selinux June 2005

selinux@lists.fedoraproject.org

83 participants
93 discussions

allow execmod and execmem for self debugging process [targeted]
by John Reiser 20 Jun '05

20 Jun '05

A self-debugging process wants arbitrary mmap() and mprotect() on itself, but gets EACCES with "avc: denied { execmod }" when it tries. What needs to be done to allow this? There are three cases: a) well-known named filesystem path as most-recent execve() b) process with "self-debug" as leaf name of most-recent execve() c) any execve() of a file with some assignable attribute [context] Using selinux-policy-targeted-1.23.16-6 enforcing under Fedora Core 4 kernel-2.6.11-1.1369_FC4, I see complaints such as ---- type=AVC_PATH msg=audit(1119151560.280:466428): \ path="/path/to/self-debugger/shared-library" type=SYSCALL msg=audit(1119151560.280:466428): arch=40000003 syscall=125 per=400000 \ success=no exit=-13 a0=3000 a1=1000 a2=5 a3=0 items=0 pid=2701 auid=4294967295 \ uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 \ comm="self-debug" exe="/path/to/self-debugger/self-debug" type=AVC msg=audit(1119151560.280:466428): avc: denied { execmod } for pid=2701 \ comm="self-debug" name=shared-library dev=hda7 ino=4104583 \ scontext=user_u:system_r:unconfined_t tcontext=system_u:object_r:file_t tclass=file ---- Booting the kernel with "enforcing=0" allows the mprotect() to succeed; auditd.log still shows similar messages, except with "success=yes exit=0". I'd like to retain the safeguards of the targeted enforcing policy, but allow "known cases" the capabilities that they need. [Yes, this is a technique that malware may try to exploit. "Bonware" deserves the chance to exploit it, too.] /etc/selinux/targeted/booleans has ----- allow_execmod=1 allow_execmem=1 ----- Shouldn't these two values have allowed any mprotect? The self-debugger wants to re-write PROT_EXEC + MAP_PRIVATE pages of itself and other files that have been mmap()ed into the same process. Code in .a archive library such as http://BitWagon.com/tub/tub.html gives an application more control over its address space by "hooking" all mmap(), etc. Complicated watchpoints run thousands of times faster in contrast to requiring ptrace() by a second process [gdb], etc. --

4 3

Re: not installing SELinux with Fedora
by stewartetcie＠canada.com 20 Jun '05

20 Jun '05

On 6/9/05, I <stewartetcie(a)canada.com> wrote: Users of Fedora Core 4 want to know, how do we not, repeat not, install SELinux? Steve Grubb <linux_4ever(a)yahoo.com> replied: >Why would you want to do that? Its better to fix >problems than avoid them. >SE Linux has to be installed. libselinux is linked to >many apps and the KERNEL is compiled with support for >SE Linux. You can disable it, but you have to install >it. Chris Bell <christofer.c.bell(a)gmail.com> replied: >Since you're already familiar how to disable SELinux, >the short answer to your question is, "you can't." Please allow me to reply to these responses. Steve, take a look at "sHype: Secure Hypervisor Approach to Trusted Virtualized Systems" an IBM research report published on February 2, 2005. On page 6, the authors say: "Mandatory access control has been designed and implemented for the Linux operating system (cf. SELinux [1]). However, controlling access of processes to kernel data structures has led to an extremely complex security policy. Therefore, SELinux does not enforce strong isolation properties equivalent to those offered when running applications on separate hardware platforms. Operating system security controls such as those offered by SELinux are more appropriate for enforcing mandatory access control among a set of closely cooperating applications, which naturally share a hardware platform. In a hypervisor system, there are few resources shared on the virtualization level. This results in simple security policies when compared to those for operating system controls." The point is that SELinux is: (1) so complex as to be unmanageable; (2) inappropriate for all cases, virtualization being a case in point. By the way, sHype is available as a patch for Xen, which is distributed with Fedora Core 4. On a more general note Steve, take a look at Ken Thompson's 1984 ACM Turing Award lecture, "Reflections on Trusting Trust" wherein the author of the UNIX operating system illustrates why you shouldn't trust sneaky folks like him. By extension, I'm a little suspicious of the NSA's motives in distributing a system for mandatory access control that is needlessly complex and, essentially, unmanageable at a time when snort and tripwire, for example, are widely available and a stateful firewall is built into the Linux kernel. Chris and Steve, you're abolutely correct. Fedora is the only widely used Linux distribution to incorporate SELinux in such a manner that it cannot be removed. If its so important, how come everybody else can get along without it? Perhaps we might consider an alternative Fedora Core 4 distro that is free of this one-stop security panacea? Yours truly, STEWART & CIE. Steve Stewart

3 2

file contexts in FC4
by Russell Coker 20 Jun '05

20 Jun '05

The attached patch fixes the following errors: matchpathcon_filespec_add: conflicting specifications for /etc/sysconfig/networking/devices/ifcfg-eth0 and /etc/sysconfig/network-scripts/ifcfg-eth0, using system_u:object_r:net_conf_t. matchpathcon_filespec_add: conflicting specifications for /etc/sysconfig/networking/profiles/default/ifcfg-eth0 and /etc/sysconfig/networking/devices/ifcfg-eth0, using system_u:object_r:net_conf_t. -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

1 0

Problem building new rpm's for FC4...
by Tom Lisjac 20 Jun '05

20 Jun '05

I've been using the checkinstall utility (http://asic-linux.com.mx/~izto/checkinstall/) to build RPM's from source packages since RH9. It's been recently fixed to work with a few changes in FC4... but there is a lingering SELinux issue that I'm hoping someone here can shed some light on. After building a few RPM's, I noticed these two lines in the file lists of the RPM's I generated: /selinux /selinux/context This causes the following error during the RPM install: root@fc4-builder:~ # rpm -i /usr/src/redhat/RPMS/i386/fwlogwatch-1.0-1.i386.rpm error: unpacking of archive failed on file /selinux/context;42b5e311: cpio: open failed - Permission denied Does anyone know why selinux/context has been inserted into the file list? Is this a new thing that's been added to rpmbuild in FC4? Best regards, -Tom

1 0

Re: having trouble getting dhcpd started
by Jon August 19 Jun '05

19 Jun '05

Ah ha! So it is SELinux. How do I tell SELinux to let this happen? (major SELinux newbie) Thanks! type=AVC msg=audit(1119209957.460:1957770): avc: denied { name_bind } for pid=3636 comm="dhcpd" src=67 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:reserved_port_t tclass=udp_socket type=SYSCALL msg=audit(1119209957.460:1957770): arch=c000003e syscall=49 success=no exit=-13 a0=6 a1=7ffffff31010 a2=10 a3=7ffffff3102c items=0 pid=3636 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="dhcpd" exe="/usr/sbin/dhcpd" On Jun 19, 2005, at 3:59 PM, Ivan Gyurdiev wrote: > On Sun, 2005-06-19 at 15:53 -0400, Jon August wrote: > >> Hi there, >> >> I just installed FC4 and I'm trying to get DHCP started, so I pulled >> my dhcpd.conf from the machine we're moving it from, and checked to >> see if any of the syntax had changed. All looks good, but when I try >> to start dhcpd I get the following. >> >> Is SELinux preventing dhcp from binding to the port? I don't see any >> audit messages in /var/log/messages. >> > > What about /var/log/audit.log ? > Is audit running? > > You can run SELinux in permissive mode to check. > (/usr/sbin/setenforce 0; > /etc/init.d/dhcpd restart; > /usr/sbin/setenforce 1;) > > >

2 2

selinux & external hd permissions.
by Justin Conover 19 Jun '05

19 Jun '05

Currently I have a server with a raid 5 for my wifes photography backups and some other stuff I keep. I want to get an exteranl hd like a LaCie 500GB firewire/usb for backup of that file system for extra safety. Question is, if that server is running SELinux on CentOS 4.0 and I back stuff up to that exteranl drive, will other box's be able to read that exteranl drive? In the chance that hardware fails and I need to be able to look at that data on another box? Or, would it just be better to format the external with fat32 or something my wife can use her box to pull the data off?

3 6

httpd fails to start with latest policy
by Bob Kashani 18 Jun '05

18 Jun '05

httpd fails to start with the latest FC3 policy. selinux-policy-targeted-1.17.30-3.9 Here is the AVC message: Jun 17 10:04:48 sorcerer kernel: audit(1119027888.944:0): avc: denied { name_bind } for pid=3265 exe=/usr/sbin/httpd src=2121 scontext=user_u:system_r:httpd_t tcontext=system_u:object_r:port_t tclass=tcp_socket Jun 17 10:04:48 sorcerer httpd: (13)Permission denied: make_sock: could not bind to address [::]:2121 Jun 17 10:04:48 sorcerer httpd: no listening sockets available, shutting down Jun 17 10:04:48 sorcerer httpd: Unable to open logs Jun 17 10:04:48 sorcerer httpd: httpd startup failed I normally use port 80 and 2121. How do I fix this? Bob -- Bob Kashani http://www.ocf.berkeley.edu/~bobk/garnome

2 2

Module compilation issues in Fedore core 3
by Narayan Krishnamurthy 17 Jun '05

17 Jun '05

Hi all, I ran make modules from the Linux--- directory and after some time I go the following error. drivers/scsi/qla2xxx/qla_os.c: In function `qla2x00_queuecommand': drivers/scsi/qla2xxx/qla_os.c:315: sorry, unimplemented: inlining failed in call to 'qla2x00_callback': function not considered for inlining drivers/scsi/qla2xxx/qla_os.c:269: sorry, unimplemented: called from here drivers/scsi/qla2xxx/qla_os.c:315: sorry, unimplemented: inlining failed in call to 'qla2x00_callback': function not considered for inlining drivers/scsi/qla2xxx/qla_os.c:269: sorry, unimplemented: called from here make[3]: *** [drivers/scsi/qla2xxx/qla_os.o] Error 1 make[2]: *** [drivers/scsi/qla2xxx] Error 2 make[1]: *** [drivers/scsi] Error 2 Anybody know how to handle this error. I am using the native compiler which came with Fedora core 3 (gcc ver 3.4.2) Thanks for any help -Narayan --------------------------------- Yahoo! Mail Mobile Take Yahoo! Mail with you! Check email on your mobile phone.

1 0

How to build modules
by Narayan Krishnamurthy 17 Jun '05

17 Jun '05

Hi, I just installed Fedora Core 3 on my desktop which is a Dell Dimension XPS T450. Pentium III 450 Mhz. How do I build modules? viz. USB modules? Any detailed assistance would be appreciated -regards Narayan --------------------------------- Yahoo! Sports Rekindle the Rivalries. Sign up for Fantasy Football

1 0

not installing SELinux with Fedora
by stewartetcie＠canada.com 17 Jun '05

17 Jun '05

Hi folks, Controlling SELinux, Fedora Core 3 SELinux FAQ at http://fedora.redhat.com/docs/selinux-faq-fc3/ says: "Q: How do I install/not install SELinux?" "A: The installer handles this based on the choice you make in the Firewall Configuration screen. The default running policy is the targeted policy, and it is on by default." Doesn't this beg the question? In fact, doesn't the Firewall Configuration screen merely determine whether SELinux is enabled/disabled? Users of Fedora Core 4 want to know, how do we not, repeat not, install SELinux? Yours truly STEWART & CIE. Steve Stewart

7 10

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2005