclass=file read exe=/sbin/iptables path=/var/run/sudo/USER/unknown scontext=USER:system_r:iptables_t tcontext=USER:object_r:pam_var_run_t tclass=file read exe=/usr/sbin/ntpdate path=/var/run/sudo/USER/unknown scontext=USER:system_r:ntpd_t tcontext=USER:object_r:pam_var_run_t tclass=file read exe=/sbin/hwclock path=/var/run/sudo/USER/unknown scontext=USER:system_r:hwclock_t tcontext=USER:object_r:pam_var_run_t tclass=file write exe=/usr/sbin/userhelper name=USER scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=dir remove_name exe/usr/sbin/userhelper name=.xauthxxxxx scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=dir unlink exe=/usr/sbin/userhelper name=.xauthxxxxx scontext=USER:staff_r:staff_userhelper_t tcontext=USER:object_r:staff_home_dir_t tclass=file -- Francis K Shim <francis.shim(a)sympatico.ca>

2 2

ntp
by Jason Hooper 18 Jun '04

18 Jun '04

could someone point me in the direction of getting ntp to work with selinux on fedora C2? does anyone have experience with this? is it supposed to just work with the default file_contexts? any help is appreciated...thanks j ..

3 4

RE: ntp
by David Balazic 17 Jun '04

17 Jun '04

> From: > fedora-selinux-list-bounces@redhat.com[SMTP:fedora-selinux-list-bounces@re > dhat.com] on behalf of Stephen Smalley[SMTP:sds@epoch.ncsc.mil] > > On Thu, 2004-06-17 at 10:03, Jason Hooper wrote: > > Jan 3 02:11:03 doh1 kernel: audit(1041581463.810:0): avc: denied { > write > > } for pid=1694 exe=/usr/sbin/ntpdate path=/ dev=hda3 ino=3367 > > scontext=root:system_r:ntpd_t tcontext=system_u:object_r:root_t > > tclass=chr_file > > Mismatch between your kernel and policy. RedHat released a kernel > update for FC2 without updating the policy accordingly. If you update > to selinux-policy-strict in the devel tree, you should be ok. But note > that this also requires updating SysVinit, libselinux, and possibly > other components as the policy layout has changed completely in the > devel tree. > > First, is SELinux supposed to work in Fedora Core 2 or is it in beta(alpha) > phase ? It is supposed to work. Khm, khm ... it is alpha/beta after all, isn't it ? > -- > Stephen Smalley <sds(a)epoch.ncsc.mil> > National Security Agency > > -- > fedora-selinux-list mailing list > fedora-selinux-list(a)redhat.com > http://www.redhat.com/mailman/listinfo/fedora-selinux-list >

3 2

RE: ntp
by David Balazic 17 Jun '04

17 Jun '04

Look, I would love to take part in the polishing of SELinux on Fedora, but I have no time at all for that, really. I will turn SELinux off on my system. Actually it's a question if I will use FC2 at all. I have very little time for FC and even that is then used for bug hunting/reporting and not actual "using"... Regards, DB > ---------- > From: > fedora-selinux-list-bounces@redhat.com[SMTP:fedora-selinux-list-bounces@re > dhat.com] on behalf of Stephen Smalley[SMTP:sds@epoch.ncsc.mil] > Reply To: Fedora SELinux support list for users & developers. > Sent: 17. junij 2004 16:45 > To: Fedora SELinux support list for users & developers. > Subject: RE: ntp > > On Thu, 2004-06-17 at 10:12, David Balazic wrote: > > Khm, khm ... it is alpha/beta after all, isn't it ? > > Shrug. If you want to be conservative, you can just patch your policy > to include the devnull initial SID rather than trying to update to > rawhide. > > -- > Stephen Smalley <sds(a)epoch.ncsc.mil> > National Security Agency > > -- > fedora-selinux-list mailing list > fedora-selinux-list(a)redhat.com > http://www.redhat.com/mailman/listinfo/fedora-selinux-list >

1 0

RE: ntp
by David Balazic 17 Jun '04

17 Jun '04

What if you set your system to permissive mode and see what is ntpdate trying to do ? > ---------- > From: > fedora-selinux-list-bounces@redhat.com[SMTP:fedora-selinux-list-bounces@re > dhat.com] on behalf of Jason Hooper[SMTP:jhooper@tlcontact.com] > Reply To: Fedora SELinux support list for users & developers. > Sent: 17. junij 2004 16:03 > To: fedora-selinux-list(a)redhat.com > Subject: RE: ntp > > Yeah it seems like it should just work...yet it doesn't...wierd. I have > two machines trying to sync ( well, three, but the third one works and is > not selinux ) > > I get this avc on both : > > Machine1 : > > Jan 3 02:11:03 doh1 kernel: audit(1041581463.810:0): avc: denied { > write > } for pid=1694 exe=/usr/sbin/ntpdate path=/ dev=hda3 ino=3367 > scontext=root:system_r:ntpd_t tcontext=system_u:object_r:root_t > tclass=chr_file > > Machine2 : > > Jun 17 06:11:33 doh2 kernel: audit(1087470693.719:0): avc: denied { > write > } for pid=2335 exe=/usr/sbin/ntpdate path=/ dev=hda2 ino=5060 > scontext=root:system_r:ntpd_t tcontext=system_u:object_r:root_t > tclass=chr_file > > Machine2 has an ntpd.te file while machine1 does not. Does that matter > in > this case? I can send it if its needed. > > Thanks again for the help > > .. > > > -----Original Message----- > From: Russell Coker [mailto:russell@coker.com.au] > Sent: Wednesday, June 16, 2004 10:01 PM > To: fedora-selinux-list(a)redhat.com > Cc: Jason Hooper > Subject: Re: ntp > > On Thu, 17 Jun 2004 04:51, "Jason Hooper" <jhooper(a)tlcontact.com> wrote: > > could someone point me in the direction of getting ntp to work with > selinux > > on fedora C2? does anyone have experience with this? is it supposed > to > > just work with the default file_contexts? any help is > > appreciated...thanks > > For the typical operation (synchronising from a master server somewhere on > the > net) it is supposed to just work, it does for me. I have a rawhide > machine > running the strict SE Linux policy synchronising with an NTP server right > now, and I don't believe that FC2 differs from the current rawhide in any > significant way related to NTP. > > Does ntpd support directly interfacing with GPS hardware or other accurate > time sources? If so some extra policy will be needed to support this. > > If you see any AVC messages related to ntpd then please post them to this > list. > > -- > http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages > http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark > http://www.coker.com.au/postal/ Postal SMTP/POP benchmark > http://www.coker.com.au/~russell/ My home page > > -- > fedora-selinux-list mailing list > fedora-selinux-list(a)redhat.com > http://www.redhat.com/mailman/listinfo/fedora-selinux-list >

1 0

mount reiserfs (novice)
by Maxim Britov 17 Jun '04

17 Jun '04

I can't mount reiserfs. I just begin study SE Linux. Could you help me? FC2+updates: mount /dev/hdc2 /mnt/disk # dmesg ReiserFS: hdc2: found reiserfs format "3.6" with standard journal ReiserFS: hdc2: using ordered data mode ReiserFS: hdc2: journal params: device hdc2, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30 ReiserFS: hdc2: checking transaction log (hdc2) ReiserFS: hdc2: Using r5 hash to sort names audit(1087473997.967:0): avc: denied { search } for pid=2885 exe=/bin/mount dev=hdc2 ino=2 scontext=root:sysadm_r:mount_t tcontext=system_u:object_r:unlabeled_t tclass=dir ReiserFS: hdc2: warning: xattrs/ACLs enabled and couldn't find/create .reiserfs_priv. Failing mount. # id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:sysadm_r:sysadm_t # ls -Z drwxr-xr-x root root system_u:object_r:mnt_t cdrom drwxr-xr-x+ root root system_u:object_r:mnt_t disk mkfs.ext2 and mount - works fine. -- MaxBritov GnuPG KeyID 0x4580A6D66F3DB1FB Keyserver hkp://keyserver.kjsl.com Fingerprint: 4059 B5C5 8985 5A47 8F5A 8623 4580 A6D6 6F3D B1FB JABBER: maxbritov on jabber.org/jabber.ru ICQ 198171258

3 3

/usr/bin/run-parts->system_u:object_r:bin_t (?!)
by Tom London 17 Jun '04

17 Jun '04

/usr/bin/run-parts has context system_u:object_r:bin_t under selinux-policy-strict-1.13.4-6 (and earlier). crond_t.te has entries to search bin_t dirs, but not to read/getattr/execute bin_t files. Here is the AVC for run-parts: audit(1087423260.368:0): avc: denied { getattr } for pid=4135 exe=/bin/bash path=/usr/bin/run-parts dev=hdb3 ino=1006312 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:bin_t tclass=file thanks. tom

3 4

Re: Where should an RPM install .te/.fc files?
by W. Michael Petullo 16 Jun '04

16 Jun '04

>> I maintain an RPM that installs .te and .fc files. In the past, >> contributing to the system's SELinux policy could be done by installing >> files in /etc/security/selinux/src/policy (I'm not sure this is right >> to begin with): >> %policy %{_sysconfdir}/security/selinux/src/policy/macros/ >> pam_mount_macros.te >> However, now policies may be in /etc/selinux/strict/src/policy/ or / >> etc/selinux/targeted/src/policy/. It is also possible that only one of >> these directories exists. > I don't think that your macros file fits in with the targetted policy, and > I think that the general aims of the targetted policy don't involve that > sort of thing (but this hasn't been considered much so far). > It's probably best to install the files under only the strict directory. > It is also possible that only one of those directories exists. Installing exclusively under the strict policy make sense. The things I am explicitly allowing should probably already be allowed by the targeted policy. However, what about the case where a user does not have the strict policy installed? In this case my RPM will install its policy files to an otherwise empty policy source tree. This may result in directories like /etc/selinux/strict being orphans -- not owned by any RPM. Should this be avoided somehow? Thanks for your help! -- Mike

1 0

'unable to relabel' in /dev.... MAKEDEV-3.7-2
by Tom London 16 Jun '04

16 Jun '04

Running off of the development tree, MAKEDEV-3.7-2 creates lots of new files. Running 'fixfiles relabel' or 'setfiles -v $FC /dev' generates lots of error messages like: /dev/ptyu7: Permission denied /usr/sbin/setfiles: unable to relabel /dev/ptyu7 to system_u:object_r:device_t /dev/ptyd7: Permission denied /usr/sbin/setfiles: unable to relabel /dev/ptyd7 to system_u:object_r:device_t /dev/ptyde: Permission denied /usr/sbin/setfiles: unable to relabel /dev/ptyde to system_u:object_r:device_t /dev/ptyac: Permission denied /usr/sbin/setfiles: unable to relabel /dev/ptyac to system_u:object_r:device_t /dev/ptys1: Permission denied /usr/sbin/setfiles: unable to relabel /dev/ptys1 to system_u:object_r:device_t /dev/ircomm9: Permission denied /usr/sbin/setfiles: unable to relabel /dev/ircomm9 to system_u:object_r:device_t /dev/ptyre: Permission denied /usr/sbin/setfiles: unable to relabel /dev/ptyre to system_u:object_r:device_t Here is an 'ls -l' of one of the files: [root@dell dev]# ls -l ptyu7 crw-rw-rw- 1 root tty 2, 87 Jun 14 12:42 ptyu7 [root@dell dev]# ls -lZ $_ crw-rw-rw- root tty root:object_r:device_t ptyu7 [root@dell dev]# I'm running selinux-policy-strict-1.13.4-6, with file_contexts augmented with Russell Coker's fix for /udev/microcode. tom

4 6

problem relabeling with FC2
by İsmail İyigünler 16 Jun '04

16 Jun '04

Hi I'm using Fedora Core 2 with kernel 2.6.6 with SELinux. However some of my directories' (in /proc for example) security context still looks "(null)". I tried the instructions in GettingStartedWithNewSELinux.pdf to relabel all the file system, but i did not work (both permissive and enforcing mode): [root@santiago /]# [root@santiago /]# make -C /etc/security/selinux/src/policy/ relabel make: Entering directory /etc/security/selinux/src/policy/ Cleaning out /tmp rm -rf /tmp/.??* /tmp/* /usr/bin/setfiles file_context/file_context 'mount | grep -v bind | grep -v " context=" | awk ' /(ext[23]|xfs).*rw{print $3}' /usr/bin/setfiles: read 1426 spesifications /usr/bin/setfiles: labeling files under / /usr/bin/setfiles: error while labeling files under / make:*** [relabel] Error 1 make: Leaving directory '/etc/security/selinux/src/policy' [root@santiago policy]# What have I missed? Could anyone help me on this? Your attention is greatly appreciated. Thank you. ------------------------------------------------- This mail sent through IMP: http://webmail.students.itu.edu.tr

3 3

Where should an RPM install .te/.fc files?
by W. Michael Petullo 16 Jun '04

16 Jun '04

Hello everyone, I maintain an RPM that installs .te and .fc files. In the past, contributing to the system's SELinux policy could be done by installing files in /etc/security/selinux/src/policy (I'm not sure this is right to begin with): %policy %{_sysconfdir}/security/selinux/src/policy/macros/ pam_mount_macros.te %policy %{_sysconfdir}/security/selinux/src/policy/file_contexts/misc/ pam_mount.fc However, now policies may be in /etc/selinux/strict/src/policy/ or / etc/selinux/targeted/src/policy/. It is also possible that only one of these directories exists. What is the proper procedure for an RPM to contribute to the system's SELinux policy? My RPM introduces new contexts and provides new allow statements. The Fedora Core 2 SELinux FAQ does not seem to address these questions, though it does allude to SELinux-related RPM hooks. -- Mike

2 1

strange AVC messages with kernel 2.6.6-1.427
by Russell Coker 15 Jun '04

15 Jun '04

With the latest kernel I am getting some strange AVC messages I didn't get with 2.6.5-1.358. audit(1087039822.666:0): avc: denied { getattr } for pid=5262 exe=/usr/sbin/pppd path=/ dev=hda1 ino=16381 scontext=rjc:system_r:pppd_t tcontext=system_u:object_r:root_t tclass=chr_file audit(1087039822.684:0): avc: denied { getattr } for pid=5262 exe=/usr/sbin/pppd path=/ dev=hda1 ino=16381 scontext=rjc:system_r:pppd_t tcontext=system_u:object_r:root_t tclass=chr_file There is no device node 16381 on the file system. Running the same command repeatedly gives similar messages with different inode numbers, so I guess it's some sort of temporary file. The machine is in enforcing mode and nothing that might want to create a root_t chr_file has permission to do so... -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

3 2

Kernel installation
by David Balazic 15 Jun '04

15 Jun '04

Hi! On afresh FC2 install I get this : [root@localhost root]# rpm -i /mnt/cdrom/fc2updates/kernel-2.6.6-1.427.i686.rpm warning: /mnt/cdrom/fc2updates/kernel-2.6.6-1.427.i686.rpm: V3 DSA signature: NOKEY, key ID 4f2a6fd2 audit(1087049637.996:0): avc: denied { transition } for pid=2632 exe=/bin/bash path=/sbin/dmsetup dev=hde2 ino=1261594 scontext=root:sysadm_r:bootloader_t tcontext=root:system_r:lvm_t tclass=process /bin/bash: /root/.bashrc: Permission denied [root@localhost root]# It appears to work after that, but I'll report it just in case ;) The same avc error happens wirth other kernels, even with one 2.4.x form older Fedora/RHL version. Regards, David Balažic ---------------------------------------------------------------------------- ----------- http://noepatents.org/ Innovation, not litigation ! --- David Balazic mailto:david.balazic@hermes.si HERMES Softlab http://www.hermes-softlab.com Zagrebska cesta 104 Phone: +386 2 450 8851 SI-2000 Maribor Slovenija ---------------------------------------------------------------------------- ----------- "Be excellent to each other." - Bill S. Preston, Esq. & "Ted" Theodore Logan ---------------------------------------------------------------------------- -----------

1 0

Where's my policy source?
by Levine, Daniel J. 15 Jun '04

15 Jun '04

Hey guys, When I first installed my Fedora Core 2 (release) OS with SELinux, I installed most of the packages I needed, but forgot that AMD doesn't get installed by default. So afterwards I found the am-utils RPM and installed it. Now I get spurious amd related messages from SELinux. I was probably root when I installed am-utils and chances are it didn't put the right contexts on the files an such. So, I figured I needed to re-label my file system so the amd related files would have the correct SELinux contexts on them. This is what it would do for me right? Well, so I got to /etc/security/selinux and I don't have a src directory! I'm pretty sure I picked Workstation Install and added various other packages that I thought I needed at installation time. Am-utils is the only after-the-fact package I installed. So, where is the policy source? I'm looking in the right place right? Now I do see in the SELinux getting started HOWTO that they do something like: make -C /etc/selinux relabel Should this cause my amd audit violation messages to go away? How would I have added the am-utils RPM so that its files were labeled correctly in the first place? Thanks, Daniel J. Levine Section Supervisor Johns Hopkins University Applied Physics Laboratory 443-778-3952 240-228-3952

2 1

Re: avc denied messages from microcode_ctl
by Tom London 15 Jun '04

15 Jun '04

[root@dell root]# ls -l /udev/microcode crw------- 1 root root 10, 184 May 25 13:56 /udev/microcode [root@dell root]# ls -lZ /udev/microcode crw------- root root system_u:object_r:device_t /udev/microcode [root@dell root]# ------------------------------------------------------------------------ * /From/: Russell Coker <russell coker com au> * /To/: Richard Hally <rhallyx mindspring com> * /Cc/: fedora-selinux-list redhat com * /Subject/: Re: avc denied messages from microcode_ctl * /Date/: Tue, 15 Jun 2004 11:50:29 +1000 ------------------------------------------------------------------------ On Tue, 15 Jun 2004 04:59, Richard Hally <rhallyx mindspring com> wrote: > >I suggest just using setfiles to relabel /dev/cpu. > > There is no /udev/cpu. There is a /udev/microcode. It is labeled > device_t. There is no /dev/microcode listed in Documentation/devices.txt in the kernel source tree from kernel.org. Please show me the "ls -l /dev/microcode" output. We'll have to add an entry to file_contexts/types.fc for it.

2 1

avc denied messages from lvm.static
by Richard Hally 15 Jun '04

15 Jun '04

While booting the 427 kernel in enforcing mode with selinux-policy-strict-1.13.4-5, the following avc denied messages occur: Jun 13 21:04:03 new2 kernel: audit(1087175021.671:0): avc: denied { search } for pid=931 exe=/sbin/lvm.static dev=devpts ino=1 scontext=system_u:system_r:lvm_t tcontext=system_u:object_r:devpts_t tclass=dir Jun 13 21:04:03 new2 kernel: audit(1087175022.193:0): avc: denied { getattr } for pid=931 exe=/sbin/lvm.static path=/dev/shm dev=hda2 ino=1091316 scontext=system_u:system_r:lvm_t tcontext=system_u:object_r:file_t tclass=dir HTH Richard Hally

3 3

(Non)Domain Transitioning
by Kirk Vogelsang 15 Jun '04

15 Jun '04

I'm having some problems getting the snortcenter agent (miniserv.pl) to start snort and transition snort to the appropriate snort_t domain. When miniserv starts snort, snort continues to run in the miniserv domain, snort_agent_t (domain I created.) avc messages show miniserv starting snort with execute_no_trans, which I believe is the problem: audit(108724131.465:0): avc: denied { execute_no_trans } for pid=7136 exe=/bin//bash path=/usr/tools/adm/packages/snort/bin/snort dev=sda2 ino=256078 scontext=system_u:system_r:snort_agent_t tcontext=system_u:object_r:snort_exec_t tclass=file When snort is started via run_init, it runs appropriately within the snort_t domain. I have: allow snort_agent_t snort_exec_t:file { read execute entrypoint }; ... ... allow snort_agent_t snort_t:process transition; My question: How do I force a process (snort) to transition to the correct domain (snort_t) when exec'd from another domain (snort_agent_t)? ----- Kirk M. Vogelsang <kvogelsa(a)ccs.neu.edu> Northeastern University College of Computer Science

2 1

avc denied messages from microcode_ctl
by Richard Hally 15 Jun '04

15 Jun '04

While booting the 427 kernel in enforcing mode with selinux-policy-strict-1.13.4-5, the following avc denied messages occur: Jun 13 21:04:03 new2 kernel: audit(1087175026.816:0): avc: denied { write } for pid=1247 exe=/sbin/microcode_ctl name=microcode dev=hda2 ino=1070659 scontext=system_u:system_r:cpucontrol_t tcontext=system_u:object_r:device_t tclass=chr_file HTH Richard Hally

2 3

avc denied messages from system cron
by Richard Hally 14 Jun '04

14 Jun '04

While running the 427 kernel in enforcing mode and selinux-policy-strict-1.13.4-5, the following avc denied messages occur from the system cron hourly job: Jun 13 22:01:00 new2 kernel: audit(1087178460.748:0): avc: denied { read } for pid=3306 exe=/bin/bash name=mtab dev=hda2 ino=869481 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:etc_runtime_t tclass=file Jun 13 22:01:00 new2 kernel: audit(1087178460.748:0): avc: denied { getattr } for pid=3306 exe=/bin/bash path=/proc/meminfo dev=proc ino=-268435454 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:proc_t tclass=file Jun 13 22:01:00 new2 kernel: audit(1087178460.792:0): avc: denied { getattr } for pid=3306 exe=/bin/bash path=/usr/bin/run-parts dev=hda2 ino=55784 scontext=system_u:system_r:crond_t tcontext=system_u:object_r:bin_t tclass=file HTH Richard Hally

2 2

Needs to prevent executing su.
by Igor Borisovsky 14 Jun '04

14 Jun '04

Hi. How to prevent executing 'su postgres' command by root? Thanks.

3 12

avc denied messages from rhgb
by Richard Hally 14 Jun '04

14 Jun '04

While booting the 427 kernel in enforcing mode with selinux-policy-strict-1.13.4-5, the following avc denied messages occur: Jun 13 21:04:03 new2 kernel: audit(1087160614.345:0): avc: denied { search } for pid=535 exe=/usr/bin/rhgb name=root dev=hda2 ino=130305 scontext=system_u:system_r:rhgb_t tcontext=root:object_r:staff_home_dir_t tclass=dir Jun 13 21:04:03 new2 last message repeated 9 times Jun 13 21:04:03 new2 kernel: audit(1087160614.346:0): avc: denied { search } for pid=535 exe=/usr/bin/rhgb name=root dev=hda2 ino=130305 scontext=system_u:system_r:rhgb_t tcontext=root:object_r:staff_home_dir_t tclass=dir Jun 13 21:04:03 new2 last message repeated 3 times Jun 13 21:04:03 new2 kernel: audit(1087160614.706:0): avc: denied { search } for pid=535 exe=/usr/bin/rhgb name=root dev=hda2 ino=130305 scontext=system_u:system_r:rhgb_t tcontext=root:object_r:staff_home_dir_t tclass=dir Jun 13 21:04:03 new2 last message repeated 2 times Jun 13 21:04:03 new2 kernel: audit(1087160614.707:0): avc: denied { search } for pid=535 exe=/usr/bin/rhgb name=root dev=hda2 ino=130305 scontext=system_u:system_r:rhgb_t tcontext=root:object_r:staff_home_dir_t tclass=dir Jun 13 21:04:03 new2 kernel: audit(1087160615.167:0): avc: denied { search } for pid=535 exe=/usr/bin/rhgb name=root dev=hda2 ino=130305 scontext=system_u:system_r:rhgb_t tcontext=root:object_r:staff_home_dir_t tclass=dir Jun 13 21:04:03 new2 last message repeated 7 times HTH Richard Hally

2 1

avc denied messages from gnome-vfs-daemon and nautilus
by Richard Hally 14 Jun '04

14 Jun '04

While booting to run level 5 and logging in, with the 427 kernel in enforcing mode and selinux-policy-strict-1.13.4-5, the following avc denied messages occur: Jun 13 21:05:09 new2 kernel: audit(1087175109.179:0): avc: denied { getattr } for pid=3137 exe=/usr/libexec/gnome-vfs-daemon path=/initrd dev=ram0 ino=2 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:file_t tclass=dir Jun 13 21:05:09 new2 kernel: audit(1087175109.839:0): avc: denied { getattr } for pid=3148 exe=/usr/bin/nautilus path=/initrd dev=ram0 ino=2 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:file_t tclass=dir Jun 13 21:05:09 new2 kernel: audit(1087175109.957:0): avc: denied { getattr } for pid=3149 exe=/usr/bin/nautilus path=/initrd dev=ram0 ino=2 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:file_t tclass=dir HTH Richard Hally

2 1

avc denied messages from ssh-agent
by Richard Hally 14 Jun '04

14 Jun '04

While booting to run level 5 with the 427 kernel in enforcing mode and selinux-policy-strict-1.13.4-5, the following avc denied messages occur: Jun 13 21:04:52 new2 gdm(pam_unix)[2828]: session opened for user richard by (uid=0) Jun 13 21:04:52 new2 kernel: audit(1087175092.764:0): avc: denied { search } for pid=2923 exe=/usr/bin/ssh-agent name=selinux dev=hda2 ino=913073 scontext=richard:staff_r:staff_ssh_agent_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 13 21:04:52 new2 kernel: audit(1087175092.764:0): avc: denied { read } for pid=2923 exe=/usr/bin/ssh-agent name=mounts dev=proc ino=-268435447 scontext=richard:staff_r:staff_ssh_agent_t tcontext=system_u:object_r:proc_t tclass=lnk_file HTH Richard Hally

1 0

avc denied messages from umount
by Richard Hally 14 Jun '04

14 Jun '04

While booting the 427 kernel in enforcing mode with selinux-policy-strict-1.13.4-5, the following avc denied messages occur: Jun 13 21:04:22 new2 kernel: audit(1087175062.270:0): avc: denied { use } for pid=2392 exe=/bin/umount path=/dev/ptmx dev=hda2 ino=1064811 scontext=system_u:system_r:mount_t tcontext=system_u:system_r:rhgb_gph_t tclass=fd Jun 13 21:04:22 new2 kernel: audit(1087175062.270:0): avc: denied { read write } for pid=2392 exe=/bin/umount path=socket:[1429] dev=sockfs ino=1429 scontext=system_u:system_r:mount_t tcontext=system_u:system_r:rhgb_t tclass=unix_stream_socket HTH Richard Hally

1 0

Re: avc denied from kernel 427 update
by Tom London 13 Jun '04

13 Jun '04

Hmmm.... worked for me. I'm running 427 on two machines. One with the 'old policy' stuff, the other with all the latest packages from the development tree (including 'new selinux-policy' stuff). A suggestion from Stephen Smalley may help you. I haven't tried to install a new kernel since doing this. Also, I noticed an updated rpm package in the development tree..... tom ------------------------------------------------------------------------ * /From/: Stephen Smalley <sds epoch ncsc mil> * /Date/: Thu, 10 Jun 2004 15:30:09 -0400 ------------------------------------------------------------------------ On Tue, 2004-06-08 at 23:25, Tom London wrote: > [On my system, yum/rpm seem not to be correctly labeling installed > files, so I manually check and change via 'fixfiles' or 'setfiles' as > appropriate. This is because rpm hasn't been updated for the new policy layout, so it cannot find the file_contexts configuration. Until it is updated, I have just created a symlink, i.e. ln -sf /etc/selinux/strict/contexts/files/file_contexts /etc/security/selinux/file_contexts -- Stephen Smalley <sds epoch ncsc mil> National Security Agency

1 1

Re: avc denied from kernel 427 update
by Tom London 13 Jun '04

13 Jun '04

The warnings seem to be caused by 'rpm' not assigning the proper contexts to 'installed' files. The 'FATAL' message from 'mkinitrd' seems to be due to a problem with 'ulimit' defaults. A workaround until fixed, install/update kernel only in permissive mode, and make sure you do a 'ulimit -l unlimited' before running 'yum' (so you'll enter 'setenforce 0; ulimit -l unlimited'). I think you'll still get the warnings, but the command will succeed without the fatal error. After the yum 'succeeds', you probably will need to correct the context labels for the kernel files. Easiest way to do that is to run FC=/etc/selinux/strict/contexts/files/file_contexts setfiles -v $FC /lib/modules/2.6.6-1.427 setfiles -v $FC /boot BEFORE you reboot, or to reboot single-user, permissive mode (by adding 'single enforcing=0' to the boot params) and then running 'fixfiles relabel'. Then you can reboot multi-user as usual. If you've updated more than just the kernel package, you probably want to do the 'boot single-user/permissive, run fixfiles' path. tom -------------------------------------- * From: Richard Hally <rhallyx mindspring com> * To: fedora-selinux-list redhat com * Subject: avc denied from kernel 427 update * Date: Sun, 13 Jun 2004 02:29:05 -0400 Below a few of the over 100 warning and error messages from doing yum update today.(6/12/04) Of the ones that didn't scroll off, they are all about the 427/build directory tree. This is in enforcing mode using the most recent strict policy that existed before todays update to selinux-policy-strict-sources-1.13.4-5. The avc denied messages are further below. HTH Richard Hally ----------------------------------------------------------------------------------------------------- from yum update: ... WARNING: Couldn't stat /lib/modules/2.6.6-1.427/build/.config: Permission denied WARNING: Couldn't stat /lib/modules/2.6.6-1.427/build/init/Makefile: Permission denied WARNING: Couldn't stat /lib/modules/2.6.6-1.427/build/init/Kconfig: Permission denied FATAL: Could not open /lib/modules/2.6.6-1.427/modules.dep.temp for writing: Permission denied /bin/bash: /root/.bashrc: Permission denied No dep file found for kernel 2.6.6-1.427 mkinitrd failed ------------------------------------------------------------------- And here are some of the avc denied messages Jun 12 19:27:20 new2 kernel: audit(1087082831.128:0): avc: denied { getattr } for pid=5774 exe=/sbin/depmod path=/lib/modules/2.6.6-1.427/build/net/ipv4/Kconfig dev=hda2 ino=543312 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 12 19:27:20 new2 kernel: audit(1087082831.142:0): avc: denied { getattr } for pid=5774 exe=/sbin/depmod path=/lib/modules/2.6.6-1.427/build/.config dev=hda2 ino=525543 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 12 19:27:20 new2 kernel: audit(1087082831.142:0): avc: denied { getattr } for pid=5774 exe=/sbin/depmod path=/lib/modules/2.6.6-1.427/build/init/Makefile dev=hda2 ino=525592 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 12 19:27:20 new2 kernel: audit(1087082831.142:0): avc: denied { getattr } for pid=5774 exe=/sbin/depmod path=/lib/modules/2.6.6-1.427/build/init/Kconfig dev=hda2 ino=525591 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 12 19:27:20 new2 kernel: audit(1087082831.142:0): avc: denied { write } for pid=5774 exe=/sbin/depmod name=2.6.6-1.427 dev=hda2 ino=525541 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=dir [Date Prev][Date Next] [Thread Prev][Thread Next] [Thread Index] [Date Index] [Author Index] Copyright © 2004 Red Hat, Inc. All rights reserved. Search by Google Privacy Policy : Careers at Red Hat : Legal statement : Patent promise : Contact Red Hat Log in to Your Account

2 1

multiple context error from updating sysklogd
by Richard Hally 13 Jun '04

13 Jun '04

Here is a error from updating the sysklogd package that appearently comes from some file context problem. The last line about the post script failing has to do with being in enforcing mode but the catch-22 is that the avc denied messages are incomplete which is the reason I am replacing the sysklogd package in the first place. The partial avc denied messages are further below. When doing the same rpm command in permissive mode, the context error is still produce but the post script runs. HTH Richard Hally --------------------------------------shell messages------------------------------------------------------------ [root@new2 richard]# rpm -U --oldpackage sysklogd-1.4.1-16.i386.rpm ERROR: Multiple different specifications for /usr/sbin/imapd (system_u:object_r:imapd_exec_t and system_u:object_r:inetd_child_exec_t). warning: sysklogd-1.4.1-16.i386.rpm: V3 DSA signature: NOKEY, key ID 4f2a6fd2 error: %post(sysklogd-1.4.1-16) scriptlet failed, exit status 255 [root@new2 richard]# setenforce 0 ----------------------------var log messages--------------------------------------------------------------------- Jun 13 02:34:31 new2 last message repeated 3 times Jun 13 02:34:31 new2 exiting on signal 15 Jun 13 02:34:31 new2 syslogd 1.4.1: restart. Jun 13 02:34:31 new2 syslog: syslogd startup succeeded Jun 13 02:34:31 new2 kernel: klogd 1.4.1, log source = /proc/kmsg started. Jun 13 02:34:31 new2 kernel: audit(1087108471.340:0): avc: denied { getattr } for pid=1 exe=/sbin/init Jun 13 02:34:31 new2 kernel: audit(1087108471.340:0): avc: denied { read write } for pid=1 exe=/sbin/init Jun 13 02:34:31 new2 syslog: klogd startup succeeded Jun 13 02:34:31 new2 syslog: syslogd shutdown succeeded

2 1

avc denied from kernel 427 update
by Richard Hally 13 Jun '04

13 Jun '04

Below a few of the over 100 warning and error messages from doing yum update today.(6/12/04) Of the ones that didn't scroll off, they are all about the 427/build directory tree. This is in enforcing mode using the most recent strict policy that existed before todays update to selinux-policy-strict-sources-1.13.4-5. The avc denied messages are further below. HTH Richard Hally ----------------------------------------------------------------------------------------------------- from yum update: ... WARNING: Couldn't stat /lib/modules/2.6.6-1.427/build/.config: Permission denied WARNING: Couldn't stat /lib/modules/2.6.6-1.427/build/init/Makefile: Permission denied WARNING: Couldn't stat /lib/modules/2.6.6-1.427/build/init/Kconfig: Permission denied FATAL: Could not open /lib/modules/2.6.6-1.427/modules.dep.temp for writing: Permission denied /bin/bash: /root/.bashrc: Permission denied No dep file found for kernel 2.6.6-1.427 mkinitrd failed ------------------------------------------------------------------- And here are some of the avc denied messages Jun 12 19:27:20 new2 kernel: audit(1087082831.128:0): avc: denied { getattr } for pid=5774 exe=/sbin/depmod path=/lib/modules/2.6.6-1.427/build/net/ipv4/Kconfig dev=hda2 ino=543312 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 12 19:27:20 new2 kernel: audit(1087082831.142:0): avc: denied { getattr } for pid=5774 exe=/sbin/depmod path=/lib/modules/2.6.6-1.427/build/.config dev=hda2 ino=525543 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 12 19:27:20 new2 kernel: audit(1087082831.142:0): avc: denied { getattr } for pid=5774 exe=/sbin/depmod path=/lib/modules/2.6.6-1.427/build/init/Makefile dev=hda2 ino=525592 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 12 19:27:20 new2 kernel: audit(1087082831.142:0): avc: denied { getattr } for pid=5774 exe=/sbin/depmod path=/lib/modules/2.6.6-1.427/build/init/Kconfig dev=hda2 ino=525591 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 12 19:27:20 new2 kernel: audit(1087082831.142:0): avc: denied { write } for pid=5774 exe=/sbin/depmod name=2.6.6-1.427 dev=hda2 ino=525541 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=dir

1 0

Various problems on fresh FC2 install
by David Balazic 12 Jun '04

12 Jun '04

Hi! I discovered more problems with SELinux. I will describe each and wait for your comment ;-) This is all on a fresh clean install of FC2 with SELinux enabled. ( I did once run "fixfiles relabel" ) ======== root under context root:staff_r:staff_t can not use rpm -q : NOTE: onyl when writing this mail I noticed, that it actually prints the expected output. Are the audit messages a problem ? I think I did not see them when running under the root:sysadm_r:sysadm_t context Fedora Core release 2 (Tettnang) Kernel 2.6.5-1.358 on an i686 localhost login: root Password: Your default context is root:sysadm_r:sysadm_t. Do you want to choose a different one? [n]y [2] root:staff_r:staff_t Enter number of choice: 2 Last login: Fri Jun 11 19:37:37 on tty2 [root@localhost root]# rpm -q kernel audit(1086975532.470:0): avc: denied { dac_override } for pid=2612 exe=/usr/lib/rpm/rpmq capability=1 scontext=root:staff_r:staff_t tcontext=root:staff_r:staff_t tclass=capability audit(1086975532.470:0): avc: denied { dac_read_search } for pid=2612 exe=/usr/lib/rpm/rpmq capability=2 scontext=root:staff_r:staff_t tcontext=root:staff_r:staff_t tclass=capability audit(1086975532.472:0): avc: denied { dac_override } for pid=2612 exe=/usr/lib/rpm/rpmq capability=1 scontext=root:staff_r:staff_t tcontext=root:staff_r:staff_t tclass=capability audit(1086975532.472:0): avc: denied { dac_read_search } for pid=2612 exe=/usr/lib/rpm/rpmq capability=2 scontext=root:staff_r:staff_t tcontext=root:staff_r:staff_t tclass=capability audit(1086975532.489:0): avc: denied { dac_override } for pid=2612 exe=/usr/lib/rpm/rpmq capability=1 scontext=root:staff_r:staff_t tcontext=root:staff_r:staff_t tclass=capability audit(1086975532.489:0): avc: denied { dac_read_search } for pid=2612 exe=/usr/lib/rpm/rpmq capability=2 scontext=root:staff_r:staff_t tcontext=root:staff_r:staff_t tclass=capability kernel-2.6.5-1.358 kernel-2.4.22-1.2061.nptl [root@localhost root]# ======== grub fails with the default root root:sysadm_r:sysadm_t : [root@localhost root]# grub Probing devices to guess BIOS drives. This may take a long time. audit(1086973995.955:0): avc: denied { read } for pid=2576 exe=/sbin/grub name=linux dev=hde2 ino=148612 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:usr_t tclass=file Error opening terminal: linux. [root@localhost root]# it works with [2] root:staff_r:staff_t grub-install does not work at all : [root@localhost root]# grub-install /dev/hde # this is root:staff_r:staff_t audit(1086974024.461:0): avc: denied { write } for pid=3140 exe=/bin/rm name=grub dev=hde1 ino=9841 scontext=root:staff_r:staff_t tcontext=system_u:object_r:boot_t tclass=dir rm: cannot remove `/boot/grub/stage1': Permission denied [root@localhost root]# [root@localhost root]# grub-install /dev/hde # root:sysadm_r:sysadm_t audit(1086974089.530:0): avc: denied { read } for pid=3193 exe=/bin/cp name=stage1 dev=hde2 ino=180241 scontext=root:sysadm_r:bootloader_t tcontext=system_u:object_r:usr_t tclass=file cp: cannot open `/usr/share/grub/i386-redhat/stage1' for reading: Permission denied ================== tvtime can not acces /dev/rtc and /dev/video0 : [stein@localhost stein]$ tvtime Running tvtime 0.9.12. rtctimer: Cannot open /dev/rtc: Permission denied rtctimer: Cannot open /dev/misc/rtc: No such file or directory Enhanced Real Time Clock support in your kernel is necessary for smooth video. We strongly recommend that you load the 'rtc' kernel module before starting tvtime, and make sure that your user has access to the device file (/dev/rtc or /dev/misc/rtc). See our support page at http://tvtime.net/ for more information. Reading configuration from /etc/tvtime/tvtime.xml Reading configuration from /home/stein/.tvtime/tvtime.xml videoinput: Cannot open capture device /dev/video0: Permission denied Thank you for using tvtime. [stein@localhost stein]$ rpm -q tvtime tvtime-0.9.12-5 ================== Regards, David ---------------------------------------------------------------------------- ----------- http://noepatents.org/ Innovation, not litigation ! --- David Balazic mailto:david.balazic@hermes.si HERMES Softlab http://www.hermes-softlab.com Zagrebska cesta 104 Phone: +386 2 450 8851 SI-2000 Maribor Slovenija ---------------------------------------------------------------------------- ----------- "Be excellent to each other." - Bill S. Preston, Esq. & "Ted" Theodore Logan ---------------------------------------------------------------------------- -----------

2 1

avc's missing again?
by Tom London 11 Jun '04

11 Jun '04

I just noticed that I am no longer getting avc messages in /var/log/messages for my 'run out of the development tree' system. It is running kernel-2.6.6-1.427, selinux-policy-strict-1.13.4-2 and libselinux-1.13.2-4. I only get 'blank lines' in /var/log/messages and 'last line repeated 47 times' type messages. Seems to have started 2 days ago. The same kernel running with the old policy files (policy-1.11.3-3 and libselinux-1.11.4-1) produce avc messages in the log. The config file for the kernel appears to have AUDIT set to 'y'..... Anyone seeing this? tom

1 2

kernel-2.6.6-1.427... update questions?
by Tom London 11 Jun '04

11 Jun '04

kernel-2.6.6-1.427 has made it to the 'released updates' tree. My other system that is running this version is also running the new selinux-policy packages, and I previously needed to add 'selinux=1' to the boot params. Before I test it out on my 'real machine', anyone know if .427 will work with the old policy packages, file tree (/etc/security/selinux vs. /etc/selinux) and config file (/etc/sysconfig/selinux vs. /etc/selinux/config)? Do I still need the 'selinux=1' boot param? thanks tom

1 1

LIST-ADMIN: Error in mail headers
by David Balazic 11 Jun '04

11 Jun '04

Hi! The header of mail coming from this list have among other things this : List-Archive: </archives/fedora-selinux-list> Which is wrong, correct would be something like this : List-Archive: <http://www.redhat.com/archives/fedora-selinux-list/> Also there is no owner or administrator listed. Regards, David ---------------------------------------------------------------------------- ----------- http://noepatents.org/ Innovation, not litigation ! --- David Balazic mailto:david.balazic@hermes.si HERMES Softlab http://www.hermes-softlab.com Zagrebska cesta 104 Phone: +386 2 450 8851 SI-2000 Maribor Slovenija ---------------------------------------------------------------------------- ----------- "Be excellent to each other." - Bill S. Preston, Esq. & "Ted" Theodore Logan ---------------------------------------------------------------------------- -----------

2 1

Newbie - From audit log message ("avc: denied") to an appropriate fix
by Francis Shim 11 Jun '04

11 Jun '04

Originally, I had Fedora Core 1 linux distro and then decided to simply upgrade to Fedora Core 2 via manually rpm-ing the necessary packages. Everything went pretty much as expected and now I have the Selinux policy packages all installed. I decided to start reading the obvious README in /etc/security/selinux/src/policy and then went to the NSA SELinux website. I did the make load and make relabel and reboot cycle, leaving the SELinux in permissive mode. Now, I am ready to take the next step: reading the audit logging messages and taking some action per audit. I just need some more insight and expertise from someone to enlighten me as to which direction to take. To start off with I am looking at the following audit line (with some editing out of irrelevant info) from "dmesg": audit(...): avc: denied { search } for pid=458 exe=/usr/bin/rhgb name=.themes dev=hda... ino=... scontext=system_u:system_r:rhgb_t tcontext=root:object_r:staff_home_t tclass=dir This audit line reports that the process (pid=458) running the executable program (/usr/bin/rhgb), the RedHat Graphics Boot program, was trying to access the target object ".themes" (a directory). Okay, the rhgb process is running in the source context with an identity of "system_u" (System user) in the role of "system_r" (System role) within the domain of "rhgb_t" (RedHat Graphics Boot domain) and is trying to access the directory target object ".themes" which has a target context with an identity of "root" in the role of "system_r" (System role) with a type of "staff_home_t" (Staff Home object type). Given that the audit process denies the "search" on this access, that means that the rhgb domain does not have "search" access to a staff_home_t type object. Okay, I guess I should go to the /etc/security/selinux/src/policy directory and edit the policy.conf(?) file to add a suitable transition policy... but I am not confident as to what. Any good tips and comments? Thanks, Frank -- Francis K Shim <belfrancis2001(a)yahoo.ca>

2 1

Re: enforcing mode problems
by Tom London 10 Jun '04

10 Jun '04

Thanks for this workaround! What a work saver. I've also bugzilla'ed it here: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=125477 ------------------------------------------------------------------------ * /From/: Stephen Smalley <sds epoch ncsc mil> * /To/: "Fedora SELinux support list for users & developers." <fedora-selinux-list redhat com> * /Cc/: Daniel J Walsh <dwalsh redhat com> * /Subject/: Re: enforcing mode problems * /Date/: Thu, 10 Jun 2004 15:30:09 -0400 ------------------------------------------------------------------------ On Tue, 2004-06-08 at 23:25, Tom London wrote: > [On my system, yum/rpm seem not to be correctly labeling installed > files, so I manually check and change via 'fixfiles' or 'setfiles' as > appropriate. This is because rpm hasn't been updated for the new policy layout, so it cannot find the file_contexts configuration. Until it is updated, I have just created a symlink, i.e. ln -sf /etc/selinux/strict/contexts/files/file_contexts /etc/security/selinux/file_contexts -- Stephen Smalley <sds epoch ncsc mil> National Security Agency

1 0

RE: Getting the user ID in log messages...
by Levine, Daniel J. 10 Jun '04

10 Jun '04

I'm curious why the ypcat cron with a make reload would present its own issues. I guess it must be a security context issue since I'm new to it. Is there a better alternative to visiting each machine manually and adding the line to /etc/selinux/users (assuming that's where it is on my Fedora Core 2 machine)? I see there's something about local policy changes being placed in /etc/security/selinux/src/policy/domains/misc/. Can I also put a users in there (or somewhere else). If so, I suppose I could have a central NFS auto-mounted location for my local users file. So at boot time, I have a nice sane policy (your default which maps all users to user user_u. But when everything is finished booting I have some additional information for my users wherever you tell me to add it. I guess my rc.local would then need to perform a make reload to incorporate this additional information. Would this be an easy and sustainable way to achieve what I want? Do you have any better ideas? I can't be the only person who wants to do this, can I? I feel like what I'm asking is not unreasonable. Is SELinux intended for single machines working in insecure environments? Daniel J. Levine Section Supervisor Johns Hopkins University Applied Physics Laboratory 443-778-3952 240-228-3952 -----Original Message----- From: Russell Coker [mailto:russell@coker.com.au] Sent: Thursday, June 10, 2004 9:46 AM To: fedora-selinux-list(a)redhat.com Cc: Levine, Daniel J.; Stephen Smalley Subject: Re: Getting the user ID in log messages... On Thu, 10 Jun 2004 22:17, "Levine, Daniel J." <Daniel.Levine(a)jhuapl.edu> wrote: > Thanks, I managed to figure that out from the "Getting Started with SELinux > HOWTO" from the adding a user section. For a standalone system, I can see > how this is no big deal. Every time I add a user, I add the user to the > /etc/selinux/users file. But suppose I have 100 machines, I would need to > add it to 100 systems. This is why I use NIS to manage my password and > shadow files. I suppose one homegrown solution would be to put > /etc/selinux/users into an NIS map (users.byname) and periodically (every > half-hour perhaps) have a cron job perform a ypcat users.byname > > /etc/selinux/users. Is there a standard map one could use or a PAM module > that's aware of such needs. There is no standard way of doing this. Maybe you will set the standard if you do it first! ;) Having a cron job automatically generate and load a SE Linux policy has it's own issues as well. > Suppose I wasn't using something as old as NIS, like OpenLDAP, is there a > standard mechanism for putting this information into its databases? And if > not, should there be one? Probably there should. But we'll need to get an OID assigned for this. > Perhaps my problem is simpler to solve than this. All I really need is the > user ID of the person who logged in to the system. This identifies whose > account was used to perpetrate the illegal access. Could the user ID > number and user name be added to the log messages when violations occur? At the moment no. Maybe this is something for the audit facility rather than SE Linux kernel code. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

2 1

Re: enforcing mode problems
by Tom London 10 Jun '04

10 Jun '04

I relabel after each policy change. If you don't, context changes reflected in the new policy files are not made. tom [On my system, yum/rpm seem not to be correctly labeling installed files, so I manually check and change via 'fixfiles' or 'setfiles' as appropriate. You can check by running 'fixfiles check'. This is especially tedious if updating the kernel/coreutils/selinux packages since improper labels could prevent rebooting in enforcing mode. When this happened to me, I added 'enforcing=0' to the boot line so I could relabel files in permissive mode.] ------------------------------------------------------------------------ * /From/: Richard Hally <rhally mindspring com> * /To/: "Fedora SELinux support list for users & developers." <fedora-selinux-list redhat com> * /Subject/: Re: enforcing mode problems * /Date/: Tue, 08 Jun 2004 23:05:54 -0400 ------------------------------------------------------------------------ Tom London wrote: Did you remember to do a 'fixfiles relabel' after installing the new policy files? If not, I suggest you reboot single-user mode, and then run 'fixfiles relabel'. You probably want fixfiles to clean out /tmp, so move/copy anything you need before running it. tom ------------------------------------------------------------------------ * /From/: Richard Hally <rhally mindspring com> * /To/: fedora-selinux-list redhat com * /Subject/: enforcing mode problems * /Date/: Tue, 08 Jun 2004 22:43:44 -0400 ------------------------------------------------------------------------ when running with the latest "strict" policy in enforcing mode, 'su -' does not work. [richard new2 richard]$ su - Password: could not open session Thanks for the suggestion. This system was installed over the past weekend and updated to the (then) latest strict policy. "fixfiles relabel" was run then to allow going to enforcing mode. "yum update" updated the policy today. I am wondering if "fixfiles relabel" will be necessary every time policy is updated? Richard Hally

3 2

errors from setools
by Richard Hally 10 Jun '04

10 Jun '04

Below is the output from attempting to use 'seinfo' and 'seaudit'. The same error occurs in both enforcing and permissive modes. Perhaps this will be helpful to someone. [root@new2 root]# seinfo Could not open policy /etc/selinux/strict/policy.17! search_for_policyfile_with_ver: No such file or directory Error while searching for default policy: Error in find_default_policy_file(). [root@new2 root]# seaudit Could not open policy /etc/selinux/strict/policy.17?! search_for_policyfile_with_ver: No such file or directory [root@new2 root]# rpm -q setools setools-1.4-1 [root@new2 root]# rpm -q selinux-policy-strict selinux-policy-strict-1.13.4-2 [root@new2 root]# HTH Richard Hally

2 1

RE: Getting the user ID in log messages...
by Levine, Daniel J. 10 Jun '04

10 Jun '04

Russell, Thanks, I managed to figure that out from the "Getting Started with SELinux HOWTO" from the adding a user section. For a standalone system, I can see how this is no big deal. Every time I add a user, I add the user to the /etc/selinux/users file. But suppose I have 100 machines, I would need to add it to 100 systems. This is why I use NIS to manage my password and shadow files. I suppose one homegrown solution would be to put /etc/selinux/users into an NIS map (users.byname) and periodically (every half-hour perhaps) have a cron job perform a ypcat users.byname > /etc/selinux/users. Is there a standard map one could use or a PAM module that's aware of such needs. Suppose I wasn't using something as old as NIS, like OpenLDAP, is there a standard mechanism for putting this information into its databases? And if not, should there be one? Perhaps my problem is simpler to solve than this. All I really need is the user ID of the person who logged in to the system. This identifies whose account was used to perpetrate the illegal access. Could the user ID number and user name be added to the log messages when violations occur? The id command seems to have the information it needs, perhaps the SELinux logger does too? Otherwise, I'd need to do something like I mention above. I'm not really interested in whether the context has the user name. That was just a way of using what seemed to be a built-in capability if I had set things up right. I have no real problem with users running around as user_u:user_r:user_t in the system. I just need to know which user to start talking to when I see they are poking around the system. Daniel J. Levine Section Supervisor Johns Hopkins University Applied Physics Laboratory 443-778-3952 240-228-3952 -----Original Message----- From: Russell Coker [mailto:russell@coker.com.au] Sent: Thursday, June 10, 2004 2:10 AM To: fedora-selinux-list(a)redhat.com Cc: Levine, Daniel J. Subject: Re: Getting the user ID in log messages... On Thu, 10 Jun 2004 01:02, "Levine, Daniel J." <Daniel.Levine(a)jhuapl.edu> wrote: > Explanation of log file messages) the example show the following scontext: > > scontext: faye:user_r:user_t > > This is great, as I would know to contact the user faye and ask about the > situation. But on my Fedora Core 2 machine, my /var/log/messages produces: > > scontext: user_u:user_r:user_t In your users file in the SE Linux policy you need the following: user dan roles user_r; Then run "make load". -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

3 2

canna .... still wants to access /tmp
by Tom London 10 Jun '04

10 Jun '04

Looks like the new policy (selinux-strict-policy-1.13.4-2) removes access to tmp files in canna.te. But canna (Canna-0.3.7p3-2) still wants to access /tmp/. Are there new versions of the canna stuff coming that move the files from /tmp elsewhere? tom Jun 8 09:32:06 dell kernel: audit(1086712326.043:0): avc: denied { search } for pid=2094 exe=/usr/sbin/cannaserver name=tmp dev=hdb3 ino=278529 scontext=system_u:system_r:canna_t tcontext=system_u:object_r:tmp_t tclass=dir Jun 8 09:32:06 dell kernel: audit(1086712326.044:0): avc: denied { search } for pid=2094 exe=/usr/sbin/cannaserver name=tmp dev=hdb3 ino=278529 scontext=system_u:system_r:canna_t tcontext=system_u:object_r:tmp_t tclass=dir Jun 8 09:32:06 dell cannaserver: Jun 8 09:32:06 dell cannaserver: ERROR: Jun 8 09:32:06 dell cannaserver: Another 'cannaserver' is detected. Jun 8 09:32:06 dell cannaserver: If 'cannaserver' is not running, Jun 8 09:32:06 dell cannaserver: "/tmp/.iroha_unix/IROHA" may remain accidentally. Jun 8 09:32:06 dell cannaserver: So, after making sure that 'cannaserver' is not running. Jun 8 09:32:06 dell cannaserver: Please execute following command. Jun 8 09:32:06 dell cannaserver: Jun 8 09:32:06 dell cannaserver: rm /tmp/.iroha_unix/IROHA Jun 8 09:32:06 dell cannaserver:

3 2

Getting the user ID in log messages...
by Levine, Daniel J. 10 Jun '04

10 Jun '04

His guys, First let me start off by saying that I've been running Fedora Core 2 with SELinux in permissive mode since a few days after it was released officially with no real system problems. That being said, I'm trying to understand how to do things properly to maintain the integrity of the system and perform the auditing I desire. Is there a good place to look which documents the SELinux relevant commands? The Fedora Core 2 SELinux FAQ has some interesting info, but relatively few commands. A Gentoo related site gave me some command ideas. Perhaps this is on the documentation CD for Fedora Core 2, which I have yet to download? I expected to be able to hunt through the man pages starting with man selinux, but that didn't pan out. I found some other references online called the Getting Started with SE Linux HOWTO and Gentoo SE Linux HOWTO, but these offered some commands not available in the Fedora Core 2 implementation. To be more specific, I have been able to type "id" and "newrole", but not able to type "rlpkg" and "run_init". Re-labeling a file system is something they do with "cd /etc/security/selinux/src/plicy; make relabel", but I was unable to find the equivalent. I have a very specific issue that I'm trying to figure out. For some reason, when a role violation (perhaps there's a better phrase) occurs and a log message is produced in /var/log/messages, I would like see a user id and the context. For example in "Getting Started with SE Linux HOWTO (7. Explanation of log file messages) the example show the following scontext: scontext: faye:user_r:user_t This is great, as I would know to contact the user faye and ask about the situation. But on my Fedora Core 2 machine, my /var/log/messages produces: scontext: user_u:user_r:user_t This is not so useful. As I have no idea who user_u is. I am using NIS for this system. Typing "id" on my system produces: uid=706(dan) gid=20(games) groups=20(games),501(test) context=user_u:user_r:user_t So I guess everything is consistent with the log entry as far as the system is concerned. I just don't want a generic user_u to get filled in for violations. I want the specific user id and name. Perhaps I need to configure some more stuff for use with NIS? Daniel J. Levine Section Supervisor Johns Hopkins University Applied Physics Laboratory 443-778-3952 240-228-3952

2 1

strange audit messages.
by Russell Coker 09 Jun '04

09 Jun '04

I've attached a small snippet of dmesg output (produced by "dmesg > file"). It's from kernel 2.6.5-1.358. Notice that there are >130 spaces at the start of some lines, and those lines also have their data truncated. It looks as if some memcpy has a bad offset. Arjan and Steve, is this a known bug that's solved in the latest 2.6.6 kernel? -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

1 0

Can not access files in own home directory
by David Balazic 09 Jun '04

09 Jun '04

Hi! First, is SELinux supposed to work in Fedora Core 2 or is it in beta(alpha) phase ? Because I get a failure right 5 minutes after installation. I did a SELinux enabled install of FC2 ( Workstation type ). In firstboot I created a user. The I tried to log in on VC2 as that user and it gave a SELinux access denied error. bash was denied access to /home/me/.bash_profile The I issued a "ls -a" command and it could only list the file names, but not the properties, again, access was denied. So is SELinux there to be used or to be yet developed ? Or was this an accidental bug ? Should I bugzilla it ? Regards, David ---------------------------------------------------------------------------- ----------- http://noepatents.org/ Innovation, not litigation ! --- David Balazic mailto:david.balazic@hermes.si HERMES Softlab http://www.hermes-softlab.com Zagrebska cesta 104 Phone: +386 2 450 8851 SI-2000 Maribor Slovenija ---------------------------------------------------------------------------- ----------- "Be excellent to each other." - Bill S. Preston, Esq. & "Ted" Theodore Logan ---------------------------------------------------------------------------- -----------

3 2

other avc denied messages
by Richard Hally 09 Jun '04

09 Jun '04

Attached is a syslog messages file that contains avc denied messages from running in enforcing mode. Near the beginning of this file there are avc messages from running 'yum update' to pickup yesterdays updates. there were no errors reported by yum/rpm during this update. Further along in the file are some avc messages that were produced after rebooting in enforcing mode with the "single" option on the kernel line, doing a fixfiles relabel and then continuing to runlevel 5. HTH Richard Hally [root@old1 richard]# rpm -q selinux-policy-strict selinux-policy-strict-1.13.4-2 Jun 9 00:14:45 old1 syslogd 1.4.1: restart. Jun 9 00:48:15 old1 kernel: audit(1086756495.137:0): avc: denied { search } for pid=8893 exe=/usr/sbin/useradd name=selinux dev=hdc3 ino=1750488 scontext=root:sysadm_r:useradd_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 9 00:48:51 old1 kernel: audit(1086756531.819:0): avc: granted { load_policy } for pid=8902 exe=/usr/sbin/load_policy scontext=root:sysadm_r:load_policy_t tcontext=system_u:object_r:security_t tclass=security Jun 9 00:48:52 old1 kernel: security: 6 users, 7 roles, 1248 types, 1 bools Jun 9 00:48:52 old1 kernel: security: 42 classes, 306765 rules Jun 9 00:49:08 old1 xinetd[2095]: Starting reconfiguration Jun 9 00:49:08 old1 xinetd: xinetd -HUP succeeded Jun 9 00:49:13 old1 xinetd[2095]: Swapping defaults Jun 9 00:49:13 old1 xinetd[2095]: Reconfigured: new=0 old=0 dropped=0 (services) Jun 9 00:49:53 old1 kernel: audit(1086756592.987:0): avc: granted { load_policy } for pid=8977 exe=/usr/sbin/load_policy scontext=root:sysadm_r:load_policy_t tcontext=system_u:object_r:security_t tclass=security Jun 9 00:49:53 old1 kernel: security: 6 users, 7 roles, 1257 types, 1 bools Jun 9 00:49:53 old1 kernel: security: 42 classes, 310475 rules Jun 9 00:49:53 old1 kernel: security: invalidating context system_u:object_r:netsaint_exec_t Jun 9 00:49:53 old1 kernel: security: invalidating context system_u:object_r:netsaint_etc_t Jun 9 00:49:53 old1 kernel: security: invalidating context system_u:object_r:netsaint_log_t Jun 9 00:49:53 old1 kernel: security: invalidating context system_u:object_r:netsaint_cgi_exec_t Jun 9 00:49:53 old1 kernel: security: invalidating context system_u:object_r:canna_tmp_t Jun 9 00:51:25 old1 kernel: audit(1086756685.811:0): avc: denied { search } for pid=8985 exe=/usr/sbin/groupadd name=selinux dev=hdc3 ino=1750488 scontext=root:sysadm_r:groupadd_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 9 00:51:26 old1 kernel: audit(1086756686.216:0): avc: denied { search } for pid=8986 exe=/usr/sbin/groupadd name=selinux dev=hdc3 ino=1750488 scontext=root:sysadm_r:groupadd_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 9 00:51:26 old1 kernel: audit(1086756686.221:0): avc: denied { search } for pid=8987 exe=/usr/sbin/groupadd name=selinux dev=hdc3 ino=1750488 scontext=root:sysadm_r:groupadd_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 9 00:51:26 old1 kernel: audit(1086756686.350:0): avc: denied { search } for pid=8988 exe=/usr/sbin/useradd name=selinux dev=hdc3 ino=1750488 scontext=root:sysadm_r:useradd_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 9 00:54:34 old1 kernel: audit(1086756874.773:0): avc: denied { search } for pid=9388 exe=/usr/sbin/userdel name=selinux dev=hdc3 ino=1750488 scontext=root:sysadm_r:useradd_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 9 00:54:35 old1 kernel: audit(1086756875.387:0): avc: denied { search } for pid=9389 exe=/usr/sbin/useradd name=selinux dev=hdc3 ino=1750488 scontext=root:sysadm_r:useradd_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 9 00:55:50 old1 kernel: audit(1086756950.873:0): avc: denied { search } for pid=9445 exe=/usr/sbin/useradd name=selinux dev=hdc3 ino=1750488 scontext=root:sysadm_r:useradd_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 9 00:56:07 old1 xinetd[2095]: Starting reconfiguration Jun 9 00:56:07 old1 xinetd: xinetd -HUP succeeded Jun 9 00:56:10 old1 xinetd[2095]: Swapping defaults Jun 9 00:56:10 old1 xinetd[2095]: Reconfigured: new=0 old=0 dropped=0 (services) Jun 9 00:56:49 old1 cups: cupsd -HUP succeeded Jun 9 00:56:51 old1 kernel: audit(1086757011.394:0): avc: denied { execute } for pid=9481 exe=/bin/bash name=epson dev=hdc3 ino=575379 scontext=system_u:system_r:cupsd_t tcontext=system_u:object_r:lib_t tclass=file Jun 9 00:56:51 old1 kernel: audit(1086757011.532:0): avc: denied { execute } for pid=9482 exe=/bin/bash name=canon dev=hdc3 ino=575374 scontext=system_u:system_r:cupsd_t tcontext=system_u:object_r:lib_t tclass=file Jun 9 01:01:48 old1 sshd: sshd -TERM succeeded Jun 9 01:01:52 old1 sshd: succeeded Jun 9 01:01:54 old1 bluetooth: hciattach shutdown failed Jun 9 01:01:54 old1 kernel: Bluetooth: Core ver 2.5 Jun 9 01:01:54 old1 kernel: NET: Registered protocol family 31 Jun 9 01:01:54 old1 kernel: Bluetooth: HCI device and connection manager initialized Jun 9 01:01:54 old1 kernel: Bluetooth: HCI socket layer initialized Jun 9 01:01:54 old1 kernel: Bluetooth: L2CAP ver 2.2 Jun 9 01:01:54 old1 kernel: Bluetooth: L2CAP socket layer initialized Jun 9 01:01:54 old1 kernel: Bluetooth: RFCOMM ver 1.3 Jun 9 01:01:54 old1 kernel: Bluetooth: RFCOMM socket layer initialized Jun 9 01:01:54 old1 kernel: Bluetooth: RFCOMM TTY layer initialized Jun 9 01:01:54 old1 bluetooth: sdpd shutdown failed Jun 9 01:01:54 old1 bluetooth: hcid shutdown failed Jun 9 01:02:32 old1 su(pam_unix)[8779]: session closed for user root Jun 9 01:04:26 old1 gpm[2185]: *** info [mice.c(1766)]: Jun 9 01:04:26 old1 gpm[2185]: imps2: Auto-detected intellimouse PS/2 Jun 9 01:04:35 old1 login(pam_unix)[2397]: session opened for user root by (uid=0) Jun 9 01:04:35 old1 -- root[2397]: ROOT LOGIN ON tty1 Jun 9 01:04:46 old1 shutdown: shutting down for system reboot Jun 9 01:04:46 old1 init: Switching to runlevel: 6 Jun 9 01:04:47 old1 login(pam_unix)[2397]: session closed for user root Jun 9 01:04:48 old1 udev[9806]: removing device node '/udev/vcsa3' Jun 9 01:04:51 old1 udev[9801]: removing device node '/udev/vcs3' Jun 9 01:04:51 old1 udev[9807]: removing device node '/udev/vcs4' Jun 9 01:04:51 old1 udev[9810]: removing device node '/udev/vcsa5' Jun 9 01:04:51 old1 udev[9818]: removing device node '/udev/vcsa6' Jun 9 01:04:51 old1 udev[9798]: removing device node '/udev/vcsa2' Jun 9 01:04:51 old1 udev[9811]: removing device node '/udev/vcs6' Jun 9 01:04:51 old1 udev[9795]: removing device node '/udev/vcs2' Jun 9 01:04:51 old1 udev[9809]: removing device node '/udev/vcs5' Jun 9 01:04:51 old1 udev[9808]: removing device node '/udev/vcsa4' Jun 9 01:04:54 old1 gdm(pam_unix)[2852]: session closed for user richard Jun 9 01:04:56 old1 messagebus: messagebus -TERM succeeded Jun 9 01:04:57 old1 atd: atd shutdown succeeded Jun 9 01:04:59 old1 privoxy: privoxy shutdown succeeded Jun 9 01:05:01 old1 cups: cupsd shutdown succeeded Jun 9 01:05:01 old1 udev[9916]: removing device node '/udev/vcsa7' Jun 9 01:05:01 old1 udev[9905]: removing device node '/udev/vcs7' Jun 9 01:05:01 old1 xfs[2287]: terminating Jun 9 01:05:01 old1 xfs: xfs shutdown succeeded Jun 9 01:05:02 old1 gpm: gpm shutdown succeeded Jun 9 01:05:02 old1 sshd: sshd -TERM succeeded Jun 9 01:05:03 old1 sendmail: sendmail shutdown succeeded Jun 9 01:05:03 old1 sendmail: sm-client shutdown failed Jun 9 01:05:04 old1 spamassassin: spamd shutdown succeeded Jun 9 01:05:05 old1 lisa: lisa shutdown succeeded Jun 9 01:05:05 old1 smartd[1930]: smartd received signal 15: Terminated Jun 9 01:05:05 old1 smartd[1930]: smartd is exiting (exit status 0) Jun 9 01:05:06 old1 smartd: smartd shutdown succeeded Jun 9 01:05:06 old1 xinetd[2095]: Exiting... Jun 9 01:05:06 old1 xinetd: xinetd shutdown succeeded Jun 9 01:05:06 old1 crond: crond shutdown succeeded Jun 9 01:05:07 old1 apmd[1890]: Exiting Jun 9 01:05:08 old1 apmd: apmd shutdown succeeded Jun 9 01:05:08 old1 ntpd: succeeded Jun 9 01:05:08 old1 ntpd: succeeded Jun 9 01:05:08 old1 ntpd[2119]: ntpd exiting on signal 15 Jun 9 01:05:08 old1 ntpd: ntpd shutdown succeeded Jun 9 01:05:09 old1 dd: 1+0 records in Jun 9 01:05:09 old1 dd: 1+0 records out Jun 9 01:05:09 old1 random: Saving random seed: succeeded Jun 9 01:05:09 old1 rpc.statd[1818]: Caught signal 15, un-registering and exiting. Jun 9 01:05:10 old1 nfslock: rpc.statd shutdown succeeded Jun 9 01:05:10 old1 portmap: portmap shutdown succeeded Jun 9 01:05:10 old1 kernel: Kernel logging (proc) stopped. Jun 9 01:05:10 old1 kernel: Kernel log daemon terminating. Jun 9 01:05:12 old1 syslog: klogd shutdown succeeded Jun 9 01:05:12 old1 exiting on signal 15 Jun 9 01:24:45 old1 syslogd 1.4.1: restart. Jun 9 01:24:45 old1 syslog: syslogd startup succeeded Jun 9 01:24:45 old1 syslog: klogd startup succeeded Jun 9 01:24:45 old1 kernel: klogd 1.4.1, log source = /proc/kmsg started. Jun 9 01:24:45 old1 kernel: Linux version 2.6.6-1.422 (bhcompile(a)porky.devel.redhat.com) (gcc version 3.3.3 20040412 (Red Hat Linux 3.3.3-7)) #1 Fri Jun 4 13:00:45 EDT 2004 Jun 9 01:24:45 old1 kernel: BIOS-provided physical RAM map: Jun 9 01:24:45 old1 kernel: BIOS-e820: 0000000000000000 - 000000000009fc00 (usable) Jun 9 01:24:45 old1 kernel: BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved) Jun 9 01:24:45 old1 kernel: BIOS-e820: 00000000000e0000 - 0000000000100000 (reserved) Jun 9 01:24:45 old1 kernel: BIOS-e820: 0000000000100000 - 0000000010000000 (usable) Jun 9 01:24:45 old1 kernel: BIOS-e820: 00000000fec00000 - 00000000fec01000 (reserved) Jun 9 01:24:45 old1 kernel: BIOS-e820: 00000000fee00000 - 00000000fee01000 (reserved) Jun 9 01:24:45 old1 kernel: BIOS-e820: 00000000fffc0000 - 0000000100000000 (reserved) Jun 9 01:24:45 old1 kernel: 0MB HIGHMEM available. Jun 9 01:24:45 old1 kernel: 256MB LOWMEM available. Jun 9 01:24:45 old1 kernel: zapping low mappings. Jun 9 01:24:45 old1 kernel: On node 0 totalpages: 65536 Jun 9 01:24:45 old1 kernel: DMA zone: 4096 pages, LIFO batch:1 Jun 9 01:24:45 old1 kernel: Normal zone: 61440 pages, LIFO batch:15 Jun 9 01:24:45 old1 kernel: HighMem zone: 0 pages, LIFO batch:1 Jun 9 01:24:45 old1 kernel: DMI 2.1 present. Jun 9 01:24:45 old1 kernel: ACPI disabled because your bios is from 00 and too old Jun 9 01:24:45 old1 kernel: You can enable it with acpi=force Jun 9 01:24:45 old1 kernel: Built 1 zonelists Jun 9 01:24:45 old1 kernel: Kernel command line: ro root=LABEL=/1 rhgb selinux=1 single Jun 9 01:24:45 old1 kernel: mapped 4G/4G trampoline to ffff3000. Jun 9 01:24:45 old1 kernel: Initializing CPU#0 Jun 9 01:24:45 old1 kernel: CPU 0 irqstacks, hard=02346000 soft=02345000 Jun 9 01:24:45 old1 irqbalance: irqbalance startup succeeded Jun 9 01:24:45 old1 kernel: PID hash table entries: 2048 (order 11: 16384 bytes) Jun 9 01:24:45 old1 kernel: Detected 501.208 MHz processor. Jun 9 01:24:45 old1 kernel: Using tsc for high-res timesource Jun 9 01:24:45 old1 kernel: Console: colour VGA+ 80x25 Jun 9 01:24:45 old1 kernel: Memory: 256464k/262144k available (1548k kernel code, 4952k reserved, 607k data, 144k init, 0k highmem) Jun 9 01:24:45 old1 kernel: Calibrating delay loop... 991.23 BogoMIPS Jun 9 01:24:45 old1 kernel: Security Scaffold v1.0.0 initialized Jun 9 01:24:45 old1 kernel: SELinux: Initializing. Jun 9 01:24:45 old1 kernel: SELinux: Starting in permissive mode Jun 9 01:24:45 old1 kernel: There is already a security framework initialized, register_security failed. Jun 9 01:24:45 old1 kernel: selinux_register_security: Registering secondary module capability Jun 9 01:24:45 old1 kernel: Capability LSM initialized as secondary Jun 9 01:24:45 old1 kernel: Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Jun 9 01:24:45 old1 kernel: Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) Jun 9 01:24:45 old1 kernel: Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Jun 9 01:24:45 old1 kernel: CPU: L1 I cache: 16K, L1 D cache: 16K Jun 9 01:24:45 old1 kernel: CPU: L2 cache: 512K Jun 9 01:24:45 old1 kernel: Intel machine check architecture supported. Jun 9 01:24:45 old1 kernel: Intel machine check reporting enabled on CPU#0. Jun 9 01:24:45 old1 kernel: CPU: Intel Pentium III (Katmai) stepping 03 Jun 9 01:24:45 old1 kernel: Enabling fast FPU save and restore... done. Jun 9 01:24:45 old1 kernel: Enabling unmasked SIMD FPU exception support... done. Jun 9 01:24:45 old1 kernel: Checking 'hlt' instruction... OK. Jun 9 01:24:45 old1 kernel: checking if image is initramfs...it isn't (no cpio magic); looks like an initrd Jun 9 01:24:45 old1 kernel: Freeing initrd memory: 187k freed Jun 9 01:24:45 old1 kernel: NET: Registered protocol family 16 Jun 9 01:24:45 old1 kernel: PCI: PCI BIOS revision 2.10 entry at 0xfdb91, last bus=1 Jun 9 01:24:45 old1 kernel: PCI: Using configuration type 1 Jun 9 01:24:45 old1 kernel: mtrr: v2.0 (20020519) Jun 9 01:24:45 old1 kernel: ACPI: Subsystem revision 20040326 Jun 9 01:24:45 old1 kernel: ACPI: Interpreter disabled. Jun 9 01:24:45 old1 kernel: Linux Plug and Play Support v0.97 (c) Adam Belay Jun 9 01:24:45 old1 kernel: usbcore: registered new driver usbfs Jun 9 01:24:45 old1 kernel: usbcore: registered new driver hub Jun 9 01:24:45 old1 kernel: PCI: Probing PCI hardware Jun 9 01:24:45 old1 kernel: PCI: Probing PCI hardware (bus 00) Jun 9 01:24:45 old1 kernel: PCI: Using IRQ router PIIX/ICH [8086/7110] at 0000:00:07.0 Jun 9 01:24:45 old1 kernel: vesafb: probe of vesafb0 failed with error -6 Jun 9 01:24:45 old1 kernel: apm: BIOS version 1.2 Flags 0x03 (Driver version 1.16ac) Jun 9 01:24:45 old1 kernel: audit: initializing netlink socket (disabled) Jun 9 01:24:45 old1 kernel: audit(1086743191.4294966944:0): initialized Jun 9 01:24:45 old1 kernel: Total HugeTLB memory allocated, 0 Jun 9 01:24:45 old1 kernel: VFS: Disk quotas dquot_6.5.1 Jun 9 01:24:45 old1 kernel: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) Jun 9 01:24:45 old1 kernel: SELinux: Registering netfilter hooks Jun 9 01:24:45 old1 kernel: Initializing Cryptographic API Jun 9 01:24:45 old1 kernel: Limiting direct PCI/PCI transfers. Jun 9 01:24:45 old1 kernel: pci_hotplug: PCI Hot Plug PCI Core version: 0.5 Jun 9 01:24:45 old1 kernel: isapnp: Scanning for PnP cards... Jun 9 01:24:45 old1 kernel: isapnp: No Plug & Play device found Jun 9 01:24:45 old1 kernel: Real Time Clock Driver v1.12 Jun 9 01:24:45 old1 kernel: Linux agpgart interface v0.100 (c) Dave Jones Jun 9 01:24:45 old1 kernel: agpgart: Detected an Intel 440BX Chipset. Jun 9 01:24:45 old1 kernel: agpgart: Maximum main memory to use for agp memory: 204M Jun 9 01:24:45 old1 kernel: agpgart: AGP aperture is 64M @ 0xf8000000 Jun 9 01:24:45 old1 kernel: Serial: 8250/16550 driver $Revision: 1.90 $ 8 ports, IRQ sharing enabled Jun 9 01:24:45 old1 kernel: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A Jun 9 01:24:45 old1 kernel: ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A Jun 9 01:24:45 old1 kernel: RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize Jun 9 01:24:45 old1 kernel: Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2 Jun 9 01:24:45 old1 kernel: ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx Jun 9 01:24:45 old1 kernel: PIIX4: IDE controller at PCI slot 0000:00:07.1 Jun 9 01:24:45 old1 kernel: PIIX4: chipset revision 1 Jun 9 01:24:45 old1 portmap: portmap startup succeeded Jun 9 01:24:45 old1 kernel: PIIX4: not 100%% native mode: will probe irqs later Jun 9 01:24:45 old1 kernel: ide0: BM-DMA at 0xffa0-0xffa7, BIOS settings: hda:DMA, hdb:pio Jun 9 01:24:45 old1 kernel: ide1: BM-DMA at 0xffa8-0xffaf, BIOS settings: hdc:DMA, hdd:DMA Jun 9 01:24:45 old1 kernel: hda: ST313021A, ATA DISK drive Jun 9 01:24:45 old1 kernel: Using cfq io scheduler Jun 9 01:24:46 old1 kernel: ide0 at 0x1f0-0x1f7,0x3f6 on irq 14 Jun 9 01:24:46 old1 kernel: hdc: Maxtor 6E040L0, ATA DISK drive Jun 9 01:24:46 old1 kernel: hdd: SAMSUNG DVD-ROM SD-608, ATAPI CD/DVD-ROM drive Jun 9 01:24:46 old1 kernel: ide1 at 0x170-0x177,0x376 on irq 15 Jun 9 01:24:46 old1 kernel: hda: max request size: 128KiB Jun 9 01:24:46 old1 rpc.statd[2093]: Version 1.0.6 Starting Jun 9 01:24:46 old1 kernel: hda: 25434228 sectors (13022 MB) w/512KiB Cache, CHS=25232/16/63, UDMA(33) Jun 9 01:24:46 old1 kernel: hda: hda1 hda2 hda3 hda4 < hda5 > Jun 9 01:24:46 old1 nfslock: rpc.statd startup succeeded Jun 9 01:24:46 old1 kernel: hdc: max request size: 128KiB Jun 9 01:24:46 old1 kernel: hdc: 80293248 sectors (41110 MB) w/2048KiB Cache, CHS=65535/16/63, UDMA(33) Jun 9 01:24:46 old1 kernel: hdc: hdc1 hdc2 hdc3 hdc4 < hdc5 > Jun 9 01:24:46 old1 kernel: hdd: ATAPI 32X DVD-ROM drive, 512kB Cache, DMA Jun 9 01:24:46 old1 kernel: Uniform CD-ROM driver Revision: 3.20 Jun 9 01:24:46 old1 kernel: ide-floppy driver 0.99.newide Jun 9 01:24:46 old1 kernel: usbcore: registered new driver hiddev Jun 9 01:24:46 old1 kernel: usbcore: registered new driver usbhid Jun 9 01:24:46 old1 kernel: drivers/usb/input/hid-core.c: v2.0:USB HID core driver Jun 9 01:24:46 old1 kernel: mice: PS/2 mouse device common for all mice Jun 9 01:24:46 old1 kernel: serio: i8042 AUX port at 0x60,0x64 irq 12 Jun 9 01:24:46 old1 kernel: input: PS/2 Generic Mouse on isa0060/serio1 Jun 9 01:24:46 old1 kernel: serio: i8042 KBD port at 0x60,0x64 irq 1 Jun 9 01:24:46 old1 kernel: input: AT Translated Set 2 keyboard on isa0060/serio0 Jun 9 01:24:46 old1 kernel: md: md driver 0.90.0 MAX_MD_DEVS=256, MD_SB_DISKS=27 Jun 9 01:24:46 old1 kernel: NET: Registered protocol family 2 Jun 9 01:24:46 old1 kernel: IP: routing cache hash table of 2048 buckets, 16Kbytes Jun 9 01:24:46 old1 kernel: TCP: Hash tables configured (established 16384 bind 32768) Jun 9 01:24:46 old1 kernel: Initializing IPsec netlink socket Jun 9 01:24:46 old1 kernel: NET: Registered protocol family 1 Jun 9 01:24:46 old1 kernel: NET: Registered protocol family 17 Jun 9 01:24:46 old1 kernel: md: Autodetecting RAID arrays. Jun 9 01:24:46 old1 kernel: md: autorun ... Jun 9 01:24:46 old1 kernel: md: ... autorun DONE. Jun 9 01:24:46 old1 kernel: RAMDISK: Compressed image found at block 0 Jun 9 01:24:46 old1 kernel: VFS: Mounted root (ext2 filesystem). Jun 9 01:24:46 old1 kernel: kjournald starting. Commit interval 5 seconds Jun 9 01:24:46 old1 kernel: EXT3-fs: mounted filesystem with ordered data mode. Jun 9 01:24:46 old1 kernel: Freeing unused kernel memory: 144k freed Jun 9 01:24:46 old1 kernel: security: 6 users, 7 roles, 1257 types, 1 bools Jun 9 01:24:46 old1 kernel: security: 42 classes, 310475 rules Jun 9 01:24:46 old1 kernel: SELinux: Completing initialization. Jun 9 01:24:46 old1 kernel: SELinux: Setting up existing superblocks. Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev hdc3, type ext3), uses xattr Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev ram0, type ext2), uses xattr Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev mqueue, type mqueue), not configured for labeling Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev hugetlbfs, type hugetlbfs), not configured for labeling Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev devpts, type devpts), uses transition SIDs Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev eventpollfs, type eventpollfs), uses genfs_contexts Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev pipefs, type pipefs), uses task SIDs Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev futexfs, type futexfs), uses genfs_contexts Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev sockfs, type sockfs), uses task SIDs Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev proc, type proc), uses genfs_contexts Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev bdev, type bdev), uses genfs_contexts Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts Jun 9 01:24:46 old1 kernel: USB Universal Host Controller Interface driver v2.2 Jun 9 01:24:46 old1 kernel: PCI: Found IRQ 9 for device 0000:00:07.2 Jun 9 01:24:46 old1 kernel: PCI: Sharing IRQ 9 with 0000:00:0b.0 Jun 9 01:24:46 old1 kernel: uhci_hcd 0000:00:07.2: UHCI Host Controller Jun 9 01:24:46 old1 kernel: uhci_hcd 0000:00:07.2: irq 9, io base 0000ef80 Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev usbdevfs, type usbdevfs), uses genfs_contexts Jun 9 01:24:46 old1 kernel: SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts Jun 9 01:24:46 old1 kernel: uhci_hcd 0000:00:07.2: new USB bus registered, assigned bus number 1 Jun 9 01:24:46 old1 kernel: hub 1-0:1.0: USB hub found Jun 9 01:24:46 old1 kernel: hub 1-0:1.0: 2 ports detected Jun 9 01:24:46 old1 kernel: EXT3 FS on hdc3, internal journal Jun 9 01:24:46 old1 kernel: device-mapper: 4.1.0-ioctl (2003-12-10) initialised: dm(a)uk.sistina.com Jun 9 01:24:46 old1 kernel: cdrom: open failed. Jun 9 01:24:46 old1 kernel: Adding 524120k swap on /dev/hdc5. Priority:-1 extents:1 Jun 9 01:24:46 old1 kernel: Adding 522072k swap on /dev/hda5. Priority:-2 extents:1 Jun 9 01:24:46 old1 kernel: kjournald starting. Commit interval 5 seconds Jun 9 01:24:47 old1 kernel: EXT3 FS on hdc2, internal journal Jun 9 01:24:47 old1 kernel: EXT3-fs: mounted filesystem with ordered data mode. Jun 9 01:24:47 old1 kernel: SELinux: initialized (dev hdc2, type ext3), uses xattr Jun 9 01:24:47 old1 kernel: SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs Jun 9 01:24:47 old1 kernel: IA-32 Microcode Update Driver: v1.13 <tigran(a)veritas.com> Jun 9 01:24:47 old1 kernel: microcode: CPU0 already at revision 0xe (current=0xe) Jun 9 01:24:47 old1 kernel: microcode: No new microdata for cpu 0 Jun 9 01:24:47 old1 kernel: parport0: PC-style at 0x378 [PCSPP,TRISTATE] Jun 9 01:24:47 old1 kernel: SCSI subsystem initialized Jun 9 01:24:47 old1 kernel: inserting floppy driver for 2.6.6-1.422 Jun 9 01:24:47 old1 kernel: Floppy drive(s): fd0 is 1.44M Jun 9 01:24:47 old1 kernel: FDC 0 is a post-1991 82077 Jun 9 01:24:47 old1 kernel: Linux Tulip driver version 1.1.13 (May 11, 2002) Jun 9 01:24:47 old1 kernel: PCI: Found IRQ 10 for device 0000:00:12.0 Jun 9 01:24:47 old1 kernel: tulip0: MII transceiver #1 config 1000 status 786d advertising 05e1. Jun 9 01:24:47 old1 kernel: eth0: ADMtek Comet rev 17 at 0x1285a800, 00:20:78:11:A3:B7, IRQ 10. Jun 9 01:24:47 old1 kernel: ip_tables: (C) 2000-2002 Netfilter core team Jun 9 01:24:47 old1 kernel: ip_conntrack version 2.1 (2048 buckets, 16384 max) - 296 bytes per conntrack Jun 9 01:24:47 old1 kernel: Linux Tulip driver version 1.1.13 (May 11, 2002) Jun 9 01:24:47 old1 kernel: PCI: Found IRQ 10 for device 0000:00:12.0 Jun 9 01:24:47 old1 kernel: tulip0: MII transceiver #1 config 1000 status 786d advertising 05e1. Jun 9 01:24:47 old1 kernel: eth0: ADMtek Comet rev 17 at 0x128fb800, 00:20:78:11:A3:B7, IRQ 10. Jun 9 01:24:47 old1 kernel: eth0: Setting full-duplex based on MII#1 link partner capability of 45e1. Jun 9 01:24:45 old1 ifup: done. Jun 9 01:24:45 old1 network: Bringing up interface eth0: succeeded Jun 9 01:24:52 old1 kernel: SELinux: initialized (dev rpc_pipefs, type rpc_pipefs), uses genfs_contexts Jun 9 01:24:52 old1 rpcidmapd: rpc.idmapd startup succeeded Jun 9 01:24:52 old1 random: Initializing random number generator: succeeded Jun 9 01:24:52 old1 netfs: Mounting other filesystems: succeeded Jun 9 01:24:52 old1 apmd[2165]: Version 3.0.2 (APM BIOS 1.2, Linux driver 1.16ac) Jun 9 01:24:52 old1 apmd: apmd startup succeeded Jun 9 01:24:53 old1 autofs: automount startup succeeded Jun 9 01:24:53 old1 smartd[2203]: smartd version 5.30 Copyright (C) 2002-4 Bruce Allen Jun 9 01:24:53 old1 smartd[2203]: Home page is http://smartmontools.sourceforge.net/ Jun 9 01:24:53 old1 smartd[2203]: Opened configuration file /etc/smartd.conf Jun 9 01:24:53 old1 smartd[2203]: Configuration file /etc/smartd.conf parsed. Jun 9 01:24:53 old1 smartd[2203]: Device: /dev/hda, opened Jun 9 01:24:53 old1 smartd[2203]: Device: /dev/hda, not found in smartd database. Jun 9 01:24:53 old1 smartd[2203]: Device: /dev/hda, is SMART capable. Adding to "monitor" list. Jun 9 01:24:53 old1 smartd[2203]: Monitoring 1 ATA and 0 SCSI devices Jun 9 01:24:53 old1 smartd[2205]: smartd has fork()ed into background mode. New PID=2205. Jun 9 01:24:53 old1 smartd: smartd startup succeeded Jun 9 01:24:54 old1 apmd[2165]: Charge: * * * (-1% unknown) Jun 9 01:24:55 old1 kernel: parport0: PC-style at 0x378 [PCSPP,TRISTATE] Jun 9 01:24:55 old1 kernel: lp0: using parport0 (polling). Jun 9 01:24:55 old1 kernel: lp0: console ready Jun 9 01:24:58 old1 kernel: drivers/usb/serial/usb-serial.c: USB Serial support registered for Generic Jun 9 01:24:58 old1 kernel: usbcore: registered new driver usbserial Jun 9 01:24:58 old1 kernel: drivers/usb/serial/usb-serial.c: USB Serial Driver core v2.0 Jun 9 01:24:59 old1 cups: cupsd startup succeeded Jun 9 01:25:00 old1 kernel: NET: Registered protocol family 10 Jun 9 01:25:00 old1 kernel: Disabled Privacy Extensions on device 022deac0(lo) Jun 9 01:25:00 old1 kernel: IPv6 over IPv4 tunneling driver Jun 9 01:25:00 old1 sshd: succeeded Jun 9 01:25:00 old1 xinetd: xinetd startup succeeded Jun 9 01:25:00 old1 ntpd: succeeded Jun 9 01:25:00 old1 ntpd: succeeded Jun 9 01:25:00 old1 xinetd[2392]: xinetd Version 2.3.13 started with libwrap loadavg options compiled in. Jun 9 01:25:00 old1 xinetd[2392]: Started working: 0 available services Jun 9 01:25:01 old1 ntpdate[2412]: step time server 209.132.176.4 offset -0.386053 sec Jun 9 01:25:01 old1 ntpd: succeeded Jun 9 01:25:01 old1 ntpd[2416]: ntpd 4.2.0(a)1.1161-r Thu Mar 11 11:46:39 EST 2004 (1) Jun 9 01:25:01 old1 ntpd: ntpd startup succeeded Jun 9 01:25:01 old1 ntpd[2416]: precision = 2.000 usec Jun 9 01:25:01 old1 ntpd[2416]: kernel time sync status 0040 Jun 9 01:25:01 old1 ntpd[2416]: frequency initialized 92.348 PPM from /var/lib/ntp/drift Jun 9 01:25:01 old1 ntpd[2416]: configure: keyword "authenticate" unknown, line ignored Jun 9 01:25:02 old1 sendmail: sendmail startup succeeded Jun 9 01:25:02 old1 sendmail: sm-client startup succeeded Jun 9 01:25:05 old1 udev[2456]: creating device node '/udev/lp0' Jun 9 01:25:05 old1 kernel: audit(1086758705.111:0): avc: denied { execute } for pid=2463 exe=/bin/bash name=net.agent dev=hdc3 ino=1733450 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:hotplug_etc_t tclass=file Jun 9 01:25:06 old1 spamassassin: spamd startup succeeded Jun 9 01:25:07 old1 privoxy: Jun 09 01:25:07 Privoxy(-150888320) Info: loading configuration file '/etc/privoxy/config': Jun 9 01:25:08 old1 privoxy: privoxy startup succeeded Jun 9 01:25:08 old1 gpm[2492]: *** info [startup.c(95)]: Jun 9 01:25:08 old1 gpm[2492]: Started gpm successfully. Entered daemon mode. Jun 9 01:25:08 old1 gpm[2492]: *** info [mice.c(1766)]: Jun 9 01:25:08 old1 gpm[2492]: imps2: Auto-detected intellimouse PS/2 Jun 9 01:25:08 old1 gpm: gpm startup succeeded Jun 9 01:25:09 old1 su(pam_unix)[2507]: session opened for user postgres by (uid=0) Jun 9 01:25:10 old1 su(pam_unix)[2507]: session closed for user postgres Jun 9 01:25:10 old1 kernel: audit(1086758710.518:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.518:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.519:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.520:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 2 times Jun 9 01:25:10 old1 kernel: audit(1086758710.521:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 2 times Jun 9 01:25:10 old1 kernel: audit(1086758710.522:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 2 times Jun 9 01:25:10 old1 kernel: audit(1086758710.523:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 4 times Jun 9 01:25:10 old1 kernel: audit(1086758710.524:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.524:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.525:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 2 times Jun 9 01:25:10 old1 kernel: audit(1086758710.526:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.526:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.527:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 4 times Jun 9 01:25:10 old1 kernel: audit(1086758710.528:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 4 times Jun 9 01:25:10 old1 kernel: audit(1086758710.529:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 4 times Jun 9 01:25:10 old1 kernel: audit(1086758710.530:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 4 times Jun 9 01:25:10 old1 kernel: audit(1086758710.531:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 3 times Jun 9 01:25:10 old1 kernel: audit(1086758710.532:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 4 times Jun 9 01:25:10 old1 kernel: audit(1086758710.533:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 6 times Jun 9 01:25:10 old1 kernel: audit(1086758710.534:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 4 times Jun 9 01:25:10 old1 kernel: audit(1086758710.535:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.535:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.538:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 5 times Jun 9 01:25:10 old1 kernel: audit(1086758710.539:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 6 times Jun 9 01:25:10 old1 kernel: audit(1086758710.540:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 3 times Jun 9 01:25:10 old1 kernel: audit(1086758710.541:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.541:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.542:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 3 times Jun 9 01:25:10 old1 kernel: audit(1086758710.543:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 4 times Jun 9 01:25:10 old1 kernel: audit(1086758710.544:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 last message repeated 4 times Jun 9 01:25:10 old1 kernel: audit(1086758710.545:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:10 old1 kernel: audit(1086758710.545:0): avc: denied { write } for pid=2537 exe=/usr/bin/postgres name=data dev=hdc3 ino=2405976 scontext=user_u:user_r:user_t tcontext=system_u:object_r:var_lib_t tclass=dir Jun 9 01:25:11 old1 postgresql: Starting postgresql service: failed Jun 9 01:25:11 old1 crond: crond startup succeeded Jun 9 01:25:12 old1 xfs: xfs startup succeeded Jun 9 01:25:13 old1 lisa: lisa startup succeeded Jun 9 01:25:13 old1 anacron: anacron startup succeeded Jun 9 01:25:13 old1 atd: atd startup succeeded Jun 9 01:25:13 old1 readahead: Starting background readahead: Jun 9 01:25:14 old1 rc: Starting readahead: succeeded Jun 9 01:25:15 old1 messagebus: messagebus startup succeeded Jun 9 01:25:16 old1 udev[2803]: creating device node '/udev/vcsa2' Jun 9 01:25:16 old1 udev[2806]: creating device node '/udev/vcsa3' Jun 9 01:25:16 old1 udev[2810]: creating device node '/udev/vcsa4' Jun 9 01:25:16 old1 udev[2664]: creating device node '/udev/vcs2' Jun 9 01:25:16 old1 udev[2811]: creating device node '/udev/vcsa5' Jun 9 01:25:16 old1 udev[2672]: creating device node '/udev/vcs3' Jun 9 01:25:16 old1 udev[2680]: creating device node '/udev/vcs4' Jun 9 01:25:16 old1 udev[2688]: creating device node '/udev/vcs5' Jun 9 01:25:19 old1 udev[2858]: creating device node '/udev/vcs6' Jun 9 01:25:19 old1 udev[2865]: creating device node '/udev/vcsa6' Jun 9 01:25:23 old1 udev[2847]: removing device node '/udev/vcs5' Jun 9 01:25:23 old1 udev[2953]: creating device node '/udev/vcs5' Jun 9 01:25:24 old1 udev[2911]: removing device node '/udev/vcs3' Jun 9 01:25:24 old1 udev[2898]: removing device node '/udev/vcsa2' Jun 9 01:25:24 old1 udev[2959]: creating device node '/udev/vcs3' Jun 9 01:25:24 old1 udev[2960]: creating device node '/udev/vcsa2' Jun 9 01:25:25 old1 udev[2917]: removing device node '/udev/vcs6' Jun 9 01:25:26 old1 udev[2927]: removing device node '/udev/vcs4' Jun 9 01:25:25 old1 udev[2932]: removing device node '/udev/vcsa4' Jun 9 01:25:26 old1 udev[2937]: removing device node '/udev/vcsa5' Jun 9 01:25:26 old1 udev[2922]: removing device node '/udev/vcsa6' Jun 9 01:25:26 old1 udev[2943]: removing device node '/udev/vcs2' Jun 9 01:25:26 old1 udev[2969]: creating device node '/udev/vcs6' Jun 9 01:25:26 old1 udev[2948]: removing device node '/udev/vcsa3' Jun 9 01:25:26 old1 udev[2970]: creating device node '/udev/vcs4' Jun 9 01:25:26 old1 udev[2971]: creating device node '/udev/vcsa4' Jun 9 01:25:26 old1 udev[2972]: creating device node '/udev/vcsa5' Jun 9 01:25:26 old1 udev[2973]: creating device node '/udev/vcsa6' Jun 9 01:25:26 old1 udev[2974]: creating device node '/udev/vcs2' Jun 9 01:25:26 old1 udev[2983]: creating device node '/udev/vcsa3' Jun 9 01:25:34 old1 udev[3046]: creating device node '/udev/vcs7' Jun 9 01:25:34 old1 udev[3053]: creating device node '/udev/vcsa7' Jun 9 01:25:36 old1 udev[3087]: removing device node '/udev/vcs7' Jun 9 01:25:36 old1 udev[3092]: removing device node '/udev/vcsa7' Jun 9 01:25:36 old1 udev[3097]: creating device node '/udev/vcs7' Jun 9 01:25:36 old1 udev[3098]: creating device node '/udev/vcsa7' Jun 9 01:25:46 old1 kernel: [drm] Initialized r128 2.5.0 20030725 on minor 0: Jun 9 01:25:46 old1 kernel: agpgart: Found an AGP 1.0 compliant device at 0000:00:00.0. Jun 9 01:25:46 old1 kernel: agpgart: Putting AGP V2 device at 0000:00:00.0 into 1x mode Jun 9 01:25:46 old1 kernel: agpgart: Putting AGP V2 device at 0000:01:00.0 into 1x mode Jun 9 01:25:47 old1 udev[3131]: creating device node '/udev/r128' Jun 9 01:26:07 old1 gdm(pam_unix)[3039]: session opened for user richard by (uid=0) Jun 9 01:26:19 old1 udev[3225]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 15 applied, 'controlC0' becomes 'snd/%k' Jun 9 01:26:19 old1 udev[3225]: creating device node '/udev/snd/controlC0' Jun 9 01:26:19 old1 kernel: PCI: Found IRQ 9 for device 0000:00:0b.0 Jun 9 01:26:19 old1 kernel: PCI: Sharing IRQ 9 with 0000:00:07.2 Jun 9 01:26:20 old1 udev[3288]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 17 applied, 'pcmC0D1p' becomes 'snd/%k' Jun 9 01:26:20 old1 udev[3288]: creating device node '/udev/snd/pcmC0D1p' Jun 9 01:26:20 old1 udev[3289]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 17 applied, 'pcmC0D0p' becomes 'snd/%k' Jun 9 01:26:20 old1 udev[3289]: creating device node '/udev/snd/pcmC0D0p' Jun 9 01:26:20 old1 udev[3290]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 17 applied, 'pcmC0D0c' becomes 'snd/%k' Jun 9 01:26:20 old1 udev[3290]: creating device node '/udev/snd/pcmC0D0c' Jun 9 01:26:20 old1 udev[3234]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 19 applied, 'timer' becomes 'snd/%k' Jun 9 01:26:20 old1 udev[3234]: creating device node '/udev/snd/timer' Jun 9 01:26:20 old1 udev[3247]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 18 applied, 'midiC0D0' becomes 'snd/%k' Jun 9 01:26:20 old1 udev[3247]: creating device node '/udev/snd/midiC0D0' Jun 9 01:26:20 old1 udev[3268]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 17 applied, 'pcmC0D2p' becomes 'snd/%k' Jun 9 01:26:20 old1 udev[3268]: creating device node '/udev/snd/pcmC0D2p' Jun 9 01:26:20 old1 udev[3254]: creating device node '/udev/midi' Jun 9 01:26:20 old1 udev[3261]: creating device node '/udev/dmmidi' Jun 9 01:26:23 old1 udev[3334]: creating device node '/udev/mixer' Jun 9 01:27:01 old1 su(pam_unix)[3446]: session opened for user root by richard(uid=500) Jun 9 01:29:27 old1 ntpd[2416]: synchronized to 209.132.176.4, stratum=1 Jun 9 01:33:44 old1 ntpd[2416]: kernel time sync disabled 0041 Jun 9 01:35:53 old1 ntpd[2416]: kernel time sync enabled 0001

3 2

enforcing mode update errors
by Richard Hally 09 Jun '04

09 Jun '04

Below are the error messages from running 'yum update' today while in enforcing mode. Perhaps this will be helpful to someone. warning: /etc/selinux/strict/contexts/files/file_contexts created as /etc/selinux/strict/contexts/files/file_contexts.rpmnew selinux-policy-striwarning: /etc/selinux/strict/policy/policy.17 created as /etc/selinux/strict/policy/policy.17.rpmnew selinux-policy-strict 100 % done 16/116 Can't open '/etc/selinux/strict/policy/policy.17': Permission denied warning: /etc/selinux/targeted/contexts/files/file_contexts created as /etc/selinux/targeted/contexts/files/file_contexts.rpmnew selinux-policy-targeted 100 % done 17/116 python-tools 100 % done 18/116 apr-devel 100 % done 19/116 dietlibc 100 % done 20/116 selinux-policy-strict-sources 100 % done 21/116 make: Entering directory `/etc/selinux/strict/src/policy' /usr/sbin/load_policy /etc/selinux/strict/policy/policy.`cat /selinux/policyvers` Can't open '/etc/selinux/strict/policy/policy.17': Permission denied make: *** [tmp/load] Error 2 make: Leaving directory `/etc/selinux/strict/src/policy' gimp-print-cups 100 % done 22/116 HTH Richard Hally

2 4

Re: enforcing mode problems
by Tom London 09 Jun '04

09 Jun '04

Did you remember to do a 'fixfiles relabel' after installing the new policy files? If not, I suggest you reboot single-user mode, and then run 'fixfiles relabel'. You probably want fixfiles to clean out /tmp, so move/copy anything you need before running it. tom ------------------------------------------------------------------------ * /From/: Richard Hally <rhally mindspring com> * /To/: fedora-selinux-list redhat com * /Subject/: enforcing mode problems * /Date/: Tue, 08 Jun 2004 22:43:44 -0400 ------------------------------------------------------------------------ when running with the latest "strict" policy in enforcing mode, 'su -' does not work. [richard new2 richard]$ su - Password: could not open session (ctrl-alt-f1 to a console, switch to permissive) [richard new2 richard]$ su - Password: [root new2 root]# It works but does't ask if I want a different context. When I went to the console it asked if I wanted a different context. Attached is the syslog messages file. Please see the attached messages file for other "AVC denied" messages as well. HTH Richard Hally p.s. [root new2 root]# rpm -q selinux-policy-strict selinux-policy-strict-1.13.4-2

2 1

enforcing mode problems
by Richard Hally 09 Jun '04

09 Jun '04

when running with the latest "strict" policy in enforcing mode, 'su -' does not work. [richard@new2 richard]$ su - Password: could not open session (ctrl-alt-f1 to a console, switch to permissive) [richard@new2 richard]$ su - Password: [root@new2 root]# It works but does't ask if I want a different context. When I went to the console it asked if I wanted a different context. Attached is the syslog messages file. Please see the attached messages file for other "AVC denied" messages as well. HTH Richard Hally p.s. [root@new2 root]# rpm -q selinux-policy-strict selinux-policy-strict-1.13.4-2 Jun 8 17:25:52 new2 syslogd 1.4.1: restart. Jun 8 17:30:46 new2 kernel: audit(1086730246.059:0): avc: denied { getattr } for pid=5231 exe=/usr/lib/mozilla-1.6/mozilla-bin path=/var dev=hda2 ino=423489 scontext=richard:staff_r:staff_mozilla_t tcontext=system_u:object_r:var_t tclass=dir Jun 8 17:30:46 new2 kernel: audit(1086730246.059:0): avc: denied { getattr } for pid=5231 exe=/usr/lib/mozilla-1.6/mozilla-bin path=/var/log dev=hda2 ino=423510 scontext=richard:staff_r:staff_mozilla_t tcontext=system_u:object_r:var_log_t tclass=dir Jun 8 17:30:46 new2 kernel: audit(1086730246.059:0): avc: denied { search } for pid=5231 exe=/usr/lib/mozilla-1.6/mozilla-bin name=log dev=hda2 ino=423510 scontext=richard:staff_r:staff_mozilla_t tcontext=system_u:object_r:var_log_t tclass=dir Jun 8 17:30:46 new2 kernel: audit(1086730246.059:0): avc: denied { getattr } for pid=5231 exe=/usr/lib/mozilla-1.6/mozilla-bin path=/var/log/messages.1 dev=hda2 ino=430695 scontext=richard:staff_r:staff_mozilla_t tcontext=system_u:object_r:var_log_t tclass=file Jun 8 17:39:55 new2 kernel: audit(1086730795.765:0): avc: denied { search } for pid=5352 exe=/bin/su dev=selinuxfs ino=819 scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:security_t tclass=dir Jun 8 17:39:55 new2 kernel: audit(1086730795.765:0): avc: denied { read write } for pid=5352 exe=/bin/su name=access dev=selinuxfs ino=6 scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:security_t tclass=file Jun 8 17:39:55 new2 kernel: audit(1086730795.765:0): avc: denied { compute_av } for pid=5352 exe=/bin/su scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:security_t tclass=security Jun 8 17:39:55 new2 kernel: audit(1086730795.862:0): avc: denied { sys_nice } for pid=5352 exe=/bin/su capability=23 scontext=system_u:system_r:system_crond_t tcontext=system_u:system_r:system_crond_t tclass=capability Jun 8 17:39:55 new2 su(pam_unix)[5352]: session opened for user cyrus by (uid=0) Jun 8 17:39:55 new2 kernel: audit(1086730795.862:0): avc: denied { compute_user } for pid=5352 exe=/bin/su scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:security_t tclass=security Jun 8 17:39:55 new2 kernel: audit(1086730795.877:0): avc: denied { check_context } for pid=5352 exe=/bin/su scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:security_t tclass=security Jun 8 17:39:55 new2 su[5352]: Unable to get valid context for cyrus, No valid tty Jun 8 17:39:56 new2 kernel: audit(1086730796.124:0): avc: denied { read } for pid=5359 exe=/usr/sbin/logrotate name=config dev=hda2 ino=914871 scontext=system_u:system_r:logrotate_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 17:39:56 new2 kernel: audit(1086730796.124:0): avc: denied { getattr } for pid=5359 exe=/usr/sbin/logrotate path=/etc/selinux/config dev=hda2 ino=914871 scontext=system_u:system_r:logrotate_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 17:40:14 new2 kernel: audit(1086730814.726:0): avc: denied { write } for pid=5463 exe=/bin/rm name=etc dev=hda2 ino=863265 scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:etc_t tclass=dir Jun 8 17:40:14 new2 kernel: audit(1086730814.726:0): avc: denied { remove_name } for pid=5463 exe=/bin/rm name=prelink.cache dev=hda2 ino=867904 scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:etc_t tclass=dir Jun 8 17:42:36 new2 kernel: inode_doinit_with_dentry: context_to_sid(system_u:object_r:at_exec_t) returned 22 for dev=hda2 ino=56182 Jun 8 17:42:36 new2 kernel: audit(1086730956.982:0): avc: denied { getattr } for pid=5465 exe=/usr/sbin/prelink path=/usr/bin/at dev=hda2 ino=56182 scontext=system_u:system_r:prelink_t tcontext=system_u:object_r:unlabeled_t tclass=file Jun 8 17:42:36 new2 kernel: audit(1086730956.982:0): avc: denied { read } for pid=5465 exe=/usr/sbin/prelink name=at dev=hda2 ino=56182 scontext=system_u:system_r:prelink_t tcontext=system_u:object_r:unlabeled_t tclass=file Jun 8 17:47:54 new2 kernel: audit(1086731274.451:0): avc: denied { relabelto } for pid=5465 exe=/usr/sbin/prelink name=gaim.#prelink#.YBkHcz dev=hda2 ino=1402109 scontext=system_u:system_r:prelink_t tcontext=root:object_r:bin_t tclass=file Jun 8 17:53:33 new2 kernel: audit(1086731613.764:0): avc: denied { relabelfrom } for pid=4744 exe=/bin/su name=3 dev=devpts ino=5 scontext=richard:staff_r:staff_t tcontext=root:object_r:sysadm_devpts_t tclass=chr_file Jun 8 17:53:33 new2 kernel: audit(1086731613.764:0): avc: denied { relabelto } for pid=4744 exe=/bin/su name=3 dev=devpts ino=5 scontext=richard:staff_r:staff_t tcontext=richard:object_r:staff_devpts_t tclass=chr_file Jun 8 17:53:33 new2 kernel: audit(1086731613.764:0): avc: denied { setexec } for pid=4744 exe=/bin/su scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=process Jun 8 17:53:33 new2 su(pam_unix)[4744]: session closed for user root Jun 8 18:07:31 new2 kernel: audit(1086732451.712:0): avc: denied { relabelto } for pid=5465 exe=/usr/sbin/prelink name=mini-wm.#prelink#.aQ7fcy dev=hda2 ino=59530 scontext=system_u:system_r:prelink_t tcontext=root:object_r:bin_t tclass=file Jun 8 18:15:13 new2 kernel: audit(1086732913.759:0): avc: denied { getattr } for pid=14286 exe=/usr/bin/slocate path=/initrd/dev/ram dev=ram0 ino=21 scontext=system_u:system_r:locate_t tcontext=root:object_r:file_t tclass=blk_file Jun 8 18:15:13 new2 kernel: audit(1086732913.759:0): avc: denied { getattr } for pid=14286 exe=/usr/bin/slocate path=/initrd/dev/tty2 dev=ram0 ino=22 scontext=system_u:system_r:locate_t tcontext=root:object_r:file_t tclass=chr_file Jun 8 18:15:13 new2 kernel: audit(1086732913.759:0): avc: denied { getattr } for pid=14286 exe=/usr/bin/slocate path=/initrd/dev/hda dev=ram0 ino=34 scontext=system_u:system_r:locate_t tcontext=system_u:object_r:file_t tclass=blk_file Jun 8 18:18:14 new2 kernel: inode_doinit_with_dentry: context_to_sid(system_u:object_r:at_exec_t) returned 22 for dev=hda2 ino=56182 Jun 8 18:19:13 new2 kernel: audit(1086733153.727:0): avc: denied { search } for pid=14291 exe=/bin/su dev=selinuxfs ino=819 scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:security_t tclass=dir Jun 8 18:19:13 new2 kernel: audit(1086733153.727:0): avc: denied { read write } for pid=14291 exe=/bin/su name=access dev=selinuxfs ino=6 scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:security_t tclass=file Jun 8 18:19:13 new2 kernel: audit(1086733153.727:0): avc: denied { compute_av } for pid=14291 exe=/bin/su scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:security_t tclass=security Jun 8 18:19:13 new2 kernel: audit(1086733153.900:0): avc: denied { sys_nice } for pid=14291 exe=/bin/su capability=23 scontext=system_u:system_r:system_crond_t tcontext=system_u:system_r:system_crond_t tclass=capability Jun 8 18:19:13 new2 su(pam_unix)[14291]: session opened for user news by (uid=0) Jun 8 18:19:13 new2 kernel: audit(1086733153.941:0): avc: denied { compute_user } for pid=14291 exe=/bin/su scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:security_t tclass=security Jun 8 18:19:13 new2 kernel: audit(1086733153.958:0): avc: denied { check_context } for pid=14291 exe=/bin/su scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:security_t tclass=security Jun 8 18:19:14 new2 su[14291]: Unable to get valid context for news, No valid tty Jun 8 18:19:14 new2 kernel: inode_doinit_with_dentry: context_to_sid(system_u:object_r:canna_tmp_t) returned 22 for dev=hda2 ino=1840547 Jun 8 18:19:14 new2 kernel: audit(1086733154.429:0): avc: denied { getattr } for pid=14301 exe=/usr/sbin/tmpwatch path=/tmp/.iroha_unix dev=hda2 ino=1840547 scontext=system_u:system_r:tmpreaper_t tcontext=system_u:object_r:unlabeled_t tclass=dir Jun 8 18:19:14 new2 kernel: audit(1086733154.429:0): avc: denied { search } for pid=14301 exe=/usr/sbin/tmpwatch name=.iroha_unix dev=hda2 ino=1840547 scontext=system_u:system_r:tmpreaper_t tcontext=system_u:object_r:unlabeled_t tclass=dir Jun 8 18:19:14 new2 kernel: audit(1086733154.429:0): avc: denied { read } for pid=14301 exe=/usr/sbin/tmpwatch name=.iroha_unix dev=hda2 ino=1840547 scontext=system_u:system_r:tmpreaper_t tcontext=system_u:object_r:unlabeled_t tclass=dir Jun 8 18:19:14 new2 kernel: audit(1086733154.440:0): avc: denied { setattr } for pid=14301 exe=/usr/sbin/tmpwatch name=.iroha_unix dev=hda2 ino=1840547 scontext=system_u:system_r:tmpreaper_t tcontext=system_u:object_r:unlabeled_t tclass=dir Jun 8 18:52:53 new2 kernel: audit(1086735173.433:0): avc: denied { read } for pid=14372 exe=/bin/su name=shadow dev=hda2 ino=867624 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:shadow_t tclass=file Jun 8 18:52:53 new2 kernel: audit(1086735173.433:0): avc: denied { getattr } for pid=14372 exe=/bin/su path=/etc/shadow dev=hda2 ino=867624 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:shadow_t tclass=file Jun 8 18:52:56 new2 su(pam_unix)[14372]: session opened for user root by richard(uid=500) Jun 8 18:52:56 new2 kernel: audit(1086735176.074:0): avc: denied { setuid } for pid=14373 exe=/bin/su capability=7 scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=capability Jun 8 18:52:56 new2 kernel: audit(1086735176.173:0): avc: denied { write } for pid=14374 exe=/usr/X11R6/bin/xauth name=.xauthMb5o1W dev=hda2 ino=684097 scontext=richard:staff_r:staff_xauth_t tcontext=richard:object_r:staff_home_t tclass=file Jun 8 18:52:56 new2 kernel: audit(1086735176.173:0): avc: denied { read } for pid=14374 exe=/usr/X11R6/bin/xauth name=.xauthMb5o1W dev=hda2 ino=684097 scontext=richard:staff_r:staff_xauth_t tcontext=richard:object_r:staff_home_t tclass=file Jun 8 18:52:56 new2 kernel: audit(1086735176.173:0): avc: denied { getattr } for pid=14374 exe=/usr/X11R6/bin/xauth path=/root/.xauthMb5o1W dev=hda2 ino=684097 scontext=richard:staff_r:staff_xauth_t tcontext=richard:object_r:staff_home_t tclass=file Jun 8 18:52:56 new2 kernel: audit(1086735176.181:0): avc: denied { unlink } for pid=14374 exe=/usr/X11R6/bin/xauth name=.xauthMb5o1W dev=hda2 ino=684097 scontext=richard:staff_r:staff_xauth_t tcontext=richard:object_r:staff_home_t tclass=file Jun 8 18:52:56 new2 kernel: audit(1086735176.216:0): avc: denied { relabelfrom } for pid=14372 exe=/bin/su name=4 dev=devpts ino=6 scontext=richard:staff_r:staff_t tcontext=richard:object_r:staff_devpts_t tclass=chr_file Jun 8 18:52:56 new2 kernel: audit(1086735176.216:0): avc: denied { relabelto } for pid=14372 exe=/bin/su name=4 dev=devpts ino=6 scontext=richard:staff_r:staff_t tcontext=root:object_r:sysadm_devpts_t tclass=chr_file Jun 8 18:52:56 new2 kernel: audit(1086735176.217:0): avc: denied { setexec } for pid=14372 exe=/bin/su scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=process Jun 8 18:52:56 new2 kernel: audit(1086735176.234:0): avc: denied { transition } for pid=14375 exe=/bin/su path=/bin/bash dev=hda2 ino=1384545 scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 18:52:56 new2 kernel: audit(1086735176.234:0): avc: denied { siginh } for pid=14375 exe=/bin/bash scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 18:52:56 new2 kernel: audit(1086735176.234:0): avc: denied { rlimitinh } for pid=14375 exe=/bin/bash scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 18:52:56 new2 kernel: audit(1086735176.234:0): avc: denied { noatsecure } for pid=14375 exe=/bin/bash scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 22:18:17 new2 su(pam_unix)[14611]: session opened for user root by richard(uid=0) Jun 8 22:18:25 new2 su(pam_unix)[14611]: session closed for user root Jun 8 22:18:28 new2 su(pam_unix)[14372]: session closed for user root Jun 8 22:18:28 new2 kernel: audit(1086747508.607:0): avc: denied { relabelfrom } for pid=14372 exe=/bin/su name=4 dev=devpts ino=6 scontext=richard:staff_r:staff_t tcontext=root:object_r:sysadm_devpts_t tclass=chr_file Jun 8 22:18:28 new2 kernel: audit(1086747508.608:0): avc: denied { relabelto } for pid=14372 exe=/bin/su name=4 dev=devpts ino=6 scontext=richard:staff_r:staff_t tcontext=richard:object_r:staff_devpts_t tclass=chr_file Jun 8 22:18:28 new2 kernel: audit(1086747508.608:0): avc: denied { setexec } for pid=14372 exe=/bin/su scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=process Jun 8 22:18:48 new2 su(pam_unix)[14667]: session opened for user root by richard(uid=500) Jun 8 22:18:48 new2 kernel: audit(1086747528.673:0): avc: denied { relabelfrom } for pid=14667 exe=/bin/su name=5 dev=devpts ino=7 scontext=richard:staff_r:staff_t tcontext=richard:object_r:staff_devpts_t tclass=chr_file Jun 8 22:18:48 new2 kernel: audit(1086747528.673:0): avc: denied { relabelto } for pid=14667 exe=/bin/su name=5 dev=devpts ino=7 scontext=richard:staff_r:staff_t tcontext=root:object_r:sysadm_devpts_t tclass=chr_file Jun 8 22:18:48 new2 kernel: audit(1086747528.708:0): avc: denied { transition } for pid=14670 exe=/bin/su path=/bin/bash dev=hda2 ino=1384545 scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 22:18:48 new2 kernel: audit(1086747528.708:0): avc: denied { siginh } for pid=14670 exe=/bin/bash scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 22:18:48 new2 kernel: audit(1086747528.708:0): avc: denied { rlimitinh } for pid=14670 exe=/bin/bash scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 22:18:48 new2 kernel: audit(1086747528.708:0): avc: denied { noatsecure } for pid=14670 exe=/bin/bash scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 22:22:15 new2 su(pam_unix)[14667]: session closed for user root Jun 8 22:22:15 new2 kernel: audit(1086747735.307:0): avc: denied { relabelfrom } for pid=14667 exe=/bin/su name=5 dev=devpts ino=7 scontext=richard:staff_r:staff_t tcontext=root:object_r:sysadm_devpts_t tclass=chr_file Jun 8 22:22:39 new2 shutdown: shutting down for system reboot Jun 8 22:22:39 new2 init: Switching to runlevel: 6 Jun 8 22:22:40 new2 login(pam_unix)[2372]: session closed for user root Jun 8 22:22:41 new2 kernel: audit(1086747761.697:0): avc: denied { read } for pid=14832 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:22:41 new2 kernel: audit(1086747761.697:0): avc: denied { getattr } for pid=14832 exe=/sbin/restorecon path=/etc/selinux/config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:22:41 new2 kernel: audit(1086747761.796:0): avc: denied { search } for pid=14832 exe=/sbin/restorecon name=strict dev=hda2 ino=913074 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:22:42 new2 udev[14797]: removing device node '/udev/vcsa4' Jun 8 22:22:42 new2 udev[14794]: removing device node '/udev/vcs3' Jun 8 22:22:42 new2 udev[14800]: removing device node '/udev/vcs6' Jun 8 22:22:42 new2 udev[14796]: removing device node '/udev/vcs4' Jun 8 22:22:42 new2 udev[14792]: removing device node '/udev/vcs2' Jun 8 22:22:42 new2 udev[14798]: removing device node '/udev/vcs5' Jun 8 22:22:42 new2 udev[14801]: removing device node '/udev/vcsa6' Jun 8 22:22:42 new2 udev[14799]: removing device node '/udev/vcsa5' Jun 8 22:22:42 new2 udev[14795]: removing device node '/udev/vcsa3' Jun 8 22:22:42 new2 udev[14793]: removing device node '/udev/vcsa2' Jun 8 22:22:43 new2 gconfd (richard-4527): Exiting Jun 8 22:22:46 new2 gdm(pam_unix)[4383]: session closed for user richard Jun 8 22:22:46 new2 messagebus: messagebus -TERM succeeded Jun 8 22:22:47 new2 atd: atd shutdown succeeded Jun 8 22:22:48 new2 udev[14877]: removing device node '/udev/vcs1' Jun 8 22:22:48 new2 udev[14888]: removing device node '/udev/vcsa1' Jun 8 22:22:48 new2 privoxy: privoxy shutdown succeeded Jun 8 22:22:48 new2 udev[14904]: creating device node '/udev/vcs1' Jun 8 22:22:48 new2 udev[14911]: creating device node '/udev/vcsa1' Jun 8 22:22:49 new2 udev[14941]: removing device node '/udev/vcsa1' Jun 8 22:22:49 new2 udev[14937]: removing device node '/udev/vcs1' Jun 8 22:22:49 new2 gpm[2203]: *** info [mice.c(1766)]: Jun 8 22:22:49 new2 gpm[2203]: imps2: Auto-detected intellimouse PS/2 Jun 8 22:22:50 new2 cups: cupsd shutdown succeeded Jun 8 22:22:50 new2 xfs[2279]: terminating Jun 8 22:22:50 new2 udev[14954]: creating device node '/udev/vcs1' Jun 8 22:22:50 new2 udev[14961]: creating device node '/udev/vcsa1' Jun 8 22:22:50 new2 xfs: xfs shutdown succeeded Jun 8 22:22:50 new2 udev[15115]: removing device node '/udev/vcs1' Jun 8 22:22:50 new2 udev[15110]: removing device node '/udev/vcsa1' Jun 8 22:22:51 new2 gpm: gpm shutdown succeeded Jun 8 22:22:51 new2 sshd: sshd -TERM succeeded Jun 8 22:22:51 new2 sendmail: sendmail shutdown succeeded Jun 8 22:22:51 new2 sendmail: sm-client shutdown failed Jun 8 22:22:55 new2 spamassassin: spamd shutdown succeeded Jun 8 22:22:56 new2 lisa: lisa shutdown succeeded Jun 8 22:22:56 new2 smartd[1886]: smartd received signal 15: Terminated Jun 8 22:22:56 new2 smartd[1886]: smartd is exiting (exit status 0) Jun 8 22:22:56 new2 smartd: smartd shutdown succeeded Jun 8 22:22:56 new2 xinetd[2118]: Exiting... Jun 8 22:22:57 new2 xinetd: xinetd shutdown succeeded Jun 8 22:22:57 new2 acpid: acpid shutdown succeeded Jun 8 22:22:58 new2 crond: crond shutdown succeeded Jun 8 22:22:58 new2 ntpd: succeeded Jun 8 22:22:58 new2 ntpd: succeeded Jun 8 22:22:58 new2 ntpd[2142]: ntpd exiting on signal 15 Jun 8 22:22:58 new2 ntpd: ntpd shutdown succeeded Jun 8 22:22:59 new2 dd: 1+0 records in Jun 8 22:22:59 new2 dd: 1+0 records out Jun 8 22:22:59 new2 random: Saving random seed: succeeded Jun 8 22:22:59 new2 rpc.statd[1765]: Caught signal 15, un-registering and exiting. Jun 8 22:22:59 new2 nfslock: rpc.statd shutdown succeeded Jun 8 22:22:59 new2 portmap: portmap shutdown succeeded Jun 8 22:23:00 new2 kernel: Kernel logging (proc) stopped. Jun 8 22:23:00 new2 kernel: Kernel log daemon terminating. Jun 8 22:23:00 new2 udev[15782]: removing device node '/udev/vcs1' Jun 8 22:23:00 new2 udev[15788]: removing device node '/udev/vcsa1' Jun 8 22:23:01 new2 syslog: klogd shutdown succeeded Jun 8 22:23:01 new2 exiting on signal 15 Jun 8 22:24:28 new2 syslogd 1.4.1: restart. Jun 8 22:24:28 new2 syslog: syslogd startup succeeded Jun 8 22:24:28 new2 kernel: klogd 1.4.1, log source = /proc/kmsg started. Jun 8 22:24:28 new2 kernel: Linux version 2.6.6-1.422 (bhcompile(a)porky.devel.redhat.com) (gcc version 3.3.3 20040412 (Red Hat Linux 3.3.3-7)) #1 Fri Jun 4 13:00:45 EDT 2004 Jun 8 22:24:28 new2 kernel: BIOS-provided physical RAM map: Jun 8 22:24:28 new2 kernel: BIOS-e820: 0000000000000000 - 000000000009fc00 (usable) Jun 8 22:24:28 new2 kernel: BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved) Jun 8 22:24:28 new2 kernel: BIOS-e820: 00000000000f0000 - 0000000000100000 (reserved) Jun 8 22:24:28 new2 kernel: BIOS-e820: 0000000000100000 - 000000000dff0000 (usable) Jun 8 22:24:28 new2 kernel: BIOS-e820: 000000000dff0000 - 000000000dff3000 (ACPI NVS) Jun 8 22:24:28 new2 kernel: BIOS-e820: 000000000dff3000 - 000000000e000000 (ACPI data) Jun 8 22:24:28 new2 kernel: BIOS-e820: 00000000fec00000 - 0000000100000000 (reserved) Jun 8 22:24:28 new2 kernel: 0MB HIGHMEM available. Jun 8 22:24:28 new2 kernel: 223MB LOWMEM available. Jun 8 22:24:28 new2 syslog: klogd startup succeeded Jun 8 22:24:28 new2 kernel: zapping low mappings. Jun 8 22:24:28 new2 kernel: On node 0 totalpages: 57328 Jun 8 22:24:28 new2 kernel: DMA zone: 4096 pages, LIFO batch:1 Jun 8 22:24:28 new2 kernel: Normal zone: 53232 pages, LIFO batch:12 Jun 8 22:24:28 new2 kernel: HighMem zone: 0 pages, LIFO batch:1 Jun 8 22:24:28 new2 kernel: DMI 2.2 present. Jun 8 22:24:28 new2 kernel: ACPI: RSDP (v000 AWARD ) @ 0x000f67f0 Jun 8 22:24:28 new2 kernel: ACPI: RSDT (v001 AWARD AWRDACPI 0x42302e31 AWRD 0x00000000) @ 0x0dff3000 Jun 8 22:24:28 new2 kernel: ACPI: FADT (v001 AWARD AWRDACPI 0x42302e31 AWRD 0x00000000) @ 0x0dff3040 Jun 8 22:24:28 new2 kernel: ACPI: MADT (v001 AWARD AWRDACPI 0x42302e31 AWRD 0x00000000) @ 0x0dff6e80 Jun 8 22:24:28 new2 irqbalance: irqbalance startup succeeded Jun 8 22:24:28 new2 kernel: ACPI: DSDT (v001 AWARD AWRDACPI 0x00001000 MSFT 0x0100000d) @ 0x00000000 Jun 8 22:24:28 new2 kernel: ACPI: PM-Timer IO Port: 0x1008 Jun 8 22:24:28 new2 kernel: Built 1 zonelists Jun 8 22:24:28 new2 kernel: Kernel command line: ro root=LABEL=/ rhgb Jun 8 22:24:28 new2 kernel: mapped 4G/4G trampoline to ffff3000. Jun 8 22:24:28 new2 kernel: Initializing CPU#0 Jun 8 22:24:28 new2 kernel: CPU 0 irqstacks, hard=02346000 soft=02345000 Jun 8 22:24:28 new2 kernel: PID hash table entries: 1024 (order 10: 8192 bytes) Jun 8 22:24:28 new2 kernel: Detected 2490.734 MHz processor. Jun 8 22:24:28 new2 kernel: Using tsc for high-res timesource Jun 8 22:24:28 new2 portmap: portmap startup succeeded Jun 8 22:24:28 new2 kernel: Console: colour VGA+ 80x25 Jun 8 22:24:28 new2 kernel: Memory: 223968k/229312k available (1548k kernel code, 4664k reserved, 607k data, 144k init, 0k highmem) Jun 8 22:24:28 new2 kernel: Calibrating delay loop... 4915.20 BogoMIPS Jun 8 22:24:28 new2 kernel: Security Scaffold v1.0.0 initialized Jun 8 22:24:28 new2 kernel: SELinux: Initializing. Jun 8 22:24:28 new2 kernel: SELinux: Starting in permissive mode Jun 8 22:24:28 new2 kernel: There is already a security framework initialized, register_security failed. Jun 8 22:24:28 new2 kernel: selinux_register_security: Registering secondary module capability Jun 8 22:24:28 new2 kernel: Capability LSM initialized as secondary Jun 8 22:24:28 new2 kernel: Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Jun 8 22:24:28 new2 kernel: Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) Jun 8 22:24:28 new2 kernel: Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Jun 8 22:24:28 new2 kernel: CPU: Trace cache: 12K uops, L1 D cache: 8K Jun 8 22:24:28 new2 kernel: CPU: L2 cache: 512K Jun 8 22:24:28 new2 kernel: Intel machine check architecture supported. Jun 8 22:24:28 new2 kernel: Intel machine check reporting enabled on CPU#0. Jun 8 22:24:28 new2 kernel: CPU0: Intel P4/Xeon Extended MCE MSRs (12) available Jun 8 22:24:28 new2 kernel: CPU: Intel(R) Pentium(R) 4 CPU 2.50GHz stepping 07 Jun 8 22:24:28 new2 kernel: Enabling fast FPU save and restore... done. Jun 8 22:24:28 new2 kernel: Enabling unmasked SIMD FPU exception support... done. Jun 8 22:24:28 new2 kernel: Checking 'hlt' instruction... OK. Jun 8 22:24:28 new2 kernel: checking if image is initramfs...it isn't (no cpio magic); looks like an initrd Jun 8 22:24:28 new2 kernel: Freeing initrd memory: 188k freed Jun 8 22:24:28 new2 kernel: NET: Registered protocol family 16 Jun 8 22:24:28 new2 kernel: PCI: PCI BIOS revision 2.10 entry at 0xfb360, last bus=1 Jun 8 22:24:28 new2 kernel: PCI: Using configuration type 1 Jun 8 22:24:28 new2 kernel: mtrr: v2.0 (20020519) Jun 8 22:24:28 new2 rpc.statd[1766]: Version 1.0.6 Starting Jun 8 22:24:28 new2 kernel: ACPI: Subsystem revision 20040326 Jun 8 22:24:28 new2 kernel: ACPI: IRQ9 SCI: Level Trigger. Jun 8 22:24:28 new2 kernel: ACPI: Interpreter enabled Jun 8 22:24:28 new2 kernel: ACPI: Using PIC for interrupt routing Jun 8 22:24:28 new2 nfslock: rpc.statd startup succeeded Jun 8 22:24:28 new2 kernel: ACPI: PCI Root Bridge [PCI0] (00:00) Jun 8 22:24:28 new2 kernel: PCI: Probing PCI hardware (bus 00) Jun 8 22:24:28 new2 kernel: Uncovering SIS962 that hid as a SIS503 (compatible=1) Jun 8 22:24:28 new2 kernel: Enabling SiS 96x SMBus. Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKA] (IRQs 3 4 5 6 7 9 *10 11 12 14 15) Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKB] (IRQs 3 4 5 6 7 9 10 11 12 14 15) *0, disabled. Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKC] (IRQs 3 4 *5 6 7 9 10 11 12 14 15) Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKD] (IRQs 3 4 5 6 7 9 10 *11 12 14 15) Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKE] (IRQs 3 4 5 6 7 9 *10 11 12 14 15) Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKF] (IRQs 3 4 5 6 7 9 10 *11 12 14 15) Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKG] (IRQs 3 4 5 6 7 *9 10 11 12 14 15) Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKH] (IRQs *3 4 5 6 7 9 10 11 12 14 15) Jun 8 22:24:28 new2 kernel: Linux Plug and Play Support v0.97 (c) Adam Belay Jun 8 22:24:28 new2 kernel: usbcore: registered new driver usbfs Jun 8 22:24:28 new2 kernel: usbcore: registered new driver hub Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKB] enabled at IRQ 11 Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKA] enabled at IRQ 10 Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 5 Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKE] enabled at IRQ 10 Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKF] enabled at IRQ 11 Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKG] enabled at IRQ 9 Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKH] enabled at IRQ 3 Jun 8 22:24:28 new2 kernel: ACPI: PCI Interrupt Link [LNKD] enabled at IRQ 11 Jun 8 22:24:28 new2 kernel: PCI: Using ACPI for IRQ routing Jun 8 22:24:28 new2 kernel: vesafb: probe of vesafb0 failed with error -6 Jun 8 22:24:28 new2 kernel: apm: BIOS version 1.2 Flags 0x07 (Driver version 1.16ac) Jun 8 22:24:28 new2 kernel: apm: overridden by ACPI. Jun 8 22:24:28 new2 kernel: audit: initializing netlink socket (disabled) Jun 8 22:24:28 new2 kernel: audit(1086733422.813:0): initialized Jun 8 22:24:28 new2 kernel: Total HugeTLB memory allocated, 0 Jun 8 22:24:28 new2 kernel: VFS: Disk quotas dquot_6.5.1 Jun 8 22:24:28 new2 kernel: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) Jun 8 22:24:28 new2 kernel: SELinux: Registering netfilter hooks Jun 8 22:24:28 new2 kernel: Initializing Cryptographic API Jun 8 22:24:28 new2 kernel: pci_hotplug: PCI Hot Plug PCI Core version: 0.5 Jun 8 22:24:28 new2 kernel: ACPI: Fan [FAN] (on) Jun 8 22:24:28 new2 kernel: ACPI: Processor [CPU0] (supports C1) Jun 8 22:24:28 new2 kernel: ACPI: Thermal Zone [THRM] (40 C) Jun 8 22:24:28 new2 kernel: isapnp: Scanning for PnP cards... Jun 8 22:24:28 new2 kernel: isapnp: No Plug & Play device found Jun 8 22:24:28 new2 kernel: Real Time Clock Driver v1.12 Jun 8 22:24:28 new2 kernel: Linux agpgart interface v0.100 (c) Dave Jones Jun 8 22:24:28 new2 kernel: agpgart: Detected SiS 650 chipset Jun 8 22:24:28 new2 kernel: agpgart: Maximum main memory to use for agp memory: 176M Jun 8 22:24:28 new2 kernel: agpgart: AGP aperture is 128M @ 0xd0000000 Jun 8 22:24:28 new2 kernel: Serial: 8250/16550 driver $Revision: 1.90 $ 8 ports, IRQ sharing enabled Jun 8 22:24:28 new2 kernel: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A Jun 8 22:24:28 new2 kernel: RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize Jun 8 22:24:28 new2 kernel: Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2 Jun 8 22:24:28 new2 kernel: ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx Jun 8 22:24:28 new2 kernel: SIS5513: IDE controller at PCI slot 0000:00:02.5 Jun 8 22:24:29 new2 kernel: SIS5513: chipset revision 0 Jun 8 22:24:29 new2 kernel: SIS5513: not 100%% native mode: will probe irqs later Jun 8 22:24:29 new2 kernel: SIS5513: SiS 962/963 MuTIOL IDE UDMA133 controller Jun 8 22:24:29 new2 kernel: ide0: BM-DMA at 0x4000-0x4007, BIOS settings: hda:DMA, hdb:pio Jun 8 22:24:29 new2 kernel: ide1: BM-DMA at 0x4008-0x400f, BIOS settings: hdc:DMA, hdd:pio Jun 8 22:24:29 new2 kernel: hda: WDC WD400EB-11CPF0, ATA DISK drive Jun 8 22:24:29 new2 kernel: Using cfq io scheduler Jun 8 22:24:29 new2 kernel: ide0 at 0x1f0-0x1f7,0x3f6 on irq 14 Jun 8 22:24:29 new2 kernel: hdc: SAMSUNG CD-R/RW DRIVE SW-252F, ATAPI CD/DVD-ROM drive Jun 8 22:24:29 new2 kernel: ide1 at 0x170-0x177,0x376 on irq 15 Jun 8 22:24:29 new2 kernel: hda: max request size: 128KiB Jun 8 22:24:29 new2 kernel: hda: 78165360 sectors (40020 MB) w/2048KiB Cache, CHS=65535/16/63, UDMA(100) Jun 8 22:24:29 new2 kernel: hda: hda1 hda2 hda3 Jun 8 22:24:29 new2 kernel: hdc: ATAPI 1X CD-ROM CD-R/RW CD-MRW drive, 2048kB Cache, UDMA(33) Jun 8 22:24:29 new2 kernel: Uniform CD-ROM driver Revision: 3.20 Jun 8 22:24:29 new2 kernel: ide-floppy driver 0.99.newide Jun 8 22:24:29 new2 kernel: usbcore: registered new driver hiddev Jun 8 22:24:29 new2 kernel: usbcore: registered new driver usbhid Jun 8 22:24:29 new2 kernel: drivers/usb/input/hid-core.c: v2.0:USB HID core driver Jun 8 22:24:29 new2 kernel: mice: PS/2 mouse device common for all mice Jun 8 22:24:29 new2 kernel: serio: i8042 AUX port at 0x60,0x64 irq 12 Jun 8 22:24:29 new2 kernel: input: ImPS/2 Generic Wheel Mouse on isa0060/serio1 Jun 8 22:24:29 new2 kernel: serio: i8042 KBD port at 0x60,0x64 irq 1 Jun 8 22:24:29 new2 kernel: input: AT Translated Set 2 keyboard on isa0060/serio0 Jun 8 22:24:29 new2 kernel: md: md driver 0.90.0 MAX_MD_DEVS=256, MD_SB_DISKS=27 Jun 8 22:24:29 new2 kernel: NET: Registered protocol family 2 Jun 8 22:24:29 new2 kernel: IP: routing cache hash table of 2048 buckets, 16Kbytes Jun 8 22:24:29 new2 kernel: TCP: Hash tables configured (established 16384 bind 32768) Jun 8 22:24:29 new2 kernel: Initializing IPsec netlink socket Jun 8 22:24:29 new2 kernel: NET: Registered protocol family 1 Jun 8 22:24:29 new2 kernel: NET: Registered protocol family 17 Jun 8 22:24:29 new2 kernel: ACPI: (supports S0 S3 S4 S5) Jun 8 22:24:29 new2 kernel: md: Autodetecting RAID arrays. Jun 8 22:24:29 new2 kernel: md: autorun ... Jun 8 22:24:29 new2 kernel: md: ... autorun DONE. Jun 8 22:24:29 new2 kernel: RAMDISK: Compressed image found at block 0 Jun 8 22:24:29 new2 kernel: VFS: Mounted root (ext2 filesystem). Jun 8 22:24:29 new2 kernel: EXT3-fs: INFO: recovery required on readonly filesystem. Jun 8 22:24:29 new2 kernel: EXT3-fs: write access will be enabled during recovery. Jun 8 22:24:29 new2 kernel: kjournald starting. Commit interval 5 seconds Jun 8 22:24:29 new2 kernel: EXT3-fs: hda2: orphan cleanup on readonly fs Jun 8 22:24:29 new2 kernel: EXT3-fs: hda2: 4 orphan inodes deleted Jun 8 22:24:29 new2 kernel: EXT3-fs: recovery complete. Jun 8 22:24:29 new2 kernel: EXT3-fs: mounted filesystem with ordered data mode. Jun 8 22:24:29 new2 kernel: Freeing unused kernel memory: 144k freed Jun 8 22:24:29 new2 kernel: security: 6 users, 7 roles, 1257 types, 1 bools Jun 8 22:24:29 new2 kernel: security: 42 classes, 310475 rules Jun 8 22:24:29 new2 kernel: SELinux: Completing initialization. Jun 8 22:24:29 new2 kernel: SELinux: Setting up existing superblocks. Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev hda2, type ext3), uses xattr Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev ram0, type ext2), uses xattr Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev mqueue, type mqueue), not configured for labeling Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev hugetlbfs, type hugetlbfs), not configured for labeling Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev devpts, type devpts), uses transition SIDs Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev eventpollfs, type eventpollfs), uses genfs_contexts Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev pipefs, type pipefs), uses task SIDs Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev futexfs, type futexfs), uses genfs_contexts Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev sockfs, type sockfs), uses task SIDs Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev proc, type proc), uses genfs_contexts Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev bdev, type bdev), uses genfs_contexts Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts Jun 8 22:24:29 new2 kernel: SELinux: initialized (dev ramfs, type ramfs), uses genfs_contexts Jun 8 22:24:29 new2 kernel: NET: Registered protocol family 10 Jun 8 22:24:29 new2 kernel: Disabled Privacy Extensions on device 022deac0(lo) Jun 8 22:24:30 new2 kernel: IPv6 over IPv4 tunneling driver Jun 8 22:24:30 new2 kernel: audit(1086733441.577:0): avc: denied { search } for pid=535 exe=/usr/bin/rhgb name=root dev=hda2 ino=130305 scontext=system_u:system_r:rhgb_t tcontext=root:object_r:staff_home_dir_t tclass=dir Jun 8 22:24:30 new2 last message repeated 3 times Jun 8 22:24:30 new2 kernel: audit(1086733441.862:0): avc: denied { search } for pid=535 exe=/usr/bin/rhgb name=root dev=hda2 ino=130305 scontext=system_u:system_r:rhgb_t tcontext=root:object_r:staff_home_dir_t tclass=dir Jun 8 22:24:30 new2 last message repeated 7 times Jun 8 22:24:30 new2 kernel: audit(1086733442.319:0): avc: denied { read } for pid=535 exe=/usr/bin/rhgb name=.fonts.cache-1 dev=hda2 ino=603 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:default_t tclass=file Jun 8 22:24:30 new2 kernel: audit(1086733444.130:0): avc: denied { search } for pid=535 exe=/usr/bin/rhgb name=root dev=hda2 ino=130305 scontext=system_u:system_r:rhgb_t tcontext=root:object_r:staff_home_dir_t tclass=dir Jun 8 22:24:30 new2 kernel: ACPI: Power Button (FF) [PWRF] Jun 8 22:24:30 new2 kernel: ACPI: Sleep Button (CM) [FUTS] Jun 8 22:24:30 new2 kernel: ehci_hcd 0000:00:03.3: EHCI Host Controller Jun 8 22:24:30 new2 kernel: ehci_hcd 0000:00:03.3: irq 3, pci mem 10856000 Jun 8 22:24:30 new2 kernel: SELinux: initialized (dev usbdevfs, type usbdevfs), uses genfs_contexts Jun 8 22:24:30 new2 kernel: SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts Jun 8 22:24:30 new2 kernel: ehci_hcd 0000:00:03.3: new USB bus registered, assigned bus number 1 Jun 8 22:24:30 new2 kernel: ehci_hcd 0000:00:03.3: USB 2.0 enabled, EHCI 1.00, driver 2004-May-10 Jun 8 22:24:30 new2 kernel: hub 1-0:1.0: USB hub found Jun 8 22:24:30 new2 kernel: hub 1-0:1.0: 6 ports detected Jun 8 22:24:30 new2 rpcidmapd: rpc.idmapd startup succeeded Jun 8 22:24:30 new2 kernel: ohci_hcd 0000:00:03.0: OHCI Host Controller Jun 8 22:24:30 new2 kernel: ohci_hcd 0000:00:03.0: irq 10, pci mem 1085c000 Jun 8 22:24:30 new2 kernel: ohci_hcd 0000:00:03.0: new USB bus registered, assigned bus number 2 Jun 8 22:24:30 new2 random: Initializing random number generator: succeeded Jun 8 22:24:30 new2 kernel: hub 2-0:1.0: USB hub found Jun 8 22:24:30 new2 kernel: hub 2-0:1.0: 2 ports detected Jun 8 22:24:30 new2 kernel: ohci_hcd 0000:00:03.1: OHCI Host Controller Jun 8 22:24:30 new2 kernel: ohci_hcd 0000:00:03.1: irq 11, pci mem 1085e000 Jun 8 22:24:30 new2 kernel: ohci_hcd 0000:00:03.1: new USB bus registered, assigned bus number 3 Jun 8 22:24:30 new2 kernel: hub 3-0:1.0: USB hub found Jun 8 22:24:30 new2 kernel: hub 3-0:1.0: 2 ports detected Jun 8 22:24:30 new2 kernel: ohci_hcd 0000:00:03.2: OHCI Host Controller Jun 8 22:24:30 new2 kernel: ohci_hcd 0000:00:03.2: irq 9, pci mem 10860000 Jun 8 22:24:30 new2 kernel: ohci_hcd 0000:00:03.2: new USB bus registered, assigned bus number 4 Jun 8 22:24:30 new2 kernel: hub 4-0:1.0: USB hub found Jun 8 22:24:30 new2 kernel: hub 4-0:1.0: 2 ports detected Jun 8 22:24:30 new2 kernel: EXT3 FS on hda2, internal journal Jun 8 22:24:30 new2 kernel: device-mapper: 4.1.0-ioctl (2003-12-10) initialised: dm(a)uk.sistina.com Jun 8 22:24:30 new2 kernel: audit(1086747848.241:0): avc: denied { search } for pid=921 exe=/sbin/lvm.static dev=devpts ino=1 scontext=system_u:system_r:lvm_t tcontext=system_u:object_r:devpts_t tclass=dir Jun 8 22:24:30 new2 kernel: audit(1086747848.419:0): avc: denied { read } for pid=930 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:30 new2 kernel: audit(1086747848.419:0): avc: denied { search } for pid=930 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:30 new2 kernel: audit(1086747848.806:0): avc: denied { getattr } for pid=921 exe=/sbin/lvm.static path=/dev/shm dev=hda2 ino=1091316 scontext=system_u:system_r:lvm_t tcontext=system_u:object_r:file_t tclass=dir Jun 8 22:24:30 new2 kernel: cdrom: open failed. Jun 8 22:24:30 new2 kernel: Adding 457844k swap on /dev/hda3. Priority:-1 extents:1 Jun 8 22:24:30 new2 kernel: kjournald starting. Commit interval 5 seconds Jun 8 22:24:30 new2 kernel: EXT3 FS on hda1, internal journal Jun 8 22:24:30 new2 kernel: EXT3-fs: mounted filesystem with ordered data mode. Jun 8 22:24:30 new2 kernel: SELinux: initialized (dev hda1, type ext3), uses xattr Jun 8 22:24:30 new2 kernel: SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs Jun 8 22:24:30 new2 kernel: audit(1086747852.410:0): avc: denied { read } for pid=1237 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:30 new2 kernel: audit(1086747852.437:0): avc: denied { read } for pid=1248 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:30 new2 kernel: IA-32 Microcode Update Driver: v1.13 <tigran(a)veritas.com> Jun 8 22:24:30 new2 kernel: microcode: No new microdata for cpu 0 Jun 8 22:24:30 new2 kernel: audit(1086747853.880:0): avc: denied { read } for pid=1268 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:30 new2 kernel: audit(1086747853.880:0): avc: denied { search } for pid=1268 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:30 new2 kernel: parport0: PC-style at 0x378 (0x778) [PCSPP,TRISTATE] Jun 8 22:24:30 new2 kernel: parport0: irq 7 detected Jun 8 22:24:30 new2 kernel: parport0: Printer, Hewlett-Packard HP LaserJet 6L Jun 8 22:24:30 new2 kernel: SCSI subsystem initialized Jun 8 22:24:30 new2 kernel: inserting floppy driver for 2.6.6-1.422 Jun 8 22:24:30 new2 kernel: Floppy drive(s): fd0 is 1.44M Jun 8 22:24:30 new2 kernel: FDC 0 is a post-1991 82077 Jun 8 22:24:30 new2 rc: Starting pcmcia: succeeded Jun 8 22:24:30 new2 kernel: audit(1086747859.036:0): avc: denied { read } for pid=1378 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:30 new2 kernel: audit(1086747859.037:0): avc: denied { search } for pid=1378 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:30 new2 kernel: sis900.c: v1.08.07 11/02/2003 Jun 8 22:24:30 new2 kernel: eth0: VIA 6103 PHY transceiver found at address 1. Jun 8 22:24:30 new2 kernel: eth0: Using transceiver found at address 1 as default Jun 8 22:24:30 new2 kernel: eth0: SiS 900 PCI Fast Ethernet at 0xe800, IRQ 11, 00:e0:4c:bd:2d:aa. Jun 8 22:24:30 new2 kernel: ip_tables: (C) 2000-2002 Netfilter core team Jun 8 22:24:30 new2 kernel: ip_conntrack version 2.1 (1791 buckets, 14328 max) - 296 bytes per conntrack Jun 8 22:24:30 new2 kernel: sis900.c: v1.08.07 11/02/2003 Jun 8 22:24:30 new2 kernel: eth0: VIA 6103 PHY transceiver found at address 1. Jun 8 22:24:30 new2 kernel: eth0: Using transceiver found at address 1 as default Jun 8 22:24:30 new2 kernel: eth0: SiS 900 PCI Fast Ethernet at 0xe800, IRQ 11, 00:e0:4c:bd:2d:aa. Jun 8 22:24:30 new2 kernel: eth0: Media Link On 100mbps full-duplex Jun 8 22:24:30 new2 kernel: SELinux: initialized (dev rpc_pipefs, type rpc_pipefs), uses genfs_contexts Jun 8 22:24:30 new2 netfs: Mounting other filesystems: succeeded Jun 8 22:24:30 new2 autofs: automount startup succeeded Jun 8 22:24:28 new2 ifup: done. Jun 8 22:24:28 new2 network: Bringing up interface eth0: succeeded Jun 8 22:24:30 new2 smartd[1885]: smartd version 5.30 Copyright (C) 2002-4 Bruce Allen Jun 8 22:24:30 new2 smartd[1885]: Home page is http://smartmontools.sourceforge.net/ Jun 8 22:24:30 new2 smartd[1885]: Opened configuration file /etc/smartd.conf Jun 8 22:24:30 new2 smartd[1885]: Configuration file /etc/smartd.conf parsed. Jun 8 22:24:30 new2 smartd[1885]: Device: /dev/hda, opened Jun 8 22:24:30 new2 smartd[1885]: Device: /dev/hda, found in smartd database. Jun 8 22:24:31 new2 smartd[1885]: Device: /dev/hda, is SMART capable. Adding to "monitor" list. Jun 8 22:24:31 new2 smartd[1885]: Monitoring 1 ATA and 0 SCSI devices Jun 8 22:24:31 new2 smartd[1887]: smartd has fork()ed into background mode. New PID=1887. Jun 8 22:24:31 new2 smartd: smartd startup succeeded Jun 8 22:24:31 new2 acpid: acpid startup succeeded Jun 8 22:24:33 new2 kernel: audit(1086747873.855:0): avc: denied { execute } for pid=1916 exe=/bin/bash name=epson dev=hda2 ino=116675 scontext=system_u:system_r:cupsd_t tcontext=system_u:object_r:lib_t tclass=file Jun 8 22:24:33 new2 kernel: audit(1086747873.889:0): avc: denied { execute } for pid=1917 exe=/bin/bash name=canon dev=hda2 ino=602663 scontext=system_u:system_r:cupsd_t tcontext=system_u:object_r:lib_t tclass=file Jun 8 22:24:34 new2 kernel: parport0: PC-style at 0x378 (0x778) [PCSPP,TRISTATE] Jun 8 22:24:34 new2 kernel: parport0: irq 7 detected Jun 8 22:24:34 new2 kernel: parport0: Printer, Hewlett-Packard HP LaserJet 6L Jun 8 22:24:34 new2 kernel: lp0: using parport0 (polling). Jun 8 22:24:34 new2 kernel: lp0: console ready Jun 8 22:24:36 new2 cups: cupsd startup succeeded Jun 8 22:24:36 new2 sshd: succeeded Jun 8 22:24:36 new2 xinetd: xinetd startup succeeded Jun 8 22:24:36 new2 ntpd: succeeded Jun 8 22:24:36 new2 ntpd: succeeded Jun 8 22:24:38 new2 xinetd[2119]: xinetd Version 2.3.13 started with libwrap loadavg options compiled in. Jun 8 22:24:38 new2 xinetd[2119]: Started working: 1 available service Jun 8 22:24:37 new2 ntpdate[2139]: step time server 209.132.176.4 offset -0.498504 sec Jun 8 22:24:37 new2 ntpd: succeeded Jun 8 22:24:37 new2 ntpd[2143]: ntpd 4.2.0(a)1.1161-r Thu Mar 11 11:46:39 EST 2004 (1) Jun 8 22:24:37 new2 ntpd: ntpd startup succeeded Jun 8 22:24:37 new2 ntpd[2143]: precision = 1.000 usec Jun 8 22:24:37 new2 ntpd[2143]: kernel time sync status 0040 Jun 8 22:24:37 new2 ntpd[2143]: frequency initialized 90.442 PPM from /var/lib/ntp/drift Jun 8 22:24:37 new2 ntpd[2143]: configure: keyword "authenticate" unknown, line ignored Jun 8 22:24:38 new2 sendmail: sendmail startup succeeded Jun 8 22:24:38 new2 sendmail: sm-client startup succeeded Jun 8 22:24:41 new2 spamassassin: spamd startup succeeded Jun 8 22:24:41 new2 privoxy: Jun 08 22:24:41 Privoxy(-150720384) Info: loading configuration file '/etc/privoxy/config': Jun 8 22:24:42 new2 privoxy: privoxy startup succeeded Jun 8 22:24:42 new2 gpm[2204]: *** info [startup.c(95)]: Jun 8 22:24:42 new2 gpm[2204]: Started gpm successfully. Entered daemon mode. Jun 8 22:24:42 new2 gpm[2204]: *** info [mice.c(1766)]: Jun 8 22:24:42 new2 gpm[2204]: imps2: Auto-detected intellimouse PS/2 Jun 8 22:24:42 new2 gpm: gpm startup succeeded Jun 8 22:24:43 new2 su(pam_unix)[2222]: session opened for user postgres by (uid=0) Jun 8 22:24:43 new2 su[2222]: Unable to get valid context for postgres, No valid tty Jun 8 22:24:43 new2 su(pam_unix)[2225]: session opened for user postgres by (uid=0) Jun 8 22:24:43 new2 su[2225]: Unable to get valid context for postgres, No valid tty Jun 8 22:24:43 new2 udev[2227]: creating device node '/udev/lp0' Jun 8 22:24:43 new2 kernel: audit(1086747883.833:0): avc: denied { read } for pid=2231 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:43 new2 kernel: audit(1086747883.833:0): avc: denied { search } for pid=2231 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:44 new2 postgresql: Starting postgresql service: failed Jun 8 22:24:44 new2 crond: crond startup succeeded Jun 8 22:24:45 new2 xfs: xfs startup succeeded Jun 8 22:24:46 new2 lisa: lisa startup succeeded Jun 8 22:24:46 new2 anacron: anacron startup succeeded Jun 8 22:24:46 new2 atd: atd startup succeeded Jun 8 22:24:46 new2 readahead: Starting background readahead: Jun 8 22:24:46 new2 rc: Starting readahead: succeeded Jun 8 22:24:48 new2 messagebus: messagebus startup succeeded Jun 8 22:24:48 new2 mdmpd: Kernel md module does not support events Jun 8 22:24:48 new2 mdmpd: mdmpd startup failed Jun 8 22:24:48 new2 mdmpd: mdmpd failed Jun 8 22:24:48 new2 udev[2363]: removing device node '/udev/vcs8' Jun 8 22:24:48 new2 kernel: audit(1086747888.939:0): avc: denied { read } for pid=2367 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:48 new2 kernel: audit(1086747888.951:0): avc: denied { use } for pid=2372 exe=/bin/umount path=/dev/ptmx dev=hda2 ino=1064811 scontext=system_u:system_r:mount_t tcontext=system_u:system_r:rhgb_gph_t tclass=fd Jun 8 22:24:48 new2 kernel: audit(1086747888.951:0): avc: denied { read write } for pid=2372 exe=/bin/umount path=socket:[1428] dev=sockfs ino=1428 scontext=system_u:system_r:mount_t tcontext=system_u:system_r:rhgb_t tclass=unix_stream_socket Jun 8 22:24:49 new2 udev[2472]: removing device node '/udev/vcsa8' Jun 8 22:24:49 new2 kernel: audit(1086747889.209:0): avc: denied { read } for pid=2476 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:49 new2 udev[2477]: creating device node '/udev/vcs1' Jun 8 22:24:49 new2 kernel: audit(1086747889.346:0): avc: denied { read } for pid=2532 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:49 new2 kernel: audit(1086747889.346:0): avc: denied { search } for pid=2532 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:49 new2 udev[2478]: creating device node '/udev/vcs2' Jun 8 22:24:49 new2 udev[2480]: creating device node '/udev/vcs4' Jun 8 22:24:49 new2 kernel: audit(1086747889.368:0): avc: denied { read } for pid=2541 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:49 new2 kernel: audit(1086747889.368:0): avc: denied { search } for pid=2541 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:49 new2 kernel: audit(1086747889.427:0): avc: denied { read } for pid=2564 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:49 new2 kernel: audit(1086747889.427:0): avc: denied { search } for pid=2564 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:49 new2 udev[2581]: removing device node '/udev/vcs1' Jun 8 22:24:49 new2 kernel: audit(1086747889.469:0): avc: denied { read } for pid=2585 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:49 new2 kernel: audit(1086747889.469:0): avc: denied { search } for pid=2585 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:49 new2 udev[2481]: creating device node '/udev/vcs5' Jun 8 22:24:49 new2 kernel: audit(1086747889.610:0): avc: denied { read } for pid=2640 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:49 new2 kernel: audit(1086747889.610:0): avc: denied { search } for pid=2640 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:49 new2 udev[2577]: creating device node '/udev/vcsa1' Jun 8 22:24:49 new2 udev[2578]: creating device node '/udev/vcsa2' Jun 8 22:24:49 new2 udev[2586]: removing device node '/udev/vcs2' Jun 8 22:24:49 new2 udev[2579]: creating device node '/udev/vcsa3' Jun 8 22:24:49 new2 udev[2591]: creating device node '/udev/vcs1' Jun 8 22:24:49 new2 udev[2624]: removing device node '/udev/vcs4' Jun 8 22:24:49 new2 kernel: audit(1086747889.635:0): avc: denied { read } for pid=2590 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:49 new2 udev[2664]: removing device node '/udev/vcsa1' Jun 8 22:24:49 new2 udev[2669]: removing device node '/udev/vcsa2' Jun 8 22:24:49 new2 udev[2622]: creating device node '/udev/vcsa5' Jun 8 22:24:49 new2 udev[2623]: creating device node '/udev/vcsa6' Jun 8 22:24:49 new2 udev[2641]: removing device node '/udev/vcs5' Jun 8 22:24:49 new2 udev[2675]: removing device node '/udev/vcsa3' Jun 8 22:24:49 new2 udev[2482]: creating device node '/udev/vcs6' Jun 8 22:24:49 new2 udev[2674]: creating device node '/udev/vcs2' Jun 8 22:24:49 new2 kernel: audit(1086747889.636:0): avc: denied { search } for pid=2590 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:49 new2 udev[2690]: creating device node '/udev/vcs4' Jun 8 22:24:50 new2 udev[2708]: creating device node '/udev/vcsa1' Jun 8 22:24:50 new2 udev[2718]: removing device node '/udev/vcsa5' Jun 8 22:24:50 new2 udev[2713]: creating device node '/udev/vcsa2' Jun 8 22:24:50 new2 udev[2731]: removing device node '/udev/vcsa6' Jun 8 22:24:50 new2 udev[2479]: creating device node '/udev/vcs3' Jun 8 22:24:50 new2 udev[2736]: creating device node '/udev/vcs5' Jun 8 22:24:50 new2 udev[2580]: creating device node '/udev/vcsa4' Jun 8 22:24:50 new2 udev[2737]: creating device node '/udev/vcsa3' Jun 8 22:24:50 new2 udev[2742]: removing device node '/udev/vcs6' Jun 8 22:24:50 new2 kernel: audit(1086747889.647:0): avc: denied { read } for pid=2651 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 udev[2760]: creating device node '/udev/vcsa5' Jun 8 22:24:51 new2 udev[2798]: removing device node '/udev/vcs3' Jun 8 22:24:51 new2 udev[2781]: creating device node '/udev/vcsa6' Jun 8 22:24:51 new2 udev[2813]: removing device node '/udev/vcsa4' Jun 8 22:24:51 new2 kernel: audit(1086747889.649:0): avc: denied { search } for pid=2651 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747889.660:0): avc: denied { read } for pid=2655 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747889.661:0): avc: denied { search } for pid=2655 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747889.671:0): avc: denied { read } for pid=2659 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747889.672:0): avc: denied { search } for pid=2659 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747889.682:0): avc: denied { read } for pid=2663 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747889.682:0): avc: denied { search } for pid=2663 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747889.693:0): avc: denied { read } for pid=2668 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747889.694:0): avc: denied { search } for pid=2668 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747889.705:0): avc: denied { read } for pid=2673 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747889.705:0): avc: denied { search } for pid=2673 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747889.729:0): avc: denied { read } for pid=2682 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747889.729:0): avc: denied { search } for pid=2682 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747889.741:0): avc: denied { read } for pid=2686 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747889.742:0): avc: denied { search } for pid=2686 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747889.743:0): avc: denied { read } for pid=2687 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747889.744:0): avc: denied { search } for pid=2687 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747890.186:0): avc: denied { read } for pid=2717 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747890.186:0): avc: denied { search } for pid=2717 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747890.198:0): avc: denied { read } for pid=2722 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747890.198:0): avc: denied { search } for pid=2722 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747890.252:0): avc: denied { read } for pid=2730 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747890.252:0): avc: denied { search } for pid=2730 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747890.264:0): avc: denied { read } for pid=2735 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747890.265:0): avc: denied { search } for pid=2735 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747890.729:0): avc: denied { read } for pid=2741 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747890.730:0): avc: denied { search } for pid=2741 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747890.741:0): avc: denied { read } for pid=2746 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747890.741:0): avc: denied { search } for pid=2746 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747890.861:0): avc: denied { read } for pid=2751 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747890.861:0): avc: denied { search } for pid=2751 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.133:0): avc: denied { read } for pid=2755 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.133:0): avc: denied { search } for pid=2755 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.181:0): avc: denied { read } for pid=2759 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.181:0): avc: denied { search } for pid=2759 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.297:0): avc: denied { read } for pid=2765 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.297:0): avc: denied { search } for pid=2765 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.570:0): avc: denied { read } for pid=2797 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.571:0): avc: denied { search } for pid=2797 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.582:0): avc: denied { read } for pid=2802 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.582:0): avc: denied { search } for pid=2802 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.670:0): avc: denied { read } for pid=2808 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.670:0): avc: denied { search } for pid=2808 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.781:0): avc: denied { read } for pid=2812 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.781:0): avc: denied { search } for pid=2812 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.792:0): avc: denied { read } for pid=2817 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.793:0): avc: denied { search } for pid=2817 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.856:0): avc: denied { read } for pid=2833 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.856:0): avc: denied { search } for pid=2833 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.873:0): avc: denied { read } for pid=2838 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.873:0): avc: denied { search } for pid=2838 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 kernel: audit(1086747891.889:0): avc: denied { read } for pid=2843 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.889:0): avc: denied { search } for pid=2843 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:51 new2 udev[2834]: creating device node '/udev/vcs6' Jun 8 22:24:51 new2 kernel: audit(1086747891.992:0): avc: denied { read } for pid=2848 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:51 new2 kernel: audit(1086747891.992:0): avc: denied { search } for pid=2848 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:52 new2 udev[2839]: creating device node '/udev/vcs3' Jun 8 22:24:52 new2 kernel: audit(1086747892.010:0): avc: denied { read } for pid=2852 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:52 new2 kernel: audit(1086747892.011:0): avc: denied { search } for pid=2852 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:52 new2 udev[2844]: creating device node '/udev/vcsa4' Jun 8 22:24:52 new2 kernel: audit(1086747892.033:0): avc: denied { read } for pid=2856 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:52 new2 kernel: audit(1086747892.034:0): avc: denied { search } for pid=2856 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:52 new2 udev[2772]: creating device node '/udev/vcs7' Jun 8 22:24:52 new2 udev[2861]: removing device node '/udev/vcs7' Jun 8 22:24:52 new2 udev[2779]: creating device node '/udev/vcsa7' Jun 8 22:24:52 new2 udev[2871]: removing device node '/udev/vcsa7' Jun 8 22:24:52 new2 kernel: audit(1086747892.438:0): avc: denied { fowner } for pid=2772 exe=/sbin/udev capability=3 scontext=system_u:system_r:udev_t tcontext=system_u:system_r:udev_t tclass=capability Jun 8 22:24:52 new2 kernel: audit(1086747892.448:0): avc: denied { read } for pid=2860 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:52 new2 kernel: audit(1086747892.448:0): avc: denied { search } for pid=2860 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:52 new2 kernel: audit(1086747892.459:0): avc: denied { read } for pid=2865 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:52 new2 kernel: audit(1086747892.460:0): avc: denied { search } for pid=2865 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:52 new2 kernel: audit(1086747892.463:0): avc: denied { fowner } for pid=2779 exe=/sbin/udev capability=3 scontext=system_u:system_r:udev_t tcontext=system_u:system_r:udev_t tclass=capability Jun 8 22:24:52 new2 kernel: audit(1086747892.472:0): avc: denied { read } for pid=2870 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:52 new2 kernel: audit(1086747892.473:0): avc: denied { search } for pid=2870 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:52 new2 kernel: audit(1086747892.484:0): avc: denied { read } for pid=2875 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:52 new2 udev[2866]: creating device node '/udev/vcs7' Jun 8 22:24:52 new2 udev[2876]: creating device node '/udev/vcsa7' Jun 8 22:24:52 new2 kernel: audit(1086747892.484:0): avc: denied { search } for pid=2875 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:53 new2 kernel: audit(1086747892.822:0): avc: denied { read } for pid=2880 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:53 new2 kernel: audit(1086747892.823:0): avc: denied { search } for pid=2880 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:24:53 new2 kernel: audit(1086747892.892:0): avc: denied { read } for pid=2884 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:24:53 new2 kernel: audit(1086747892.892:0): avc: denied { search } for pid=2884 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:25:14 new2 gdm(pam_unix)[2761]: session opened for user richard by (uid=0) Jun 8 22:25:15 new2 kernel: audit(1086747915.533:0): avc: denied { setrlimit } for pid=2955 exe=/usr/bin/ssh-agent scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=process Jun 8 22:25:23 new2 kernel: intel8x0_measure_ac97_clock: measured 49355 usecs Jun 8 22:25:23 new2 kernel: intel8x0: clocking to 48000 Jun 8 22:25:23 new2 udev[3022]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 17 applied, 'pcmC0D0p' becomes 'snd/%k' Jun 8 22:25:23 new2 udev[3022]: creating device node '/udev/snd/pcmC0D0p' Jun 8 22:25:23 new2 kernel: audit(1086747923.901:0): avc: denied { read } for pid=3028 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:25:23 new2 kernel: audit(1086747923.901:0): avc: denied { search } for pid=3028 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:25:24 new2 udev[3037]: creating device node '/udev/mixer' Jun 8 22:25:24 new2 kernel: audit(1086747924.182:0): avc: denied { read } for pid=3048 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:25:24 new2 kernel: audit(1086747924.183:0): avc: denied { search } for pid=3048 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:25:24 new2 udev[2993]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 15 applied, 'controlC0' becomes 'snd/%k' Jun 8 22:25:24 new2 udev[2993]: creating device node '/udev/snd/controlC0' Jun 8 22:25:24 new2 kernel: audit(1086747924.500:0): avc: denied { read } for pid=3052 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:25:24 new2 kernel: audit(1086747924.500:0): avc: denied { search } for pid=3052 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:25:24 new2 udev[3000]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 19 applied, 'timer' becomes 'snd/%k' Jun 8 22:25:24 new2 udev[3000]: creating device node '/udev/snd/timer' Jun 8 22:25:24 new2 kernel: audit(1086747924.598:0): avc: denied { read } for pid=3056 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:25:24 new2 kernel: audit(1086747924.598:0): avc: denied { search } for pid=3056 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:25:24 new2 udev[3009]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 17 applied, 'pcmC0D1c' becomes 'snd/%k' Jun 8 22:25:24 new2 udev[3009]: creating device node '/udev/snd/pcmC0D1c' Jun 8 22:25:24 new2 kernel: audit(1086747924.841:0): avc: denied { read } for pid=3060 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:25:24 new2 kernel: audit(1086747924.841:0): avc: denied { search } for pid=3060 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:25:24 new2 udev[3023]: configured rule in '/etc/udev/rules.d//50-udev.rules' at line 17 applied, 'pcmC0D0c' becomes 'snd/%k' Jun 8 22:25:24 new2 udev[3023]: creating device node '/udev/snd/pcmC0D0c' Jun 8 22:25:24 new2 kernel: audit(1086747924.905:0): avc: denied { read } for pid=3064 exe=/sbin/restorecon name=config dev=hda2 ino=914871 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=file Jun 8 22:25:24 new2 kernel: audit(1086747924.905:0): avc: denied { search } for pid=3064 exe=/sbin/restorecon name=targeted dev=hda2 ino=913088 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jun 8 22:25:31 new2 kernel: audit(1086747931.981:0): avc: denied { getattr } for pid=3118 exe=/usr/libexec/gnome-vfs-daemon path=/initrd dev=ram0 ino=2 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:file_t tclass=dir Jun 8 22:25:32 new2 kernel: audit(1086747932.884:0): avc: denied { getattr } for pid=3129 exe=/usr/bin/nautilus path=/initrd dev=ram0 ino=2 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:file_t tclass=dir Jun 8 22:25:33 new2 kernel: audit(1086747933.022:0): avc: denied { getattr } for pid=3130 exe=/usr/bin/nautilus path=/initrd dev=ram0 ino=2 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:file_t tclass=dir Jun 8 22:25:58 new2 kernel: audit(1086747958.306:0): avc: denied { read } for pid=3168 exe=/bin/su name=shadow dev=hda2 ino=867624 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:shadow_t tclass=file Jun 8 22:25:58 new2 last message repeated 3 times Jun 8 22:26:01 new2 kernel: audit(1086747961.248:0): avc: denied { read } for pid=3168 exe=/bin/su name=shadow dev=hda2 ino=867624 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:shadow_t tclass=file Jun 8 22:26:01 new2 last message repeated 3 times Jun 8 22:26:01 new2 kernel: audit(1086747961.256:0): avc: denied { dac_override } for pid=3168 exe=/bin/su capability=1 scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=capability Jun 8 22:26:01 new2 kernel: audit(1086747961.256:0): avc: denied { dac_read_search } for pid=3168 exe=/bin/su capability=2 scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=capability Jun 8 22:26:01 new2 kernel: audit(1086747961.318:0): avc: denied { setuid } for pid=3170 exe=/bin/su capability=7 scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=capability Jun 8 22:26:01 new2 kernel: audit(1086747961.356:0): avc: denied { setuid } for pid=3171 exe=/bin/su capability=7 scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=capability Jun 8 22:26:01 new2 kernel: audit(1086747961.365:0): avc: denied { read } for pid=3171 exe=/usr/X11R6/bin/xauth name=.xauthvDHBZv dev=hda2 ino=684106 scontext=richard:staff_r:staff_xauth_t tcontext=richard:object_r:staff_home_t tclass=file Jun 8 22:26:01 new2 kernel: audit(1086747961.399:0): avc: denied { relabelfrom } for pid=3168 exe=/bin/su name=1 dev=devpts ino=3 scontext=richard:staff_r:staff_t tcontext=richard:object_r:staff_devpts_t tclass=chr_file Jun 8 22:26:01 new2 kernel: audit(1086747961.399:0): avc: denied { dac_override } for pid=3168 exe=/bin/su capability=1 scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=capability Jun 8 22:26:01 new2 kernel: audit(1086747961.399:0): avc: denied { dac_read_search } for pid=3168 exe=/bin/su capability=2 scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=capability Jun 8 22:26:01 new2 kernel: audit(1086747961.399:0): avc: denied { setexec } for pid=3168 exe=/bin/su scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=process Jun 8 22:26:01 new2 kernel: audit(1086747961.399:0): avc: denied { dac_override } for pid=3168 exe=/bin/su capability=1 scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=capability Jun 8 22:26:01 new2 kernel: audit(1086747961.399:0): avc: denied { dac_read_search } for pid=3168 exe=/bin/su capability=2 scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=capability Jun 8 22:26:59 new2 gpm[2204]: *** info [mice.c(1766)]: Jun 8 22:26:59 new2 gpm[2204]: imps2: Auto-detected intellimouse PS/2 Jun 8 22:27:10 new2 login(pam_unix)[2373]: session opened for user root by (uid=0) Jun 8 22:27:10 new2 -- root[2373]: ROOT LOGIN ON tty1 Jun 8 22:27:35 new2 kernel: audit(1086748055.368:0): avc: granted { setenforce } for pid=3216 exe=/usr/bin/setenforce scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security Jun 8 22:27:48 new2 kernel: audit(1086748068.957:0): avc: denied { read } for pid=3219 exe=/bin/su name=shadow dev=hda2 ino=867624 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:shadow_t tclass=file Jun 8 22:27:48 new2 kernel: audit(1086748068.958:0): avc: denied { getattr } for pid=3219 exe=/bin/su path=/etc/shadow dev=hda2 ino=867624 scontext=richard:staff_r:staff_t tcontext=system_u:object_r:shadow_t tclass=file Jun 8 22:27:52 new2 su(pam_unix)[3219]: session opened for user root by richard(uid=500) Jun 8 22:27:52 new2 kernel: audit(1086748072.836:0): avc: denied { setuid } for pid=3220 exe=/bin/su capability=7 scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=capability Jun 8 22:27:53 new2 kernel: audit(1086748073.019:0): avc: denied { write } for pid=3221 exe=/usr/X11R6/bin/xauth name=.xauthogcM82 dev=hda2 ino=684140 scontext=richard:staff_r:staff_xauth_t tcontext=richard:object_r:staff_home_t tclass=file Jun 8 22:27:53 new2 kernel: audit(1086748073.019:0): avc: denied { read } for pid=3221 exe=/usr/X11R6/bin/xauth name=.xauthogcM82 dev=hda2 ino=684140 scontext=richard:staff_r:staff_xauth_t tcontext=richard:object_r:staff_home_t tclass=file Jun 8 22:27:53 new2 kernel: audit(1086748073.019:0): avc: denied { getattr } for pid=3221 exe=/usr/X11R6/bin/xauth path=/root/.xauthogcM82 dev=hda2 ino=684140 scontext=richard:staff_r:staff_xauth_t tcontext=richard:object_r:staff_home_t tclass=file Jun 8 22:27:53 new2 kernel: audit(1086748073.027:0): avc: denied { unlink } for pid=3221 exe=/usr/X11R6/bin/xauth name=.xauthogcM82 dev=hda2 ino=684140 scontext=richard:staff_r:staff_xauth_t tcontext=richard:object_r:staff_home_t tclass=file Jun 8 22:27:53 new2 kernel: audit(1086748073.062:0): avc: denied { relabelfrom } for pid=3219 exe=/bin/su name=1 dev=devpts ino=3 scontext=richard:staff_r:staff_t tcontext=richard:object_r:staff_devpts_t tclass=chr_file Jun 8 22:27:53 new2 kernel: audit(1086748073.062:0): avc: denied { relabelto } for pid=3219 exe=/bin/su name=1 dev=devpts ino=3 scontext=richard:staff_r:staff_t tcontext=root:object_r:sysadm_devpts_t tclass=chr_file Jun 8 22:27:53 new2 kernel: audit(1086748073.062:0): avc: denied { setexec } for pid=3219 exe=/bin/su scontext=richard:staff_r:staff_t tcontext=richard:staff_r:staff_t tclass=process Jun 8 22:27:53 new2 kernel: audit(1086748073.064:0): avc: denied { transition } for pid=3222 exe=/bin/su path=/bin/bash dev=hda2 ino=1384545 scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 22:27:53 new2 kernel: audit(1086748073.064:0): avc: denied { siginh } for pid=3222 exe=/bin/bash scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 22:27:53 new2 kernel: audit(1086748073.064:0): avc: denied { rlimitinh } for pid=3222 exe=/bin/bash scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 22:27:53 new2 kernel: audit(1086748073.064:0): avc: denied { noatsecure } for pid=3222 exe=/bin/bash scontext=richard:staff_r:staff_t tcontext=root:sysadm_r:sysadm_t tclass=process Jun 8 22:28:30 new2 kernel: audit(1086748110.529:0): avc: denied { getattr } for pid=3255 exe=/usr/lib/mozilla-1.6/mozilla-bin path=/initrd dev=ram0 ino=2 scontext=richard:staff_r:staff_mozilla_t tcontext=system_u:object_r:file_t tclass=dir Jun 8 22:29:00 new2 ntpd[2143]: synchronized to 209.132.176.4, stratum=1 Jun 8 22:29:00 new2 ntpd[2143]: kernel time sync disabled 0041 Jun 8 22:32:26 new2 gpm[2204]: *** info [mice.c(1766)]: Jun 8 22:32:26 new2 gpm[2204]: imps2: Auto-detected intellimouse PS/2 Jun 8 22:37:34 new2 ntpd[2143]: kernel time sync enabled 0001

1 0

context for /var/log/cron.*
by Tom London 08 Jun '04

08 Jun '04

I noticed that the contexts for the logrotated cron log files are 'restored' by fixfiles/restorecon from system_u:object_r:crond_log_t to system_u:object_r:var_log_t . Would it make sense to change crond.fc from: /var/log/cron -- system_u:object_r:crond_log_t to something like: /var/log/cron.* -- system_u:object_r:crond_log_t tom

2 1

Request for help .... system call entry pointes ...
by jagan kommineni 08 Jun '04

08 Jun '04

Hi, In my projects, I am trapping basic system calls like open, read, write, close etc ... for creating POSIX interface semantics for remote file. I am using SOAP protocol to communicate with the remote foles. http://www.csse.monash.edu.au/~jagan/research.htm I rewrite functions such as open, read, write etc... as shown below and I created a library module and preloaded by using LD_PRELOAD environemnt variable. --------------------------------------- for open call, open, _open, __open, __libc_open, open64, _open64, __open64, __libc_open64 for read call read, _read, _read, __libc_read for write call write, _write, __write __libc_write etc ..... ------------------------------------------- It is working pefectly well with Redhat 7.3, but in the recent releases of redhat 8 and 9. I am not able to trap system calls, it seems there are some changes to interfaces for enter in to system calls. If any body have any idea about the new changes, I will be glad to here. my email addess: jagan(a)csse.monash.edu.au with regards, Jagan Kommineni

1 0

What does 'plus' in ls -Z mean?
by Ling Li 07 Jun '04

07 Jun '04

Some files/directories have '+' when they are displayed with ls -Z. For example, # ls -dZ /lost+found/ drwx------+ root root system_u:object_r:lost_found_t /lost+found/ What does the '+' after the mode 'rwx------' mean? --Ling

4 4

Re: Access to the postgresql data files
by Stephen Smalley 07 Jun '04

07 Jun '04

On Fri, 2004-06-04 at 08:15, Igor Borisovsky wrote: > Hi. > I have a question about selinux policy configuration for FC2. > I need to forbid access to the postgresql data files from user root. > I guess i have to create certain type for postgresql. Let's name this type > pgsql. > Thus i have something like that: > [root selinux pgsql]# pwd > /var/lib/pgsql > [root selinux pgsql]# ls -aZ > drwx------+ postgres postgres postgres:object_r:pgsql_home_dir_t . > drwxr-xr-x root root system_u:object_r:var_lib_t .. > drwx------ postgres postgres postgres:object_r:pgsql_home_dir_t backups > -rw------- postgres postgres postgres:object_r:pgsql_home_t .bash_history > -rw-r--r-- postgres postgres postgres:object_r:pgsql_home_t .bash_profile > drwx------ postgres postgres postgres:object_r:pgsql_home_dir_t data > -rw-r--r-- postgres postgres postgres:object_r:pgsql_home_t initdb.i18n > drwxr-xr-x+ postgres postgres postgres:object_r:pgsql_home_t .mc > [root selinux pgsql]# > So far user root within sysadm_r role has access to the postgresql data > files. > I guess i need to find and revoke this permission from sysadm_r role. > After looking at the policy.conf file I can't understand this. > So how can i prevent access to postgresql data files from user root? > Thanks. Russell Coker already responded to your posting on the fedora-selinux-list. I would only add a few comments: 1) If you truly want to start reducing the power of sysadm_t, then you would start by disabling the unrestricted_admin and unlimitedServices tunables in policy/tunable.te and make load. Otherwise, sysadm_t is completely unconfined in the Fedora policy. Then you can remove direct access by sysadm_t to your new types just by omitting the sysadmfile attribute from the type declarations for your new types. But as Russell noted, sysadm_t can easily get around such restrictions, so much more work would be necessary to truly prevent access. 2) If you just want to prevent root from having such access, you could remove sysadm_r from the authorized roles for root, as Russell noted. I think that for SELinux play machines, people have authorized root for only user_r and then authorized another user identity for staff_r and sysadm_r. But in Fedora, I think you would also have to remove pam_selinux from the /etc/pam.d/su configuration to achieve this goal, so that your non-root user can su to uid 0 without having his SELinux user identity changed to root. Otherwise, su will try to change the SELinux user identity to root at the same time. 3) Do you really want to prevent someone with the root password from having access to the database, or do you just want to prevent uid 0 processes from having access? A uid 0 process does not necessarily have the SELinux root user identity; the SELinux user identity is only assigned by particular programs such as login and sshd and is unaffected by setuid programs. -- Stephen Smalley <sds(a)epoch.ncsc.mil> National Security Agency

4 7

Matlab and /var/tmp
by chris albert 07 Jun '04

07 Jun '04

Hi, Upgraded FC1->FC2, installed selinux later, running in permissive mode, debugging 'avc: denied' messages. Matlab's license manager, called from an init script writes files in /var/tmp and checks them periodically, including inside a subdirectory /var/tmp/.flexlm, which it creates if necessary. The init script, provided in the Matlab distro, asks you in comments to change the user it runs under to an ordinary user, and the initrc_su_t transition works fine for file creation in /var/tmp, as long as you dont have vestigal files and directories there from before the selinux relabling. I noticed also that other leftovers from rpm build processes were there, still unlabelled after the move to selinux. I'm wondering if I missed something, or would it be a good idea to have 'fixfiles relable' flush /var/tmp in the same way it does /tmp. Chris

2 2

Runaway .* globs in file_contexts/types.fc
by Valdis.Kletnieks＠vt.edu 06 Jun '04

06 Jun '04

OK.. Maybe 3rd time's the charm ;) Running Fedora Core as of last night-ish -devel tree, and installing selinux-policy-strict-1.13.2-4. Spotted while doing the relabelling (I knew there was a reason I try to rememer to run it with '-v' ;): /usr/sbin/setfiles: relabeling /usr/local/lib/xemacs/xemacs-packages/pkginfo/MANIFEST.sounds-au from root:object_r:lib_t to system_u:object_r:shlib_t /usr/sbin/setfiles: relabeling /usr/local/lib/xemacs/xemacs-packages/pkginfo/MANIFEST.sounds-wav from root:object_r:lib_t to system_u:object_r:shlib_t Looks like a runaway glob on '.*\.so'... Whoops. ;) First, the good news.. ;) Some grepping through file_contexts/file_contexts indicates that of the 553 uses of a .* glob, almost all are using it to indicate "to end of filename" with either "/some/path.*" (197 usages) or "/some/path(/.*)?" (313 usages). (Somebody else can audit these 510 to determine if The Other Flavor should have been specified to handle the case of a file called "/some/path-foo" ;) Now, the bad news.. There's 43 cases of "neither of the above" ;) To find the rest: grep '\.\*' file_contexts/file_contexts | egrep -v '$\/\.\*$\?[[:space:]]|\.\*[[:space:]]' These 4 mystified me - why "(.*)?" instead of ".*" or "(/.*)?" /var/run/courier(.*)? system_u:object_r:courier_var_run_t /usr/lib(64)?/cyrus-imapd/(.*)? -- system_u:object_r:bin_t /var/www/lrrd(.*)? system_u:object_r:lrrd_var_lib_t /usr/X11R6/lib(64)?/xscreensaver(.*)? system_u:object_r:bin_t I suspect that all 4 were intended to be of the form "foo(/.*)?" - anybody know for sure? Also, anybody know where these come from? /lib(64)?/lvm-10(/.*) system_u:object_r:lvm_exec_t /lib(64)?/lvm-200(/.*) system_u:object_r:lvm_exec_t (I have some /lib/liblvm-10* files, but not /lib/lvm-* - is that from a non-Fedora system? I'm not seeing a /lib/lvm-* file in either the lvm or lvm2 Fedora RPMs) Now, some more good news - close to half the remaining 43 are from types.fc handling of ld_so_t and shlib_t - patch to clean those up attached. ;) Please double-check - I've verified that this patch doesn't unintentionally relabel anything on my system, and does avoid mislabeling the two xemacs files, but there very well might be things that intend to use .* to greedily swallow across a / character for the types I changed.. if it's too drastic, probably 95% of the benefit could be gained by just changing all the \.so.* to be \.so(\.[^/]*)* instead... As an aside, I *tried* to do this against a current Fedora: for i in *.rpm; do rpm -qpl $i >> /tmp/allfiles; done sort -u /tmp/allfiles | /usr/sbin/setfiles -v -d -n -s file_contexts/file_contexts but that just throws a lot of "File not found" for any files in RPMs that aren't on my system. Could we have a -t (for "test") flag that reports "What would the file context be set to if the file existed?" that skips statting the file? It would make automated regression testing of this sort of thing a lot easier. --- file_contexts/types.fc.dist 2004-06-01 21:09:03.000000000 -0400 +++ file_contexts/types.fc 2004-06-03 00:20:41.899373306 -0400 @@ -85,8 +85,8 @@ /var/ftp/bin(/.*)? system_u:object_r:bin_t /var/ftp/bin/ls -- system_u:object_r:ls_exec_t /var/ftp/lib(64)?(/.*)? system_u:object_r:lib_t -/var/ftp/lib(64)?/ld.*\.so.* -- system_u:object_r:ld_so_t -/var/ftp/lib(64)?/lib.*\.so.* -- system_u:object_r:shlib_t +/var/ftp/lib(64)?/ld[^/]*\.so(\.[^/]*)* -- system_u:object_r:ld_so_t +/var/ftp/lib(64)?/lib[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t /var/ftp/etc(/.*)? system_u:object_r:etc_t # @@ -258,13 +258,13 @@ # /lib(64)? # /lib(64)?(/.*)? system_u:object_r:lib_t -/lib(64)?/ld.*\.so.* -- system_u:object_r:ld_so_t -/lib(64)?/tls/ld.*\.so.* -- system_u:object_r:ld_so_t -/lib(64)?/lib.*\.so.* -- system_u:object_r:shlib_t -/lib(64)?/[^/]*/lib.*\.so.* -- system_u:object_r:shlib_t -/lib(64)?/devfsd/.*\.so.* -- system_u:object_r:shlib_t -/lib(64)?/security/.*\.so.* -- system_u:object_r:shlib_t -/lib(64)?/tls/i686/cmov/.*\.so.* -- system_u:object_r:shlib_t +/lib(64)?/ld[^/]*\.so(\.[^/]*)* -- system_u:object_r:ld_so_t +/lib(64)?/tls/ld[^/]*\.so(\.[^/]*)* -- system_u:object_r:ld_so_t +/lib(64)?/lib[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t +/lib(64)?/[^/]*/lib[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t +/lib(64)?/devfsd/[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t +/lib(64)?/security/[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t +/lib(64)?/tls/i686/cmov/[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t # # /sbin @@ -299,9 +299,9 @@ # /usr/lib(64)? # /usr/lib(64)?(/.*)? system_u:object_r:lib_t -/usr/lib(64)?/lib.*\.so.* -- system_u:object_r:shlib_t +/usr/lib(64)?/lib[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t /usr/lib(64)?/python.*\.so -- system_u:object_r:shlib_t -/usr/lib(64)?/.*/lib[^/]*\.so.* -- system_u:object_r:shlib_t +/usr/lib(64)?/.*/lib[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t /usr/lib(64)?/.*/.*\.so -- system_u:object_r:shlib_t /usr/lib(64)?/autofs/.*\.so -- system_u:object_r:shlib_t /usr/lib(64)?/perl5/man(/.*)? system_u:object_r:man_t @@ -316,21 +316,21 @@ # /usr/.*glibc.*-linux/lib(64)? # /usr/.*glibc.*-linux/lib(64)?(/.*)? system_u:object_r:lib_t -/usr/.*glibc.*-linux/lib(64)?/ld.*\.so.* system_u:object_r:ld_so_t -/usr/.*glibc.*-linux/lib(64)?/lib.*\.so.* system_u:object_r:shlib_t +/usr/.*glibc.*-linux/lib(64)?/ld[^/]*\.so(\.[^/]*)* system_u:object_r:ld_so_t +/usr/.*glibc.*-linux/lib(64)?/lib[^/]*\.so(\.[^/]*)* system_u:object_r:shlib_t # /usr/.*redhat-linux/lib(64)? # /usr/.*redhat-linux/lib(64)?(/.*)? system_u:object_r:lib_t -/usr/.*redhat-linux/lib(64)?/ld.*\.so.* system_u:object_r:ld_so_t -/usr/.*redhat-linux/lib(64)?/lib.*\.so.* system_u:object_r:shlib_t +/usr/.*redhat-linux/lib(64)?/ld[^/]*\.so(\.[^/]*)* system_u:object_r:ld_so_t +/usr/.*redhat-linux/lib(64)?/lib[^/]*\.so(\.[^/]*)* system_u:object_r:shlib_t # # /usr/.*linux-libc.*/lib(64)? # /usr/.*linux-libc.*/lib(64)?(/.*)? system_u:object_r:lib_t -/usr/.*linux-libc.*/lib(64)?/ld.*\.so.* system_u:object_r:ld_so_t -/usr/.*linux-libc.*/lib(64)?/lib.*\.so.* system_u:object_r:shlib_t +/usr/.*linux-libc.*/lib(64)?/ld[^/]*\.so(\.[^/]*)* system_u:object_r:ld_so_t +/usr/.*linux-libc.*/lib(64)?/lib[^/]*\.so(\.[^/]*)* system_u:object_r:shlib_t # # /usr/local @@ -349,7 +349,7 @@ # /usr/local/lib(64)? # /usr/local/lib(64)?(/.*)? system_u:object_r:lib_t -/usr/local/lib(64)?/.*\.so.* -- system_u:object_r:shlib_t +/usr/local/lib(64)?(/.*)+\.so(\.[^/]*)* -- system_u:object_r:shlib_t # # /usr/sbin @@ -365,7 +365,7 @@ # /usr/X11R6/(.*/)?lib(64)? # /usr/X11R6/(.*/)?lib(64)?(/.*)? system_u:object_r:lib_t -/usr/X11R6/(.*/)?lib(64)?/.*\.so.* -- system_u:object_r:shlib_t +/usr/X11R6/(.*/)?lib(64)?(/.*)+\.so(\.[^/]*)* -- system_u:object_r:shlib_t # # /usr/X11R6/man @@ -378,7 +378,7 @@ /usr/kerberos/bin(/.*)? system_u:object_r:bin_t /usr/kerberos/sbin(/.*)? system_u:object_r:sbin_t /usr/kerberos/lib(64)?(/.*)? system_u:object_r:lib_t -/usr/kerberos/lib(64)?/lib.*\.so.* -- system_u:object_r:shlib_t +/usr/kerberos/lib(64)?/lib[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t # # Fonts dir @@ -459,7 +459,7 @@ # /usr/java/j2sdk.*/bin(/.*)? system_u:object_r:bin_t /usr/java/j2sdk.*/jre/lib(64)?/i386(/.*)? system_u:object_r:lib_t -/usr/java/j2re1.*/plugin/i386(/.*)?/lib.*\.so.* -- system_u:object_r:shlib_t +/usr/java/j2re1.*/plugin/i386(/.*)?/lib[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t # # The krb5.conf file is always being tested for writability, so

2 1

Turn on SELinux
by Khurt Williams 05 Jun '04

05 Jun '04

I installed Fedora Core 2. I did not enable selinux at install. How do I now enable it?

2 1

kernel install issue: /sbin/depmod - avc's supplied
by Tom London 04 Jun '04

04 Jun '04

I'm presuming this is a know issue, but just in case.... kernel installs (via 'yum update') when running in strict/enforcing fail. Now that I have kernel-2.6.6-1.421 installed and running, I have avc's from /var/log/messages. Here are just a few: Jun 4 14:03:16 dell kernel: audit(1086382996.206:0): avc: denied { read } for pid=3643 exe=/sbin/depmod name=toshiba.ko dev=hdb3 ino=1056054 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 4 14:03:16 dell kernel: audit(1086382996.206:0): avc: denied { read } for pid=3643 exe=/sbin/depmod name=ppdev.ko dev=hdb3 ino=1056048 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 4 14:03:16 dell kernel: audit(1086382996.207:0): avc: denied { read } for pid=3643 exe=/sbin/depmod name=edd.ko dev=hdb3 ino=1069944 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 4 14:03:16 dell kernel: audit(1086382996.207:0): avc: denied { getattr } for pid=3643 exe=/sbin/depmod path=/lib/modules/2.6.6-1.422/build/sound/oss/dmasound/Makefile dev=hdb3 ino=1036012 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 4 14:03:16 dell kernel: audit(1086382996.208:0): avc: denied { getattr } for pid=3643 exe=/sbin/depmod path=/lib/modules/2.6.6-1.422/build/sound/oss/dmasound/Kconfig dev=hdb3 ino=1036011 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file Jun 4 14:03:16 dell kernel: audit(1086382996.208:0): avc: denied { getattr } for pid=3643 exe=/sbin/depmod path=/lib/modules/2.6.6-1.422/build/sound/oss/Makefile dev=hdb3 ino=1036006 scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:lib_t tclass=file The contexts in the rpm appear correct (i.e., most are system_u:object_r:modules_object_t, or similar), but the files in /lib/modules/2.6.6-1.422/.... are all labeled system_u:object_r:lib_t. Anyway, /sbin/depmod is having a hell of a time. Thanks to Stephen, the workaround of going into permissive mode prior to 'yum update' seems to work, but the file contexts need fixing. I checked bugzilla for yum but didn't find anything. Has this been filed/fixed? tom

1 0

Re: Install of latest packages....kernel-2.6.6-1.421 fails, selinux-policy-strict-1.13.3-2 succeeds
by Tom London 04 Jun '04

04 Jun '04

Stephen, That did it! Thanks! (You saved me a lot of time, since I usually don't check fedora-devel-list. I guess I should!) I needed to use 'single enforcing=0' to do the 'fixfiles relabel'. Lots needed relabeling (much in /lib/modules/2.6.6-1.421/). kernel-2.6.6-1.421 turns avc messages back on! tom ------------------------------------------------------------------------ * /From/: Stephen Smalley <sds epoch ncsc mil> ------------------------------------------------------------------------ On Fri, 2004-06-04 at 14:06, Tom London wrote: > My previous workaround (do 'setenforce 0; yum ....' followed by a > relabel) did not work this time. The mkinitrd now fails even under > permissive mode: > kernel 100 % done 1/1 > memlock: Cannot allocate memory > Couldn't lock into memory, exiting. > mkinitrd failed Also reported on fedora-devel-list; I don't think it is SELinux-related. 'ulimit -l unlimited' to workaround until a new kernel is available. -- Stephen Smalley <sds epoch ncsc mil> National Security Agency

1 0

[Fwd: Re: who provides /etc/sysconfig/selinux?]
by Daniel J Walsh 04 Jun '04

04 Jun '04

2 7

Install of latest packages....kernel-2.6.6-1.421 fails, selinux-policy-strict-1.13.3-2 succeeds
by Tom London 04 Jun '04

04 Jun '04

I did a 'yum update' to pick up the latest stuff from the development and Arjan's tree. I worked around the rpm conflicts from early stuff in the development tree. The kernel update (421) still fails under strict/enforcing mode. The context labels now appear to be in the rpm file, but I'm getting similar messages: ...... lots and lots of WARNING messages like: WARNING: Couldn't stat /lib/modules/2.6.6-1.421/build/include/asm-i386/ptrace.h: Permission denied WARNING: Couldn't stat /lib/modules/2.6.6-1.421/build/include/asm-i386/bug.h: Permission denied WARNING: Couldn't stat /lib/modules/2.6.6-1.421/build/include/asm-i386/serial.h: Permission denied WARNING: Couldn't stat /lib/modules/2.6.6-1.421/build/mm/Makefile: Permission denied FATAL: Could not open /lib/modules/2.6.6-1.421/modules.dep.temp for writing: Permission denied /bin/bash: /root/.bashrc: Permission denied No dep file found for kernel 2.6.6-1.421 mkinitrd failed My previous workaround (do 'setenforce 0; yum ....' followed by a relabel) did not work this time. The mkinitrd now fails even under permissive mode: [root@dell selinux]# setenforce 0 [root@dell selinux]# yum install kernel Gathering header information file(s) from server(s) Server: Test Linux 2.6-test prerelease kernels Server: Fedora Core 2 - i386 - Base Server: Fedora Core 2 - Development Tree Server: Fedora Core 2 - i386 - Released Updates Finding updated packages Downloading needed headers Resolving dependencies Dependencies resolved I will do the following: [install: kernel 2.6.6-1.421.i686] Is this ok [y/N]: y Downloading Packages Running test transaction: Test transaction complete, Success! kernel 100 % done 1/1 memlock: Cannot allocate memory Couldn't lock into memory, exiting. mkinitrd failed Since the latest kernel's seemed to have auditing off, I can't locate anything interesting in /var/log/messages. (Looks like CONFIG_AUDIT is set to y in 421.) Since the label now appear correct in the rpm file, could this be something in the policy/context files? Any ideas? The install of the 1.13.3-2 policy packages seemed to work OK. It left my /etc/selinux/config file untouched. (I guess I should have removed it prior to install.....sorry). tom

2 1

issue on Yum & Xattr
by Park Lee 04 Jun '04

04 Jun '04

Hi, I have several questions there: When we use the command 'yum', must we keep on line? Can I use it on my local machine? Where is the extended attributes stored? in the inode? Is there any text-based web browser that can be used in SELinux? I greatly appreciate your answer. Yours, Park Lee 2004-06-05 --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

1 0

Summary of Informal SELinux Meeting on May 6, 2004
by Karl MacMillan 04 Jun '04

04 Jun '04

An informal meeting of SELinux developers was held on May 6, 2004 at Tresys Technology in Columbia, Maryland. Below are some notes from that meeting. Karl MacMillan Tresys Technology http://www.tresys.com (410)290-1411 ext 134 Summary of Informal SELinux Meeting Columbia, Maryland, USA, 6 May, 2004 An informal meeting involving a group of some of the key contributors to the development of SELinux was held on May 6, 2004, at Tresys Technology, in Columbia, Maryland, USA. A small gathering was initially prompted by Russell Coker's visit to the Washington, D.C. area, but evolved into a larger informal meeting. The purpose of the meeting was to have informal, real-time discussions about the current status, challenges, and future of SELinux. ATTENDANCE Joshua Brindle Hardened Gentoo David Caplan Tresys Technology Jim Carter National Security Agency Russell Coker Red Hat James Griffin Howard Holm National Security Agency Jeff Johnson Red Hat Peter Loscocco National Security Agency Karl MacMillan Tresys Technology Frank Mayer Tresys Technology Stephen Smalley National Security Agency Eamon Walsh National Security Agency Via conference call: James Morris Red Hat Dan Walsh Red Hat WORKSHOP There was discussion of whether there was a need for establishing a regular forum, similar in nature to this meeting, aimed at examining the state of SELinux development. Specific issues discussed included the target audience, duration, scheduling, and potential sponsorship of the meetings. Tresys volunteered to organize an initial meeting in the Baltimore/Washington area some time in the fall. It was assumed that this area would accommodate the largest likely user participation. Additionally, there was some discussion as to whether the audience should be limited to core developers or extend to a more general population. The consensus was to model it after the Ottawa Linux kernel conference, which involves an initial meeting of core contributors followed by a more general symposium. The possibility of adding tutorials to this structure was also discussed. Finally, corporate sponsorship and government participation will be investigated. FEDORA CORE A brief update on the status of SELinux and Fedora Core 2 was given. The need for transparency and limited user interaction with SELinux was mentioned as a motivating requirement for much of the work that Red Hat has done. The discussion quickly branched off into details about the policy and policy management as Russell mentioned specific challenges Red Hat had encountered with their integration of SELinux. POLICY The current state of the public "default" policies was discussed. The set of default policies includes the original example base policy distributed by the NSA, the Fedora core policy, and the recently released targeted (or relaxed) policy. The new targeted policy was written with the aim of isolating a limited set of services or daemons and allowing the rest of the system to be relatively unaffected by the SELinux policy. The purpose of this is to provide an example policy that the general Linux population will be comfortable with (i.e., one that will minimally interfere with their accustomed operations) yet would show how SELinux can provide a level of protection from a service that at some time may be compromised. It makes the initial policy easier to analyze and provides groundwork for slowly introducing increased protection from the policy. Providing the targeted policy as the default might help SELinux gain acceptance, but it is not without potential drawbacks. A possible con to this strategy is that it may make application developers less likely to alter their software to work with SELinux or, where appropriate, be aware of SELinux. This goes against the strong objective to have application developers accept and integrate SELinux controls. Additionally, the targeted policy makes only limited use of the user and role features of SELinux because all users are placed in the same context. It is not clear whether this exposes an area of the policy language that needs additional thought. The desirability of modifying applications to be SELinux aware was discussed. A goal of SELinux is to allow the use of unmodified applications. Certain core system utilities need to be modified to be aware of SELinux (init for example), but in general it is possible to create policies that work with unmodified applications. There was a general consensus that the requirement to modify applications has been a limiting factor to the acceptance of other operating systems with mandatory access controls. This does not mean, however, that it is not desirable to make SELinux specific modifications to certain trusted system services. One example that was mentioned is that it is difficult to create optimal policies for certain types of applications. In particular, the Samba daemon needs the ability to access files with a wide variety of labels in order to service the requests of different users. It is desirable, however, to have SELinux limit the types of files that Samba will access on behalf of a specific user. The standard practices for handling this situation, like executing a separate Samba daemon for each user, will not work in this circumstance because of some details of the SMB/CIFS protocol. It was argued that Samba is a trusted application and it would be appropriate, therefore, to allow it to enforce SELinux access decisions by becoming a user-space object manager. See the "Policy Management" and "Security Enhanced X Status" sections for more details about user-space object managers. The conditional policy features were briefly discussed. It was suggested the conditional policy features could be used to grant privileges to daemons only on startup, similar to a setuid application dropping capabilities. Using the fine-grained labeling of the boolean files in the selinuxfs it is possible for an application to remove access privileges (through setting a boolean) and not have sufficient access privileges to turn them on again. The policy discussion ended with a consensus that it is a mistake to try to overreach on our goals (and likely come up short) on the initial versions of SELinux policies for mainstream users; instead, the initial goal should be to manage expectations of the general community to gain acceptance of type enforcement a little bit at a time. POLICY MANAGEMENT There was a lengthy discussion on how best to manage policy and the associated file context information. It was clear from the discussion that this is an area that has many unsolved challenges. Though no definitive solutions were determined, several motivating requirements emerged from the discussion and are detailed below. Local customizations One of the issues that has arisen as part of the Fedora Core 2 development process is how to handle local customizations to the policy on upgrade. Currently, user modified changes are overwritten by RPM on upgrade of the policy unless they are marked noreplace in the rpm spec file (tunables.te for example). Users must manually merge the changes from the update for files marked noreplace that had local customizations. All of the other customizations to the policy are lost on update. Gentoo handles this problem by presenting the user with diffs for all changes to files in /etc. The general consensus was that this is not an appropriate solution for the target audience of Fedora Core, but no other solution emerged. RPM Integration There was a lengthy discussion of integration with RPM. RPM is seen as a primary delivery mechanism for policy and file labels. Currently, RPM can record a single label for each file in the package and sets that label at installation time. The policy for each application is not contained with the package that provides that application. Instead, the entire policy is contained in a single RPM. After the previous discussions on default policies, it was clear that RPM needs to support multiple policies and that a single label per file is not sufficient. Several people suggested that modifying RPM to support multiple labels per file would solve this problem. Concerns were voiced about placing multiple labels in each package, however. It was argued that this would enlarge the package size, perhaps substantially, without solving the underlying problem of supporting multiple, arbitrary policies. This problem has some similarities to translation strings in that a potentially large number of translations needs to be provided for each package, they are not necessarily known at package creation time, and it is desirable to upgrade the translations without changing the packages. The translations are supported by allowing RPM to query an external translation database at installation time. There was a consensus that a similar scheme should be adopted by RPM for file labels. Policy Packaging and Dependencies There was some discussion about the way policy is currently associated with packages and how the dependency issues are solved. Fedora Core 2 provides a single package with the entire policy for the system. Hardened Gentoo provides a separate package for the policy for each application. The policy packages are automatically installed by marking them as dependencies of the application packages. The Gentoo package management system has a complex infrastructure for optional dependencies to allow the installation of different dependent packages based on user settings or system properties (architecture for example). These optional dependencies allow for considerable flexibility when managing SELinux policy packages. Binary Policy Modules The current work by Tresys on developing binary policy modules was discussed. This will allow for the management of policies without source, provide infrastructure and language support for specifying and tracking dependencies, and optionally manage file labeling on the installation and removal of policy modules. Some of the expected benefits of this work would be the looser coupling between portions of the policy and simplified policy management. For example, adding a user to the policy currently requires a full policy development environment including the source for the entire policy. The binary policy modules would allow the addition of a user without source or policy development tools. The desire to protect certain application by creating a separate domain for each user domain in a system was brought up. This is currently accomplished using macros that will be unavailable in the binary policy modules. It suggested that this could be solved using inheritance. It was agreed to investigate these additional policy language semantics. User-space Object Managers The need for better support of user-space object managers was discussed (see "Security Enhanced X Status" for more discussion). In particular, it was suggested that it is desirable to provide a mechanism that allows the policy for user-space object managers to be selectively separated from each other and the kernel policy. This is access control for policy modification and can be implemented through namespace separation and creating an object abstraction of the policy. Tresys stated that they are starting a research project on this topic which will result in a user-mode policy server based on the binary policy module work. SECURITY ENHANCED X STATUS A summary of the work done by the NSA to adapt user space SELinux type controls to X windows was presented. This work involved two main tasks: creating a user-space access vector cache and implementing the object classes and access control within X. The user-space access vector cache has been completed and is available as part of the standard NSA distribution. The implementation is a port of the kernel access vector cache and includes support for flushing on policy reload. The user-space cache is notified of the policy reloads through a netlink socket. The changes required to implement access control for X include the creation of eleven new object classes and modifications to the X server. The new object classes closely mirror those described in the technical report "Securing The X Window System With SELinux" by NAI labs. It was reported that the X developers are enthusiastic about the SELinux work and have accepted the changes to the X server in a branch of the upstream CVS repository. See http://www.x.org for more information. NFS A report on the progress of integrating SELinux mechanisms into NFS version 3 by the NSA was given. The current implementation was described as relatively simple and experimental. In particular, the implementation does not address many issues and has several assumptions including: * the underlying security problems with NFS are not addressed, * a secure network is assumed, * the client and server must both have the same policy, * and the issues with revocation caused by NFS caching are not addressed. Despite these issues, it is possible to have SELinux access control enforced on NFS mounted file systems. This is done by extending the NFS protocol to handle extended attributes so that a client can retrieve the labels of files of NFS file systems and extending the client to enforce access based on those labels. Additionally, mount options were added to specify that these features should be used. The current implementation is for NFS version 3, but it is expected that in the future work will be done on NFS version 4. It is not clear whether the NFS version 3 implementation will be acceptable upstream, but it is hoped that the future work on NFS version 4 will be. The NFS version 3 patches are available from the NSA website (http://www.nsa.gov/selinux) Finally, it was mentioned that the NFS work has exposed several bugs related to the labeling of sockets created by the kernel. Patches for these problems exist and were merged into the 2.6.6 kernel. TRAINING AND DOCUMENTATION It was reported that there has recently been a large amount of new interest expressed from both the corporate and government side for training. Tresys is in the process of refreshing their SELinux course material and will be offering a new set of classes shortly. The NSA is also working on updating past reference papers to reflect the more recent generation of SELinux. ASSURANCE Assurance was mentioned several times throughout the symposium. No SELinux system has currently been Common Criteria evaluated at any EAL level, though it is expected that one of the distributions that is currently seeking certification will have a system certified that includes SELinux. SELinux cannot be evaluated separately; only a complete system can be evaluated. BUSINESS CASE FOR SELINUX There was a discussion of strategies for making a case for the use of SELinux to decision makers in organizations. It was argued that making the case to managers can be different than making a case to front-line technical people. It was suggested that the fundamental question that needs to be answered for managers is how does the technology solve an important problem that they have.

4 6

fedora policy changes
by Chris Grier 04 Jun '04

04 Jun '04

Hi, I'm using Fedora Core 2 with SELinux, and I was wondering if there is an official place to submit (possible) policy changes. I have run across a couple things that might need to be changed, and I would like to submit them for the next versions of the policy packages. I can do bugzilla if thats the right place for these things. The main things I'm looking at right now are for dm-crypt. It seems that there might not be correct labeling to support device mapper. hda6 is the / partition, where the loopback file is (I'm using losetup to setup the loop, and dm-crypt to encrypt, which is then mounted as a user home directory) audit(1086192065.154:0): avc: denied { read } for pid=2844 exe=/sbin/ldconfig name=libdevmapper.so.1.00 dev=hda6 ino=278879 scontext=root:sysadm_r:ldconfig_t tcontext=system_u:object_r:usr_t tclass=file audit(1086192065.179:0): avc: denied { read } for pid=2844 exe=/sbin/ldconfig name=libdevmapper.so dev=hda6 ino=278880 scontext=root:sysadm_r:ldconfig_t tcontext=system_u:object_r:usr_t tclass=lnk_file -- Chris Grier <grier(a)uiuc.edu>

2 3

Access to the postgresql data files
by Igor Borisovsky 04 Jun '04

04 Jun '04

Hi. I have a question about selinux policy configuration for FC2. I need to forbid access to the postgresql data files from user root. I guess i have to create certain type for postgresql. Let's name this type pgsql. Thus i have something like that: [root@selinux pgsql]# pwd /var/lib/pgsql [root@selinux pgsql]# ls -aZ drwx------+ postgres postgres postgres:object_r:pgsql_home_dir_t . drwxr-xr-x root root system_u:object_r:var_lib_t .. drwx------ postgres postgres postgres:object_r:pgsql_home_dir_t backups -rw------- postgres postgres postgres:object_r:pgsql_home_t .bash_history -rw-r--r-- postgres postgres postgres:object_r:pgsql_home_t .bash_profile drwx------ postgres postgres postgres:object_r:pgsql_home_dir_t data -rw-r--r-- postgres postgres postgres:object_r:pgsql_home_t initdb.i18n drwxr-xr-x+ postgres postgres postgres:object_r:pgsql_home_t .mc [root@selinux pgsql]# So far user root within sysadm_r role has access to the postgresql data files. I guess i need to find and revoke this permission from sysadm_r role. After looking at the policy.conf file I can't understand this. So how can i prevent access to postgresql data files from user root? Thanks.

2 1

Re: Enabling SELinux (was Re: How to make SELinux in Fedora work?)
by Park Lee 03 Jun '04

03 Jun '04

On Thu, 03 Jun 2004 12:42:35 ,Daniel J Walsh wrote: >No, Relabel will not work in a Non SELinux kernel. But there are 2 items in The UnOfficial SELinux FAQ� http://www.crypt.gen.nz/selinux/faq.html : I upgraded my SELinux kernel to a new version and now I get lots of errors on booting, what went wrong? Bad things happen if you upgrade your kernel to a newer version which has an incompatible policy with the previous version. You probably forgot to install the policy and/or relabel the filesystems before booting the new version. Boot your system from a non-SELinux kernel and go back and do these things. If one of those messages is "login[1007]: UNABLE TO GET VALID SID FOR root" The SID table is mangled. Try logging in using a different method ( such as connecting over SSH ), otherwise you will need to recover by booting a non-SELinux kernel, then relabel the filesystem and reload the policy ( make reset and make load ). Then, what are those means? Does they mean that relabel can work in a non-SELinux kernel? yours, Park Lee 2004-06-03 --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

2 1

Re: re:Enabling SELinux (was Re: How to make SELinux in Fedora work?)
by Park Lee 03 Jun '04

03 Jun '04

Dear sir, Now, I know the reason to run 'fixfiles relabel' in single-user mode. Let's look at the 3 steps again: 1. Modified /etc/sysconfig/selinux to have 'SELINUX=permissive' 2. Rebooted single-user and ran 'fixfiles relabel' 3. Rebooted multi-user Can I take the steps in the order as the following: 1. Rebooted single-user and ran 'fixfiles relabel' 2. Rebooted multi-user 3. Modified /etc/sysconfig/selinux to have 'SELINUX=permissive' 4. Rebooted multi-user That is ,can we first 'fixfiles relabel' in a non-SELinux kernel. and then turn into the SELinux kernel ? Is it safe? Respectfully yours, Park Lee 2004-06-03 --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

3 2

re:Enabling SELinux (was Re: How to make SELinux in Fedora work?)
by Park Lee 03 Jun '04

03 Jun '04

ON Thu, 27 May 2004 11:07:33 ,Tom London wrote: >Following the attached advice, here's what I did: > 1. Modified /etc/sysconfig/selinux to have 'SELINUX=permissive' > 2. Rebooted single-user and ran 'fixfiles relabel' > 3. Rebooted multi-user For the 2nd item, I want to ask why you must reboot in single-user? can't we run 'fixfiles relabel' directly? Thank you Park Lee 2004-06-03 --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

3 2

No avc denied messages
by Richard Hally 03 Jun '04

03 Jun '04

When running kernel 406 in both enforcing and permissive mode with the latest "strict" policy(1-13.2-3) there are no (absolutely none!) avc denied messages. The troubling thing is that there is at least one thing that works in permissive and fails in enforcing. The first thing I checked was postgresql. It starts in permissive and fails to start in enforcing and there are no avc denied messages in either case. What could be the problem? thanks for the help. Richard Hally

3 2

issue on 'fixfiles relabel'
by Park Lee 03 Jun '04

03 Jun '04

Hi, I found in 'Fedora Core 2 SELinux FAQ', there is one item: "Fedora Core ships with a new script fixfiles which supports three options: check, restore, and relabel. This allows users to relabel the file system without having the policy-sources package installed." But ,if I don't install policy-sources package, where are the file_contexts information that used for relabelling? --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

2 1

Installing the new policy
by Richard Hally 03 Jun '04

03 Jun '04

Included below is the out put from doing a "yum install selinux-policy\*" while in enforcing mode: [root@old1 root]# yum install selinux-policy\* Gathering header information file(s) from server(s) Server: Fedora Core 2 - i386 - Base Server: Fedora Core 2 - Development Tree Server: Fedora Core 2 - i386 - Released Updates Finding updated packages Downloading needed headers Resolving dependencies Dependencies resolved I will do the following: [install: selinux-policy-targeted 1.13.1-1.noarch] [install: selinux-policy-strict 1.13.1-1.noarch] [install: selinux-policy-strict-sources 1.13.1-1.noarch] [install: selinux-policy-targeted-sources 1.13.1-1.noarch] Is this ok [y/N]: y Downloading Packages Getting selinux-policy-targeted-1.13.1-1.noarch.rpm selinux-policy-targeted-1 100% |=========================| 25 kB 00:00 Getting selinux-policy-strict-1.13.1-1.noarch.rpm selinux-policy-strict-1.1 100% |=========================| 1.1 MB 00:08 Getting selinux-policy-strict-sources-1.13.1-1.noarch.rpm selinux-policy-strict-sou 100% |=========================| 1.3 MB 00:12 Getting selinux-policy-targeted-sources-1.13.1-1.noarch.rpm selinux-policy-targeted-s 100% |=========================| 252 kB 00:01 Running test transaction: Test transaction complete, Success! selinux-policy-strict 100 % done 1/6 Can't open '/etc/selinux/strict/policy/policy.17': Permission denied selinux-policy-targeted 100 % done 2/6 Can't open '/etc/selinux/targeted/policy/policy.17': Permission denied selinux-policy-strict-sources 100 % done 3/6 make: Entering directory `/etc/selinux/strict/src/policy' /usr/sbin/load_policy /etc/selinux/strict/policy/policy.`cat /selinux/policyvers` Can't open '/etc/selinux/strict/policy/policy.17': Permission denied make: *** [tmp/load] Error 2 make: Leaving directory `/etc/selinux/strict/src/policy' selinux-policy-targeted-sources 100 % done 4/6 make: Entering directory `/etc/selinux/targeted/src/policy' /usr/sbin/load_policy /etc/selinux/targeted/policy/policy.`cat /selinux/policyvers` Can't open '/etc/selinux/targeted/policy/policy.17': Permission denied make: *** [tmp/load] Error 2 make: Leaving directory `/etc/selinux/targeted/src/policy' warning: /etc/security/selinux/policy.17 saved as /etc/security/selinux/policy.17.rpmsave warning: /etc/security/selinux/file_contexts saved as /etc/security/selinux/file_contexts.rpmsave Erasing: policy 5/6 warning: /etc/security/selinux/src/policy/users saved as /etc/security/selinux/src/policy/users.rpmsave warning: /etc/security/selinux/src/policy/file_contexts/program/seuser.fc saved as /etc/security/selinux/src/policy/file_contexts/program/seuser.fc.rpmsave Erasing: policy-sources 6/6 Installed: selinux-policy-targeted 1.13.1-1.noarch selinux-policy-strict 1.13.1-1.noarch selinux-policy-strict-sources 1.13.1-1.noarch selinux-policy-targeted-sources 1.13.1-1.noarch Transaction(s) Complete [root@old1 root]# Richard Hally

6 7

Re: How to make SELinux in Fedora work?
by Park Lee 03 Jun '04

03 Jun '04

Dear sir, Thank you, I still want to ask:"can I use 'rpm -Uvh' to install the policy-sources package instead of using the command of 'yum install policy-sources'"? Respectfully yours, Park Lee 2004-06-03 --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

2 1

New policies installed. Minor problem & change(?)
by Tom London 03 Jun '04

03 Jun '04

I've installed the latest selinux-policy-strict-1.13.2-4 stuff (along with -sources, libselinux*, etc. dependencies via 'yum update') with system running selinux-policy-strict-1.13.2-2/enforcing. A few 'minor' items noted: 1). The install produced protection/access messages when attempting to write/create /etc/selinux/strict/policy/policy.17 (the usual 'creating in .rpmnew' thing). Did this once for selinux-policy-strict and once for selinux-policy-strict-sources. (I had just completed a 'fixfiles relabel' with selinux-policy-strict-1.13.2-2, so I'm confident that the /etc/selinux directory was properly labeled.) I then did a manual 'mv policy.17 policy.17.rpmsave; mv policy.17.rpmnew policy.17', rebooted single-user, and did a 'fixfiles relabel', and then rebooted multi-user. ('fixfiles relabel/check' now fails if run in enforcing mode ('Permission denied' for file_contexts). Works if you 'setenforce 0' first. Did I miss a change?) 2). Also, there now is a complete absence of 'avc' messages in /var/log/messages. Is this expected? 3). I checked the scripts on the policy rpms and it looks like the reference to 'POLICYTYPE' is gone (replaced with 'SELINUXTYPE'). Is it safe to remove the 'POLICYTYPE=strict' line from /etc/sysconfig/selinux and from /etc/selinux/config? Can I safely remove one file? Thanks for the updates! tom

2 1

Re: How to make SELinux in Fedora work?
by Park Lee 03 Jun '04

03 Jun '04

On Thu, 27 May 2004 08:16:03 Stephen Smalley wrote: >If you didn't enable SELinux at install time, >then you'll need to install a policy >(yum install policy policy-sources), create or edit >/etc/sysconfig/selinux and set SELINUX=permissive in it, > and relabel your filesystems (via fixfiles relabel). >Once you get your filesystems labeled and have verified >that you can boot without avc denials in your logs, >you can set SELINUX=enforcing in /etc/sysconfig/selinux. I really didn't enable SELinux at install time. Then, I had a try to enable SELinx on my FC2 according to what you said. On my FC2,there was no policy-sources RPM package installed by default. Then I wanted to install the package. but there was something wrong when I using 'yum install policy-sources'. Below is what came on my screen: [root@localhost RPMS]# yum install policy-sources Gathering header information file(s) from server(s) Server: Fedora Core 2 - i386 - Base retrygrab() failed for: http://download.fedora.redhat.com/pub/fedora/linux/core/2/i386/os/headers/h… .info Executing failover method failover: out of servers to try Error getting file http://download.fedora.redhat.com/pub/fedora/linux/core/2/i386/os/headers/h… .info [Errno 4] IOError: <urlopen error > I wonder what's wrong? and here can I use 'rpm -Uvh' to install the package instead of using 'yum install policy-sources'. And there is another question: In 'Fedora Core 2 SELinux FAQ', it said: Q:. How do I temporarily turn off enforcing mode without having to reboot? A:. This situation usually arises when you can't perform an action that is being prevented by policy. Run the command setenforce 0 to turn off enforcing mode in real time. When you are finished, run setenforce 1 to turn enforcing back on Then, my question is: "can we still run 'echo 1 > /selinux/enforce' program to switch into enforcing mode. and switch back to permissive mode with 'echo 0 > /selinux/enforce'. Thank you very much! Sincerely yours, Park Lee 2004-06-03 --------------------------------- Do you Yahoo!? Friends. Fun. Try the all-new Yahoo! Messenger

2 2

Kernel 2.4 on fc2 with selinux?
by maillist＠wolke7.net 03 Jun '04

03 Jun '04

Hi, because lacks of sys_call_table in kernel 2.6 and other I must "downgrade" kernel on fc2 from 2.6 to 2.4, but selinux should works furtheron. Are there steps of particular importance to be taken? Should I prefer the clean kernel from kernel.org, or one from fc1 ( which one? src.rpm's ?) ? Is the nsa patch and the clean kernel enough (http://www.nsa.gov/selinux/code/download3.cfm) or any|all of the fc1 patches must be apply to works properly? TIA Marco -- +++ Jetzt WLAN-Router f�r alle DSL-Einsteiger und Wechsler +++ GMX DSL-Powertarife zudem 3 Monate gratis* http://www.gmx.net/dsl

3 2

Guidance using pam_passwdqc module and Army Regulation 25-2
by William Brower 03 Jun '04

03 Jun '04

Can anyone provide guidance concerning how to integrate the pam_passwdqc module with FC1 or FC2 ? I'll admit to not being a PAM expert, but I have RTFM, but still no luck. Some details: 1) pam_passwdqc can be found here: http://www.openwall.com/passwdqc/ I downloaded and installed the module - things went cleanly and the module was installed in /lib/security/pam_passwdqc.so 2) I tried modifying /etc/pam.d/system-auth to look like this (I know there is a warning about file autogeneration, but frankly, the /etc/pam.d/passwd file seems to direct all real action to this file - should I just modify the /etc/pam.d/passwd file instead??) OLD: password required /lib/security/$ISA/pam_cracklib.so retry=3 type= password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow password required /lib/security/$ISA/pam_deny.so NEW: #password required /lib/security/$ISA/pam_cracklib.so retry=3 type= password required /lib/security/$ISA/pam_passwdqc.so password sufficient /lib/security/$ISA/pam_unix.so nullok use_first_pass md5 shadow password required /lib/security/$ISA/pam_deny.so Please ignore possible line-wrap on "md5 shadow" lines above. The above fails with: [testuser@sloth testuser]$ passwd Changing password for user testuser. passwd: Authentication token manipulation error Here is my goal. Maybe I can reach it another way entirely: I'm trying to see if I can't make FCx automatically compliant with a new Army regulation (AR25-2) which provides specific password guidance, including the number of required characters from each character set (lower case, upper-case, numbers, punctuation), password length, etc. The regulation can be found here (see section 4-12: Password control): XML: http://docs.usapa.belvoir.army.mil/jw2/xmldemo/r25_2/cover.asp PDF: http://www.usapa.army.mil/pdffiles/r25_2.pdf In a nutshell, the relevant parts are: >e. Generate passwords as follows — > >(1) The minimum requirement is a 10-character case-sensitive password. >Passwords or phrases longer than 10 characters are recommended when >supported by the IS. Password expiration will be not more than 150 >days. > >(2) The password will be a mix of uppercase letters, lowercase letters, >numbers, and special characters, including at least two of each of the >four types of characters (for example, x$TloTBn2!) and can be user >generated. > >(3) Enforce password policy through implementation or enhancement of >native security mechanisms. > >(4) Passwords will not include such references as social security >numbers (SSNs), birthdays, USERIDs, names, slang, military acronyms, >call signs, dictionary words, consecutive or repetitive characters, >system identification, or names; neither will they be easy to guess >(for example, mypassword, abcde12345). > >(5) Password history configurations will prevent reutilization of the >last 10 passwords when technically possible. > Any help you can offer would be appreciated. Finally, would FC consider adding this module? I think a few distros have done this. Having an out-of-box AR25-2 compliant system would be pretty great from the Army's point of view! Thanks! Bill -- William Brower MIT Lincoln Laboratory Reagan Test Site, Kwajalein, Marshall Islands p: 805.355.1310 f: 805.355.1701

2 1

[ANNOUNCE] Setools version 1.4 released
by Karl MacMillan 02 Jun '04

02 Jun '04

Tresys Setools version 1.4 has been released. It is available from the SELinux sourceforge cvs repository and the Tresys webpage: http://www.tresys.com/selinux/ This release includes several new features including: - Support for binary policies in addition to source policies in libapol. This allows almost all of the tools, including Apol, Seaudit, sesearch, and seinfo, to work with a binary policy. This is especially important as more SELinux systems are deployed without a full policy source tree. - GUI updates to Apol and Seaudit to correctly support binary policies. - Seaudit, sesearch, and seinfo will now load a binary policy by default if no source policy is found. - Numerous bug fixes and policy updates for Seuser allowing it to run correctly under Fedora Core 2. - The installation of policy and labeling of files has been removed from the 'make install' target in order to support systems with policies that are significantly different from the default NSA policy. The new target 'make install-policy' will install the Setools policy files and label the applications and configuration files. - Seinfo now supports conditional policies. - The results tabs in Apol can now be renamed by the user to make them easier to distinguish when many tabs are open simultaneously. Karl MacMillan Tresys Technology http://www.tresys.com (410)290-1411 ext 134

1 0

Re: Installing the new policy
by Tom London 02 Jun '04

02 Jun '04

I also had some issues in the newest selinux-policy installs from the development tree. First, I had to remove setools to remove a yum/rpm conflict. After successfully yum'ing selinux-policy-strict-sources (which also installed selinux-policy-strict and removed policy and policy-sources), I rebooted in single user mode, where I did the usual 'fixfiles relabel'. I then rebooted to multiuser mode, where I determined that the 'mode' was set to 'disabled' (i.e., 'getenforce->disabled'). Rooting around uncovered that there was no /etc/selinux/config installed, nor was /etc/sysconfig/selinux updated with the 'SELINUXTYPE=strict' line. Since the thread on this was confusing to me, I also added a line 'POLICYTYPE=strict'). I modified /etc/syconfig/selinux copied it to /etc/selinux/config and rebooted. Still came up with selinux in 'disabled' mode. Checking /var/log/messages showed 'SELinux disabled at boot'. So, I rebooted adding 'selinux=1' to the boot line. This time, the boot failed with 'can't read /etc/fstab' and brought me up in 'filesystem repair' mode. There I determined that /etc/fstab had no security context assigned to it (Did it get rewritten during a 'disabled' boot?) I rebooted without the 'selinux=1' but in single-user mode, where I adjusted the context of /etc/fstab, /etc/sysconfig/selinux and /etc/selinux/config. I also changed /etc/sysconfig/selinux to boot up in permissive mode. Rebooting with 'selinux=1 single' worked, I reran 'fixfiles relabel'. Rebooting with 'selinux=1' into permissive/multi-user worked. I changed /etc/sysconfig/selinux and /etc/selinux/config to 'enforce'. Rebooting single-user (i.e., with 'selinux=1 single') worked. Rebooting strict/multi-user (i.e. with 'selinux=1') did not work. It got jammed setting up X.org log files. Seems that /var/log/Xorg.0.log.old had no security context so the attempt to move /var/log/Xorg.0.log 'on top of it' failed. I'm guessing it was a leftover from a 'disabled' boot.) I fixed that ('chcon --reference Xorg.0.log Xorg.0.log.old'), fixed /tmp/gconfd-tbl (same problem), and now it boots up strict/multi-user. So here's the condensed version; 1. installing selinux-policy-strict-sources (and selinux-policy-strict) did not setup /etc/selinux/config, nor did it modify /etc/sysconfig/selinux. (I must admit that I was confused by the message thread. Did I need to remove /etc/sysconfig/selinux before doing the 'yum install selinux-policy-strict-sources'? I thought the install would add the 'SELINUXTYPE=strict' line to an existing file, but I may have read this wrong.) 2. My system was 'setup' to boot by default into 'disabled' mode. This caused a lot of problems with unlabeled files, directories, etc. Accidently forgetting to add 'selinux=1' to the boot line may cause this. 3. I had to 'yum remove setools'. Did this cause my booting or other problems? 4. I added both 'SELINUXTYPE=' and 'POLICYTYPE=' lines to /etc/sysconfig/selinux and to /etc/selinux/config. Are both needed/correct? /sbin/fixfiles seems to want 'SELINUXTYPE'... 5. I manually copied /etc/selinux/conf from /etc/sysconfig/selinux. Does that provide the correct info/format? System is up and running in strict/enforcing mode. I will later try to install selinux-policy-targeted*. tom

3 2

Simplistic X11 logins not working.. (newbie questions)
by Erik Fichtner 01 Jun '04

01 Jun '04

So. I've got vanilla FC2 with SELinux loaded and the standard policy sources loaded on my laptop. For various reasons (low memory and a general dislike for all things GNOME; primarily), I'm trying to make good old xdm work and start boring old twm. This requires a little bit of manhandling within /etc/X11/xdm/Xsession and /etc/inittab. No big deal here. As packaged, the policy sets up xdm running as system_u:system_r:xdm_t. This starts a copy of X which is transitioned into system_u:system_r:xdm_xserver_t. Then there's a display ":0" sitting around on a third pid running as system_u:system_r:xdm_t. Fine. Logging in as my user (which results in a nice clean emf:user_r:user_t on the console) launches a twm as system_u:system_r:xdm_t, and then when I attempt to run an Xterm; i get the following avc denies: avc: denied { read write } for pid=3793 exe=/usr/bin/xterm name=ptmx dev=hda2 ino=134859 scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:ptmx_t tclass=chr_file avc: denied { search } for pid=3793 exe=/usr/bin/xterm dev= ino=1 scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:devpts_t tclass=dir avc: denied { search } for pid=3793 exe=/usr/bin/xterm dev= ino=1 scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:devpts_t tclass=dir and xterm promptly exits since it can't get a pty, and everything is still running as system_r:xdm_t; the real issue here. /etc/security/default_contexts does have an entry for: system_r:xdm_t staff_r:staff_t user_r:user_t sysadm_r:sysadm_t I even tried changing that to read: system_r:xdm_t user_r:user_t At this point, I started flailing around a little bit and created an Xwm.{te|fc} pair: type Xwm_exec_t, file_type, sysadmfile, exec_type; domain_auto_trans(xdm_t,Xwm_exec_t,user_t) /usr/X11R6/bin/twm system_u:object_r:Xwm_exec_t reloaded the policy, and relabelled twm. Alles gut, ya? Nein! Now, when xdm->Xsession fires off twm, i get this: security_compute_sid: invalid context system_u:system_r:user_t for scontext=system_u:system_r:xdm_t tcontext=system_u:object_r:Xwm_exec_t tclass=process and twm exits. Clearly, that wasn't the answer. So..... Questions are: 1) why doesn't default_contexts appear to have any influence upon xdm? 1a) is there a way to force it? 2) what am I supposed to do to get my window manager and its children into user_r:user_t ? Thanks in advance... -- Erik Fichtner; Unix Ronin

2 2

fedora 2 - ls -Z for proc
by Pratik Mehta 01 Jun '04

01 Jun '04

Hi, When i run on Fedora 2 ls --context or ls -Z for /proc i get: [root@localhost proc]# ls --context dr-xr-xr-x root root (null) 1 dr-xr-xr-x root root (null) 10 dr-xr-xr-x root root (null) 11 dr-xr-xr-x root root (null) 116 But as faye says in his documentation: Running ls --context /proc shows the following listing for the init process (with a process id of 1): dr-xr-xr-x root root system_u:system_r:init_t 1 Why is this so ????? - Pratik

2 1

Dumb question - where does policy.17 go when it is 'loaded'?
by Bob Gustafson 01 Jun '04

01 Jun '04

When a policy is reloaded (i.e., cd /etc/selinux/strict/src/policy; make reload), where does it go? Here we have a local make of the policy: [root@hoho2 policy]# make policy 2>&1 | tee policy.out /usr/bin/checkpolicy -o policy.17 policy.conf /usr/bin/checkpolicy: loading policy configuration from policy.conf security: 5 users, 7 roles, 1248 types, 1 bools security: 42 classes, 306567 rules /usr/bin/checkpolicy: policy configuration loaded /usr/bin/checkpolicy: writing binary representation (version 17) to policy.17 [root@hoho2 policy]# date Tue Jun 1 01:15:00 CDT 2004 [root@hoho2 policy]# ls -lt | head total 11712 -rw------- 1 root root 7465378 Jun 1 01:14 policy.17 -rw-r--r-- 1 root root 330 Jun 1 01:14 policy.out -rw-r--r-- 1 root root 97 May 29 23:57 reload.out drwxr-xr-x 2 root root 4096 May 29 23:57 tmp drwxr-xr-x 4 root root 4096 May 29 12:06 file_contexts -rw-r--r-- 1 root root 4207890 May 29 12:05 policy.conf drwx------ 2 root root 4096 May 29 12:05 flask drwx------ 3 root root 4096 May 29 12:05 macros drwx------ 2 root root 4096 May 29 12:05 types OK, policy.17 is dropped into this directory. [root@hoho2 policy]# ls -l ../../policy total 7308 -rw-r--r-- 1 root root 7465378 May 29 12:06 policy.17 And, the policy.17 in this strict tree - has not been updated Now, zap the local policy.17 [root@hoho2 policy]# rm policy.17 rm: remove regular file `policy.17'? y And now just do a make reload [root@hoho2 policy]# make reload 2>&1 | tee policy.out /usr/sbin/load_policy /etc/selinux/strict/policy/policy.`cat /selinux/policyvers` touch tmp/load Now, check where it went.. [root@hoho2 policy]# ls -l ../../policy total 7308 -rw-r--r-- 1 root root 7465378 May 29 12:06 policy.17 Does not seem to have updated policy in the same (strict) tree Look around for it [root@hoho2 policy]# find / -name policy.17 -print /etc/security/selinux/policy.17 /etc/security/selinux/src/policy/policy.17 /etc/selinux/targeted/src/policy/policy.17 /etc/selinux/targeted/policy/policy.17 /etc/selinux/strict/policy/policy.17 Lots of policies - now check dates [root@hoho2 policy]# ls -l /etc/security/selinux/policy.17 -rw-r--r-- 1 root root 7410154 May 29 12:13 /etc/security/selinux/policy.17 [root@hoho2 policy]# ls -l /etc/security/selinux/src/policy/policy.17 -rw------- 1 root root 7385824 May 7 10:24 /etc/security/selinux/src/policy/policy.17 [root@hoho2 policy]# ls -l /etc/selinux/strict/policy/policy.17 -rw-r--r-- 1 root root 7465378 May 29 12:06 /etc/selinux/strict/policy/policy.17 [root@hoho2 policy]# ls -l /etc/selinux/targeted/policy/policy.17 -rw-r--r-- 1 root root 97919 May 29 12:06 /etc/selinux/targeted/policy/policy.17 [root@hoho2 policy]# ls -l /etc/selinux/targeted/src/policy/policy.17 -rw------- 1 root root 97919 May 28 13:38 /etc/selinux/targeted/src/policy/policy.17 None of the dates have been touched. Where did it go? ----- Now, if policy is 'loaded', why do I now get these errors? [root@hoho2 user1]# rpm -i policycoreutils-1.13-3.src.rpm /etc/security/selinux/file_contexts: invalid context system_u:object_r:at_exec_t on line number 710 /etc/security/selinux/file_contexts: invalid context system_u:object_r:seuser_exec_t on line number 1550 /etc/security/selinux/file_contexts: invalid context system_u:object_r:seuser_conf_t on line number 1551 [root@hoho2 user1]# Also - hmm, I think I have security 'loaded' because I cannot 'su' into root now - unless I know what my role and type and ... are !! - may have to reboot. My guess at this point is that the policy is loaded into memory somewhere - maybe the kernel patches will tell where?? But why is there no disk version?

3 2

mysql issues...
by Valdis.Kletnieks＠vt.edu 01 Jun '04

01 Jun '04

Running the mysql command as a mortal user dies: $ mysql -hlocalhost -u MMMMMM -p MMMMMM Enter password: ERROR 2002: Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13) after throwing this avc message: May 24 21:34:19 pink kernel: audit(1085448859.069:0): avc: denied { search } for pid=4519 exe=/usr/bin/mysql name=mysql dev=dm-6 ino=129035 scontext=user_u:user_r:user_t tcontext=system_u:object_r:mysqld_db_t tclass=dir It's not able to search /var/lib/mysql to find the socket... A (slightly edited) grep shows us: [/etc/security/selinux/src/policy]3 find . | xargs grep mysqld_var_run | more ./domains/program/apache.te:allow httpd_php_t mysqld_var_run_t:dir { search }; ./domains/program/apache.te:allow httpd_php_t mysqld_var_run_t:sock_file { write }; ./domains/program/mysqld.te:allow mysqld_t mysqld_var_run_t:sock_file create_file_perms; ./domains/program/mysqld.te:allow initrc_t mysqld_var_run_t:sock_file write; ./domains/program/mysqld.te:allow logrotate_t mysqld_var_run_t:dir search; ./domains/program/mysqld.te:allow logrotate_t mysqld_var_run_t:sock_file write; ./file_contexts/program/mysqld.fc:/var/run/mysqld(/.*)? system_u:object_r:mysqld_var_run_t ./file_contexts/file_contexts:/var/run/mysqld(/.*)? system_u:object_r:mysqld_var_run_t Does anybody see a good reason why we don't have this too: mysqld.te: allow mysql_cmd_t mysqld_var_run_t:dir search; mysqld.te: allow mysql_cmd_t mysqld_var_run_t:sock_file write; and add this to mysqld.fc: /usr/bin/mysql system_u:object_r:mysql_cmd_t (or the correct version thereof, it's way too late to think straight.. ;)

3 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2004