November 2006 - selinux - Fedora Mailing-Lists

by Ted Rule

I wanted to integrate auditd with Logwatch as well as providing for overnight audit log rotation. Sadly, I'm still on FC4, so some of what follows may be out of date. Nevertheless, since the current FC6 Logwatch RPM isn't able to process /var/log/audit/audit.log, I thought the following might be of general interest, anyway. By default, my system was previously set with auditd disabled on boot. Once I enabled auditd, I found that auditd logged numerous types of message other than plain SELinux AVC's. Syslog, ( actually syslog-ng reading /proc/kmsg ), had only logged AVC's. Curiously, if I started auditd, and then stopped it again without a reboot, syslog immediately started logging all manner of non-AVC messages. Is it a bug that only AVC messages are logged via syslog when auditd is never started, OR is it a bug that non-AVC messages are logged via syslog when auditd is stopped after being run temporarily? I would imagine that this 'bug' is in the kernel itself, or perhaps a problem with the cleanliness of auditd's shutdown sequence. The audit RPM provides an example Cron script for SIGUSR1'ing auditd on demand. I created a copy of this in /etc/cron.daily so that it is called BEFORE logwatch is run overnight, as in: $ rpm -qvl audit |grep cron -rw-r--r-- 1 root root 271 Nov 4 2005 /usr/share/doc/audit-1.0.14/auditd.cron $ cat /etc/cron.daily/0auditrotate #!/bin/sh ########## # This script can be installed to get a daily log rotation # based on a cron job. ########## /sbin/service auditd rotate EXITVALUE=$? if [ $EXITVALUE != 0 ]; then /usr/bin/logger -t auditd "ALERT exited abnormally with [$EXITVALUE]" fi exit 0 $ The problem I then found was that system_crond_t had insufficient permissions to signal the daemon, so I had to add these extra permissions to my local SELinux policy: # Allow Cron invocations of auditdrotate to kill -USR1 auditd # Cron needs to read /var/run/audit.pid, and /proc/<pid of auditd> # as well as SIGUSR1 the process itself. allow system_crond_t auditd_var_run_t:file r_file_perms; allow system_crond_t auditd_t:dir r_dir_perms; allow system_crond_t auditd_t:process { signull signal }; Could/should the above set of permissions to grant Cron the ability to rotate audit logs be added to default policy? Perhaps controlled by an additional Boolean? Would it be a better overall solution to add an extra command-line option to auditctl so that it signals auditd via either SIGUSR1 or a private control channel? Cron could then be granted permission to run auditctl instead of directly signalling the daemon. Would it perhaps be better to relabel /etc/cron.daily/0auditrotate as auditctl_exec_t? I note from auditd.conf's man page that raising the number of logs which auditd rotates upon receipt of SIGUSR1 may be problematical as it may require increasing the kernel backlog setting in audit.rules. Since I would prefer to be able to have a complete rolling month's worth of history to hand, with or without compression, I wonder if it might be useful to get /etc/cron.daily/0auditrotate to pre-rotate AND gzip older logs before SIGUSR1'ing auditd. Since the gzip'ed logs would presumably be "invisible" to auditd, but "visible" to Logwatch's Archive processing, this would still allow Logwatch to run correctly, whilst reducing the rotation processing load on auditd itself. There are probably numerous little race conditions to beware of here, of course! The next problem, of course, was that logwatch, running as system_crond_t under FC4, but presumably as logwatch_t under FC5 and above, is unable to read /var/log/audit by default. To work round this, I duly added this set of permissions to my local policy: # Allow Cron invocations of logwatch to read /var/log/audit allow system_crond_t auditd_log_t:file r_file_perms; allow system_crond_t auditd_log_t:dir r_dir_perms; Could/should logwatch_t be granted permission to be an audit_log reader under latest policy by default, please? Perhaps controlled by an additional Boolean? The default installation of logwatch itself has a script for processing the AVC messages which are routed via syslog, namely /usr/share/logwatch/scripts/services/audit. Unfortunately, because of the difference in log format, and the log timestamping in particular, logwatch is unable to process /var/log/audit/audit.log "out of the box". Furthermore, it seems that this script is not capable of properly handling various non-AVC messages. To work round this problem, I created an extra shared script for logwatch, /etc/logwatch/scripts/shared/applyauditdate, which explicitly matched on the "date +%s" style timestamp in audit messages. This was tied into some additional configuration files, and a modified form of /usr/share/logwatch/scripts/services/audit, which I haved placed in /etc/logwatch/scripts/services/auditd, for processing raw audit daemon logs. I would envisage that a fully integrated installation would place the new script in /usr/share/logwatch/scripts/services/auditd, of course. With this all in place, I was finally able to get a daily Logwatch summary of all audit daemon activity, including all the non-AVC messages, albeit currently limited to a 4-day history. -- Ted Rule Director, Layer3 Systems Ltd W: http://www.layer3.co.uk/

17 years, 5 months

2
1
0 / 0

one particular key is not working

by ganesan pravinth

Hi, I am new to fedora, For me the . with > key is not working. But the same key is working for others' login. Before login that key is working but after i login that particular key is not working. Please help me. Any idea what might be the reason??? Thank You all ! Send instant messages to your online friends http://uk.messenger.yahoo.com

17 years, 5 months

2
1
0 / 0

nvidia 9626(9) drivers

by Tim Fenn

I've noticed with the latest nvidia drivers (9626 and 9629, obtained as RPMs from atrpms.net), nvidia_drv.o requires the textrel_shlib_t label, without which X fails to load: (II) Loading /usr/lib/xorg/modules/drivers/nvidia_drv.o dlopen: /usr/lib/xorg/modules/drivers/nvidia_drv.o: cannot restore segment prot after reloc: Permission denied (EE) Failed to load /usr/lib/xorg/modules/drivers/nvidia_drv.o Adding the following to file_contexts fixed things for me: /usr/lib(64)?/xorg/modules/drivers/nvidia-.*_drv\.o -- system_u:object_r:textrel_shlib_t:s0 If it would be best for me to file a bugzilla ticket, let me know. Regards, Tim

17 years, 5 months

1
0
0 / 0

NFS client support

by Clarkson, Mike R (US SSA)

A 2001 paper on SELinux that I have discusses SELinux's ability to control access to file systems mounted from ordinary NFS servers. It says that each file will be labeled based upon the NFS server identity. It goes on to say that separate labels for different file systems mounted from the same NFS server could be supported but is not currently implemented. Does fedora provide this capability? And if so, is the granularity of the labeling based upon NFS server identity or file system? Thanks, Mike

17 years, 5 months

2
1
0 / 0

execmem/execstack AVCs in recent updates

by Tom London

Running latest rawhide, targeted/enforcing. I seem to be getting execmem/execstack AVCs that I don't recall getting before, e.g., from firefox, vmware, realplayer: Believe this is from starting vmware: type=AVC msg=audit(1163430106.494:54): avc: denied { execstack } for pid=3462 comm="ld-linux.so.2" scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process type=AVC msg=audit(1163430106.494:54): avc: denied { execmem } for pid=3462 comm="ld-linux.so.2" scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process type=SYSCALL msg=audit(1163430106.494:54): arch=40000003 syscall=125 success=yes exit=0 a0=bfd55000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=3460 pid=3462 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 comm="ld-linux.so.2" exe="/lib/ld-2.5.90.so" subj=user_u:system_r:unconfined_t:s0 key=(null) Believe this is from starting realplayer: type=AVC msg=audit(1163429593.548:23): avc: denied { execmem } for pid=3291 comm="realplay.bin" scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process type=SYSCALL msg=audit(1163429593.548:23): arch=40000003 syscall=192 per=400000 success=yes exit=16433152 a0=0 a1=a01000 a2=7 a3=22 items=0 ppid=3286 pid=3291 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 comm="realplay.bin" exe="/usr/local/RealPlayer/realplay.bin" subj=user_u:system_r:unconfined_t:s0 key=(null) These from firefox: type=AVC msg=audit(1163429690.683:30): avc: denied { execstack } for pid=3327 comm="firefox-bin" scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process type=SYSCALL msg=audit(1163429690.683:30): arch=40000003 syscall=125 success=no exit=-13 a0=bfb21000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=1 pid=3327 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="firefox-bin" exe="/usr/lib/firefox-2.0/firefox-bin" subj=user_u:system_r:unconfined_t:s0 key=(null) type=AVC msg=audit(1163429690.693:31): avc: denied { execstack } for pid=3327 comm="firefox-bin" scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process type=SYSCALL msg=audit(1163429690.693:31): arch=40000003 syscall=125 success=no exit=-13 a0=bfb21000 a1=1000 a2=1000007 a3=fffff000 items=0 ppid=1 pid=3327 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="firefox-bin" exe="/usr/lib/firefox-2.0/firefox-bin" subj=user_u:system_r:unconfined_t:s0 key=(null) Did I clobber an update somehow? tom -- Tom London

17 years, 5 months

2
9
0 / 0

realplayer AVCs

by Tom London

After updating to selinux-policy-targeted-2.4.3-10, I notice the following AVCs when starting 'realplayer'. Realplayer no longer works. Didn't notice these before. Don't believe I saw any context changes during the update. type=AVC msg=audit(1163288612.216:22): avc: denied { execmem } for pid=3365 comm="realplay.bin" scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process type=SYSCALL msg=audit(1163288612.216:22): arch=40000003 syscall=192 per=400000 success=no exit=-13 a0=0 a1=a01000 a2=7 a3=22 items=0 ppid=3360 pid=3365 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 comm="realplay.bin" exe="/usr/local/RealPlayer/realplay.bin" subj=user_u:system_r:unconfined_t:s0 key=(null) type=AVC msg=audit(1163288612.224:23): avc: denied { execmem } for pid=3365 comm="realplay.bin" scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process type=SYSCALL msg=audit(1163288612.224:23): arch=40000003 syscall=192 per=400000 success=no exit=-13 a0=0 a1=a01000 a2=7 a3=22 items=0 ppid=3360 pid=3365 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 comm="realplay.bin" exe="/usr/local/RealPlayer/realplay.bin" subj=user_u:system_r:unconfined_t:s0 key=(null) type=AVC msg=audit(1163288612.224:24): avc: denied { execmem } for pid=3365 comm="realplay.bin" scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=process type=SYSCALL msg=audit(1163288612.224:24): arch=40000003 syscall=192 per=400000 success=no exit=-13 a0=0 a1=a01000 a2=7 a3=22 items=0 ppid=3360 pid=3365 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts1 comm="realplay.bin" exe="/usr/local/RealPlayer/realplay.bin" subj=user_u:system_r:unconfined_t:s0 key=(null) tom -- Tom London

17 years, 5 months

2
3
0 / 0

AVC denied for Spamassassin

by Volker Englisch

I have a lot of avc messages in my log file indicating a problem with spamassassin/mqueue. I am running FC6 with a standard installation and don't know why there is a problem with the directory /var/spool/mqueue. $ ls -Zd mqueue drwx------ root mail system_u:object_r:mqueue_spool_t mqueue/ Do I need to change the context for this directory? Below are some of the messages from my log file: Nov 8 23:02:32 kepler kernel: audit(1163044952.697:127322): avc: denied { search } for pid=14530 comm="spamassassin" name="mqueue" dev=sda8 ino=326413 scontext=user_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=dir Nov 8 23:02:33 kepler kernel: audit(1163044953.317:127323): avc: denied { search } for pid=14530 comm="spamassassin" name="mqueue" dev=sda8 ino=326413 scontext=user_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=dir Nov 8 23:02:33 kepler kernel: audit(1163044953.317:127324): avc: denied { search } for pid=14530 comm="spamassassin" name="mqueue" dev=sda8 ino=326413 scontext=user_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=dir Nov 8 23:02:33 kepler kernel: audit(1163044953.317:127325): avc: denied { search } for pid=14530 comm="spamassassin" name="mqueue" dev=sda8 ino=326413 scontext=user_u:system_r:procmail_t:s0 tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=dir -- Thanks Volker Englisch

17 years, 5 months

3
7
0 / 0

how to relabel one folder with SELinux

by shams

hi, i installed the fc6, my Documents Root for the server html was in the separate partition i mounted after installation under /var/www/, now SELinux prevent to reach the document root the this is: www]$ls -halZ drwxr-xr-x root root system_u:object_r:textrel_shlib_t . drwxr-xr-x root root system_u:object_r:var_t .. drwxr-xr-x root root system_u:object_r:httpd_sys_script_exec_t cgi-bin drwxr-xr-x root root system_u:object_r:httpd_sys_content_t error drwxr-xr-x root root user_u:object_r:file_t html drwxr-xr-x root root system_u:object_r:httpd_sys_content_t icons how i can relabel the only one directory html? ---------- * Zoner PhotoStudio 8 - Your Photos perfect, shared, organised! www.zoner.com/zps You can download your free version.

17 years, 5 months

2
1
0 / 0

postgres issues

by Craig White

on CentOS 4.4 - trying to have postgres authenticate a user via pam via LDAP ;-) I do see in /var/log/audit/audit.log type=AVC msg=audit(1163102102.393:151988): avc: denied { read } for pid=9424 comm="postmaster" name="ldaprc" dev=dm-0 ino=2864066 scontext=root:system_r :postgresql_t tcontext=root:object_r:var_lib_t tclass=file type=SYSCALL msg=audit(1163102102.393:151988): arch=40000003 syscall=5 success=no exit=-13 a0=8381848 a1=0 a2=1b6 a3=0 items=1 pid=9424 auid=0 uid=26 gid=2 6 euid=26 suid=26 fsuid=26 egid=26 sgid=26 fsgid=26 comm="postmaster" exe="/usr/bin/postgres" type=CWD msg=audit(1163102102.393:151988): cwd="/var/lib/pgsql" type=PATH msg=audit(1163102102.393:151988): name="/var/lib/pgsql/ldaprc" flags=101 inode=2864066 dev=fd:00 mode=0100644 ouid=26 ogid=26 rdev=00:00 type=AVC msg=audit(1163102102.395:151989): avc: denied { create } for pid=9424 comm="postmaster" scontext=root:system_r:postgresql_t tcontext=root:syste m_r:postgresql_t tclass=netlink_route_socket type=SYSCALL msg=audit(1163102102.395:151989): arch=40000003 syscall=102 success=no exit=-13 a0=1 a1=bfecd3cc a2=892ff4 a3=bfece464 items=0 pid=9424 auid=0 uid=26 gid=26 euid=26 suid=26 fsuid=26 egid=26 sgid=26 fsgid=26 comm="postmaster" exe="/usr/bin/postgres" type=SOCKETCALL msg=audit(1163102102.395:151989): nargs=3 a0=10 a1=3 a2=0 type=AVC msg=audit(1163102102.449:151990): avc: denied { create } for pid=9424 comm="postmaster" scontext=root:system_r:postgresql_t tcontext=root:syste m_r:postgresql_t tclass=netlink_audit_socket type=SYSCALL msg=audit(1163102102.449:151990): arch=40000003 syscall=102 success=no exit=-13 a0=1 a1=bfecc380 a2=a0eff4 a3=0 items=0 pid=9424 auid=0 uid=26 gid=26 euid=26 suid=26 fsuid=26 egid=26 sgid=26 fsgid=26 comm="postmaster" exe="/usr/bin/postgres" SO this is what I did... # audit2allow -i /var/log/audit/audit.log allow postgresql_t self:netlink_audit_socket create; allow postgresql_t self:netlink_route_socket create; allow postgresql_t var_lib_t:file read; # audit2allow -i /var/log/audit/audit.log \ >> /etc/selinux/targeted/src/policy/domains/local.te # cd /etc/selinux/targeted/src/policy/ # make reload but I am still being refused access per strace of process (forked from postmaster / postgres) [pid 11494] connect(3, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.2.0")}, 16) = -1 EACCES (Permission denied) [pid 11494] connect(3, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("255.255.255.255")}, 16) = -1 EACCES (Permission denied) [pid 11494] connect(3, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("192.168.2.0")}, 16) = -1 EACCES (Permission denied) What am I missing? Thanks Craig

17 years, 5 months

1
1
0 / 0

RE: New SELinux User

by Leffler, Sean

I don't know if this will fix your FC5 problems, but its worth a shot. I found mine worked after I upgraded these two files. (I was actually trying to make setools work with the new policy.21) After I was done updating stuff, my refpolicy actually compiled. :) policycoreutils 1.32 or higher libsemanage (1.6.17 I think is the latest?) Policycoreutils and libsemanage are available on the development repo's, so run something like this to gain access to these updates/upgrades yum --enablerepo=development --enablerepo=extras-development install libesemanage yum --enablerepo=development --enablerepo=extras-development install policycoreutils Run 'make clean' before retrying your refpolicy compile. Fellow struggling new user, Sean -----Original Message----- I've also had a go with the reference policy example in the book for FC5 and couldn't get that to compile either. That gives an error with the generated_definitions.conf file. I downloaded the most uptodate version of the refpolicy from Tresys' site but maybe there are other patches I need? Again, this was a std FC5 install.

17 years, 5 months

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2006