June 2006 - selinux - Fedora mailing-lists

List of operations
by Göran Uddeborg 17 Oct '06

17 Oct '06

Maybe this is a FAQ, but I haven't found it answered in any of the FAQ:s I've looked through: Is there some kind of documentation list over the available classes and operations (permissions)? Other concepts, like types and roles are defined in the policy, with some luck together with a comment. In some cases there are even manual pages, like httpd_selinux. But the list of available classes and operations must be defined by the kernel module if I understand things correctly. I could extract a list from the flask/access_vectors file. But I would have liked something with a sentence or so of explanation. Some names may be self-explanatory, but many are not obvious. I'm imagining some kind of list like the appendices of the O'Reilley book, but updated for the current version. Does such a list exist somewhere? Or is it just in my imagination? :-)

4 4

Re: postfix, procmail and SELinux - No Go
by Paul Howarth 14 Aug '06

14 Aug '06

On Tue, 2006-06-06 at 21:34 -0500, Marc Schwartz wrote: > Paul, > > OK...seemingly back up and running. Here are the present avc messages > since re-loading everything and confirming that the file contexts are > back to the changes that we made. > > I note that the /proc/meminfo messages are back, but now for > clamassassin. I am sure that I have reloaded the new modules that we > created, so not sure what is up here, unless there was some conflict > when the two versions of the policies we seemingly loaded earlier today. > > Let me know on these and if perhaps I missed something: You forgot that we reverted the clamassassin context change yesterday. # restorecon -v /usr/local/bin/clamassassin > type=AVC msg=audit(1149646922.456:801): avc: denied { read } for pid=23273 comm="clamassassin" name="meminfo" dev=proc ino=-268435454 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file > type=SYSCALL msg=audit(1149646922.456:801): arch=40000003 syscall=5 success=yes exit=3 a0=489093ef a1=0 a2=1b6 a3=a021240 items=1 pid=23273 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 comm="clamassassin" exe="/bin/bash" > type=CWD msg=audit(1149646922.456:801): cwd="/home/marcs" > type=PATH msg=audit(1149646922.456:801): item=0 name="/proc/meminfo" flags=101 inode=4026531842 dev=00:03 mode=0100444 ouid=0 ogid=0 rdev=00:00 > type=AVC msg=audit(1149646922.456:802): avc: denied { getattr } for pid=23273 comm="clamassassin" name="meminfo" dev=proc ino=-268435454 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=file > type=SYSCALL msg=audit(1149646922.456:802): arch=40000003 syscall=197 success=yes exit=0 a0=3 a1=bf8d7f28 a2=4891eff4 a3=3 items=0 pid=23273 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 comm="clamassassin" exe="/bin/bash"type=AVC_PATH msg=audit(1149646922.456:802): path="/proc/meminfo" > type=AVC msg=audit(1149646922.456:803): avc: denied { search } for pid=23273 comm="clamassassin" name="bin" dev=hdc7 ino=3112982 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=dir > type=SYSCALL msg=audit(1149646922.456:803): arch=40000003 syscall=5 success=yes exit=3 a0=a023018 a1=8000 a2=0 a3=8000 items=1 pid=23273 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 comm="clamassassin" exe="/bin/bash" > type=CWD msg=audit(1149646922.456:803): cwd="/home/marcs" > type=PATH msg=audit(1149646922.456:803): item=0 name="/usr/local/bin/clamassassin" flags=101 inode=3115337 dev=16:07 mode=0100555 ouid=0 ogid=0 rdev=00:00 > type=AVC msg=audit(1149646922.460:804): avc: denied { execute } for pid=23274 comm="clamassassin" name="mktemp" dev=hdc7 ino=1966111 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file > type=AVC msg=audit(1149646922.460:804): avc: denied { execute_no_trans } for pid=23274 comm="clamassassin" name="mktemp" dev=hdc7 ino=1966111 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file > type=AVC msg=audit(1149646922.460:804): avc: denied { read } for pid=23274 comm="clamassassin" name="mktemp" dev=hdc7 ino=1966111 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file > type=SYSCALL msg=audit(1149646922.460:804): arch=40000003 syscall=11 success=yes exit=0 a0=a0232c0 a1=a023500 a2=a026dd0 a3=a023228 items=2 pid=23274 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 comm="mktemp" exe="/bin/mktemp" > type=AVC_PATH msg=audit(1149646922.460:804): path="/bin/mktemp" > type=AVC_PATH msg=audit(1149646922.460:804): path="/bin/mktemp" > type=CWD msg=audit(1149646922.460:804): cwd="/home/marcs" > type=PATH msg=audit(1149646922.460:804): item=0 name="/bin/mktemp" flags=101 inode=1966111 dev=16:07 mode=0100555 ouid=0 ogid=0 rdev=00:00 > type=PATH msg=audit(1149646922.460:804): item=1 flags=101 inode=754491 dev=16:07 mode=0100755 ouid=0 ogid=0 rdev=00:00 > type=AVC msg=audit(1149646922.460:805): avc: denied { read } for pid=23274 comm="mktemp" name="urandom" dev=tmpfs ino=1719 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file > type=SYSCALL msg=audit(1149646922.460:805): arch=40000003 syscall=5 success=yes exit=3 a0=80494d8 a1=0 a2=48920120 a3=8f5f008 items=1 pid=23274 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 comm="mktemp" exe="/bin/mktemp" > type=CWD msg=audit(1149646922.460:805): cwd="/home/marcs" > type=PATH msg=audit(1149646922.460:805): item=0 name="/dev/urandom" flags=101 inode=1719 dev=00:0f mode=020444 ouid=0 ogid=0 rdev=01:09 > type=AVC msg=audit(1149646922.468:806): avc: denied { execute_no_trans } for pid=23277 comm="clamassassin" name="clamscan" dev=hdc7 ino=3123838 scontext=system_u:system_r:clamscan_t:s0 tcontext=system_u:object_r:clamscan_exec_t:s0 tclass=file > type=SYSCALL msg=audit(1149646922.468:806): arch=40000003 syscall=11 success=yes exit=0 a0=a026c00 a1=a026210 a2=a026dd0 a3=a026d90 items=2 pid=23277 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 comm="clamscan" exe="/usr/bin/clamscan" > type=AVC_PATH msg=audit(1149646922.468:806): path="/usr/bin/clamscan" > type=CWD msg=audit(1149646922.468:806): cwd="/home/marcs" > type=PATH msg=audit(1149646922.468:806): item=0 name="/usr/bin/clamscan" flags=101 inode=3123838 dev=16:07 mode=0100755 ouid=0 ogid=0 rdev=00:00 > type=PATH msg=audit(1149646922.468:806): item=1 flags=101 inode=754491 dev=16:07 mode=0100755 ouid=0 ogid=0 rdev=00:00 The context change should fix all of the above. > type=AVC msg=audit(1149646926.516:807): avc: denied { recv_msg } for saddr=66.250.40.33 src=24441 daddr=192.168.1.2 dest=32875 netif=eth0 scontext=user_u:system_r:pyzor_t:s0 tcontext=system_u:object_r:pyzor_port_t:s0 tclass=udp_socket Hmm, pyzor needs to receive messages as well as send them... > type=AVC msg=audit(1149646926.528:808): avc: denied { create } for pid=23325 comm="dccproc" scontext=user_u:system_r:spamd_t:s0 tcontext=user_u:system_r:spamd_t:s0 tclass=netlink_route_socket > type=SYSCALL msg=audit(1149646926.528:808): arch=40000003 syscall=102 success=yes exit=3 a0=1 a1=bfb89868 a2=4891eff4 a3=8069fbf items=0 pid=23325 auid=500 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 comm="dccproc" exe="/usr/local/bin/dccproc" > type=SOCKETCALL msg=audit(1149646926.528:808): nargs=3 a0=10 a1=3 a2=0 > type=AVC msg=audit(1149646926.528:809): avc: denied { bind } for pid=23325 comm="dccproc" scontext=user_u:system_r:spamd_t:s0 tcontext=user_u:system_r:spamd_t:s0 tclass=netlink_route_socket > type=SYSCALL msg=audit(1149646926.528:809): arch=40000003 syscall=102 success=yes exit=0 a0=2 a1=bfb89868 a2=4891eff4 a3=3 items=0 pid=23325 auid=500 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 comm="dccproc" exe="/usr/local/bin/dccproc" > type=SOCKADDR msg=audit(1149646926.528:809): saddr=100000000000000000000000 > type=SOCKETCALL msg=audit(1149646926.528:809): nargs=3 a0=3 a1=bfb89874 a2=c > type=AVC msg=audit(1149646926.528:810): avc: denied { getattr } for pid=23325 comm="dccproc" scontext=user_u:system_r:spamd_t:s0 tcontext=user_u:system_r:spamd_t:s0 tclass=netlink_route_socket > type=SYSCALL msg=audit(1149646926.528:810): arch=40000003 syscall=102 success=yes exit=0 a0=6 a1=bfb89868 a2=4891eff4 a3=3 items=0 pid=23325 auid=500 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 comm="dccproc" exe="/usr/local/bin/dccproc" > type=SOCKETCALL msg=audit(1149646926.528:810): nargs=3 a0=3 a1=bfb89874 a2=bfb89880 > type=AVC msg=audit(1149646926.528:811): avc: denied { write } for pid=23325 comm="dccproc" scontext=user_u:system_r:spamd_t:s0 tcontext=user_u:system_r:spamd_t:s0 tclass=netlink_route_socket > type=AVC msg=audit(1149646926.528:811): avc: denied { nlmsg_read } for pid=23325 comm="dccproc" scontext=user_u:system_r:spamd_t:s0 tcontext=user_u:system_r:spamd_t:s0 tclass=netlink_route_socket > type=SYSCALL msg=audit(1149646926.528:811): arch=40000003 syscall=102 success=yes exit=20 a0=b a1=bfb887b4 a2=4891eff4 a3=ffffffcc items=0 pid=23325 auid=500 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 comm="dccproc" exe="/usr/local/bin/dccproc" > type=SOCKADDR msg=audit(1149646926.528:811): saddr=100000000000000000000000 > type=SOCKETCALL msg=audit(1149646926.528:811): nargs=6 a0=3 a1=bfb8982c a2=14 a3=0 a4=bfb89840 a5=c > type=AVC msg=audit(1149646926.528:812): avc: denied { read } for pid=23325 comm="dccproc" scontext=user_u:system_r:spamd_t:s0 tcontext=user_u:system_r:spamd_t:s0 tclass=netlink_route_socket > type=SYSCALL msg=audit(1149646926.528:812): arch=40000003 syscall=102 success=yes exit=128 a0=11 a1=bfb887b4 a2=4891eff4 a3=ffffffcc items=0 pid=23325 auid=500 uid=500 gid=0 euid=500 suid=0 fsuid=500 egid=0 sgid=500 fsgid=0 comm="dccproc" exe="/usr/local/bin/dccproc" > type=SOCKETCALL msg=audit(1149646926.528:812): nargs=3 a0=3 a1=bfb89810 a2=0 I've seen a lot of these recently. I think dcc is trying to read the routing table. We'll allow that. (snip) The rest seem to be duplicates. Updated policy modules: ####### mydcc.te ####### policy_module(mydcc, 0.1.3) require { type spamd_t; } type dcc_var_t; files_type(dcc_var_t) type dcc_client_map_t; files_type(dcc_client_map_t) # Allow spamd to behave as a dcc client allow spamd_t dcc_client_map_t:file rw_file_perms; allow spamd_t dcc_var_t:dir search; # Allow spamd to read the routing table (needed by dcc) allow spamd_t self:netlink_route_socket { r_netlink_socket_perms }; ####### mypyzor.te ####### policy_module(mypyzor, 0.1.3) require { type pyzor_t; type pyzor_port_t; type spamd_t; }; # temp files type pyzor_tmp_t; files_tmp_file(pyzor_tmp_t) # Allow pyzor to create and use temp files and dirs allow pyzor_t pyzor_tmp_t:dir create_dir_perms; allow pyzor_t pyzor_tmp_t:file create_file_perms; files_type(pyzor_tmp_t) files_tmp_filetrans(pyzor_t, pyzor_tmp_t, { file dir }) # Allow pyzor to read config (and any other file...) # from user home directories userdom_read_unpriv_users_home_content_files(pyzor_t) # Allow pyzor to read /dev/urandom dev_read_urand(pyzor_t) # Allow pyzor to send and receive pyzor messages! allow pyzor_t pyzor_port_t:udp_socket send_msg; allow pyzor_t pyzor_port_t:udp_socket recv_msg; # Allow spamd to signal pyzor (kill/hup ?) allow spamd_t pyzor_t:process signal; # Allow pyzor to ...? corecmd_search_bin(pyzor_t) kernel_read_kernel_sysctls(pyzor_t) # It does a getattr on /usr/bin/time for reasons unknown... allow pyzor_t bin_t:dir getattr; allow pyzor_t bin_t:file getattr; # Pyzor/python probably doesn't need to be able to read /proc/meminfo kernel_dontaudit_list_proc(pyzor_t) kernel_dontaudit_read_system_state(pyzor_t) Paul.

8 104

FC2 useradd in chroot on FC5 host with SELinux
by Paul Howarth 11 Aug '06

11 Aug '06

I use mock to build packages for old distributions in a chroot-ed environment on my FC5 box. I've pretty well got this working for all old distributions now apart from FC2 (see http://www.fedoraproject.org/wiki/Legacy/Mock) On FC2, the process gets off to quite a good start, installing the following packages into the chroot: ============================================================================= Package Arch Version Repository Size ============================================================================= Installing: buildsys-build noarch 0.5-1.CF.fc2 groups 1.8 k Installing for dependencies: SysVinit i386 2.85-25 core 96 k basesystem noarch 8.0-3 core 2.7 k bash i386 2.05b-38 core 1.5 M beecrypt i386 3.1.0-3 core 64 k binutils i386 2.15.90.0.3-5 core 2.8 M buildsys-macros noarch 2-2.fc2 groups 2.1 k bzip2 i386 1.0.2-12.1 core 48 k bzip2-libs i386 1.0.2-12.1 core 32 k chkconfig i386 1.3.9-1.1 core 99 k coreutils i386 5.2.1-7 core 2.8 M cpio i386 2.5-6 core 45 k cpp i386 3.3.3-7 core 1.4 M cracklib i386 2.7-27.1 core 26 k cracklib-dicts i386 2.7-27.1 core 409 k db4 i386 4.2.52-3.1 core 1.5 M dev i386 3.3.13-1 core 3.6 M diffutils i386 2.8.1-11 core 205 k e2fsprogs i386 1.35-7.1 core 728 k elfutils-libelf i386 0.95-2 core 36 k ethtool i386 1.8-3.1 core 48 k fedora-release i386 2-4 core 92 k file i386 4.07-4 core 242 k filesystem i386 2.2.4-1 core 18 k findutils i386 1:4.1.7-25 core 102 k gawk i386 3.1.3-7 core 1.5 M gcc i386 3.3.3-7 core 3.8 M gcc-c++ i386 3.3.3-7 core 2.0 M gdbm i386 1.8.0-22.1 core 26 k glib i386 1:1.2.10-12.1.1 core 134 k glib2 i386 2.4.8-1.fc2 updates-released 477 k glibc i686 2.3.3-27.1 updates-released 4.9 M glibc-common i386 2.3.3-27.1 updates-released 14 M glibc-devel i386 2.3.3-27.1 updates-released 1.9 M glibc-headers i386 2.3.3-27.1 updates-released 530 k glibc-kernheaders i386 2.4-8.44 core 697 k grep i386 2.5.1-26 core 168 k gzip i386 1.3.3-12.2.legacy updates-released 88 k info i386 4.7-4 updates-released 147 k initscripts i386 7.55.2-1 updates-released 906 k iproute i386 2.4.7-14 core 591 k iputils i386 20020927-13 core 92 k less i386 382-3 core 85 k libacl i386 2.2.7-5 core 15 k libattr i386 2.4.1-4 core 8.6 k libgcc i386 3.3.3-7 core 33 k libselinux i386 1.11.4-1 core 45 k libstdc++ i386 3.3.3-7 core 240 k libstdc++-devel i386 3.3.3-7 core 1.3 M libtermcap i386 2.0.8-38 core 12 k make i386 1:3.80-3 core 337 k mingetty i386 1.07-2 core 18 k mktemp i386 2:1.5-7 core 12 k modutils i386 2.4.26-16 core 395 k ncurses i386 5.4-5 core 1.5 M net-tools i386 1.60-25.1 updates-released 311 k pam i386 0.77-40 core 1.9 M patch i386 2.5.4-19 core 61 k pcre i386 4.5-2 core 59 k perl i386 3:5.8.3-18 core 11 M perl-Filter i386 1.30-5 core 68 k popt i386 1.9.1-0.4.1 updates-released 61 k procps i386 3.2.0-1.2 updates-released 176 k psmisc i386 21.4-2 core 41 k redhat-rpm-config noarch 8.0.28-1.1.1 core 41 k rpm i386 4.3.1-0.4.1 updates-released 2.2 M rpm-build i386 4.3.1-0.4.1 updates-released 437 k sed i386 4.0.8-4 core 116 k setup noarch 2.5.33-1 core 29 k shadow-utils i386 2:4.0.3-55 updates-released 671 k sysklogd i386 1.4.1-16 core 65 k tar i386 1.13.25-14 core 351 k termcap noarch 11.0.1-18.1 core 237 k tzdata noarch 2005f-1.fc2 updates-released 449 k unzip i386 5.50-37 core 139 k util-linux i386 2.12-19 updates-released 1.5 M which i386 2.16-2 core 21 k words noarch 2-22 core 137 k zlib i386 1.2.1.2-0.fc2 updates-released 44 k After installing all of these packages successfully, the next thing that happens is: Executing /usr/sbin/mock-helper chroot /var/lib/mock/fedora-2-i386-core/root /bin/su - root -c "/usr/sbin/useradd -m -u 500 -d /builddir mockbuild" and at that point the "useradd" process just hangs indefinitely. I'm told that if SELinux is disabled (I've tried permissive mode and that doesn't help), this works. I can't see any AVCs in the logs. Any ideas what might be causing this and how it might be fixed? Paul.

3 15

Running two named processes in selinux
by Faisal Ali 13 Jul '06

13 Jul '06

Hi, Is it possible to run two named process in selinux each having different file permissions. Instead of using DNS Views Iam thinking about running two named processes, one for external and one for internal. Ofcourse external named process will have access to different set of files versus internal named process. Can this be done. Its security-of-Xen-Vm-isolation vs SELinux-isolation comparision. Should I run two Xen VMs one for external DNS and the other for Internal DNS or run two named processes each isolated and jailed by SELinux. Faisal Ali

2 1

pam_console_t wants access to device_t:chr_file ?
by Tom London 13 Jul '06

13 Jul '06

Running targeted/enforcing, latest Rawhide. Noticed this in /var/log/messages, before auditd is started I guess: Jun 29 06:43:48 localhost kernel: audit(1151588567.562:102): avc: denied { getattr } for pid=1526 comm="pam_console_app" name="usbdev5.5_ep02" dev=tmpfs ino=5143 scontext=system_u:system_r:pam_console_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file Jun 29 06:43:48 localhost kernel: audit(1151588567.562:103): avc: denied { getattr } for pid=1526 comm="pam_console_app" name="usbdev5.5_ep81" dev=tmpfs ino=5120 scontext=system_u:system_r:pam_console_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file Jun 29 06:43:48 localhost kernel: audit(1151588567.562:104): avc: denied { getattr } for pid=1526 comm="pam_console_app" name="usbdev5.5_ep00" dev=tmpfs ino=5068 scontext=system_u:system_r:pam_console_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file << actually many, many copies of these....>> tom -- Tom London

3 7

dovecot 1.0.rc1
by Paul Howarth 13 Jul '06

13 Jul '06

New in rc1 is a directory /var/lib/dovecot where the SSL parameters files are generated before they are copied to the login directory. The following additions to policy support this: :::::::::::::: dovecot.fc :::::::::::::: /var/lib/dovecot(/.*)? gen_context(system_u:object_r:dovecot_var_lib_t,s0) :::::::::::::: dovecot.te :::::::::::::: policy_module(dovecot, 0.1.4) ######################################## # # Declarations # require { type dovecot_t; }; # /var/lib/dovecot holds SSL parameters file type dovecot_var_lib_t; files_type(dovecot_var_lib_t) ######################################## # # Local policy # # Allow dovecot to read the routing table (in selinux-policy 2.2.43-4.fc5) #allow dovecot_t self:netlink_route_socket { r_netlink_socket_perms }; # Allow dovecot to create and read SSL parameters file files_search_var_lib(dovecot_t) allow dovecot_t dovecot_var_lib_t:dir { rw_dir_perms }; allow dovecot_t dovecot_var_lib_t:file { manage_file_perms }; Paul.

2 1

AVCs when printing from firefox...
by Tom London 13 Jul '06

13 Jul '06

Running targeted/enforcing, latest rawhide. Trying to print from firefox, I get: type=AVC msg=audit(1151341517.216:697): avc: denied { recv } for pid=2965 comm="firefox-bin" saddr=127.0.0.1 src=50209 daddr=127.0.0.1 dest=631 netif=lo scontext=system_u:system_r:cupsd_t:s0-s0:c0.c255 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=AVC msg=audit(1151341520.217:698): avc: denied { recv } for saddr=127.0.0.1 src=50209 daddr=127.0.0.1 dest=631 netif=lo scontext=system_u:system_r:cupsd_t:s0-s0:c0.c255 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=AVC msg=audit(1151341526.217:699): avc: denied { recv } for saddr=127.0.0.1 src=50209 daddr=127.0.0.1 dest=631 netif=lo scontext=system_u:system_r:cupsd_t:s0-s0:c0.c255 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=AVC msg=audit(1151341538.217:700): avc: denied { recv } for saddr=127.0.0.1 src=50209 daddr=127.0.0.1 dest=631 netif=lo scontext=system_u:system_r:cupsd_t:s0-s0:c0.c255 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=AVC msg=audit(1151341562.219:701): avc: denied { recv } for saddr=127.0.0.1 src=50209 daddr=127.0.0.1 dest=631 netif=lo scontext=system_u:system_r:cupsd_t:s0-s0:c0.c255 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Doing a 'setenforce 0' and retrying yields: type=AVC msg=audit(1151342357.528:780): avc: denied { recv } for pid=3943 comm="firefox-bin" saddr=127.0.0.1 src=47782 daddr=127.0.0.1 dest=631 netif=lo scontext=system_u:system_r:cupsd_t:s0-s0:c0.c255 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=AVC msg=audit(1151342357.528:780): avc: denied { send } for pid=3943 comm="firefox-bin" saddr=127.0.0.1 src=631 daddr=127.0.0.1 dest=47782 netif=lo scontext=system_u:system_r:cupsd_t:s0-s0:c0.c255 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=SYSCALL msg=audit(1151342357.528:780): arch=40000003 syscall=102 success=yes exit=0 a0=3 a1=bfbf8db0 a2=4703c3f4 a3=0 items=0 ppid=3938 pid=3943 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="firefox-bin" exe="/usr/lib/firefox-1.5.0.4/firefox-bin" subj=user_u:system_r:unconfined_t:s0 type=SOCKADDR msg=audit(1151342357.528:780): saddr=020002777F0000010000000000000000 type=SOCKETCALL msg=audit(1151342357.528:780): nargs=3 a0=27 a1=b6d875c a2=10 type=AVC msg=audit(1151342370.197:781): avc: denied { send } for pid=4108 comm="hp" saddr=127.0.0.1 src=43162 daddr=127.0.0.1 dest=50000 netif=lo scontext=system_u:system_r:cupsd_t:s0-s0:c0.c255 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=AVC msg=audit(1151342370.197:781): avc: denied { recv } for pid=4108 comm="hp" saddr=127.0.0.1 src=43162 daddr=127.0.0.1 dest=50000 netif=lo scontext=system_u:system_r:hplip_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=AVC msg=audit(1151342370.197:781): avc: denied { send } for pid=4108 comm="hp" saddr=127.0.0.1 src=50000 daddr=127.0.0.1 dest=43162 netif=lo scontext=system_u:system_r:hplip_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=AVC msg=audit(1151342370.197:781): avc: denied { recv } for pid=4108 comm="hp" saddr=127.0.0.1 src=50000 daddr=127.0.0.1 dest=43162 netif=lo scontext=system_u:system_r:cupsd_t:s0-s0:c0.c255 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=SYSCALL msg=audit(1151342370.197:781): arch=40000003 syscall=102 success=yes exit=0 a0=3 a1=bf86ac50 a2=804d110 a3=804d1a4 items=0 ppid=2246 pid=4108 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) comm="hp" exe="/usr/lib/cups/backend/hp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c255 type=SOCKADDR msg=audit(1151342370.197:781): saddr=0200C3507F0000010000000000000000 type=SOCKETCALL msg=audit(1151342370.197:781): nargs=3 a0=4 a1=bf86ac78 a2=10 tom -- Tom London

3 2

Openswan on FC4/5
by Stuart James 13 Jul '06

13 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, We are using Openswan to connect two of our sites together via an IPSEC tunnel. Recently we upgraded from FC3 to FC5 on our frontend firewalls, including the version of openswan , selinux policy, kernel ,ect. We used to run in enforcing mode without any difficulties, it now seems that with Enforcing mode on Openswan does not seem to be able to add the route. Using setenforce 0 , the tunnel becomes active. As far as i can tell Openswan has difficulty adding the route to the Right/Left nexthop, although the status of the tunnel appears to be up, the routing does not appear to take place. #audit2allow -a -t /var/log/audit/audit.log allow ifconfig_t self:netlink_xfrm_socket create; allow ifconfig_t initrc_t:unix_stream_socket { read write }; Versions we are using are. selinux-policy-targeted-2.2.43-4.fc5 kernel-2.6.16-1.2122_FC5 openswan-2.4.4-1.1.2.1 As i have not seen any other mention of this being an issue, I was wondering if anyone else has encountered this. I have also tested this on FC4 with the same result. Am i right in assuming that openswan is using ifconfig to add the route, i have looked into the source policy that define ipsec which has no reference to ifconfig, but rather to ipsec eroute. I am not sure if this just defined in the wrong place, or if it needs ifconfig to be added into the policy. Regards, Stuart James -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFEn5lKr8LwOCpshrYRAr+gAJ9y7uL7WOco3Pxj4gg0gWlrqhGRIQCeLIFu Cfnub95XnvCsMRwxI9ojSek= =dXrv -----END PGP SIGNATURE-----

2 4

RE: Running two named processes in selinux
by Paul Howarth 30 Jun '06

30 Jun '06

On Fri, 2006-06-30 at 16:15 -0400, Faisal Ali wrote: > Yes, exactly to run named in different SELinux domains. Iam glad its doable, > do you mean use the canned policy for one named and create a new one for > another named process. Can you point me to any read on the web that can help > in doing this. Can't think of any offhand. The approach I'd take would be to get the SELinux SRPM and "prep" it to get all the patches applied, then find the bind policy module and make a copy of it, and then edit all of the named_* types to have another name (e.g. other_named_*). Change the file contexts to refer to the locations and new type names you're using, then try building and loading the new module and see how it goes. Of course, I'd get the two-daemon thing working without SELinux (or with the same policy for each) first. > I guess its more of comfort level thing, I know BIND9 is quite secure and I > have'nt heard of any hacks. But if it happens then hacker can have > visibility to internal hosts information. True, but is that such a big deal? It might give a clue to where to start looking for targets but if they can get into your network they could probably figure that out anyway by portscanning. Paul.

1 0

Running two named processes in selinux
by Faisal Ali 30 Jun '06

30 Jun '06

Hi, Is it possible to run two named process in selinux each having different file permissions. Instead of using DNS Views Iam thinking about running two named processes, one for external and one for internal. Ofcourse external named process will have access to different set of files versus internal named process. Can this be done. Faisal Ali

2 2

smbd execstack error
by Tim Fenn 28 Jun '06

28 Jun '06

I just finished installing FC5 on a machine along with samba, and for whatever reason I'm getting execstack errors when trying to start it (just using service smb start): kernel: audit(1151522284.161:13552): avc: denied { execstack } for pid=28158 comm="smbd" scontext=user_u:system_r:smbd_t:s0 tcontext=user_u:system_r:smbd_t:s0 tclass=process although execstack reports otherwise: # execstack -q /usr/sbin/smbd - /usr/sbin/smbd setup: samba-3.0.22-1.fc5 selinux-policy-targeted-2.2.43-4.fc5 kernel 2.6.17-1.2139_FC5 Any hints/pointers as to whats going on here would be greatly appreciated. -Tim

2 2

rpc.statd, ntpdate/ntpd avcs..
by Tom London 27 Jun '06

27 Jun '06

Running targeted/enforcing, latest rawhide. Noticed the following in /var/log/audit/audit.log: type=AVC msg=audit(1151339261.011:8): avc: denied { send } for pid=2087 comm="rpc.statd" saddr=127.0.0.1 src=32770 daddr=127.0.0.1 dest=111 netif=lo scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=SYSCALL msg=audit(1151339261.011:8): arch=40000003 syscall=102 success=no exit=-1 a0=b a1=bfc68f34 a2=fefff4 a3=fad8c0 items=0 ppid=2086 pid=2087 auid=4294967295 uid=29 gid=29 euid=29 suid=29 fsuid=29 egid=29 sgid=29 fsgid=29 tty=(none) comm="rpc.statd" exe="/sbin/rpc.statd" subj=system_u:system_r:rpcd_t:s0 type=SOCKADDR msg=audit(1151339261.011:8): saddr=0200006F7F0000010000000000000000 type=SOCKETCALL msg=audit(1151339261.011:8): nargs=6 a0=7 a1=96281f8 a2=38 a3=0 a4=9628010 a5=10 type=AVC msg=audit(1151339261.123:9): avc: denied { send } for pid=2087 comm="rpc.statd" saddr=127.0.0.1 src=32770 daddr=127.0.0.1 dest=111 netif=lo scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=AVC msg=audit(1151339277.372:11): avc: denied { send } for pid=2290 comm="ntpdate" saddr=10.10.4.52 src=32771 daddr=10.10.2.102 dest=53 netif=eth0 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=SYSCALL msg=audit(1151339277.372:11): arch=40000003 syscall=102 success=no exit=-1 a0=9 a1=bfd21190 a2=3d1ff4 a3=5 items=0 ppid=2281 pid=2290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ntpdate" exe="/usr/sbin/ntpdate" subj=system_u:system_r:ntpd_t:s0 type=SOCKETCALL msg=audit(1151339277.372:11): nargs=4 a0=4 a1=bfd214f0 a2=20 a3=4000 type=AVC msg=audit(1151339277.372:12): avc: denied { send } for pid=2290 comm="ntpdate" saddr=10.10.4.52 src=32771 daddr=10.10.2.11 dest=53 netif=eth0 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=SYSCALL msg=audit(1151339277.372:12): arch=40000003 syscall=102 success=no exit=-1 a0=9 a1=bfd21190 a2=3d1ff4 a3=3 items=0 ppid=2281 pid=2290 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ntpdate" exe="/usr/sbin/ntpdate" subj=system_u:system_r:ntpd_t:s0 type=SOCKETCALL msg=audit(1151339277.372:12): nargs=4 a0=4 a1=bfd214f0 a2=20 a3=4000 <<<< similar for ntpd >>>>> type=SYSCALL msg=audit(1151339261.123:9): arch=40000003 syscall=102 success=no exit=-1 a0=b a1=bfc68ee4 a2=fefff4 a3=fad8c0 items=0 ppid=1 pid=2087 auid=4294967295 uid=29 gid=29 euid=29 suid=29 fsuid=29 egid=29 sgid=29 fsgid=29 tty=(none) comm="rpc.statd" exe="/sbin/rpc.statd" subj=system_u:system_r:rpcd_t:s0 type=SOCKADDR msg=audit(1151339261.123:9): saddr=0200006F7F0000010000000000000000 type=SOCKETCALL msg=audit(1151339261.123:9): nargs=6 a0=3 a1=9628f40 a2=38 a3=0 a4=9628d58 a5=10 type=AVC msg=audit(1151339261.163:10): avc: denied { send } for pid=2087 comm="rpc.statd" saddr=127.0.0.1 src=32771 daddr=127.0.0.1 dest=111 netif=lo scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet type=SYSCALL msg=audit(1151339261.163:10): arch=40000003 syscall=102 success=no exit=-1 a0=b a1=bfc68ec0 a2=fefff4 a3=fad8c0 items=0 ppid=1 pid=2087 auid=4294967295 uid=29 gid=29 euid=29 suid=29 fsuid=29 egid=29 sgid=29 fsgid=29 tty=(none) comm="rpc.statd" exe="/sbin/rpc.statd" subj=system_u:system_r:rpcd_t:s0 type=SOCKADDR msg=audit(1151339261.163:10): saddr=0200006F7F0000010000000000000000 type=SOCKETCALL msg=audit(1151339261.163:10): nargs=6 a0=7 a1=962cb38 a2=38 a3=0 a4=962c950 a5=10 tom -- Tom London

1 1

FC6T1 avc denied messages
by Jay Cliburn 26 Jun '06

26 Jun '06

I installed FC6T1 in the last day or two, and I'm seeing lots of avc:denied messages when something tries to access the network. The common thread seems to be netif. SELinux is enforcing. I relabeled with: setfiles /etc/selinux/targeted/contexts/files/file_contexts / but the problem persists. [root@gadwall etc]# grep "avc: denied" /var/log/messages | more Jun 25 04:12:39 gadwall kernel: audit(1151226759.322:28): avc: denied { send } for pid=4327 comm="local" saddr=127.0.0.1 src=32769 daddr=127.0.0.1 dest=512 netif=lo scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 04:26:44 gadwall kernel: audit(1151227604.199:29): avc: denied { send } for pid=28419 comm="smtp" saddr=192.168.1.8 src=54461 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 04:26:47 gadwall kernel: audit(1151227607.199:30): avc: denied { send } for pid=28697 comm="makewhatis" saddr=192.168.1.8 src=54461 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 04:26:53 gadwall kernel: audit(1151227613.199:31): avc: denied { send } for pid=29189 comm="gawk" saddr=192.168.1.8 src=54461 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 04:27:05 gadwall kernel: audit(1151227625.200:32): avc: denied { send } for pid=30221 comm="gawk" saddr=192.168.1.8 src=54461 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 05:00:03 gadwall kernel: audit(1151229603.556:33): avc: denied { send } for pid=22871 comm="smtp" saddr=192.168.1.8 src=46979 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 05:00:06 gadwall kernel: audit(1151229606.556:34): avc: denied { send } for saddr=192.168.1.8 src=46979 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 05:00:12 gadwall kernel: audit(1151229612.556:35): avc: denied { send } for saddr=192.168.1.8 src=46979 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 05:00:24 gadwall kernel: audit(1151229624.557:36): avc: denied { send } for saddr=192.168.1.8 src=46979 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 06:06:43 gadwall kernel: audit(1151233603.890:37): avc: denied { send } for pid=22984 comm="smtp" saddr=192.168.1.8 src=46089 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 06:06:46 gadwall kernel: audit(1151233606.890:38): avc: denied { send } for saddr=192.168.1.8 src=46089 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 06:06:52 gadwall kernel: audit(1151233612.890:39): avc: denied { send } for saddr=192.168.1.8 src=46089 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 06:07:04 gadwall kernel: audit(1151233624.891:40): avc: denied { send } for saddr=192.168.1.8 src=46089 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 07:30:04 gadwall kernel: audit(1151238604.282:41): avc: denied { send } for pid=23122 comm="smtp" saddr=192.168.1.8 src=34065 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 07:30:07 gadwall kernel: audit(1151238607.283:42): avc: denied { send } for saddr=192.168.1.8 src=34065 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 07:30:13 gadwall kernel: audit(1151238613.283:43): avc: denied { send } for saddr=192.168.1.8 src=34065 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 07:30:25 gadwall kernel: audit(1151238625.284:44): avc: denied { send } for saddr=192.168.1.8 src=34065 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 08:53:25 gadwall kernel: audit(1151243605.259:45): avc: denied { send } for pid=23349 comm="smtp" saddr=192.168.1.8 src=33208 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 08:53:28 gadwall kernel: audit(1151243608.259:46): avc: denied { send } for saddr=192.168.1.8 src=33208 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 08:53:34 gadwall kernel: audit(1151243614.259:47): avc: denied { send } for saddr=192.168.1.8 src=33208 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 08:53:46 gadwall kernel: audit(1151243626.260:48): avc: denied { send } for saddr=192.168.1.8 src=33208 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 10:16:44 gadwall kernel: audit(1151248604.735:49): avc: denied { send } for pid=23490 comm="smtp" saddr=192.168.1.8 src=47209 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 10:16:47 gadwall kernel: audit(1151248607.736:50): avc: denied { send } for saddr=192.168.1.8 src=47209 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 10:16:53 gadwall kernel: audit(1151248613.736:51): avc: denied { send } for saddr=192.168.1.8 src=47209 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 10:17:05 gadwall kernel: audit(1151248625.737:52): avc: denied { send } for saddr=192.168.1.8 src=47209 daddr=192.168.1.3 dest=25 netif=eth0 scontext=system_u:system_r:postfix_smtp_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 11:25:07 gadwall kernel: audit(1151252707.572:53): avc: denied { send } for pid=23734 comm="ntpd" saddr=192.168.1.8 src=32771 daddr=4.2.2.1 dest=53 netif=eth0 scontext=user_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 11:25:07 gadwall kernel: audit(1151252707.572:54): avc: denied { send } for pid=23734 comm="ntpd" saddr=192.168.1.8 src=32771 daddr=4.2.2.2 dest=53 netif=eth0 scontext=user_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet Jun 25 11:25:07 gadwall kernel: audit(1151252707.572:55): avc: denied { send } for pid=23734 comm="ntpd" saddr=192.168.1.8 src=32771 daddr=4.2.2.1 dest=53 netif=eth0 scontext=user_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=packet

3 5

Polyinstantiated directory instance name bug?
by Joe Nall 26 Jun '06

26 Jun '06

I added the following line to the end of /etc/pam.d/[login,sshd,su] session required pam_namespace.so debug I added the following line to /etc/security/namespace.conf /var/polyinstantiated /var/polyinstantiated/polyinstantiated- inst/ context root,adm If I ssh to test@localhost and touch /var/polyinstantiated/foo I get cd /var [root@cipso var]# ls -lR polyinstantiated/ polyinstantiated/: total 20 d--------- 3 root root 4096 Jun 23 18:32 polyinstantiated-inst polyinstantiated/polyinstantiated-inst: total 8 drwxrwxrwx 2 root root 4096 Jun 23 18:41 test polyinstantiated/polyinstantiated-inst/test: total 8 -rw-rw-r-- 1 test test 0 Jun 23 18:41 bar -rw-rw-r-- 1 test test 0 Jun 23 18:35 foo Shouldn't the instance name be the context instead of the username (test)? joe

2 3

Step-by-Step Guide To Creating SELinux Policy for Google Earth
by Benjy Grogan 26 Jun '06

26 Jun '06

Hello: Would it be possible for the SELinux team at Red Hat to create an SELinux policy module for Google Earth and to show the step by step process for confining the application? I think these kind of examples would be useful to developers attempting to create SELinux policies for other rpm packages out there. I'm not interested so much in the actual policy module, but in creating it myself from step-by-step instructions. IMHO, that would be the best way to educate developers on how to use SELinux. Thanks, Benjy

4 13

firefox downloaded files are user_u:object_r:tmp_t
by dragoran 26 Jun '06

26 Jun '06

When I download a file using firefox it is saved as user_u:object_r:tmp_t it should be user_u:object_r:user_home_t I have a folder which is shared using samba and when I download a file into it I had to restorecon it in order to let the windows clients (and linux) see it. I am using FC5 x86_64 with selinux-policy-targeted-2.2.40-1.fc5 note: I am using a 32bit firefox build

3 7

Re: Selinux Sources
by Paul Howarth 26 Jun '06

26 Jun '06

Miguel Fernandes wrote: > Sorry, I'm not following you. I'm relatively new to linux and don't know > what to do. Is SRPM like an RPM? it installs in the same way? Not quite. The SRPM contains the source code, patches, and other files for a package, plus the "recipe" in the form of a "spec" file for how to build the regular RPM. When you install an SRPM, it's just extracted into a few directories and not entered into your RPM database. You do not have to be root to install an SRPM, and in fact you shouldn't build packages as root anyway, for security reasons. Here's what I'd do to look at the sources in FC5: 1. Set up an RPM build environment for your account: http://www.city-fan.org/tips/CreateRPMBuildEnvironment 2. Get the selinux-policy SRPM: # yum install yum-utils (do that as root; you don't need to be root for anything else) $ yumdownloader --source --enablerepo=updates-source selinux-policy 3. Install the SRPM: $ rpm -Uvh selinux-policy-2.2.43-4.fc5.src.rpm 4. Unpack tarball and apply patches: $ cd ~/rpmbuild/SPECS $ rpmbuild -bp selinux-policy.spec That should leave you with the patched policy sources corresponding to the latest FC5 policy in ~/rpmbuild/BUILD/serefpolicy-2.2.43 Paul.

2 1

Help, SELinux warnings on data-preserved partitions
by yaomaidongxi-fc3forum＠yahoo.com.cn 26 Jun '06

26 Jun '06

Sincere apologies if you receive this multiple times. Hi, everyone I installed a Fedora Core 5 on my desktop PC. Each time by the end of a startup, I can see the following errors on the screen, for each patitions that not formatted on installing (because they have data and used before that install). # Here come the errors Jun 21 10:30:04 localhost avahi-daemon[2216]: Server startup complete. Host name is localhost.local. Local service cookie is 283868878. Jun 21 10:30:05 localhost kernel: audit(1150857005.013:2): avc: denied { getattr } for pid=2236 comm="hald" name="/" dev=sda6 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir Jun 21 10:30:05 localhost kernel: audit(1150857005.177:3): avc: denied { getattr } for pid=2236 comm="hald" name="/" dev=sda6 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir ... And many warnings like that. I also observed that there is a "operation not supported" message when mounting on start-up and a failure on stopping bluetooth daemon. I asked in a forum and someone told me it is a problem of SELinux that "Hald daemon can't get attributes from this partition". I am suggested 1) disable SELinux; 2) ignore these warnings; 3) read SELinux's mannual. But I am a newbie and not ready to look though the whole mannal to find out a solution. Is there a quick and easy way to fix it? Thanks. ---YAO --------------------------------- Mp3疯狂搜-新歌热歌高速下

2 1

Problem with run_init
by Roland Cruesemann 26 Jun '06

26 Jun '06

Hello, this is a rather basic question concerning run_init. I use the targeted policy. If I start a daemon, for example postgresql, with run_init: run_init /etc/init.d/postgresql start postgresql ends up in the unconfined_t domain. But during a reboot postgresql is transferred to the correct postgresql_t domain. The content of /etc/selinux/targeted/contexts/initrc_context is user_u:system_r:unconfined_t Best regards, Roland Cruesemann -- Roland Crüsemann TC TrustCenter a company of GeoTrust Sonninstr. 24 - 28 D-20097 Hamburg Germany Phone: +49 40 / 80 80 26 210 Fax: +49 40 / 80 80 26 126 mailto:roland.cruesemann@trustcenter.de http://www.trustcenter.de http://www.geotrust.com This email may contain confidential and privileged material for the sole use of the intended recipient. Any review or distribution by others is strictly prohibited. If you are not the intended recipient please contact the sender and delete all copies.

3 2

runcon command
by Roland Cruesemann 26 Jun '06

26 Jun '06

Hello, we use the targeted policy. We would like to start the PostgreSQL database under the user postgresql too. But doing so using the command runcon one needs an additional allow unconfined_t postgresql_t:process transition; statement. This is of course not so nice. Are there any other methods available? Best regards, Roland Cruesemann -- Roland Crüsemann TC TrustCenter a company of GeoTrust Sonninstr. 24 - 28 D-20097 Hamburg Germany Phone: +49 40 / 80 80 26 210 Fax: +49 40 / 80 80 26 126 mailto:roland.cruesemann@trustcenter.de http://www.trustcenter.de http://www.geotrust.com This email may contain confidential and privileged material for the sole use of the intended recipient. Any review or distribution by others is strictly prohibited. If you are not the intended recipient please contact the sender and delete all copies.

2 1

Re: Apache/PHP module boot restriction?
by Stephen Smalley 26 Jun '06

26 Jun '06

On Wed, 2006-02-22 at 16:41 -0800, Andrew JH Ring wrote: > I've recently set up a Fedora Core 4 web server running Apache 2.2.0 > with PHP 5.1.2. I've managed to get Apache loading the module, after > setting libphp5.so to shlib_t, however Apache seems to still be unable > to access the module during boot. I'm getting a Cannot load libphp5 > cannot restore segment prot after reloc. Is this a known problem, and > if so, how is it fixed? cc'd fedora-selinux-list as well above, since you mentioned you were using FC4. This usually indicates a text relocation, which is undesirable if it can be avoided. The stock FC4 php doesn't appear to have any text relocations in its libphp (readelf -d libphp5.so.1 | grep TEXTREL). Possibly it has a patch to avoid the problem. Ideally, it would be best if you could similarly patch or fix the build for PHP 5.1.2. If you truly need to allow it, then you can label the .so file with the texrel_shlib_t type (since you are using FC4, I used the old type name). Some discussion of the SELinux memory protection tests can be found in: http://people.redhat.com/drepper/selinux-mem.html -- Stephen Smalley National Security Agency

3 3

Selinux Sources
by Miguel Fernandes 23 Jun '06

23 Jun '06

Hi, I'm using FC5 with SELinux enable, but I'm unable to find the ploicy sources that should be located in /etc/selinux/targeted/src. The src folder doesn't exist on /etc/selinux/targeted. In /etc/security doesn't exist a selinux directory either. I dont know which package I have to install to obtain this files. Thanks in advance!

2 1

rpmbuild and selinux
by Eric Tanguy 22 Jun '06

22 Jun '06

Since the update this morning when i try to build a package using rpmbuild i obtain this kind of errors in the log : Traitement des fichiers: libupnp-devel-1.4.0-1 file_contexts: invalid context system_u:object_r:usr_t file_contexts: invalid context system_u:object_r:usr_t file_contexts: invalid context system_u:object_r:usr_t file_contexts: invalid context system_u:object_r:usr_t file_contexts: invalid context system_u:object_r:usr_t file_contexts: invalid context system_u:object_r:usr_t file_contexts: invalid context system_u:object_r:usr_t file_contexts: invalid context system_u:object_r:usr_t file_contexts: invalid context system_u:object_r:usr_t file_contexts: invalid context system_u:object_r:usr_t someone could explain me why and how to solve this ? Thanks Eric

4 10

new mock package
by Eric Tanguy 22 Jun '06

22 Jun '06

Since i updated mock to 0.6-1.fc5 when i try to run it i obtain : init clean prep This may take a while Could not find useradd in chroot, maybe the install failed? ending done What is the problem ? Eric

2 1

RE: SELinux Module Packaging in FC5
by Joshua Brindle 21 Jun '06

21 Jun '06

> From: Paul Howarth [mailto:paul@city-fan.org] <snip> > > Back to the point, my email a few times back suggested > putting a line > > with just ; where the rules would be in order to get a > module without > > rules, have you tried that? > > Is this with or without the requires clause? > > With the requires clause, the semicolon doesn't seem to make > any difference. Ok, now I'm not sure what is going on. I built a policy with no rules and it linked in fine. (no ; was required either).. The policy_module statement always brings in a ton of requires (object classes mainly) so you'll always have requires whether you add them explicitly or not. What problem are you running into with this?

2 1

RE: SELinux Module Packaging in FC5
by Joshua Brindle 21 Jun '06

21 Jun '06

> From: Paul Howarth [mailto:paul@city-fan.org] > > Joshua Brindle wrote: > >> From: Paul Howarth [mailto:paul@city-fan.org] > >> > >> Joshua Brindle wrote: > >>>> From: Paul Howarth [mailto:paul@city-fan.org] > >>>> > >>>> On Tue, 2006-06-20 at 16:12 -0400, Christopher J. PeBenito wrote: > >>>>> On Fri, 2006-05-19 at 08:03 -0400, Stephen Smalley wrote: > >>>>>> On Thu, 2006-05-18 at 13:39 +0100, Paul Howarth wrote: > >>>>>>> Paul Howarth wrote: > >>>>>>>> Stephen Smalley wrote: > >>>>>>>>> On Tue, 2006-05-16 at 17:33 +0100, Paul Howarth wrote: > >>>>>>>>>> It contains a policy module, but the module only > >>>> includes file contexts. > >>>>>>>>> If this is going to be common, then semodule_package and > >>>>>>>>> libsemanage need to allow for policy packages that > >>>> have no policy module. > >>>>> [cut] > >>>>>> - Cleanly supporting policy packages that do not include > >> a binary > >>>>>> policy module in the tools (e.g. semodule_package) and > >>>> libraries (e.g. > >>>>>> libsemanage, libsepol), so that they can be used to ship > >>>> just file > >>>>>> contexts or other components. I don't know of any work > >>>> in progress > >>>>>> yet on that issue, so it may make sense to bugzilla it, > >>>> although it > >>>>>> is really an upstream issue, and there isn't presently an > >>>> upstream > >>>>>> bugzilla for selinux (just the mailing list). > >>>>> I was looking at what it would take to support a package > >> without a > >>>>> module. Without the binary policy, there is one problem of > >>>> where the > >>>>> module name and version will come from. We could either > >>>> add this to > >>>>> the package itself (which would require a policy package format > >>>>> change), or add a section to the package for module name > >>>> and version > >>>>> (which seems like a hack to me). > >>>> What I'm suggesting isn't a policy package with just file > >> contexts, > >>>> it's one with no allow/dontaudit rules in the policy, like this: > >>>> > >>>> :::::::::::::: > >>>> contagged.if > >>>> :::::::::::::: > >>>> # contagged.if > >>>> # > >>>> # This module has no interfaces > >>>> :::::::::::::: > >>>> contagged.fc > >>>> :::::::::::::: > >>>> /var/cache/contagged(/.*)? > >>>> gen_context(system_u:object_r:httpd_cache_t,s0) > >>>> :::::::::::::: > >>>> contagged.te > >>>> :::::::::::::: > >>>> # It's currently only necessary to set file contexts for > the cache > >>>> directory # in this policy, but doing it in a module is > >> easier from a > >>>> package maintenance # point of view than using semanage > >> and chcon in > >>>> scriptlets > >>>> > >>>> policy_module(contagged, 0.3) > >>>> > >>>> ######################################## > >>>> # > >>>> # Declarations > >>>> # > >>>> > >>>> require { > >>>> type httpd_cache_t; > >>>> }; > >>>> > >>>> > >>>> ######################################## > >>>> # > >>>> # Local policy > >>>> # > >>>> > >>>> # (none needed) > >>>> > >>>>> More importantly, I believe a package without a module does > >>>> not make > >>>>> sense because the types and users used in the file > >> contexts should > >>>>> either be declared or required by the module in the package. > >>>>> Otherwise the transaction fails late when the file contexts are > >>>>> validated, rather than early during linking. > >>>> I agree. It would make sense for compilation/linking of > the module > >>>> above to fail if the "require" wasn't present. > >>>> Currently that doesn't happen. > >>>> > >>>> Paul. > >>>> > >>> Try putting a line with just ; where the rules would go > and see if > >>> that compiles. > >> What I'm saying is that the module compiles just fine without the > >> "require" section, and I think it might be better if it > didn't (or at > >> least emitted a warning) since the .fc part references > httpd_cache_t. > >> > >> Paul. > >> > > > > Not necessarilly. For example, a policy that declares 2 > roles and does > > a role allow between them, while not useful, is valid. No > requirements > > would be necessary then. > > In the example I gave earlier, file context types were used > in the .fc file; I just think it would make sense for these > to be "required" in the same way that they would be if they > were used in the .te file. > > We're getting away from the original issue here though, which > was for clean support of policy module packages containing > file contexts and no rules, to avoid issues like this: > > http://www.redhat.com/archives/fedora-selinux-list/2006-May/ms > g00104.html > It would be non-trivial to change the linker to enforce requires in file contexts but I agree that it should at least be convention. Back to the point, my email a few times back suggested putting a line with just ; where the rules would be in order to get a module without rules, have you tried that?

2 1

selinux-policy-devel?
by Paul Howarth 21 Jun '06

21 Jun '06

Perhaps the selinux-policy package should be split into an selinux-policy and selinux-policy-devel package, with the -devel package being needed for building new policy/modules, and the base policy package containing just the stuff needed for regular runtime usage? I suggest this because I just tried building a policy module in mock with the new minimal environment and it fell over because building policy modules requires m4, which is not in the minimal environment. So m4 needs adding as a dep of selinux-policy (it's referenced from /usr/share/selinux/devel/include/Makefile), and this is really a devel-specific package that shouldn't be needed by most people, hence splitting off a -devel subpackage and adding the dep to that makes more sense. The -devel package could also have a dep on checkpolicy, which would be nice... Paul.

2 5

RE: SELinux Module Packaging in FC5
by Joshua Brindle 21 Jun '06

21 Jun '06

> From: Paul Howarth [mailto:paul@city-fan.org] > > Joshua Brindle wrote: > >> From: Paul Howarth [mailto:paul@city-fan.org] > >> > >> On Tue, 2006-06-20 at 16:12 -0400, Christopher J. PeBenito wrote: > >>> On Fri, 2006-05-19 at 08:03 -0400, Stephen Smalley wrote: > >>>> On Thu, 2006-05-18 at 13:39 +0100, Paul Howarth wrote: > >>>>> Paul Howarth wrote: > >>>>>> Stephen Smalley wrote: > >>>>>>> On Tue, 2006-05-16 at 17:33 +0100, Paul Howarth wrote: > >>>>>>>> It contains a policy module, but the module only > >> includes file contexts. > >>>>>>> If this is going to be common, then semodule_package and > >>>>>>> libsemanage need to allow for policy packages that > >> have no policy module. > >>> [cut] > >>>> - Cleanly supporting policy packages that do not include > a binary > >>>> policy module in the tools (e.g. semodule_package) and > >> libraries (e.g. > >>>> libsemanage, libsepol), so that they can be used to ship > >> just file > >>>> contexts or other components. I don't know of any work > >> in progress > >>>> yet on that issue, so it may make sense to bugzilla it, > >> although it > >>>> is really an upstream issue, and there isn't presently an > >> upstream > >>>> bugzilla for selinux (just the mailing list). > >>> I was looking at what it would take to support a package > without a > >>> module. Without the binary policy, there is one problem of > >> where the > >>> module name and version will come from. We could either > >> add this to > >>> the package itself (which would require a policy package format > >>> change), or add a section to the package for module name > >> and version > >>> (which seems like a hack to me). > >> What I'm suggesting isn't a policy package with just file > contexts, > >> it's one with no allow/dontaudit rules in the policy, like this: > >> > >> :::::::::::::: > >> contagged.if > >> :::::::::::::: > >> # contagged.if > >> # > >> # This module has no interfaces > >> :::::::::::::: > >> contagged.fc > >> :::::::::::::: > >> /var/cache/contagged(/.*)? > >> gen_context(system_u:object_r:httpd_cache_t,s0) > >> :::::::::::::: > >> contagged.te > >> :::::::::::::: > >> # It's currently only necessary to set file contexts for the cache > >> directory # in this policy, but doing it in a module is > easier from a > >> package maintenance # point of view than using semanage > and chcon in > >> scriptlets > >> > >> policy_module(contagged, 0.3) > >> > >> ######################################## > >> # > >> # Declarations > >> # > >> > >> require { > >> type httpd_cache_t; > >> }; > >> > >> > >> ######################################## > >> # > >> # Local policy > >> # > >> > >> # (none needed) > >> > >>> More importantly, I believe a package without a module does > >> not make > >>> sense because the types and users used in the file > contexts should > >>> either be declared or required by the module in the package. > >>> Otherwise the transaction fails late when the file contexts are > >>> validated, rather than early during linking. > >> I agree. It would make sense for compilation/linking of the module > >> above to fail if the "require" wasn't present. > >> Currently that doesn't happen. > >> > >> Paul. > >> > > > > Try putting a line with just ; where the rules would go and see if > > that compiles. > > What I'm saying is that the module compiles just fine without > the "require" section, and I think it might be better if it > didn't (or at least emitted a warning) since the .fc part > references httpd_cache_t. > > Paul. > Not necessarilly. For example, a policy that declares 2 roles and does a role allow between them, while not useful, is valid. No requirements would be necessary then.

2 1

RE: SELinux Module Packaging in FC5
by Joshua Brindle 21 Jun '06

21 Jun '06

> From: Paul Howarth [mailto:paul@city-fan.org] > > On Tue, 2006-06-20 at 16:12 -0400, Christopher J. PeBenito wrote: > > On Fri, 2006-05-19 at 08:03 -0400, Stephen Smalley wrote: > > > On Thu, 2006-05-18 at 13:39 +0100, Paul Howarth wrote: > > > > Paul Howarth wrote: > > > > > Stephen Smalley wrote: > > > > >> On Tue, 2006-05-16 at 17:33 +0100, Paul Howarth wrote: > > > > >>> It contains a policy module, but the module only > includes file contexts. > > > > >> > > > > >> If this is going to be common, then semodule_package and > > > > >> libsemanage need to allow for policy packages that > have no policy module. > > [cut] > > > - Cleanly supporting policy packages that do not include a binary > > > policy module in the tools (e.g. semodule_package) and > libraries (e.g. > > > libsemanage, libsepol), so that they can be used to ship > just file > > > contexts or other components. I don't know of any work > in progress > > > yet on that issue, so it may make sense to bugzilla it, > although it > > > is really an upstream issue, and there isn't presently an > upstream > > > bugzilla for selinux (just the mailing list). > > > > I was looking at what it would take to support a package without a > > module. Without the binary policy, there is one problem of > where the > > module name and version will come from. We could either > add this to > > the package itself (which would require a policy package format > > change), or add a section to the package for module name > and version > > (which seems like a hack to me). > > What I'm suggesting isn't a policy package with just file > contexts, it's one with no allow/dontaudit rules in the > policy, like this: > > :::::::::::::: > contagged.if > :::::::::::::: > # contagged.if > # > # This module has no interfaces > :::::::::::::: > contagged.fc > :::::::::::::: > /var/cache/contagged(/.*)? > gen_context(system_u:object_r:httpd_cache_t,s0) > :::::::::::::: > contagged.te > :::::::::::::: > # It's currently only necessary to set file contexts for the > cache directory # in this policy, but doing it in a module is > easier from a package maintenance # point of view than using > semanage and chcon in scriptlets > > policy_module(contagged, 0.3) > > ######################################## > # > # Declarations > # > > require { > type httpd_cache_t; > }; > > > ######################################## > # > # Local policy > # > > # (none needed) > > > More importantly, I believe a package without a module does > not make > > sense because the types and users used in the file contexts should > > either be declared or required by the module in the package. > > Otherwise the transaction fails late when the file contexts are > > validated, rather than early during linking. > > I agree. It would make sense for compilation/linking of the > module above to fail if the "require" wasn't present. > Currently that doesn't happen. > > Paul. > Try putting a line with just ; where the rules would go and see if that compiles.

2 1

unidentified audit msg
by David-Alexandre Davidson 21 Jun '06

21 Jun '06

Hi, I recently observed a strange behavior of selinux while serving web content over a smb share. The result was some images not showing with httpd returning a forbidden status. After verifying all other possible issue. I found this strange entry in my audit.log file : type=AVC msg=audit(1150863068.013:12309): avc: denied { 0x100000 } for pid=14365 comm="httpd" name="stock" dev=cifs ino=361051 scontext=root:system_r:httpd_t:s0 tcontext=system_u:object_r:cifs_t:s0 tclass=file type=SYSCALL msg=audit(1150863068.013:12309): arch=40000003 syscall=196 success=no exit=-13 a0=9a76740 a1=bfece07c a2=2c8ff4 a3=2008171 items=1 pid=14365 auid=0 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 comm="httpd" exe="/usr/sbin/httpd" type=CWD msg=audit(1150863068.013:12309): cwd="/" type=PATH msg=audit(1150863068.013:12309): item=0 name="/home/testeur/var/www/manage/public_domains_icons/CrystalClear-GNOME-1.0.0/22x22/stock/stock-help.png" flags=0 Is there someone who knows what this 0x100000 permission is? I tried to compile a loadable module with the corresponding allow statement (I'm on core 5) but the 0x100000 does not appear to be a valid element and it fails to compile. I observed this behavior on different files(for example in this msg the denial occur on the "stock" folder of the path, but I've seen it on the 22x22 folder as well). Restarting the system results in some file that were forbidden to show up without reason and some that were ok to just stop being served by httpd (always giving the 0x100000 dennial) At first I suspected a problem with the smb (cifs) mount but everything work perfectly if I try to access the mount directly. Then I suspected apache but the forbidden status code seems directly related to the audit msg. Anyone is welcome to help, I'm quite lost on that matter.

2 1

SELinux Module Packaging in FC5
by Paul Howarth 21 Jun '06

21 Jun '06

Is there any documentation anywhere on including SELinux Policy Modules in packages (e.g. for Extras) in FC5? For instance, is there a directory where modules can be dropped into so that they get picked up aotomatically? Where should they live? Consider an example. I have an LDAP-backed addressbook frontend written in PHP that runs on apache. So I install the files in /var/www/someplace in my package and I need to provide an SELinux module that: * Includes the appropriate file contexts for the application's cache directory, which needs to be writable by httpd * Gives httpd permission to contact LDAP servers over the network (i.e. ports 389 and 636) Is it possible to turn on the httpd_builtin_scripting boolean from a module (the app is written in PHP and needs this)? Is it even sensible to try to do this, or there just be a README.SELinux telling people they need to do this themselves? Should the module be loaded in a %post script? Some guidelines would no doubt be appreciated by many people. Paul.

5 20

hplip needs /dev/random.... ?
by Tom London 20 Jun '06

20 Jun '06

Running latest rawhide, targeted/enforcing. Noticed the folowing AVC (when I printed from Firefox to an old HP5MP): type=AVC msg=audit(1150647750.373:32): avc: denied { read } for pid=2140 comm="python" name="random" dev=tmpfs ino=5947 scontext=system_u:system_r:hplip_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file type=SYSCALL msg=audit(1150647750.373:32): arch=40000003 syscall=33 success=no exit=-13 a0=42a982b8 a1=4 a2=42aa92c4 a3=2 items=1 pid=2140 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="python" exe="/usr/bin/python" subj=system_u:system_r:hplip_t:s0 type=CWD msg=audit(1150647750.373:32): cwd="/" type=PATH msg=audit(1150647750.373:32): item=0 name="/dev/random" inode=5947 dev=00:10 mode=020666 ouid=0 ogid=0 rdev=01:08 obj=system_u:object_r:random_device_t:s0 Printing seemed to work regardless. /usr/share/hplip/base/slp.py appears to import random and call 'random.randint()' tom -- Tom London

4 5

SELinux T-Shirt available.
by Daniel J Walsh 19 Jun '06

19 Jun '06

http://www.cafepress.com/cp/customize/product.aspx?clear=true&number=625973… Dan

1 0

new user domain
by Stefan 19 Jun '06

19 Jun '06

Hi, I'd like to create an user with a type of e.g. backup. So when the user logs in and types "id -Z" backup:user_r:backup_t:SystemLow-SystemHigh should be the right context. In the past I did this like that: full_user_role(backup) allow system_r backup_r allow sysadm_r backup_r undefine(`in_user_role') define(`in_user_role', ` role user_r types $1; role second_r types $1; ') But now I'm using FC5 and things have changed. I searched a while and found the macro "unpriv_user_template". So I created a policy module: policy_module(backup,1.0.0) unpriv_user_template(backup) and tried to compile it. But I get an error message: Compiling mls backup module /usr/bin/checkmodule: loading policy configuration from tmp/backup.tmp backup.te:4:ERROR 'attribute userdomain is not declared' at token ';' on line 57013: #line 4 type backup_t, userdomain; /usr/bin/checkmodule: error(s) encountered while parsing configuration make: *** [tmp/backup.mod] Error 1 Isn't this the right way? Did I something wrong? Or how do you create a new user domain? Best regards, Stefan PS: I'm using FC5 with the latest updates and the mls policy.

2 2

suppress success messages from dmesg & co
by Stefan 16 Jun '06

16 Jun '06

Hi, is it possible to suppress success messages like: audit(1150460352.961:685): user pid=10323 uid=500 auid=500 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)' audit(1150460352.961:686): user pid=10323 uid=500 auid=500 msg='PAM: session close acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/0 res=success)' audit(1150462861.629:687): user pid=10507 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' audit(1150462861.629:688): login pid=10507 uid=0 old auid=4294967295 new auid=0 audit(1150462861.629:689): user pid=10507 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' audit(1150465564.666:694): login pid=10695 uid=0 old auid=4294967295 new auid=500 audit(1150465564.666:695): user pid=10695 uid=0 auid=500 msg='PAM: session open acct=foobar : exe="/usr/sbin/ sshd" (hostname=2001:6f8:1294:1::3, addr=?, terminal=ssh res=success)' Everytime someone uses 'su' or newrole or ... a audit message is created. This spams my logfiles so I would like to turn such "success messages" of. I'm using FC5 with latest updates and selinux-policy-mls. Best regards, Stefan

2 1

postfix_pipe_t ... execute_no_trans
by QingLong 16 Jun '06

16 Jun '06

Hello! Would you be so kind as to give me a hint why postfix's pipe command tries to execute a custom script with execute_no_trans? Details follow. Here we have a combination of Spamassassin and DrWeb virus scaner. Due to lame DrWeb programs stupidity one has to create a shell script that first passes a mail through spamassassin and then throws it to DrWeb. I have created a custom selinux module of my own named ql_spamassassin to (try to) put this combination under selinux control. So I have defined my own type `ql_spamassassin_client_exec_t' for the script and ql_spamassassin_client_t domain type. And I have | | domain_entry_file(ql_spamassassin_client_t,ql_spamassassin_client_exec_t) | domain_auto_trans(postfix_pipe_t,ql_spamassassin_client_exec_t,ql_spamassassin_client_t) | to allow postfix_pipe_t execute the script and perform the type transition. The module has been compiled and loaded into the kernel quite successfully, but I still get the execution denials: | | type=AVC msg=audit(1150125191.592:740): avc: denied { execute_no_trans } for pid=2793 comm="pipe" name="PostFix.mail.SpamAssassin.spamfilter.sh" dev=md9 ino=56842 scontext=system_u:system_r:postfix_pipe_t:s0 tcontext=system_u:object_r:ql_spamassassin_client_exec_t:s0 tclass=file | type=SYSCALL msg=audit(1150125191.592:740): arch=40000003 syscall=11 success=no exit=-13 a0=804e410 a1=804e0a8 a2=804e550 a3=3d09 items=1 pid=2793 auid=4294967295 uid=15625 gid=15625 euid=15625 suid=15625 fsuid=15625 egid=15625 sgid=15625 fsgid=15625 comm="pipe" exe="/usr/libexec/postfix/pipe" | type=AVC_PATH msg=audit(1150125191.592:740): path="/usr/local/sbin/PostFix.mail.SpamAssassin.spamfilter.sh" | type=CWD msg=audit(1150125191.592:740): cwd="/var/spool/postfix" | type=PATH msg=audit(1150125191.592:740): item=0 name="/usr/local/sbin/PostFix.mail.SpamAssassin.spamfilter.sh" flags=101 inode=56842 dev=09:09 mode=0100555 ouid=0 ogid=0 rdev=00:00 | The system is FC5. SElinux related packages: checkpolicy-1.30.3-1.fc5 libselinux-1.30-1.fc5 libselinux-python-1.30-1.fc5 libsepol-1.12.6-1.fc5 policycoreutils-1.30.10-1.fc5 selinux-policy-2.2.40-1.fc5 selinux-policy-targeted-2.2.40-1.fc5 kernel-smp-2.6.16-1.2133_FC5 Please, give me a hint, what's wrong here. Thank you. QingLong.

2 3

Re: CGI Script permissions
by Jochen Wiedmann 16 Jun '06

16 Jun '06

Paul Howarth wrote: > The simplest fix might be to change the file context of this particular > CGI script to httpd_unconfined_script_exec_t instead of > httpd_sys_script_t. That would effectively turn off SELinux protection > for that particular script. > The alternative approach of using audit2allow to create a local policy > to allow these capabilities would turn on these capabilities for *all* > of your CGI scripts, which IMHO would be worse than turning off > protection for just that one script (particularly if that script was > well-audited for security issues). > Ideally it would be easy to create a subclass of CGI scripts and assign > special capabilities to those (I have a similar issue with FastCGI > scripts that need slightly more capabilities than regular CGI scripts), > but that's beyond me at this moment. As the script in question can indeed be called well-audited (basically, it just allows to trigger a certain action by calling another script with fixed attributes), I have decided to go with httpd_unconfined_script_exec_t. That did the trick neatly. Thanks very much, Jochen

3 8

spamd binding on strange ports
by Paul Howarth 16 Jun '06

16 Jun '06

Anyone got any ideas why this is happening and how to fix it (i.e. stop it happening rather than allow it)? type=AVC msg=audit(1149425260.649:225271): avc: denied { name_bind } for pid=968 comm="spamd" src=64006 scontext=user_u:system_r:spamd_t:s0 tcontext=system_u:object_r:traceroute_port_t:s0 tclass=udp_socket type=SYSCALL msg=audit(1149425260.649:225271): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bf8cb460 a2=c095c8 a3=10 items=0 pid=968 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="spamd" exe="/usr/bin/perl" type=SOCKADDR msg=audit(1149425260.649:225271): saddr=0200FA06000000000000000000000000 type=SOCKETCALL msg=audit(1149425260.649:225271): nargs=3 a0=b a1=a3bc740 a2=10 Paul.

2 2

Re: AVC's and Xen
by Gawain Lynch 15 Jun '06

15 Jun '06

On Tue, 2006-06-13 at 11:51 -0400, James Antill wrote: > On Tue, 2006-06-13 at 22:24 +1000, Gawain Lynch wrote: > > audit(1150200957.379:95): avc: denied { use } for pid=4853 comm="xm" > > name="console" dev=tmpfs ino=838 scontext=system_u:system_r:xm_t:s0 > > tcontext=system_u:system_r:init_t:s0 tclass=fd > > What xm command were you doing for this? xm list xm create xm save All of these were triggering the avc's > You can use setbool xm_disable_trans=no, as a temporary workaround. Is that maybe supposed to be setsebool xm_disable_trans=false I obviously need to do a *lot* more reading on selinux before going down this path. :-) > Until recently combining Xen and SELinux basically didn't work at all, > so we are improving a lot :). That is OK, I thought it was up and running and just wanted to report issues. I'll leave it be for the time being and study up so I can be of more use in reporting/fixing these things. Thanks kindly for your help, Gawain

2 1

Problem to get FC$ sepolicy in FC5
by Pranav Vishnoi 14 Jun '06

14 Jun '06

In the past I M using FC4 & selinux on it, but switch to FC5. I m unable to use my old configuration of FC4 in Fc5. Please tell me the proper step to use FC4 selinux setting in FC5. ******************************************************************** Regards, Pranav Vishnoi Network Programs India Ltd. B-1-C, Sec-10, Noida-201301, India Ph:-0120-2536622 (O) Ext.:1209, 9899290712 (M) ********************************************************************

2 1

Re: FC5 - problems setting context
by Paul Howarth 14 Jun '06

14 Jun '06

Hello, On Tue, 2006-06-13 at 16:44 -0400, Sandra Julieta Rueda Rodriguez wrote: > Hello, > > About my previous message: > > Paul: Your idea was really effective, FC5 requires the additional field. > The command works fine now, Thanks. > > Does this behavior have to do with the fact that FC5 have the mcs/mls > option enabled by default? Is it possible to disable it? You shouldn't need to supply the extra field; there is a translation facility in libselinux that can supply a default value for it. It looks like a similar issue in setkey to the one I found in mount: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=186915 I think it's worth raising a bug on ipsec-tools. Paul.

1 0

New installation of FC5 with strict policy
by Stefan 13 Jun '06

13 Jun '06

Hi, I did a fresh installation of FC5 and upgraded to the strict policy. After creating a new user via "adduser" I get the following avc denials when I try to login via ssh. audit(1150198407.761:2862): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process audit(1150198411.552:2863): avc: denied { getattr } for pid=3717 comm="sshd" name="stefan" dev=hda2 ino=58667 scontext=staff_u:system_r:sshd_t:s0 tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir audit(1150198411.624:2864): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=process audit(1150198411.624:2865): avc: denied { execute_no_trans } for pid=3721 comm="sshd" name="bash" dev=hda2 ino=29283 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file audit(1150198411.628:2866): avc: denied { execute } for pid=3721 comm="bash" name="id" dev=hda7 ino=1846199 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file audit(1150198411.628:2867): avc: denied { read } for pid=3722 comm="bash" name="id" dev=hda7 ino=1846199 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file audit(1150198411.628:2868): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.628:2869): avc: denied { execute_no_trans } for pid=3723 comm="bash" name="id" dev=hda7 ino=1846199 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file audit(1150198411.632:2870): avc: denied { execute } for pid=3725 comm="bash" name="hostname" dev=hda2 ino=29286 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file audit(1150198411.632:2871): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=process audit(1150198411.632:2872): avc: denied { execute_no_trans } for pid=3725 comm="bash" name="hostname" dev=hda2 ino=29286 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file audit(1150198411.632:2873): avc: denied { read } for pid=3725 comm="bash" name="hostname" dev=hda2 ino=29286 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file audit(1150198411.636:2874): avc: denied { execute } for pid=3721 comm="bash" name="colorls.sh" dev=hda2 ino=175700 scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file audit(1150198411.636:2875): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.640:2876): avc: denied { read } for pid=3721 comm="bash" name="stefan" dev=hda2 ino=58667 scontext=staff_u:system_r:sshd_t:s0 tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir audit(1150198411.640:2877): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.644:2878): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.644:2879): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.648:2880): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.652:2881): avc: denied { read } for pid=3721 comm="bash" name=".bash_profile" dev=hda2 ino=58595 scontext=staff_u:system_r:sshd_t:s0 tcontext=user_u:object_r:user_home_t:s0 tclass=file audit(1150198411.652:2882): avc: denied { getattr } for pid=3721 comm="bash" name=".bash_profile" dev=hda2 ino=58595 scontext=staff_u:system_r:sshd_t:s0 tcontext=user_u:object_r:user_home_t:s0 tclass=file audit(1150198411.656:2883): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process audit(1150198411.660:2884): security_compute_sid: invalid context staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=process I know that the strict policy is quiet not perfect but I thought a ssh login should went fine, shouldn't it? My question is, is this the default behaviour or did I something wrong? I get also a lot of avc denials after a reboot with the strict policy. Shouldn't the strict policy work quiet fine with a default installation (I know it's not perfect but ... ;-))? Best regards, Stefan

1 0

AVC's and Xen
by Gawain Lynch 13 Jun '06

13 Jun '06

I have turned on selinux on my dom0 and relabelled my file system but am getting the following avc's that are causing me grief: audit(1150199625.630:325): avc: denied { search } for pid=7068 comm="python" name="data" dev=dm-0 ino=720897 scontext=system_u:system_r:xend_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir audit(1150200957.379:95): avc: denied { use } for pid=4853 comm="xm" name="console" dev=tmpfs ino=838 scontext=system_u:system_r:xm_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=fd In the first one, I presume "data" is the /data mount point which was crated before the relabel. Any ideas how to fix? Take care, Gawain

1 0

FC5 - problems setting context
by Sandra Rueda 12 Jun '06

12 Jun '06

Hello, I am new with selinux and I have a problem: My system: Fedora Core 5, FC5 - 2.6.16-1.2122 SMP I am trying to set communication policies between two machines and I am using the set of commands implemented by ipsec-tools. I am running the command: setkey -v -f set.conf Contents of the file set.conf (it had more things at the beginning but I reduced it while looking for the cause of the error): flush; spdflush; spdadd src dest any -ctx 1 1 "user_u:object_r:user_t" -P out ipsec esp/transport//require ; I always receive the same output at the end: "Invalid Argument". sadb_msg{ version=2 type=9 errno=0 satype=0 len=2 reserved=0 seq=0 pid=16090 sadb_msg{ version=2 type=9 errno=0 satype=0 len=2 reserved=0 seq=0 pid=16090 sadb_msg{ version=2 type=19 errno=0 satype=0 len=2 reserved=0 seq=0 pid=16090 sadb_msg{ version=2 type=19 errno=0 satype=0 len=2 reserved=0 seq=0 pid=16090 sadb_msg{ version=2 type=14 errno=0 satype=0 len=16 reserved=0 seq=0 pid=16090 sadb_ext{ len=4 type=18 } sadb_x_policy{ type=2 dir=2 id=0 priority=2147483648 } { len=16 proto=50 mode=1 level=2 reqid=0 } sadb_ext{ len=3 type=5 } sadb_address{ proto=255 prefixlen=32 reserved=0x0000 } sockaddr{ len=16 family=2 port=0 82cb2034 } sadb_ext{ len=3 type=6 } sadb_address{ proto=255 prefixlen=32 reserved=0x0000 } sockaddr{ len=16 family=2 port=0 82cb2035 } sadb_ext{ len=4 type=24 } sadb_x_sec_ctx{ doi=1 alg=1 length=23, context:user_u:object_r:user_t} sadb_msg{ version=2 type=14 errno=22 satype=0 len=2 reserved=0 seq=0 pid=16090 The result of line 4: Invalid argument. I followed the procedure and it looks like the problem is not related to ipsec-tools but to something in the kernel, because it returns errno=22. Running the same command without the ctx extension works fine. Does anyone have any idea? Thanks, Sandra

2 1

semanage translation -a is not working
by omok 11 Jun '06

11 Jun '06

Dear, Folks, My environment is; FC5 (yum updated on 6/12/2006 JST) policycoreutils-1.30.10-1.fc5 libselinux-python-1.30-1.fc5 selinux-policy-2.2.40-1.fc5 libselinux-1.30-1.fc5 libselinux-devel-1.30-1.fc5 selinux-policy-2.2.38-1.fc5 selinux-policy-targeted-2.2.40-1.fc5 When I try to add additional translations to my FC5 in permissive mode, I got error messages as follow; ---------------------------------------------------------------- [root@vmfc5omo ~]# semanage translation -a -T blahblahblah s0:c6 Traceback (most recent call last): File "/usr/sbin/semanage", line 239, in ? OBJECT.add(target, setrans) File "/usr/lib/python2.4/site-packages/seobject.py", line 180, in add self.save() File "/usr/lib/python2.4/site-packages/seobject.py", line 198, in save fd.write(self.out()) AttributeError: 'int' object has no attribute 'write' ---------------------------------------------------------------- and can't add any lines on setrans.conf. "-l" option seems working correctly; ---------------------------------------------------------------- [root@vmfc5omo ~]# semanage translation -l Level Translation s0 s0-s0:c0.c255 SystemLow-SystemHigh s0:c0.c255 SystemHigh ---------------------------------------------------------------- I checked "How do I add additional translations to my MCS/MLS system?" on http://fedora.redhat.com/docs/selinux-faq-fc5/#id2964683. Is this a bug? Regards, -- Kazuki Omo: omok(a)honto.info LIDS Japanese Information: Japanese: http://www.selinux.gr.jp/LIDS-JP/index.html English: http://www.selinux.gr.jp/LIDS-JP/LIDS_en/index.html

1 0

vsftpd problems
by CodeHeads 11 Jun '06

11 Jun '06

Hello all, I have a problem getting vsftpd working with SELinux. I opened up ports 20 and 21 on the firewall, plus disabled the firewall to see if that was the problem and it still did not work. I am not using home directories, is that part of the problem??? I tried google but that really did not turn anything up that I wanted. Thanks, Will

2 1

proftpd and ftpdctl
by Paul Howarth 09 Jun '06

09 Jun '06

The recent update of proftpd in Extras to 1.3.0 has introduced a new feature, an "ftpdctl" program allowing some run-time control of the FTP daemon, somewhat akin to rndc with named. This needs new policy. Below is what's working for me: ===== proftpd.if ===== ## <summary>FTP Daemon Control Program.</summary> ######################################## ## <summary> ## Execute the ftpdctl program in the ftpdctl domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`ftpdctl_domtrans',` gen_require(` type ftpdctl_t, ftpdctl_exec_t; ') corecmd_search_bin($1) domain_auto_trans($1, ftpdctl_exec_t, ftpdctl_t) allow $1 ftpdctl_t:fd use; allow ftpdctl_t $1:fd use; allow ftpdctl_t $1:fifo_file rw_file_perms; allow ftpdctl_t $1:process sigchld; ') ===== proftpd.fc ===== /usr/bin/ftpdctl -- gen_context(system_u:object_r:ftpdctl_exec_t,s0) ===== proftpd.te ===== policy_module(proftpd, 0.4.0) ######################################## # # Declarations # require { type ftpd_t; type ftpd_var_run_t; type xferlog_t; }; # run ftpdctl in its own domain type ftpdctl_t; type ftpdctl_exec_t; init_system_domain(ftpdctl_t,ftpdctl_exec_t) role system_r types ftpdctl_t; # ftpdctl control sockets have their own domain # When ftpdctl is run, it creates a socket in /tmp and then binds it # to the control socket for the running proftpd server, usually at # /var/run/proftpd/proftpd.sock type ftpdctl_tmp_t; files_tmp_file(ftpdctl_tmp_t) ######################################## # # Local policy # # Temporary sockets created by ftpdctl are ftpdctl_tmp_t files_tmp_filetrans(ftpdctl_t, ftpdctl_tmp_t, { sock_file }) # Fixed in selinux-policy 2.2.29-6 #allow ftpd_t xferlog_t:dir { getattr search }; # Allow proftpd to read the routing table allow ftpd_t self:netlink_route_socket { r_netlink_socket_perms }; # Allow proftpd to create and use a control socket (/var/run/proftpd/proftpd.sock) allow ftpd_t self:unix_stream_socket listen; allow ftpd_t ftpd_var_run_t:sock_file { create setattr unlink }; # Allow proftpd to remove temporary communications sockets created by ftpdctl allow ftpd_t ftpdctl_tmp_t:sock_file { getattr unlink }; # Transition to ftpdctl_t from unconfined_t ftpdctl_domtrans(unconfined_t) libs_use_ld_so(ftpdctl_t) libs_use_shared_libs(ftpdctl_t) term_use_generic_ptys(ftpdctl_t) # Allow ftpdctl to read config files files_read_etc_files(ftpdctl_t) # Allow ftpdctl to create and use temporary sockets allow ftpdctl_t ftpdctl_tmp_t:sock_file { create setattr }; # Allow ftpdctl to talk to ftpd over a socket connection allow ftpdctl_t ftpd_t:unix_stream_socket connectto; allow ftpdctl_t ftpd_var_run_t:dir search; allow ftpdctl_t ftpd_var_run_t:sock_file write; Paul.

2 2

Re: httpd can't execute bash?
by Jouni Viikari 09 Jun '06

09 Jun '06

On Tue, 6 Jun 2006, James Antill wrote: > On Mon, 2006-05-29 at 19:47 +0300, Jouni Viikari wrote: >> On Sun, 2006-05-28 at 10:58 +0100, Paul Howarth wrote: >>> On Sun, 2006-05-28 at 12:43 +0300, Jouni Viikari wrote: >>>> I have the same problem: >>>> >>>> type=AVC msg=audit(1148808793.986:30189): avc: denied { execute } for >>>> pid=18644 comm="httpd" name="bash" dev=dm-0 ino=3440979 >>>> scontext=user_u:system_r:httpd_t:s0 >>>> tcontext=system_u:object_r:shell_exec_t:s0 tclass=file > [...] >> It is a php-script doing basically ugly 'system("cat xyz");' >> >> #ls -Z >> system_u:object_r:httpd_sys_content_t >> >> This is just a testing_something.php where I happened to notice a change >> in a behavior. > > See "man httpd_selinux" ... summary is you need at least: > > chcon -t httpd_sys_exec_t Yeah, I thought the context might not be rigth. Anyway the behaviour has changed. However, there seems not to be httpd_sys_exec_t (trying above gives "Invalid argument"). If I try httpd_sys_script_exec_t it does not work either. Biggest problem I just found out is that I can not send mail any more from SquirrelMail (standard FC5 package): type=AVC msg=audit(1149674474.840:81196): avc: denied { execute } for pid=20207 comm="httpd" name="bash" dev=dm-0 ino=3440979 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file -Jouni

2 2

setsebool generates error message....
by Tom London 08 Jun '06

08 Jun '06

Running today's rawhide, targeted/enforcing: [root@localhost files]# setsebool allow_execmem=1 libsemanage.semanage_install_active: setfiles returned error code 1. libsemanage.semanage_install_active: setfiles returned error code 1. Could not change policy booleans [root@localhost files]# Appears that boolean has changed: [root@localhost files]# getsebool -a | grep exec allow_execheap --> off allow_execmem --> on allow_execmod --> off allow_execstack --> on allow_java_execstack --> on httpd_ssi_exec --> off httpd_suexec_disable_trans --> off [root@localhost files]# tom -- Tom London

2 1

FC5/SELinux: Possibilty to enforce an "second set of eyes" method for admins?
by Michael Decker 08 Jun '06

08 Jun '06

Hi! I wonder, if I can setup this kind of scenario: An admin has to change e.g. some SELinux policies. But if an admin can change all SELinux policies, he could change his own or others in a way, so he can do anything. So a second admin/user has to allow that action. Is there a way to setup that? Thanks... -- Michael Decker Michael.Decker(a)tesis.de TESIS SYSware GmbH http://www.tesis.de Baierbrunnerstr. 15 * 81379 Muenchen * Tel. +49 89 747377-0

2 1

automount policy still broken
by Tom London 08 Jun '06

08 Jun '06

Running latest rawhide, targeted/enforcing. Automount still fails: type=AVC msg=audit(1149695027.054:8): avc: denied { search } for pid=2322 comm="automount" name="irq" dev=proc ino=-268435218 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:object_r:sysctl_irq_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.054:8): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.054:8): cwd="/" type=PATH msg=audit(1149695027.054:8): item=0 name="/proc/irq/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.054:9): avc: denied { search } for pid=2322 comm="automount" name="net" dev=proc ino=-268435432 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.054:9): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.054:9): cwd="/" type=PATH msg=audit(1149695027.054:9): item=0 name="/proc/net/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.058:10): avc: denied { search } for pid=2322 comm="automount" name="1" dev=proc ino=65538 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.058:10): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.058:10): cwd="/" type=PATH msg=audit(1149695027.058:10): item=0 name="/proc/1/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.058:11): avc: denied { search } for pid=2322 comm="automount" name="2" dev=proc ino=131074 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.058:11): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.058:11): cwd="/" type=PATH msg=audit(1149695027.058:11): item=0 name="/proc/2/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.058:12): avc: denied { search } for pid=2322 comm="automount" name="3" dev=proc ino=196610 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.058:12): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.058:12): cwd="/" type=PATH msg=audit(1149695027.058:12): item=0 name="/proc/3/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.058:13): avc: denied { search } for pid=2322 comm="automount" name="4" dev=proc ino=262146 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.058:13): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.058:13): cwd="/" type=PATH msg=audit(1149695027.058:13): item=0 name="/proc/4/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.058:14): avc: denied { search } for pid=2322 comm="automount" name="5" dev=proc ino=327682 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.058:14): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.058:14): cwd="/" type=PATH msg=audit(1149695027.058:14): item=0 name="/proc/5/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.058:15): avc: denied { search } for pid=2322 comm="automount" name="6" dev=proc ino=393218 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.058:15): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.058:15): cwd="/" type=PATH msg=audit(1149695027.058:15): item=0 name="/proc/6/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.058:16): avc: denied { search } for pid=2322 comm="automount" name="7" dev=proc ino=458754 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.058:16): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.058:16): cwd="/" type=PATH msg=audit(1149695027.058:16): item=0 name="/proc/7/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:17): avc: denied { search } for pid=2322 comm="automount" name="9" dev=proc ino=589826 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:17): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:17): cwd="/" type=PATH msg=audit(1149695027.062:17): item=0 name="/proc/9/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:18): avc: denied { search } for pid=2322 comm="automount" name="10" dev=proc ino=655362 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:18): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:18): cwd="/" type=PATH msg=audit(1149695027.062:18): item=0 name="/proc/10/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:19): avc: denied { search } for pid=2322 comm="automount" name="119" dev=proc ino=7798786 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:19): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:19): cwd="/" type=PATH msg=audit(1149695027.062:19): item=0 name="/proc/119/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:20): avc: denied { search } for pid=2322 comm="automount" name="121" dev=proc ino=7929858 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:20): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:20): cwd="/" type=PATH msg=audit(1149695027.062:20): item=0 name="/proc/121/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:21): avc: denied { search } for pid=2322 comm="automount" name="175" dev=proc ino=11468802 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:21): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:21): cwd="/" type=PATH msg=audit(1149695027.062:21): item=0 name="/proc/175/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:22): avc: denied { search } for pid=2322 comm="automount" name="176" dev=proc ino=11534338 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:22): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:22): cwd="/" type=PATH msg=audit(1149695027.062:22): item=0 name="/proc/176/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:23): avc: denied { search } for pid=2322 comm="automount" name="177" dev=proc ino=11599874 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:23): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:23): cwd="/" type=PATH msg=audit(1149695027.062:23): item=0 name="/proc/177/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:24): avc: denied { search } for pid=2322 comm="automount" name="178" dev=proc ino=11665410 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:24): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:24): cwd="/" type=PATH msg=audit(1149695027.062:24): item=0 name="/proc/178/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:25): avc: denied { search } for pid=2322 comm="automount" name="325" dev=proc ino=21299202 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:25): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:25): cwd="/" type=PATH msg=audit(1149695027.062:25): item=0 name="/proc/325/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:26): avc: denied { search } for pid=2322 comm="automount" name="336" dev=proc ino=22020098 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:26): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:26): cwd="/" type=PATH msg=audit(1149695027.062:26): item=0 name="/proc/336/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:27): avc: denied { search } for pid=2322 comm="automount" name="357" dev=proc ino=23396354 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:27): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:27): cwd="/" type=PATH msg=audit(1149695027.062:27): item=0 name="/proc/357/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.062:28): avc: denied { search } for pid=2322 comm="automount" name="362" dev=proc ino=23724034 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.062:28): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.062:28): cwd="/" type=PATH msg=audit(1149695027.062:28): item=0 name="/proc/362/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:29): avc: denied { search } for pid=2322 comm="automount" name="393" dev=proc ino=25755650 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.066:29): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:29): cwd="/" type=PATH msg=audit(1149695027.066:29): item=0 name="/proc/393/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:30): avc: denied { search } for pid=2322 comm="automount" name="403" dev=proc ino=26411010 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.066:30): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:30): cwd="/" type=PATH msg=audit(1149695027.066:30): item=0 name="/proc/403/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:31): avc: denied { search } for pid=2322 comm="automount" name="474" dev=proc ino=31064066 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:udev_t:s0-s0:c0.c255 tclass=dir type=SYSCALL msg=audit(1149695027.066:31): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:31): cwd="/" type=PATH msg=audit(1149695027.066:31): item=0 name="/proc/474/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:32): avc: denied { search } for pid=2322 comm="automount" name="810" dev=proc ino=53084162 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.066:32): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:32): cwd="/" type=PATH msg=audit(1149695027.066:32): item=0 name="/proc/810/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:33): avc: denied { search } for pid=2322 comm="automount" name="1588" dev=proc ino=104071170 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.066:33): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:33): cwd="/" type=PATH msg=audit(1149695027.066:33): item=0 name="/proc/1588/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:34): avc: denied { search } for pid=2322 comm="automount" name="1651" dev=proc ino=108199938 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.066:34): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:34): cwd="/" type=PATH msg=audit(1149695027.066:34): item=0 name="/proc/1651/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:35): avc: denied { search } for pid=2322 comm="automount" name="1705" dev=proc ino=111738882 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:cpuspeed_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.066:35): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:35): cwd="/" type=PATH msg=audit(1149695027.066:35): item=0 name="/proc/1705/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:36): avc: denied { search } for pid=2322 comm="automount" name="1989" dev=proc ino=130351106 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:dhcpc_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.066:36): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:36): cwd="/" type=PATH msg=audit(1149695027.066:36): item=0 name="/proc/1989/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:37): avc: denied { search } for pid=2322 comm="automount" name="2036" dev=proc ino=133431298 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:auditd_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.066:37): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:37): cwd="/" type=PATH msg=audit(1149695027.066:37): item=0 name="/proc/2036/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:38): avc: denied { search } for pid=2322 comm="automount" name="2038" dev=proc ino=133562370 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.066:38): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:38): cwd="/" type=PATH msg=audit(1149695027.066:38): item=0 name="/proc/2038/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.066:39): avc: denied { search } for pid=2322 comm="automount" name="2052" dev=proc ino=134479874 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:setrans_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.066:39): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.066:39): cwd="/" type=PATH msg=audit(1149695027.066:39): item=0 name="/proc/2052/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.070:40): avc: denied { search } for pid=2322 comm="automount" name="2061" dev=proc ino=135069698 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.070:40): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.070:40): cwd="/" type=PATH msg=audit(1149695027.070:40): item=0 name="/proc/2061/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.070:41): avc: denied { search } for pid=2322 comm="automount" name="2064" dev=proc ino=135266306 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:klogd_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.070:41): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.070:41): cwd="/" type=PATH msg=audit(1149695027.070:41): item=0 name="/proc/2064/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.070:42): avc: denied { search } for pid=2322 comm="automount" name="2088" dev=proc ino=136839170 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:portmap_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.070:42): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.070:42): cwd="/" type=PATH msg=audit(1149695027.070:42): item=0 name="/proc/2088/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.070:43): avc: denied { search } for pid=2322 comm="automount" name="2107" dev=proc ino=138084354 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:rpcd_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.070:43): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.070:43): cwd="/" type=PATH msg=audit(1149695027.070:43): item=0 name="/proc/2107/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.070:44): avc: denied { search } for pid=2322 comm="automount" name="2136" dev=proc ino=139984898 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:rpcd_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.070:44): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.070:44): cwd="/" type=PATH msg=audit(1149695027.070:44): item=0 name="/proc/2136/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:45): avc: denied { search } for pid=2322 comm="automount" name="2177" dev=proc ino=142671874 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.074:45): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.074:45): cwd="/" type=PATH msg=audit(1149695027.074:45): item=0 name="/proc/2177/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:46): avc: denied { search } for pid=2322 comm="automount" name="2187" dev=proc ino=143327234 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.074:46): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.074:46): cwd="/" type=PATH msg=audit(1149695027.074:46): item=0 name="/proc/2187/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:47): avc: denied { search } for pid=2322 comm="automount" name="2217" dev=proc ino=145293314 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.074:47): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.074:47): cwd="/" type=PATH msg=audit(1149695027.074:47): item=0 name="/proc/2217/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:48): avc: denied { search } for pid=2322 comm="automount" name="2235" dev=proc ino=146472962 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.074:48): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.074:48): cwd="/" type=PATH msg=audit(1149695027.074:48): item=0 name="/proc/2235/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:49): avc: denied { search } for pid=2322 comm="automount" name="2254" dev=proc ino=147718146 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.074:49): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.074:49): cwd="/" type=PATH msg=audit(1149695027.074:49): item=0 name="/proc/2254/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:50): avc: denied { search } for pid=2322 comm="automount" name="2267" dev=proc ino=148570114 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.074:50): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.074:50): cwd="/" type=PATH msg=audit(1149695027.074:50): item=0 name="/proc/2267/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:51): avc: denied { search } for pid=2322 comm="automount" name="2268" dev=proc ino=148635650 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.074:51): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.074:51): cwd="/" type=PATH msg=audit(1149695027.074:51): item=0 name="/proc/2268/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:52): avc: denied { search } for pid=2322 comm="automount" name="2271" dev=proc ino=148832258 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.074:52): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.074:52): cwd="/" type=PATH msg=audit(1149695027.074:52): item=0 name="/proc/2271/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:53): avc: denied { search } for pid=2322 comm="automount" name="2310" dev=proc ino=151388162 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:bluetooth_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.074:53): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.074:53): cwd="/" type=PATH msg=audit(1149695027.074:53): item=0 name="/proc/2310/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:54): avc: denied { search } for pid=2322 comm="automount" name="2318" dev=proc ino=151912450 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dir type=SYSCALL msg=audit(1149695027.074:54): arch=40000003 syscall=5 success=no exit=-13 a0=bfec7988 a1=0 a2=1b6 a3=9e7b290 items=1 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.074:54): cwd="/" type=PATH msg=audit(1149695027.074:54): item=0 name="/proc/2318/cmdline" obj=system_u:object_r:proc_t:s0 type=AVC msg=audit(1149695027.074:55): avc: denied { setrlimit } for pid=2322 comm="automount" scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:automount_t:s0 tclass=process type=SYSCALL msg=audit(1149695027.074:55): arch=40000003 syscall=75 success=no exit=-13 a0=7 a1=bfec9414 a2=b38ff4 a3=bfec9414 items=0 pid=2322 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=AVC msg=audit(1149695027.078:56): avc: denied { execute } for pid=2327 comm="automount" name="modprobe" dev=dm-0 ino=2687054 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:object_r:insmod_exec_t:s0 tclass=file type=SYSCALL msg=audit(1149695027.078:56): arch=40000003 syscall=11 success=no exit=-13 a0=2edebf a1=bfec58b0 a2=9e791e8 a3=2edebf items=1 pid=2327 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="automount" exe="/usr/sbin/automount" subj=system_u:system_r:automount_t:s0 type=CWD msg=audit(1149695027.078:56): cwd="/" type=PATH msg=audit(1149695027.078:56): item=0 name="/sbin/modprobe" inode=2687054 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:insmod_exec_t:s0 -- Tom London

2 1

postgresql AVC errors
by Ben 08 Jun '06

08 Jun '06

I get this a LOT on my fedora postgres server: kernel: audit(1148742297.318:91630): avc: denied { create } for pid=29176 comm="postmaster" scontext=system_u:system_r:postgresql_t:s0 tcontext=system_u:system_r:postgresql_t:s0 tclass=netlink_route_socket It doesn't seem to harm anything, but it hardly seems like it should be there, either. Ideas?

3 2

selinux-policy 2.2.43-4 file_contexts conflict
by Valdis.Kletnieks＠vt.edu 08 Jun '06

08 Jun '06

In today's rawhide: /etc/selinux/strict/contexts/files/file_contexts: Multiple different specifications for /usr/bin/mplayer (system_u:object_r:unconfined_execmem_exec_t and system_u:object_r:mplayer_exec_t). Looks like somebody added an mplayer policy and the cleanup didn't get finished?

1 0

Another mount issue
by Paul Howarth 08 Jun '06

08 Jun '06

On my file/web/samba/nfs server I have a software archive, which I serve out using both samba and httpd. So the whole thing as public_content_rw_t, and the appropriate boolean set so that samba can write to it. On the software archive I have DVD ISO images of FC4 and FC5. I have fstab entries for these to loopback mount them as follows: /srv/softlib/fedora/stentz/FC4-i386-DVD.iso /srv/softlib/fedora/stentz/dvd iso9660 ro,loop,fscontext=system_u:object_r:public_content_t 0 0 /srv/softlib/fedora/bordeaux/FC-5-i386-DVD.iso /srv/softlib/fedora/bordeaux/dvd iso9660 ro,loop,fscontext=system_u:object_r:public_content_t 0 0 Unfortunately the mount won't work at boot time because mount is confined to the mount_t domain, which can't read public_content_rw_t: Apr 21 08:40:21 badby kernel: audit(1145605218.512:331): avc: denied { read } for pid=1469 comm="mount" name="FC4-i386-DVD.iso" dev=dm-5 ino=1032205 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:public_content_rw_t:s0 tclass=file Apr 21 08:40:21 badby kernel: audit(1145605218.564:332): avc: denied { read } for pid=1469 comm="mount" name="FC-5-i386-DVD.iso" dev=dm-5 ino=606259 scontext=system_u:system_r:mount_t:s0 tcontext=root:object_r:public_content_rw_t:s0 tclass=file A "mount -a" after booting works fine as it then runs unconfined. Is this something that should be generally allowed or should I just write local policy to fix this? Paul.

3 3

noexec mount-option with selinux?
by Marten Lehmann 07 Jun '06

07 Jun '06

Hello, I would like to mount the /tmp directory with the noexec option, so that no files can be executed directly from /tmp. But the problem is, that I don't have a separate partition for /tmp. It would be useless to create one, because the users on this system have strict quota limits, which wouldn't apply on a separate /tmp partition. Lots of example policies only show ways to restrict certain applications. But is there a way to restrict access to the /tmp directory in general, too? Regards Marten

8 16

Problems with pppd and mgetty+sendfax on FC5
by Peter Hancox 07 Jun '06

07 Jun '06

Recently installed FC5 and am experiencing problems with pppd and mgetty+sendfax when running with SELinux enabled. mgetty+sendfax was unable to write to /var/spool/fax/incoming. However, switching to permissive mode fixed this problem. What I can't understand is the problem experienced with pppd. Users dialing in fail PAP authentication when SELinux is enabled. This doesn't happen with SELinux disabled and dial in works correctly. However, when SELinux is enabled but running in "permissive" mode rather than "enforcing", pppd still fails. I thought that in "permissive" mode, SELinux would just log the permission failures but allow everything to go ahead ??? Appears that SELinux is still preventing pppd from accessing the shadow file to validate user password credentials. Is this a special case? Disabling SELinux protection for pppd didn't appear to make any difference. Jun 7 11:44:59 zeus mgetty[2458]: data dev=ttyS1, pid=2458, caller='none', conn='26400/ARQ/V34/LAPM/V42BIS', name='', cmd='/usr/sbin/pppd', user='/AutoPPP/' Jun 7 11:44:59 zeus pppd[2458]: pppd 2.4.3 started by a_ppp, uid 0 Jun 7 11:44:59 zeus pppd[2458]: Using interface ppp0 Jun 7 11:44:59 zeus pppd[2458]: Connect: ppp0 <--> /dev/ttyS1 Jun 7 11:45:02 zeus pppd[2458]: PAP peer authentication failed for phancox Jun 7 11:45:02 zeus kernel: audit(1149644702.926:69): avc: denied { read } for pid=2458 comm="pppd" name="shadow" dev=dm-0 ino=1495903 scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file Jun 7 11:45:02 zeus kernel: audit(1149644702.926:70): avc: denied { getattr } for pid=2458 comm="pppd" name="shadow" dev=dm-0 ino=1495903 scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file Jun 7 11:45:02 zeus kernel: audit(1149644702.930:71): avc: denied { create } for pid=2458 comm="pppd" scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=netlink_audit_socket Jun 7 11:45:02 zeus kernel: audit(1149644702.930:72): avc: denied { write } for pid=2458 comm="pppd" scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=netlink_audit_socket Jun 7 11:45:02 zeus kernel: audit(1149644702.930:73): avc: denied { nlmsg_relay } for pid=2458 comm="pppd" scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=netlink_audit_socket Jun 7 11:45:02 zeus kernel: audit(1149644702.930:74): avc: denied { read } for pid=2458 comm="pppd" scontext=system_u:system_r:pppd_t:s0 tcontext=system_u:system_r:pppd_t:s0 tclass=netlink_audit_socket Jun 7 11:45:03 zeus pppd[2458]: Connection terminated. Jun 7 11:45:03 zeus pppd[2458]: Exit.

1 0

postfix, procmail and SELinux - No Go
by Marc Schwartz 06 Jun '06

06 Jun '06

Hi all, I took advantage of the long weekend here in the States to finally update to FC5. All went well in general, however it has become apparent that procmail is problematic with SELinux enabled. fetchmail and postfix work fine in terms of getting my e-mail from multiple POP3 accounts. However local (~/.procmailrc) procmail filtering does not. My FC4 configuration files, with a few edits to reflect some path changes for postfix, now work fine with SELinux disabled. I was not running SELinux on FC4 and all worked fine there. I found other FC5/SELinux posts where others have had similar problems and disabling SELinux solved them. This is on a fully updated FC5 system as of the writing of this post. Is there a policy update pending to resolve this issue or some temporary steps that can be used in the interim, short of disabling SELinux entirely? Thanks, Marc Schwartz

4 25

Stuff I found in my log?
by Knute Johnson 06 Jun '06

06 Jun '06

I found some interesting things in my 'messages' log today. I'm not sure what they mean and would appreciate any information. This one is the most bothersome. It appears that 'useradd' was prevented from running this morning only I didn't run it. Would any other programs run 'useradd' and what would cause it to be denied? May 23 05:11:49 rabbitbrush kernel: audit(1148386309.877:556): avc: denied { write } for pid=13906 comm="useradd" name="[1708464]" dev=pipefs ino=1708464 scontext=user_u:system_r:useradd_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=fifo_file There are a boatload of these messages. I know that 'webalizer' is a statistics formatter for the web server but why would it be run dozens of times and be denied? May 23 04:02:02 rabbitbrush kernel: audit(1148382121.861:514): avc: denied { create } for pid=12313 comm="webalizer" scontext=user_u:system_r:webalizer_t:s0 tcontext=user_u:system_r:webalizer_t:s0 tclass=netlink_route_socket May 23 04:02:02 rabbitbrush kernel: audit(1148382122.237:515): avc: denied { create } for pid=12313 comm="webalizer" scontext=user_u:system_r:webalizer_t:s0 tcontext=user_u:system_r:webalizer_t:s0 tclass=netlink_route_socket May 23 04:02:02 rabbitbrush kernel: audit(1148382122.237:516): avc: denied { create } for pid=12313 comm="webalizer" scontext=user_u:system_r:webalizer_t:s0 tcontext=user_u:system_r:webalizer_t:s0 tclass=netlink_route_socket What would cause hundreds of these messages to appear in the log. I know I played with setsebool but I only changed one item. May 22 17:33:58 rabbitbrush kernel: audit(1148344436.645:286): avc: granted { setbool } for pid=2303 comm="setsebool" scontext=user_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security May 22 17:33:58 rabbitbrush kernel: audit(1148344436.645:287): avc: granted { setbool } for pid=2303 comm="setsebool" scontext=user_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security May 22 17:33:58 rabbitbrush kernel: audit(1148344436.645:288): avc: granted { setbool } for pid=2303 comm="setsebool" scontext=user_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security May 22 17:33:58 rabbitbrush kernel: audit(1148344436.645:289): avc: granted { setbool } for pid=2303 comm="setsebool" scontext=user_u:system_r:unconfined_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security Thanks very much, -- Knute Johnson Molon Labe...

5 9

policy for mock - put in mock package or selinux-policy-targeted?
by Matt Domsch 04 Jun '06

04 Jun '06

What's the right place to put application-specific policy modules, such as the mock policy outlined here: http://fedoraproject.org/wiki/Extras/MockTricks Should those files get compiled into modules, and installed, using mock's SRPM, or should they go into selinux-policy-targeted? Seth Vidal wants to push out a new mock build soonish, and this is something I'd like cleared up before that if possible. Thanks, Matt -- Matt Domsch Software Architect Dell Linux Solutions linux.dell.com & www.dell.com/linux Linux on Dell mailing lists @ http://lists.us.dell.com

3 3

Cannot FTP to /var/www/don/html with SELinux enabled
by Don 01 Jun '06

01 Jun '06

Hi, I have two problems which I think they are similar. 1) I have a directory /var/www/don/html which is owned by don. I want to ftp some web pages, but I cannot cd to /var/www/don/html when SELinux is enabled. When I turn SELinux off it works. What do I need to set to allow this. 2) If I ftp the html files to my home dir the and copy them to /var/www/don/html they cannot we read by the browser while SELinux is enabled. Thanks in advance, Don

3 4

File contexts again
by Paul Howarth 01 Jun '06

01 Jun '06

Having trouble with default file contexts again. I have a policy module with the following .fc file: /home/pgsql -d gen_context(system_u:object_r:var_lib_t,s0) /home/pgsql/data -d gen_context(system_u:object_r:postgresql_db_t,s0) /home/pgsql/data/.* -d gen_context(system_u:object_r:postgresql_db_t,s0) /home/pgsql/data/.* -- gen_context(system_u:object_r:postgresql_db_t,s0) /home/pgsql/pgstartup\.log -- gen_context(system_u:object_r:postgresql_log_t,s0) The entries that are not regexes work OK, but as soon as I use a regex, the type I'm specifying gets overridden by user_home_t when I do a restorecon. For instance, if I have a file /home/pgsql/data/test.db, restorecon labels it user_home_t rather than postgresql_db_t. /home/pgsql is not the home directory of any user. Why is this happening? It appears that some further tweaking to the file contexts sort order that I put on the wiki (http://fedoraproject.org/wiki/SELinux/ManagingFileContext) after the last discussion is needed. Paul.

3 11

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2006