selinux October 2005

selinux@lists.fedoraproject.org

52 participants
53 discussions

Security context, how to change?
by Tomas Larsson 13 Oct '05

13 Oct '05

How do I change the security context automatically. I.e if I am moving one file from one folder, is it possible to automatically to Put the context for the new directory on the file. For example, if I move a file from the FTP-upload folder to HTTPD download folder. With best regards Tomas Larsson Sweden http://www.naks.mine.nu for downloads etc. ftp://ktl.mine.nu for uploads. Verus Amicus Est Tamquam Alter Idem

5 4

[ANN] SELinux Symposium Delegate Program
by James Morris 12 Oct '05

12 Oct '05

HP and Red Hat are pleased to sponsor the SELinux Symposium Community Delegate program. The Program sponsors community-based delegates to the Second Annual SELinux Symposium held February 28 to March 2, 2006 at the Wyndham Hotel in Baltimore Maryland. This program is designed to encourage and recognize outstanding community contributors of the SELinux project. The program will select and sponsor up to three community delegates to attend the Symposium, covering the costs of: * Travel to and from the Symposium * Hotel accommodations * Professional registration Nominations for delegates (including self-nominations) should be sent to selinux-delegate-program(a)redhat.com by November 30, 2005. HP and Red Hat will announce the names of the chosen delegates December 15, 2005. Nomination emails must include: * Up to 200 words describing the contributions of the nominee to the SELinux project and any related noteworthy Linux community achievements. Nominations are not limited to developers and open to all SELinux community members worldwide who are not employees of SELinux Symposium sponsors. See: <http://www.redhat.com/promo/selinux/> Please forward as necessary. - James -- James Morris <jmorris(a)redhat.com>

1 0

FC3 strict policy
by Russell Coker 11 Oct '05

11 Oct '05

I had a user ask me off-list about strict policy for FC3. It hadn't been updated for name_connect and the policy in FC4 doesn't work. Attached is a first pass at updating the FC3 strict policy to work with the latest kernels. I encourage anyone who is running FC3 strict machines to use selinux-policy-strict-sources-1.19.10-2 plus this patch instead of trying to use FC4 policy. NB It will take a little more work to get anything other than a basic server going with this policy, but it should be less work than the other options and the results should be better. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

2 2

SELinux Control of Network Cards?
by Robert L Cochran 11 Oct '05

11 Oct '05

If I have two network adapters e.g. eth0 and eth1 installed in a Fedora Core 4 system under SELinux control, does SELinux control the operation of these devices in any way? For example, suppose I have my own iptables firewall script. The script performs routing functions as well. Does SELinux impact this? Thanks Bob Cochran

2 1

Re: fedora-selinux-list Digest, Vol 20, Issue 9
by John Griffiths 10 Oct '05

10 Oct '05

fedora-selinux-list-request(a)redhat.com wrote: > > ------------------------------------------------------------------------ > > Subject: > Re: cant create dirs from vsftpd > From: > Peter Magnusson <iocc(a)fedora-selinux.lists.flashdance.cx> > Date: > Sun, 9 Oct 2005 23:01:03 +0200 (CEST) > To: > "Lamont R. Peterson" <lamont(a)gurulabs.com> > > To: > "Lamont R. Peterson" <lamont(a)gurulabs.com> > CC: > Fedora SELinux <fedora-selinux-list(a)redhat.com> > > > On Mon, 3 Oct 2005, Lamont R. Peterson wrote: > >>> Yes, you are. Im NOT talking about an anonymous ftp server. I login >>> with my >>> user and I expect to have the same files available as when I login over >>> ssh or sits in front of the computer. >> >> >> Daniel has already replied and told you how to make the change you >> want. I >> will just say that the setup you describe here is VERY VERY insecure. > > > Yes. Just like it worked in FC3. > >> Remember, FTP is not encrypted, so your username and password are >> going over >> the wire in clear text. Also, since the FTP daemon has access to the >> whole >> filesystem, anyone can get anything on your box (possibly even write any >> files they want, though that would depend on more configuration >> details than >> what you have told me about). > > > I know, if I am at some untrusted location I ftp to a temp-ftp account > that I change the password for each time. Or use scp. > >> FTP is the wrong tool for this. You should use sftp (from SSH not >> SSL) or >> scp. > > > Problems with scp: cant tab dirs, cant use -R like in ncftp to upload > whole dirs. > > scp -r works but thats not always how I want it. Use sftp. John Griffiths

1 0

cant create dirs from vsftpd
by Peter Magnusson 09 Oct '05

09 Oct '05

selinux-policy-targeted-1.25.3-9 in FC4 surely isnt perfect. Cant create dirs when I login over ftp: type=CWD msg=audit(1123375603.524:11258814): cwd="/home/iocc" type=PATH msg=audit(1123375603.524:11258814): item=0 name="mp3" flags=10 inode=5046274 dev=03:01 mode=040755 ouid=636 ogid=636 rdev=00:00 type=AVC msg=audit(1123375603.539:11258878): avc: denied { getattr } for pid=10556 comm="vsftpd" name="/" dev=0:10 ino=49161 scontext=root:system_r:ftpd_t tcontext=system_u:object_r:nfs_t tclass=dir type=SYSCALL msg=audit(1123375603.539:11258878): arch=40000003 syscall=196 success=no exit=-13 a0=9527930 a1=9523328 a2=3a3ff4 a3=797eec items=1 pid=10556 auid=636 uid=636 gid=636 euid=636 suid=636 fsuid=636 egid=636 sgid=636 fsgid=636 comm="vsftpd" exe="/usr/sbin/vsftpd" Cant find what I should turn off in /etc/selinux/targeted/booleans to make it work. So I need a little help. Later, I want to upload files in that dir also. Also, Im not so sure that I like that I cant see alot of dirs when Im logged in at the ftp.

5 12

FC3 selinux pam_auth
by Silvano Malaguti 08 Oct '05

08 Oct '05

I have installed three servers with Fedora C3. One of this three have selinux installed and just in this machine I have some trouble to authenticate squid users with pam_auth. /var/log/messages reports error form avc about the execution of pam_auth. Is real to think next to problems of interaction between selinux and pam_auth? Thanks in advance. Best regards. _________________________________________________ Silvano Malaguti System Administrator silvano(a)global.it - supporto.tecnico(a)global.it - www.global.it Global eXperience since 1995 _________________________________________________ Punto Net S.r.l Socio Unico Professione Internet dal 1995 Via Orsatti, 8 - 44038 - Pontelagoscuro - Ferrara - Italy (UE) Centro Servizi Ferrara: Tel: 0532.490.150 Fax: 0532.490.101

1 0

selinux squid pam_auth
by Silvano Malaguti 08 Oct '05

08 Oct '05

I have installed three server with Fedora C3. One of this three have selinux installed and just in this machine I have some trouble to authenticate squid users with pam_auth. /var/log/messages reports error form avc about the execution of pam_auth. Is real to think next to problems of interaction between selinux and pam_auth? Thanks in advance. Best regards. _________________________________________________ Silvano Malaguti System Administrator silvano(a)global.it - supporto.tecnico(a)global.it - www.global.it Global eXperience since 1995 _________________________________________________ Punto Net S.r.l Socio Unico Professione Internet dal 1995 Via Orsatti, 8 - 44038 - Pontelagoscuro - Ferrara - Italy (UE) Centro Servizi Ferrara: Tel: 0532.490.150 Fax: 0532.490.101

1 0

FC4 last updates kill postfix+postgrey
by Andy Green 08 Oct '05

08 Oct '05

Hi Folks - Using FC4 postfix with 'postgrey', a greylisting service that communicates via a unix socket: # ll -Z /var/spool/postfix/postgrey/socket srw-rw-rw- postgrey nobody root:object_r:postfix_spool_t /var/spool/postfix/postgrey/socket After recent updates: Sep 27 09:25:17 Updated: audit-libs.i386 1.0.4-1.fc4 Sep 27 09:25:31 Updated: audit.x86_64 1.0.4-1.fc4 Sep 27 09:25:34 Updated: selinux-policy-targeted.noarch 1.27.1-2.2 Sep 27 09:25:35 Updated: audit-libs.x86_64 1.0.4-1.fc4 and a reboot, the socket is not available for postfix to open: Sep 27 14:08:56 siamese postfix/smtpd[13486]: warning: connect to /var/spool/postfix/postgrey/socket: Permission denied Sep 27 14:08:56 siamese postfix/smtpd[13486]: warning: problem talking to server /var/spool/postfix/postgrey/socket: Permission denied Mail is then getting kicked because of this with, eg: Sep 27 14:08:57 siamese postfix/smtpd[13486]: NOQUEUE: reject: RCPT from hormel.redhat.com[209.132.177.30]: 450 Server configuration problem; from=<fedora-list-bounces(a)redhat.com> to=<andy(a)warmcat.com> proto=ESMTP helo=<hormel.redhat.com> However there are no avc complaints in /var/log/messages. Turning off enforcing (of the targetted mode this is) in system-config-securitylevel enables mail to work, therefore I deduce it is to do with selinux despite the lack of complaints. The socket is live alright as it appears (twice?) on: # lsof -n | grep postgrey\/socket postgrey 12989 postgrey 5u unix 0xffff81007995d800 77801 /var/spool/postfix/postgrey/socket postgrey 12989 postgrey 9u unix 0xffff810005ed3800 92050 /var/spool/postfix/postgrey/socket Any advice? -Andy

3 6

Audacity in FC, anyone?
by Brian 07 Oct '05

07 Oct '05

Does anyone know of a "short-list" means to get the Audacity application to compile under Fedora Core 3 or 4? Some of us in a group here have been trying, but the results either fail outright, or have rather strange issues with the MP3 format. We know that the "libmad" modules are done separately, and that the "wxWidgets" modules are also required as separately obtained modules for the link-stage. What we don't know is why the simple compilation of an app from a "trusted source" (sourceforge.net) should be so problematic. Is there a makefile which is relatively routine for this app? The documention does not seem to mention any such thing, and also does not clearly list any environment settings which are mandatory. Audacity is bundled with the /Mandrake/ distro, but as many of us know, that one is notoriously hard to "get under the hood" for maintenance. As far as we know, only the app itself is bundled with Mandrake, not any development materials. Any constructive suggestions are welcome. Brian Hagen

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux October 2005