file_contexts.local install error...
by Tom London
Running latest rawhide, targeted/enforcing.
Today's 'yumex' produced:
libsemanage.semanage_install_active: Non-fatal error: Could not copy
/etc/selinux/targeted/modules/active/file_contexts.local to
/etc/selinux/targeted/contexts/files/file_contexts.local.
Is this similar to what happened with 'netfilter_contexts' (i.e., need
to run update in permissive mode)?
tom
--
Tom London
16 years, 7 months
Who Watches Over Coverity?
by Benjy Grogan
Hello:
Is Red Hat worried about Coverity or other such bug/security hole
searching private ventures? There are probably 1000s of critical
security holes in any given Linux distro and the only problem is that
there doesn't exist sophisticated enough tools yet to discover them.
Companies like Coverity are attempting to develop them, and for what
seems like the greater good of Linux distros. Nevertheless, with Red
Hat having invested so much into SELinux is there also considerable
thought put into developing a Coverity-like project to get to those
lingering security threats first?
Benjy
16 years, 7 months
dbus/wine and selinux problems
by dragoran
Hello
I am working on a opengl wrapper that displays some data on hud in games.
It uses dbus in a thread to get the data. The wrapper is loaded using
LD_PRELOAD.
The problem is when a game is started using wine (a windows game) dbus
does not work because selinux is blocking it.
setenforce 0 fixes it but isn't a solution.
so how can I allow wine_exec_t to connect to dbus?
16 years, 7 months
AVCs from today's updates.... (stroke 2)
by Tom London
Resending with <100K text to avoid moderator .....
Today's update generated some AVCs (actually lots of them).
Here is audit2allow output:
allow bootloader_t rpm_t:tcp_socket { read write };
allow bootloader_t rpm_var_lib_t:file { read write };
allow depmod_t rpm_t:tcp_socket { read write };
allow depmod_t rpm_var_lib_t:file { read write };
allow depmod_t var_t:file read;
Here are clippings from /var/log/audit/audit.log:
type=AVC msg=audit(1155307887.872:40): avc: denied { read write }
for pid=4770 comm="depmod" name="[51427]" dev=sockfs ino=51427
scontext=system_u:system_r:depmod_t:s0
tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1155307887.872:40): avc: denied { read write }
for pid=4770 comm="depmod" name="__db.000" dev=dm-0 ino=2786034
scontext=system_u:system_r:depmod_t:s0
tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
type=AVC msg=audit(1155307887.872:40): avc: denied { read } for
pid=4770 comm="depmod" name="kernel-2.6.17-1.2548.fc6.i686.rpm"
dev=dm-0 ino=2818553 scontext=system_u:system_r:depmod_t:s0
tcontext=system_u:object_r:var_t:s0 tclass=file
type=SYSCALL msg=audit(1155307887.872:40): arch=40000003 syscall=11
success=yes exit=0 a0=8858430 a1=884a5c8 a2=884d8a0 a3=8858760 items=0
ppid=4762 pid=4770 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="depmod" exe="/sbin/depmod"
subj=system_u:system_r:depmod_t:s0 key=(null)
type=AVC_PATH msg=audit(1155307887.872:40):
path="/var/cache/yum/development/packages/kernel-2.6.17-1.2548.fc6.i686.rpm"
type=AVC_PATH msg=audit(1155307887.872:40): path="/var/lib/rpm/__db.000"
type=AVC_PATH msg=audit(1155307887.872:40): path="socket:[51427]"
<<<<< many, many of the above, various socket #s>>>>>>
<<<<< many, many of the below, various socket #s>>>>>>
type=AVC msg=audit(1155307888.860:41): avc: denied { read write }
for pid=4771 comm="mkinitrd" name="[54546]" dev=sockfs ino=54546
scontext=system_u:system_r:bootloader_t:s0
tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1155307888.860:41): avc: denied { read write }
for pid=4771 comm="mkinitrd" name="[51427]" dev=sockfs ino=51427
scontext=system_u:system_r:bootloader_t:s0
tcontext=system_u:system_r:rpm_t:s0 tclass=tcp_socket
type=AVC msg=audit(1155307888.860:41): avc: denied { read write }
for pid=4771 comm="mkinitrd" name="__db.000" dev=dm-0 ino=2786034
scontext=system_u:system_r:bootloader_t:s0
tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file
type=SYSCALL msg=audit(1155307888.860:41): arch=40000003 syscall=11
success=yes exit=0 a0=8857f58 a1=884a5c8 a2=884d8a0 a3=8858470 items=0
ppid=4762 pid=4771 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=pts0 comm="mkinitrd" exe="/bin/bash"
subj=system_u:system_r:bootloader_t:s0 key=(null)
type=AVC_PATH msg=audit(1155307888.860:41): path="/var/lib/rpm/__db.000"
type=AVC_PATH msg=audit(1155307888.860:41): path="socket:[51427]"
type=AVC_PATH msg=audit(1155307888.860:41): path="socket:[54546]"
type=AVC_PATH msg=audit(1155307888.860:41): path="socket:[55152]"
type=AVC_PATH msg=audit(1155307888.860:41): path="socket:[48873]"
<<<< many, many of the above, various socket #s >>>>>
tom
--
Tom London
16 years, 7 months
FC2 useradd in chroot on FC5 host with SELinux
by Paul Howarth
I use mock to build packages for old distributions in a chroot-ed
environment on my FC5 box. I've pretty well got this working for all old
distributions now apart from FC2 (see
http://www.fedoraproject.org/wiki/Legacy/Mock). On FC2, the process gets
off to quite a good start, installing the following packages into the
chroot:
=============================================================================
Package Arch Version Repository
Size
=============================================================================
Installing:
buildsys-build noarch 0.5-1.CF.fc2 groups
1.8 k
Installing for dependencies:
SysVinit i386 2.85-25 core
96 k
basesystem noarch 8.0-3 core
2.7 k
bash i386 2.05b-38 core
1.5 M
beecrypt i386 3.1.0-3 core
64 k
binutils i386 2.15.90.0.3-5 core
2.8 M
buildsys-macros noarch 2-2.fc2 groups
2.1 k
bzip2 i386 1.0.2-12.1 core
48 k
bzip2-libs i386 1.0.2-12.1 core
32 k chkconfig i386 1.3.9-1.1 core
99 k
coreutils i386 5.2.1-7 core
2.8 M
cpio i386 2.5-6 core
45 k
cpp i386 3.3.3-7 core
1.4 M
cracklib i386 2.7-27.1 core
26 k
cracklib-dicts i386 2.7-27.1 core
409 k
db4 i386 4.2.52-3.1 core
1.5 M
dev i386 3.3.13-1 core
3.6 M
diffutils i386 2.8.1-11 core
205 k
e2fsprogs i386 1.35-7.1 core
728 k
elfutils-libelf i386 0.95-2 core
36 k
ethtool i386 1.8-3.1 core
48 k
fedora-release i386 2-4 core
92 k
file i386 4.07-4 core
242 k
filesystem i386 2.2.4-1 core
18 k
findutils i386 1:4.1.7-25 core
102 k
gawk i386 3.1.3-7 core
1.5 M
gcc i386 3.3.3-7 core
3.8 M
gcc-c++ i386 3.3.3-7 core
2.0 M
gdbm i386 1.8.0-22.1 core
26 k
glib i386 1:1.2.10-12.1.1 core
134 k
glib2 i386 2.4.8-1.fc2 updates-released
477 k
glibc i686 2.3.3-27.1 updates-released
4.9 M
glibc-common i386 2.3.3-27.1 updates-released
14 M
glibc-devel i386 2.3.3-27.1 updates-released
1.9 M
glibc-headers i386 2.3.3-27.1 updates-released
530 k
glibc-kernheaders i386 2.4-8.44 core
697 k
grep i386 2.5.1-26 core
168 k
gzip i386 1.3.3-12.2.legacy updates-released
88 k
info i386 4.7-4 updates-released
147 k
initscripts i386 7.55.2-1 updates-released
906 k
iproute i386 2.4.7-14 core
591 k
iputils i386 20020927-13 core
92 k
less i386 382-3 core
85 k
libacl i386 2.2.7-5 core
15 k
libattr i386 2.4.1-4 core
8.6 k
libgcc i386 3.3.3-7 core
33 k
libselinux i386 1.11.4-1 core
45 k
libstdc++ i386 3.3.3-7 core
240 k
libstdc++-devel i386 3.3.3-7 core
1.3 M
libtermcap i386 2.0.8-38 core
12 k
make i386 1:3.80-3 core
337 k
mingetty i386 1.07-2 core
18 k
mktemp i386 2:1.5-7 core
12 k
modutils i386 2.4.26-16 core
395 k
ncurses i386 5.4-5 core
1.5 M
net-tools i386 1.60-25.1 updates-released
311 k
pam i386 0.77-40 core
1.9 M
patch i386 2.5.4-19 core
61 k
pcre i386 4.5-2 core
59 k
perl i386 3:5.8.3-18 core
11 M
perl-Filter i386 1.30-5 core
68 k
popt i386 1.9.1-0.4.1 updates-released
61 k
procps i386 3.2.0-1.2 updates-released
176 k
psmisc i386 21.4-2 core
41 k
redhat-rpm-config noarch 8.0.28-1.1.1 core
41 k
rpm i386 4.3.1-0.4.1 updates-released
2.2 M
rpm-build i386 4.3.1-0.4.1 updates-released
437 k
sed i386 4.0.8-4 core
116 k
setup noarch 2.5.33-1 core
29 k
shadow-utils i386 2:4.0.3-55 updates-released
671 k
sysklogd i386 1.4.1-16 core
65 k
tar i386 1.13.25-14 core
351 k
termcap noarch 11.0.1-18.1 core
237 k
tzdata noarch 2005f-1.fc2 updates-released
449 k
unzip i386 5.50-37 core
139 k
util-linux i386 2.12-19 updates-released
1.5 M
which i386 2.16-2 core
21 k
words noarch 2-22 core
137 k
zlib i386 1.2.1.2-0.fc2 updates-released
44 k
After installing all of these packages successfully, the next thing that
happens is:
Executing /usr/sbin/mock-helper
chroot /var/lib/mock/fedora-2-i386-core/root /bin/su - root -c
"/usr/sbin/useradd -m -u 500 -d /builddir mockbuild"
and at that point the "useradd" process just hangs indefinitely. I'm
told that if SELinux is disabled (I've tried permissive mode and that
doesn't help), this works. I can't see any AVCs in the logs.
Any ideas what might be causing this and how it might be fixed?
Paul.
16 years, 7 months
sendmail aliases context
by Paul Howarth
Upstream sendmail has aliases in /etc/mail/aliases(.db)? rather than
/etc/aliases(.db)?
I therefore suggest adding the following contexts to policy for the
benefit those of us rolling our own sendmail packages:
/etc/mail/aliases -- gen_context(system_u:object_r:etc_aliases_t,s0)
/etc/mail/aliases\.db -- gen_context(system_u:object_r:etc_aliases_t,s0)
Paul,
16 years, 7 months
un
by Icebarron
unsubscribe
16 years, 7 months
setroubleshoot: Import error....
by Tom London
Running latest rawhide (setroubleshoot-0.18-1), targeted/enforcing.
Get this in /var/log/setroubleshoot/setroubleshoot.log (repeated several times):
2006-08-08 06:59:23,081 [avc.ERROR] Traceback (most recent call last):
File "/usr/lib/python2.4/site-packages/setroubleshoot/dispatcher.py",
line 152, in HandleAVCS
analyze_thread = Analyze(analyze_queue, sigHandler)
File "/usr/lib/python2.4/site-packages/setroubleshoot/dispatcher.py",
line 23, in __init__
self.plugins = LoadPlugins()
File "/usr/lib/python2.4/site-packages/setroubleshoot/util.py", line
299, in LoadPlugins
imp.load_module(pluginBase, *imp.find_module(pluginBase, [pluginRoot]))
ImportError: No module named plugins
Traceback (most recent call last):
File "/usr/lib/python2.4/site-packages/setroubleshoot/dispatcher.py",
line 152, in HandleAVCS
analyze_thread = Analyze(analyze_queue, sigHandler)
File "/usr/lib/python2.4/site-packages/setroubleshoot/dispatcher.py",
line 23, in __init__
self.plugins = LoadPlugins()
File "/usr/lib/python2.4/site-packages/setroubleshoot/util.py", line
299, in LoadPlugins
imp.load_module(pluginBase, *imp.find_module(pluginBase, [pluginRoot]))
ImportError: No module named plugins
tom
--
Tom London
16 years, 7 months
Setroubleshoot question
by Jay Cliburn
Is it a bug that setroubleshoot_dispatcher continues to run even when
setroubleshoot is shut off?
[[root@osprey ~]# rpm -q setroubleshoot
setroubleshoot-0.16-1
root@osprey ~]# service setroubleshoot status
setroubleshoot is stopped
[root@osprey ~]# ps -ef | grep setrou
root 1783 1770 0 20:55 ? 00:00:00 python
/usr/lib/audit/setroubleshoot_dispatcher
root 2558 2523 0 21:29 pts/0 00:00:00 grep setrou
[root@osprey ~]# tail -100 /var/log/messages | grep setrouble
Aug 4 20:56:12 osprey setroubleshoot: 2006-08-04 20:56:12,711
[ipc.ERROR] exiting after [Errno 2] No such file or directory, socket
AlertClient: socket=/var/run/setroubleshoot/setroubleshoot_server user=None
Thanks,
Jay
16 years, 7 months
[ANN]segatex2.02 released !!
by shintaro_fujiwara
Hi,all.
I made a simple GUI tool,
which generates .te file from
/var/log/audit/audit.log.
It checks all .if files and generates
.te with raw permissions which
had not been found in .if files.
You can download source from
https://sourceforge.net/projects/segatex/
It needs C++ Boost library and Qt.
Thank you.
16 years, 7 months
