January 2007 - selinux - Fedora mailing-lists

Nagios Web Interface and SELinux
by Ryan Skadberg 13 Sep '07

13 Sep '07

I have been trying to get nagios up and running on 2 different machines. One running FC5 and one running FC6. Nagios itself starts up fine, but the web interface fails miserably. When looking at /var/log/messages, I see things like: Dec 3 11:38:17 xray kernel: audit(1165174697.348:289): avc: denied { execute_no_trans } for pid=22237 comm="httpd" name="tac.cgi" dev=dm-0 ino=11272226 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file I noticed in the selinux-policy-targeted Changelog: * Wed Jul 26 2006 Dan Walsh <dwalsh(a)redhat.com> 2.3.3-13 - Add nagios policy This may have been for the program itself or maybe the web interface, but it sure doesn't seem to be working for me. Both systems are set to: SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 Anyone have any advice on how to fix this? Thanks! Skadz

3 4

Mail problems...
by melaina＠libero.it 06 Feb '07

06 Feb '07

Hello! I have just started playing a bit with SELinux in permissive mode on my system. I have qmail with spamassassin installed; the only AVC denied messages I get (after I relabeled the system and fixed domains on a couple of log files), is the following: Jan 30 20:23:13 drake kernel: audit(1170210193.998:8): avc: denied { read } for pid=11862 comm="sendmail" name="RsmVLSTr" dev=loop0 ino=20 scontext=user_u: system_r:system_mail_t tcontext=user_u:object_r:httpd_sys_script_rw_t tclass=fil e Jan 30 20:23:13 drake kernel: audit(1170210193.998:9): avc: denied { read wr ite } for pid=11862 comm="sendmail" name="jk-runtime-status" dev=hda5 ino=49827 49 scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:httpd_log_t tclass=file Jan 30 20:23:14 drake kernel: audit(1170210194.019:10): avc: denied { ioctl } for pid=11863 comm="qmail-scanner-q" name="error_log" dev=hda5 ino=4984894 sc ontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:httpd_log_t tcla ss=file Jan 30 20:23:14 drake kernel: audit(1170210194.026:11): avc: denied { read } for pid=11863 comm="sperl5.8.5" name="mounts" dev=proc ino=777453584 scontext= user_u:system_r:system_mail_t tcontext=user_u:system_r:system_mail_t tclass=file Jan 30 20:23:14 drake kernel: audit(1170210194.026:12): avc: denied { getatt r } for pid=11863 comm="sperl5.8.5" name="mounts" dev=proc ino=777453584 sconte xt=user_u:system_r:system_mail_t tcontext=user_u:system_r:system_mail_t tclass=f ile Jan 30 20:23:15 drake kernel: audit(1170210195.204:13): avc: denied { append } for pid=11863 comm="perl5.8.5" name="qmail-queue.log" dev=hda5 ino=5130271 s context=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tcl ass=file Jan 30 20:23:15 drake kernel: audit(1170210195.204:14): avc: denied { ioctl } for pid=11863 comm="perl5.8.5" name="qmail-queue.log" dev=hda5 ino=5130271 sc ontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tcla ss=file Jan 30 20:23:15 drake kernel: audit(1170210195.205:15): avc: denied { getatt r } for pid=11863 comm="perl5.8.5" name="qmail-queue.log" dev=hda5 ino=5130271 scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tc lass=file Jan 30 20:23:15 drake kernel: audit(1170210195.206:16): avc: denied { read } for pid=11863 comm="perl5.8.5" name="qmail-scanner-queue-version.txt" dev=hda5 ino=5130273 scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:v ar_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.208:17): avc: denied { write } for pid=11863 comm="perl5.8.5" name="tmp" dev=hda5 ino=5195094 scontext=user_ u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.208:18): avc: denied { add_na me } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com1170210195772118 63" scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_ t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.208:19): avc: denied { create } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863 " scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:var_spool_t tc lass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.409:20): avc: denied { create } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863 " scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:var_spool_t tc lass=file Jan 30 20:23:15 drake kernel: audit(1170210195.410:21): avc: denied { ioctl } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.410:22): avc: denied { getatt r } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com11702101957721186 3" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:o bject_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.414:23): avc: denied { write } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.418:24): avc: denied { link } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:obje ct_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.419:25): avc: denied { remove _name } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com1170210195772 11863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=syst em_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.419:26): avc: denied { unlink } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863 " dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:ob ject_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.424:27): avc: denied { read w rite } for pid=11864 comm="sh" name="tty" dev=tmpfs ino=1804 scontext=user_u:sy stem_r:system_mail_t tcontext=system_u:object_r:devtty_t tclass=chr_file Jan 30 20:23:15 drake kernel: audit(1170210195.431:28): avc: denied { read } for pid=11865 comm="sh" name="drake.mydomain.com117021019577211863" dev=hda 5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:va r_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.434:29): avc: denied { write } for pid=11865 comm="reformime" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5408221 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.434:30): avc: denied { add_na me } for pid=11865 comm="reformime" name="1170210195.11865-0.drake.mydomain. com" scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.739:31): avc: denied { read } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5408221 scontext=user_u:system_r:system_mail_t tcontext=user_u:obje ct_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.755:32): avc: denied { read } for pid=11863 comm="perl5.8.5" name="tmp" dev=hda5 ino=4980740 scontext=user_u :system_r:system_mail_t tcontext=system_u:object_r:var_t tclass=lnk_file Jan 30 20:23:15 drake kernel: audit(1170210195.795:33): avc: denied { execut e } for pid=11867 comm="perl5.8.5" name="find" dev=hda5 ino=5297451 scontext=us er_u:system_r:system_mail_t tcontext=system_u:object_r:file_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.796:34): avc: denied { execut e_no_trans } for pid=11867 comm="perl5.8.5" name="find" dev=hda5 ino=5297451 sc ontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:file_t tclass=fi le Jan 30 20:23:15 drake kernel: audit(1170210195.796:35): avc: denied { read } for pid=11867 comm="perl5.8.5" name="find" dev=hda5 ino=5297451 scontext=user_ u:system_r:system_mail_t tcontext=system_u:object_r:file_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.798:36): avc: denied { search } for pid=11867 comm="find" name="selinux" dev=hda5 ino=557257 scontext=user_u :system_r:system_mail_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.798:37): avc: denied { read } for pid=11867 comm="find" name="config" dev=hda5 ino=557274 scontext=user_u:sy stem_r:system_mail_t tcontext=user_u:object_r:selinux_config_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.798:38): avc: denied { getatt r } for pid=11867 comm="find" name="config" dev=hda5 ino=557274 scontext=user_u :system_r:system_mail_t tcontext=user_u:object_r:selinux_config_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.860:39): avc: denied { read } for pid=11871 comm="rm" name="qscan" dev=hda5 ino=5130256 scontext=user_u:syst em_r:system_mail_t tcontext=system_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.860:40): avc: denied { remove _name } for pid=11871 comm="rm" name="1170210195.11865-0.drake.mydomain.com" dev=hda5 ino=5408222 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.861:41): avc: denied { rmdir } for pid=11871 comm="rm" name="drake.mydomain.com117021019577211863" dev=hd a5 ino=5408221 scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:v ar_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.873:42): avc: denied { sigchl d } for pid=1 comm="init" scontext=user_u:system_r:system_mail_t tcontext=user_ u:system_r:unconfined_t tclass=process Any directions to fix this? Thanks! ------------------------------------------------------ Mutuo da 200.000 ? Tassi ridotti da 4.25%. Solo per richieste online. Mutuionline.it http://click.libero.it/mutuionline31ge07

2 1

Crossover
by Göran Uddeborg 06 Feb '07

06 Feb '07

Crossover installs under /opt/cxoffice by default. The rules for wine-style programs does not seem to cover that hierarchy, and just trying to run things gives a lot of denied execmods. I assume just mirroring the settings for regular wine is fine for Crossover too: /opt/cxoffice/lib/wine/.+\.so system_u:object_r:textrel_shlib_t:s0 /opt/cxoffice/bin/wine system_u:object_r:wine_exec_t:s0 I changed the files (only directly with chcon) and it appears to work. At least so far, we have not used this too much yet. Does this make sense? Do you want a bugzilla about it?

2 1

Selinux is ignoring me
by Ronald 30 Jan '07

30 Jan '07

My problem can be viewed here: http://forums.fedoraforum.org/showthread.php?p=734545#post734545 No one answered on the forums. Can someone help me on the mailinglist? I'm trying to understand the system, so I can hopefully write a manual (or HOWTO) for the forums. Can anybody help me with my problem? And some good links will be appreciated as well. The ones from google give hits that rever to non-existing files...

2 1

PAM problems
by Anne Wilson 29 Jan '07

29 Jan '07

From logwatch: **Unmatched Entries** userhelper[20994]: PAM [error: /lib/security/lib/security/pam_permit.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[20994]: PAM [error: /lib/security/lib/security/pam_rootok.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[20994]: PAM [error: /lib/security/lib/security/pam_stack.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[20994]: PAM [error: /lib/security/lib/security/pam_timestamp.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[20994]: PAM [error: /lib/security/lib/security/pam_xauth.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[20994]: PAM adding faulty module: /lib/security/lib/security/pam_permit.so: 1 Time(s) userhelper[20994]: PAM adding faulty module: /lib/security/lib/security/pam_rootok.so: 1 Time(s) userhelper[20994]: PAM adding faulty module: /lib/security/lib/security/pam_stack.so: 1 Time(s) userhelper[20994]: PAM adding faulty module: /lib/security/lib/security/pam_timestamp.so: 1 Time(s) userhelper[20994]: PAM adding faulty module: /lib/security/lib/security/pam_xauth.so: 1 Time(s) userhelper[20994]: PAM unable to dlopen(/lib/security/lib/security/pam_permit.so): 1 Time(s) userhelper[20994]: PAM unable to dlopen(/lib/security/lib/security/pam_rootok.so): 1 Time(s) userhelper[20994]: PAM unable to dlopen(/lib/security/lib/security/pam_stack.so): 1 Time(s) userhelper[20994]: PAM unable to dlopen(/lib/security/lib/security/pam_timestamp.so): 1 Time(s) userhelper[20994]: PAM unable to dlopen(/lib/security/lib/security/pam_xauth.so): 1 Time(s) userhelper[21001]: PAM [error: /lib/security/lib/security/pam_permit.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[21001]: PAM [error: /lib/security/lib/security/pam_rootok.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[21001]: PAM [error: /lib/security/lib/security/pam_stack.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[21001]: PAM [error: /lib/security/lib/security/pam_timestamp.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[21001]: PAM [error: /lib/security/lib/security/pam_xauth.so: cannot open shared object file: No such file or directory]: 1 Time(s) userhelper[21001]: PAM adding faulty module: /lib/security/lib/security/pam_permit.so: 1 Time(s) userhelper[21001]: PAM adding faulty module: /lib/security/lib/security/pam_rootok.so: 1 Time(s) userhelper[21001]: PAM adding faulty module: /lib/security/lib/security/pam_stack.so: 1 Time(s) userhelper[21001]: PAM adding faulty module: /lib/security/lib/security/pam_timestamp.so: 1 Time(s) userhelper[21001]: PAM adding faulty module: /lib/security/lib/security/pam_xauth.so: 1 Time(s) userhelper[21001]: PAM unable to dlopen(/lib/security/lib/security/pam_permit.so): 1 Time(s) userhelper[21001]: PAM unable to dlopen(/lib/security/lib/security/pam_rootok.so): 1 Time(s) userhelper[21001]: PAM unable to dlopen(/lib/security/lib/security/pam_stack.so): 1 Time(s) userhelper[21001]: PAM unable to dlopen(/lib/security/lib/security/pam_timestamp.so): 1 Time(s) userhelper[21001]: PAM unable to dlopen(/lib/security/lib/security/pam_xauth.so): 1 Time(s) What's happening? Anne

3 6

SELinux Policy/Flask Classes from scratch
by bx 29 Jan '07

29 Jan '07

Hello, Let me apologize if this is the wrong place to ask this question, but I figure that those well versed in SELinux can help me. I have been reading a ton about SELinux and Flask, and I haven't found anything that answered my question. I am working on creating a security policy from scratch and followed the tutorial the IBM published ( http://www-128.ibm.com/developerworks/linux/library/l-selinux.html) After taking a look at the bare bones policy.conf file it generated, it got me thinking- I don't need to have something as granular as SELinux allows me to be. In fact it would simplify things if I could change the granularity. How would SELinux be affected if I were to remove some of the class definitions and took anything that referred to those classes out of my policy? Would SELinux just not enforce anything on those types of objects, would SELinux completely disallow all use of those objects or would it just break SELinux? Thank you for your time and help, Rebecca

3 5

httpd and tcp_connect
by Michael Thomas 27 Jan '07

27 Jan '07

I'm receiving the following avc denial from a game package that's under review[1]: Jan 21 10:55:49 localhost kernel: audit(1169405749.338:3): avc: denied { name_connect } for pid=2661 comm="httpd" dest=19382 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket The package includes a php-based web application and a python daemon backend. The php webapp communicates with the python daemon through tcp sockets. From the avc denial it appears that this communication fails because httpd is not allowed to establish tcp connections. This seems like a valid security restriction, except in this case I do want to allow it. How can I configure the httpd policy to allow tcp connections, but only to localhost and only on the python daemon's ports (19380-19383)? --Wart [1] https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=219972

2 3

script executables
by Michael Thomas 27 Jan '07

27 Jan '07

I'm working on selinux protection for a python script daemon that is started inside of an init.d script. Inside the init.d script the python daemon is invoked as: python myscript.py --daemon --pid=... --log=... I'd like to have this process run under its own domain. The worst thing I could do is to relabel python with that domain, but that would just be really bad and sloppy, and not really an option. Another option that I've gotten to work is to use a wrapper shell script to invoke the python commands. The init.d script invokes the wrapper script, which is labeled with the desired domain. But I was wondering of there was another way to get myscript.py to run under a specific domain without using an application-specific wrapper. Something like 'sedomainexec myappd_t python myscript.py --daemon ...' Is the wrapper script my only option? --Wart

2 7

ANN: SELinux Policy IDE (SLIDE)
by David Sugar 26 Jan '07

26 Jan '07

Version 1.0 of the SELinux Policy IDE (SLIDE) from Tresys is now available for download from the Tresys Open Source website at http://oss.tresys.com. SLIDE is an Eclipse plug-in that integrates with the SELinux Reference Policy to provide a development environment for building SELinux policy. SLIDE features: * A graphical user interface for policy development, including policy syntax highlighting, context suggestions, and integrated compilation. * Integration with SELinux Reference Policy, including quick lookup and documentation for interfaces. * Wizards and easy to use templates to automate common tasks from creating a new SELinux policy to adding an interface into an existing module. * Integrated remote policy installation and audit log monitoring, to facilitate policy testing. * Seamless integration with the power of standard Eclipse. Version 1.0 highlights: * Integration of online help into the SLIDE plugin. * Display of distinct icon for disabled modules. * Improved documentation on the open source web site. If you would like to contribute, currently the best help would be to test and provide feedback on the SLIDE plugin and SLIDE Remote.

1 0

chcat problem
by pandalists＠free.fr 25 Jan '07

25 Jan '07

Hi, I am currently trying teach myself SELinux on a Fedora FC6 box (VMware), configured with the strict policy running in permissive mode. I followed the instructions provided on http://james-morris.livejournal.com/8228.html to play with MCS functions, but I get an error when I try to assign a category "Public" to an unprivileged user "foo" with the chcat command (as root, with sysadm role) ----------------------------------------------- # chcat -l -- +Public foo libsemanage.validate_handler: MLS range s0-s0:c0 for Unix user foo exceeds allow ed range s0 for SELinux user user_u libsemanage.validate_handler: seuser mapping [foo -> (user_u, s0-s0:c0)] is inva lid libsemanage.dbase_llist_iterate: could not iterate over records ----------------------------------------------- Other techniques to achieve the same result (e.g. trying to assign this category with semanage) leads the same error. ----------------------------------------------- # semanage login -l __default__ user_u s0 foo user_u s0 root root SystemLow-SystemHigh system_u system_u SystemLow-SystemHigh # semanage user -l root sysadm s0 SystemLow-SystemHigh system_r sy sadm_r staff_r staff_u staff s0 SystemLow-SystemHigh sysadm_r st aff_r sysadm_u sysadm s0 SystemLow-SystemHigh sysadm_r system_u user s0 SystemLow-SystemHigh system_r user_u user s0 s0 user_r ----------------------------------------------- My setrans.conf file contains : s0:c0=Public s0:c1=Confidential s0:c2=Secret s0:c3=TopSecret Any idea? Apart from that, setting a category on a non-existing file leads to a segmentation fault : # chcat -- +Public doesnotexist.txt Segmentation fault Thanks for your help, Ben

2 2

console-kit-domain
by Tom London 25 Jan '07

25 Jan '07

Running latest rawhide, targeted/enforcing. 'console-kit-daemon' is running as initrc_t. I'm getting the following AVC: type=USER_AVC msg=audit(1169660835.581:34): user pid=2558 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.ConsoleKit.Manager member=OpenSessionWithParameters dest=org.freedesktop.ConsoleKit spid=3363 tpid=3018 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus : exe="/bin/dbus-daemon" (sauid=81, hostname=?, addr=?, terminal=?)' [root@localhost ~]# ls -lZ /usr/sbin/console* -rwxr-xr-x root root system_u:object_r:sbin_t /usr/sbin/console-kit-daemon [root@localhost ~]# Should /usr/sbin/console-kit-daemon be xdm_exec_t ? tom [Not sure how to BZ this.... ConsoleKit package is not listed in bugzilla.] -- Tom London

3 2

tzdata-update AVC caused by pam_console ?
by Davide Bolcioni 25 Jan '07

25 Jan '07

Greetings, I am investigating the following AVCs Jan 6 18:12:25 camelot kernel: audit(1168103545.309:4): avc: denied { use } for pid=2302 comm="tzdata-update" name="tty1" dev=tmpfs ino=1745 scontext=root:system_r:tzdata_t:s0-s0:c0.c255 tcontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tclass=fd Jan 6 18:12:25 camelot kernel: audit(1168103545.310:5): avc: denied { use } for pid=2302 comm="tzdata-update" name="tty1" dev=tmpfs ino=1745 scontext=root:system_r:tzdata_t:s0-s0:c0.c255 tcontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tclass=fd which occurred when updating tzdata just after upgrading from Fedora Core 5 to Fedora Core 6. During the same update I also encountered http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=222179 but I did not see the above two lines mentioned (the inode 1745 matched /dev/tty1 at the time). I just tried running tzdata-update from an xterm and when logged at the console, but the above no longer happens. At present I have: $ ls -lZ /dev/tty1 crw--w---- root tty root:object_r:tty_device_t /dev/tty1 so I wonder if the above just got fixed in the meantime or there is some interaction with pam_console using different labeling from what the policy expects - I was running in runlevel 1 at the time. Thank you for your consideration, Davide Bolcioni -- There is no place like /home.

2 1

anacron under FC6/SELinux/strict
by Ted Rule 25 Jan '07

25 Jan '07

I've patched my local FC6 strict policy to accommodate the use of anacron; as the machine is generally powered off overnight, anacron gets far more usage than crond. The FC6 strict policy, selinux-policy-2.4.6-17.fc6.noarch.rpm, appeared to fail to run the overnight jobs in the correct domains. Whilst investigating the issue, I noted the following: crond starts up in crond_t, but seemingly transitions itself to system_crond_t via setexeccon(). anacron is also started in crond_t, but doesn't bother to call setexeccon(), and hence remains forever in crond_t. Under targeted policy only, crond_t is a typealias for system_crond_t The various auto-transitions to logrotate_t, logwatch_t and so on, are apparently linked to system_crond_t rather than crond_t. Hence anacron jobs never transition to system_crond_t, unless the policy is targeted, in which case anacron is already in system_crond_t by virtue of the typealias. The fcron package in Extras appears to have sufficient functionality to replace both anacron and cron, and also knows about setexeccon(), but I didn't investigate this further. The nsarefpolicy contains a separate transition from initrc_t to system_crond_t for anacron_exec_t, but the latest FC6 policy, (selinux-policy-2.4.6-17.fc6.noarch.rpm), has both the anacron_exec_t definition and the alternative transition patched out. The latest rawhide policy contains some additional fixes for anacron covering /var/spool/anacron and /var/lock usage, but not the anacron_exec_t definition or the initrc_t -> system_crond_t transition. Because the cron.fc already defines a label for /usr/sbin/anacron, I've manually labelled /usr/sbin/anacron to anacron_exec_t for the present. Obviously this label will be undone by any /.autorelabel I'm forced to invoke, until such time as this patch, or an equivalent fix, is released. My current patch module, incorporating the cron fixes already in selinux-policy-2.4.6-21.fc6.noarch.rpm, is as below. The ifdef strict clause at the end avoids a double definition of the same policy on targeted where crond_t and system_crond_t are the same thing. I guess that in an ideal world, anacron itself would be patched to launch all it's child jobs in system_crond_t, further emulating crond's behaviour, and thereby avoiding this fixup. [root@topaz ~]# cat /root/selinux.local/localanacron.fc # anacrond executable will have: # label: system_u:object_r:anacron_exec_t # MLS sensitivity: s0 # MCS categories: <none> # We cant easily override the /usr/sbin/anacron setting in Fedora policy, so we create # a clone binary and label as anacron_exec_t /usr/sbin/anacrond -- gen_context(system_u:object_r:anacron_exec_t,s0) /var/lock/subsys/anacron -- gen_context(system_u:object_r:system_crond_lock_t,s0) /var/spool/anacron(/.*)? gen_context(system_u:object_r:cron_spool_t,s0) [root@topaz ~]# [root@topaz ~]# cat /root/selinux.local/localanacron.te policy_module(localanacron,0.1.1) require { type system_crond_t; type system_crond_lock_t; type cron_spool_t; type crond_var_run_t; } ######################################## # # Anacron local policy # type anacron_exec_t; corecmd_executable_file(anacron_exec_t) # anacron transitions directly to system_crond_t, # rather than crond_t because it doesnt currently # perform a setexeccon internally init_daemon_domain(system_crond_t,anacron_exec_t) # Allow anacron to update spool files in /var/spool/anacron allow system_crond_t cron_spool_t:file create_file_perms; # This is to handle creation of files in /var/lock directory. (anacron) allow system_crond_t system_crond_lock_t:file create_file_perms; files_lock_filetrans(system_crond_t,system_crond_lock_t,file) # Allow anacron to write to /var/run/anacron.pid ifdef(`strict_policy',` allow system_crond_t crond_var_run_t:file create_file_perms; files_pid_filetrans(system_crond_t,crond_var_run_t,file) ') [root@topaz ~]# -- Ted Rule Director, Layer3 Systems Ltd W: http://www.layer3.co.uk/

2 2

Cron mail problem with FC6/strict
by Ted Rule 25 Jan '07

25 Jan '07

A little while ago, I found that anacron wasn't running correctly under FC6/strict, which led to me add a temporary fixup .te for its operation. Once I had that in place, I finally received the cron.daily and logwatch Emails every day shortly after bootup. With that in place, I recently took to leaving the machine powered overnight, which of course led to all the Cron jobs running via crond instead of anacron. Oddly, I noticed that the logwatch Email arrived, but NOT the cron.daily summary Email. Looking further, I found this odd avc: Jan 21 21:29:51 topaz kernel: audit(1169414991.423:988): avc: denied { entrypoint } for pid=4891 comm="crond" name="sendmail.sendmail" dev=hda6 ino=1313020 scontext=system_u:system_r:system_crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file i.e. the crond child process running in system_crond_t was apparently unable to run sendmail. Just to be curious, I added this permission: auditallow system_crond_t sendmail_exec_t:file execute and saw this: Jan 21 21:30:51 topaz kernel: audit(1169415051.521:993): avc: granted { execute } for pid=4909 comm="crond" name="sendmail.sendmail" dev=hda6 ino=1313020 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file Jan 21 21:30:51 topaz kernel: audit(1169415051.521:994): avc: denied { entrypoint } for pid=4909 comm="crond" name="sendmail.sendmail" dev=hda6 ino=1313020 i.e. crond was apparently allowed to execute sendmail but got caught with the 'entrypoint' denial slightly later on. As an added test, I created a per-minute Cron Job which itself invoked /bin/mail which in turn called sendmail and a few invocations of sleep (the sleeps just to make it slightly easier to read the process list changes). Jan 21 21:31:11 topaz kernel: audit(1169415071.651:996): avc: granted { execute } for pid=4938 comm="mail" name="sendmail.sendmail" dev=hda6 ino=1313020 scontext=system_u:system_r:system_crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file Jan 21 21:31:11 topaz kernel: audit(1169415071.651:997): avc: granted { read execute } for pid=4938 comm="sendmail" name="sendmail.sendmail" dev=hda6 ino=1313020 scontext=system_u:system_r:system_crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file Jan 21 21:31:51 topaz kernel: audit(1169415111.704:999): avc: granted { execute } for pid=4947 comm="crond" name="sendmail.sendmail" dev=hda6 ino=1313020 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file Jan 21 21:31:51 topaz kernel: audit(1169415111.704:1000): avc: denied { entrypoint } for pid=4947 comm="crond" name="sendmail.sendmail" dev=hda6 ino=1313020 scontext=system_u:system_r:system_crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file i.e. the call the sendmail from system_crond_t within the Cron job by something other than the crond binary itself worked Ok, but when crond tried to invoke, it just sulked. If I went to permissive mode the log was filled with avc's indicating that crond's direct invocation of sendmail failed to transition to system_mail_t, even though these two interface calls appear to exist in the policy: mta_send_mail(crond_t) mta_send_mail(system_crond_t) For both anacron and crond launched invocations of cron.daily/0logwatch, of course, logwatch itself invokes sendmail from logwatch_t, so the problem doesn't arise. I'm currently using selinux-policy-strict-2.4.6-27 I also tried adding this permission: allow system_crond_t sendmail_exec_t:file entrypoint but this didn't really help; crond:system_crond_t stubbornly refused to transition to system_mail_t. Since all the invocations from within Jobs running as system_crond_t and also from anacron running as system_crond_t invoked sendmail Ok, my presumption is that there's something in crond's own use of libselinux which is confusing matters and preventing Email's being created. Looking at the policy source a little bit more, mta_send_mail() calls domain_auto_trans() which in turn calls domain_trans(). Way back in FC4 policy, I can see that domain_trans()'s definition contains an entry that suggests I actually need to add allow system_mail_t sendmail_exec_t:file entrypoint since the entrypoint permission appears to take the child_domain's type as its first parameter, (which itself implies that the log entry is slightly awry, just to be confusing...): domain_trans(parent_domain, program_type, child_domain) ... allow $3 $2:file entrypoint; The FC6 policy source seems to have no automatic entrypoint permission within the domain_trans() definition but does have the domain_entry_file() interface. Just for fun, therefore, I tried adding this: domain_entry_file(system_mail_t, sendmail_exec_t) All to no avail, I'm afraid; I continue to be unable to get crond to directly execute sendmail. Can anyone enlighten me, please? -- Ted Rule Director, Layer3 Systems Ltd W: http://www.layer3.co.uk/ -- Ted Rule Director, Layer3 Systems Ltd W: http://www.layer3.co.uk/

2 2

Re: Worrying AVC messages
by Anne Wilson 25 Jan '07

25 Jan '07

On Monday 22 January 2007 19:40, Stephen Smalley wrote: > > type=AVC msg=audit(1162463326.809:49): avc: denied { search } for > > pid=4186 comm="postmap" name="nscd" dev=hdb1 ino=195773 > > scontext=user_u:system_r:postfix_map_t:s0 > > tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir > > type=SYSCALL msg=audit(1162463326.809:49): arch=40000003 syscall=102 > > success=no exit=-2 a0=3 a1=bf915688 a2=67eff4 a3=4 items=0 ppid=4147 > > pid=4186 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > > tty=pts5 comm="postmap" exe="/usr/sbin/postmap" > > subj=user_u:system_r:postfix_map_t:s0 key=(null) > > Yes, that shows the security contexts of the source (process) and the > target (in this case, a directory). audit2allow will turn those > messages into allow rules, e.g. > su - > audit2allow -a -M local > semodule -i local.pp > After reading the man pages I find that I'm no wiser as to what this is doing. I understand the first and last lines, but could you explain how you build the audit2allow line, and what it actually does? Thanks Anne

3 9

selinux and oracle
by bastard operater 25 Jan '07

25 Jan '07

I have a RHEL4U4 server that will become an Oracle 10gR2 server in three weeks. Almost all of the documentation I have seen about installing oracle on a selinux enabled server says to turn off selinux. Only 1 document said that oracle and selinux can function together. So can oracle and selinux play nice or do I have to turn it off? Thanks, Adam _________________________________________________________________ Find sales, coupons, and free shipping, all in one place! MSN Shopping Sales & Deals http://shopping.msn.com/content/shp/?ctid=198,ptnrid=176,ptnrdata=200639

3 9

[Fwd: Re: Access attempts]
by mantaray_1 24 Jan '07

24 Jan '07

3 4

Re: Worrying AVC messages
by Anne Wilson 23 Jan '07

23 Jan '07

On Monday 22 January 2007 19:40, Stephen Smalley wrote: > On Mon, 2007-01-22 at 18:59 +0000, Anne Wilson wrote: > > On Monday 22 January 2007 14:49, you wrote: > > > > Hi, Stephen. I'm very new to all this, so bear with me if I don't give > > you the right info first try :-) > > Why take discussion off-list? > Sorry - not intentional. A new folder in KMail, and I forgot to set up Mailing List Management. > > > You don't seem to have included the scontext, tcontext, and tclass > > > information, which is the real basis for the permission denial. > > > > > > You can also get supplemental information about each avc denial by > > > enabling system call auditing. Requires installing "audit" and adding > > > at least one audit rule to enable collection of the full audit context. > > > This will provide you with information like the system call number and > > > arguments, the path that has been looked up, etc. > > > > I have audit.log and I get logwatch messages, so I think audit is working > > properly. Where do I look to see if rules have been made? They would > > probably be defaults, as I'm sure I haven't made any myself. > > /sbin/auditctl -l will list any rules. auditctl man page will show you > some examples of rules, which you can apply manually via auditctl or by > putting into /etc/audit/audit.rules and re-starting auditd. Any rule > will suffice, as the goal is just to get the audit system to start > collecting information for use when an avc message happens; it used to > always do that proactively, but that caused performance issues, so they > disabled it when there are no audit rules in place. > Fine. I'll see what I can do with this. > > Is this the kind of info you need? > > > > type=AVC msg=audit(1162463326.809:49): avc: denied { search } for > > pid=4186 comm="postmap" name="nscd" dev=hdb1 ino=195773 > > scontext=user_u:system_r:postfix_map_t:s0 > > tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir > > type=SYSCALL msg=audit(1162463326.809:49): arch=40000003 syscall=102 > > success=no exit=-2 a0=3 a1=bf915688 a2=67eff4 a3=4 items=0 ppid=4147 > > pid=4186 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 > > tty=pts5 comm="postmap" exe="/usr/sbin/postmap" > > subj=user_u:system_r:postfix_map_t:s0 key=(null) > > Yes, that shows the security contexts of the source (process) and the > target (in this case, a directory). audit2allow will turn those > messages into allow rules, e.g. > su - > audit2allow -a -M local > semodule -i local.pp > Examples are always helpful :-) > > type=AVC msg=audit(1169487905.785:178): avc: denied { read } for > > pid=2965 comm="hald-addon-stor" name="hdc" dev=tmpfs ino=7065 > > scontext=system_u:system_r:hald_t:s0 > > tcontext=system_u:object_r:device_t:s0 tclass=blk_file > > type=SYSCALL msg=audit(1169487905.785:178): arch=40000003 syscall=5 > > success=yes exit=4 a0=96e1ac6 a1=8880 a2=0 a3=8880 items=0 ppid=2940 > > pid=2965 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > > fsgid=0 tty=(none) comm="hald-addon-stor" > > exe="/usr/libexec/hald-addon-storage" subj=system_u:system_r:hald_t:s0 > > key=(null) > > Question on this one is why this device node has a generic type > (device_t) rather than a specific one (e.g. removable_device_t). > I suspect that this is my video capture card, a pci card for use with an analogue camcorder. I had been trying to write udev rules to track video0 and video1, so that webcam and camcorder capture could always be found. The device is listed currently under video1. Udevinfo doesn't walk the sys tree for this card, the way it does for the webcam. Perhaps that's part of the puzzle? > > type=AVC msg=audit(1169489443.261:186): avc: denied { read } for > > pid=4482 comm="smartd" name="hda" dev=tmpfs ino=879 > > scontext=system_u:system_r:fsdaemon_t:s0 > > tcontext=system_u:object_r:device_t:s0 tclass=blk_file > > type=SYSCALL msg=audit(1169489443.261:186): arch=40000003 syscall=5 > > success=yes exit=3 a0=99c60a0 a1=800 a2=c3c490 a3=c42cae items=0 ppid=1 > > pid=4482 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > > fsgid=0 tty=(none) comm="smartd" exe="/usr/sbin/smartd" > > subj=system_u:system_r:fsdaemon_t:s0 key=(null) > > Likewise. > This I don't understand. I've seen messages like this for hdb as well. They are standard hdds. > > > audit2allow can be used to generate a local policy module to allow > > > permissions as appropriate; see its man page and the Fedora SELinux > > > FAQ. > > Thanks for the help so far. I'll catch up on the reading. Anne

1 0

Selinux, Oracle, DBD::Oracle, RHEL5B2
by Thomas J. Baker 22 Jan '07

22 Jan '07

I'm trying to set up a a mod_perl/oracle website on an RHEL5B2 system. I installed the oracle-xe-client rpm, DBD::Oracle, etc. Almost got everything working except for this selinux problem (http log error): [Thu Jan 18 14:01:31 2007] [error] [client xxx] install_driver(Oracle) failed: Can't load '/usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/auto/DBD/Oracle/Oracle.so' for module DBD::Oracle: libclntsh.so.10.1: cannot enable executable stack as shared object requires: Permission denied at /usr/lib/perl5/5.8.8/i386-linux-thread-multi/DynaLoader.pm line 230.\n at (eval 11) line 3\nCompilation failed in require at (eval 11) line 3.\nPerhaps a required shared library or dll isn't installed where expected\n at /web1/perl/Lib/Layout2/Core/Initializer.pm line 191\n\t(in cleanup) Can't call method "disconnect" on an undefined value at /web1/perl/Lib/Layout2/Core/Initializer.pm line 206.\n I've tried turning off execstack on the affected oracle shared libs but that didn't work. First I turned it off on libclntsh.so.10.1 but got the same error about libnnz10.so so I turned it off on that. Then I got [Thu Jan 18 14:06:29 2007] [error] [client xxx] install_driver(Oracle) failed: Can't load '/usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/auto/DBD/Oracle/Oracle.so' for module DBD::Oracle: /usr/lib/oracle/xe/app/oracle/product/10.2.0/client/lib/libnnz10.so: cannot restore segment prot after reloc: Permission denied at /usr/lib/perl5/5.8.8/i386-linux-thread-multi/DynaLoader.pm line 230.\n at (eval 11) line 3\nCompilation failed in require at (eval 11) line 3.\nPerhaps a required shared library or dll isn't installed where expected\n at /web1/perl/Lib/Layout2/Core/Initializer.pm line 191\n\t(in cleanup) Can't call method "disconnect" on an undefined value at /web1/perl/Lib/Layout2/Core/Initializer.pm line 206.\n Turning on allow_exec{mem,mod,heap} didn't help. I should add that turning off enforcing makes everything work. Is there any type I can label the oracle libs so this works? Thanks, tjb -- ======================================================================= | Thomas Baker email: tjb(a)unh.edu | | Systems Programmer | | Research Computing Center voice: (603) 862-4490 | | University of New Hampshire fax: (603) 862-1761 | | 332 Morse Hall | | Durham, NH 03824 USA http://wintermute.sr.unh.edu/~tjb | =======================================================================

3 5

Worrying AVC messages
by Anne Wilson 22 Jan '07

22 Jan '07

I'm seeing a lot of AVC message, a sample of which is type=AVC msg=audit(1162463326.809:49): avc: denied { search } for pid=4186 comm="postmap" name="nscd" dev=hdb1 ino=195773 type=AVC msg=audit(1162483288.034:31): avc: denied { write } for pid=5804 comm="ip" name="[23145]" dev=pipefs ino=23145 type=AVC msg=audit(1162483738.762:39): avc: denied { write } for pid=7191 comm="ip" name="[27659]" dev=pipefs ino=27659 type=AVC msg=audit(1169284673.188:58): avc: denied { ioctl } for pid=4212 comm="smartd" name="hda" dev=tmpfs ino=879 type=AVC msg=audit(1162495544.436:62): avc: denied { write } for pid=28024 comm="setfiles" name="[120832]" dev=pipefs ino=120832 type=AVC_PATH msg=audit(1169310171.523:150): path="/dev/bus/usb/001/004" type=AVC msg=audit(1169310172.778:151): avc: denied { read } for pid=2996 comm="hald-addon-stor" name="hdd" dev=tmpfs ino=7431 I don't really understand what is going on. 'postmap' to me implies postfix, which seems odd. There are many such messages about smartd. This is something I'd want to be working. Why is this blocked? Can/Should I enable it? How? I looked at /dev/bus/usb/001/004 but I can't tell what this is. I'm guessing that it's a card-reader, but it's sheer guesswork. I'd be glad of any hints. SELinux hasn't really caused me any problems up to now, but one of my projects, which I'll address in a later thread, may be being blocked, so I need to start to understand more. Thanks Anne

2 1

pidof -c fails under FC6/strict
by Ted Rule 20 Jan '07

20 Jan '07

There appears to be a generic problem with "pidof -c" under SELinux enforcing which has the side-effect of confusing some of the init.d scripts. In particular, the following services - at least - fail to shut down or report status cleanly: acpid hidd vsftpd smartd autofs mcstrans syslog-ng ( but not syslogd .. ) The common feature is that these daemons lack a corresponding /var/run/<daemonname>.pid; in the case of syslog-ng, of course, the real pid has the "wrong" name. During shutdown, /etc/init.d/functions:killproc() searches for the pidfile, and if it fails to find one, it searches for a pid with a matching exec name via the __pids_pidof() function. ... # Output PIDs of matching processes, found using pidof __pids_pidof() { pidof -c -o $$ -o $PPID -o %PPID -x "$1" || \ pidof -c -o $$ -o $PPID -o %PPID -x "${1##*/}" } ... When invoked in SELinux permissive, all is well, and the correct pid is located, but under enforcing, ( selinux-policy-strict-2.4.6-27 in my case), "pidof -c" returns a null string. This in turn, causes killproc to assume that the service is dead. FWIW, FC4/strict/enforcing is Ok where pidof has a -c option, whilst RHEL4 doesn't appear to have a -c option to pidof anyway. The latest pidof appears to use readlink() to compare the value of /proc/<pid>/exe for any matching pids - older pidof's used stat(). Needless to say, logs don't show any AVC's when I try to run the rogue pidof calls. By way of example, one can read the basic process list from sysadm_t, and then show that pidof -c -x fails where pidof -x works. Similarly, I've used run_init to emulate the behaviour of the boot scripts running pidof: [root@topaz ~]# ps axZ | grep smartd system_u:system_r:fsdaemon_t 2871 ? S 0:00 /usr/sbin/smartd -q never staff_u:sysadm_r:sysadm_t 3375 pts/0 R+ 0:00 grep smartd [root@topaz ~]# [root@topaz ~]# pidof -x /usr/sbin/smartd 2871 [root@topaz ~]# pidof -x smartd 2871 [root@topaz ~]# [root@topaz ~]# pidof -c -x /usr/sbin/smartd [root@topaz ~]# pidof -c -x smartd [root@topaz ~]# run_init pidof -c -x /usr/sbin/smartd Authenticating root. Password: [root@topaz ~]# [root@topaz ~]# run_init pidof -x /usr/sbin/smartd Authenticating root. Password: 2871 [root@topaz ~]# As a variant on these tests, I've tried to directly ls and readlink the exe in question; ls fails to read the symlink and errors, whilst readlink silently returns with a null. [root@topaz ~]# ls -ldZ /proc/2871/exe ls: cannot read symbolic link /proc/2871/exe: Permission denied lrwxrwxrwx root root system_u:system_r:fsdaemon_t /proc/2871/exe [root@topaz ~]# run_init ls -ldZ /proc/2871/exe Authenticating root. Password: lrwxrwxrwx root root system_u:system_r:fsdaemon_t /proc/2871/exe [root@topaz ~]# [root@topaz ~]# run_init ls -lZ /proc/2871/exe Authenticating root. Password: ls: /proc/2871/exe: Permission denied [root@topaz ~]# readlink /proc/2871/exec [root@topaz ~]# [root@topaz ~]# run_init readlink /proc/2871/exec Authenticating root. Password: [root@topaz ~]# As a workround for the present, I've simply removed the -c option from /etc/init.d/functions:__pids_pidof() I'm currently running: selinux-policy-strict-2.4.6-27.fc6 kernel-2.6.18-1.2869 SysVinit-2.86-14 Should this be logged as a bug under SELinux policy or SysVinit? Does this bug affect targeted policy as well? Is there some simple extra permission which could be granted to initrc_t and sysadm_t which would let them perform readlink /proc/<pid>/exe, and hence pidof -c ? -- Ted Rule Director, Layer3 Systems Ltd W: http://www.layer3.co.uk/

3 3

Another syslog issue (disable_syslogd_trans interaction)
by Steve Friedman 17 Jan '07

17 Jan '07

Another problem that I just discovered with syslog is, with syslogd_disable_trans=1, /dev/log is labelled device_t and not dev_log_t (thus breaking a number of other apps). I discovered this with syslog-ng, but suspect that it will be the same with syslog. (This was BZ'ed as 222195.) Steve Friedman

1 0

Trouble with syslogd and named
by Harley Race 17 Jan '07

17 Jan '07

I am using the bind-chroot package in FC6 and am tying to get named in the chroot to log queries and named activity to /var/log/named/named.log (outside of the chroot) via a logging device in the chroot /dev/log. Selinux is preventing syslogd from creating the device and genereating the following errors: type=AVC msg=audit(1168359275.971:7): avc: denied { search } for pid=1587 comm="syslogd" name="named" dev=dm-3 ino=10704673 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:name d_zone_t:s0 tclass=dir type=SYSCALL msg=audit(1168359275.971:7): arch=40000003 syscall=10 success=no exit=-13 a0=bfcacf08 a1=1b6 a2=c1e120 a3=bfcab31c items=0 ppid=1586 pid=1587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 f suid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="syslogd" exe="/sbin/syslogd" subj=system_u:system_r:syslogd_t:s0 key=(null) type=AVC msg=audit(1168359275.995:8): avc: denied { search } for pid=1587 comm="syslogd" name="named" dev=dm-3 ino=10704673 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:name d_zone_t:s0 tclass=dir type=SYSCALL msg=audit(1168359275.995:8): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=bfca8ec0 a2=c1e120 a3=bfcab31c items=0 ppid=1586 pid=1587 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fs uid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="syslogd" exe="/sbin/syslogd" subj=system_u:system_r:syslogd_t:s0 key=(null) I suppose I could use audit2allow to allow this, but am wondering why the policy was changed from FC4 to disable this. ____________________________________________________________________________________ The fish are biting. Get more visitors on your site using Yahoo! Search Marketing. http://searchmarketing.yahoo.com/arp/sponsoredsearch_v2.php

3 7

sparc64 kernel won't boot with selinux enabled
by Tom Callaway 16 Jan '07

16 Jan '07

I'm working on Aurora, which is a rebuild of Fedora Core for SPARC. Lately, I've been testing with selinux enabled on the targeted policy, but I haven't gotten very far. When I try to boot on a sparc64, I get the following (copied by hand, apologies for any typos, I tried to be accurate): EXT3-fs: mounted filesystem with ordered data mode. audit(1168807648.026:2): enforcing=1 old_enforcing=0 auid=4294967295 security: 3 users, 6 roles, 1584 types, 172 bools, 1 sens, 1024 cats security: 59 classes, 49650 rules security: class dccp_socket not defined in policy security: permission dccp_recv in class node not defined in policy security: permission dccp_send in class node not defined in policy security: permission dccp_recv in class netif not defined in policy security: permission dccp_send in class netif not defined in policy SELinux: Completing initialization SELinux: Setting up existing superblocks. SELinux: initialized (dev dm-0, type ext3), uses xattr SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts SELinux: initialized (dev mqueue, type mqueue), uses transition SIDs SELinux: initialized (dev hugetlbfs, type hugetlbfs), uses genfs_contexts SELinux: initialized (dev devpts, type devpts), uses transition SIDs SELinux: initialized (dev eventpollfs, type eventpollfs), uses task SIDs SELinux: initialized (dev inotifyfs, type inotifyfs), uses genfs_contexts SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs SELinux: initialized (dev futexfs, type futexfs), uses genfs_contexts SELinux: initialized (dev pipefs, type pipefs), uses task SIDs SELinux: initialized (dev sockfs, type sockfs), uses task SIDs SELinux: initialized (dev proc, type proc), uses genfs_contexts SELinux: initialized (dev bdev, type bdev), uses genfs_contexts SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts audit(1168807652.930:3): policy loaded auid=4294967295 audit(1168807653.174:4): avc: denied { execmem } for pid=1 comm="init" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process ...And there it sits, as init is denied. :) I found this thread (http://www.redhat.com/archives/fedora-selinux-list/2005-April/msg00037.html) while looking through google for other cases of this error message, and I looked through bugzilla 149819. The sparc64 kernel has CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1, and I tried booting with "checkreqprot=0", but it does not change the result. Booting with selinux=permissive works fine. I booted as selinux=permissive and ran fixfiles relabel, but again, no change seen. Here are the relevant versions of packages which I have installed: kernel-2.6.19-1.2906.al3.4.sparc64.rpm libselinux-1.33.4-2.al3.sparc.rpm libsemanage-1.9.2-1.al3.sparc.rpm libsepol-1.15.3-1.al3.sparc.rpm checkpolicy-1.33.1-2.al3.sparc.rpm policycoreutils-1.33.12-2.al3.sparc.rpm selinux-policy-2.4.6-21.al3.noarch.rpm For obvious reasons (Aurora, like Fedora, enables selinux by default), I'd like to get this fixed. Any ideas where I should go from here? Thanks in advance, ~spot

3 2

Oddity in evolution.if in selinux-policy-devel-2.4.6-23.fc6.noarch.rpm
by Ted Rule 15 Jan '07

15 Jan '07

The recently released devel rpm, selinux-policy-devel-2.4.6-23.fc6.noarch.rpm, appears to contain an odd 'corruption' in the evolution.if file, viz: /usr/share/selinux/devel/include/apps/evolution.if The end of the interface file contains this set of allow statements: allow staff_evolution_alarm_t staff_t:fifo_file { getattr write }; allow staff_evolution_alarm_t staff_t:unix_stream_socket connectto; allow staff_evolution_alarm_t staff_tmp_t:dir { add_name getattr search setattr write }; allow staff_evolution_alarm_t staff_tmp_t:file { getattr lock read write }; allow staff_evolution_alarm_t staff_tmp_t:sock_file { create write }; allow staff_evolution_alarm_t tmp_t:dir read; allow staff_evolution_exchange_t staff_t:fd use; allow staff_evolution_exchange_t staff_t:fifo_file { getattr write }; allow staff_evolution_exchange_t staff_tmp_t:dir { add_name getattr search setattr write }; allow staff_evolution_exchange_t staff_tmp_t:file { getattr lock read write }; allow staff_evolution_exchange_t staff_tmp_t:sock_file { create write }; allow staff_evolution_server_t staff_t:fifo_file { getattr write }; allow staff_evolution_server_t staff_t:unix_stream_socket connectto; allow staff_evolution_server_t staff_tmp_t:dir { add_name getattr search setattr write }; allow staff_evolution_server_t staff_tmp_t:file { getattr lock read write }; allow staff_evolution_server_t staff_tmp_t:sock_file { create write }; allow staff_evolution_server_t tmp_t:dir { getattr read search }; allow staff_evolution_t default_t:lnk_file read; I had previously downloaded the .23 rpm from the testing area, but I only noticed this today whilst I was trying to build a module to rebuild my anacron module tweak against the .23 policy, and got this error message: [root selinux.local]# make localanacron.pp Compiling strict localanacron module /usr/bin/checkmodule: loading policy configuration from tmp/localanacron.tmp tmp/all_interfaces.conf:7820:ERROR 'syntax error' at token 'allow' on line 3871: allow staff_evolution_alarm_t staff_t:fifo_file { getattr write }; /usr/bin/checkmodule: error(s) encountered while parsing configuration make: *** [tmp/localanacron.mod] Error 1 [root@topaz selinux.local]# [root ~]# The error message corresponds to the first rogue line in the interface file; once I'd commented out all the lines, my new module compiled Ok. I checked for any other rogue 'allow' lines in the other interface definitions, but this appears to be the only set of oddities. I made a cursory check elsewhere, and the 2.4.6-21.fc7 policy-devel appears to have the same corruption, whilst the previous stable fc6 rpm, 2.4.6-17.fc6, doesn't. I've also created BZ #222548 containing these notes. -- Ted Rule Director, Layer3 Systems Ltd W: http://www.layer3.co.uk/

2 2

[Fwd: Re: sparc64 kernel won't boot with selinux enabled]
by Karl MacMillan 15 Jan '07

15 Jan '07

[Forwarding to the correct list this time] Tom 'spot' Callaway wrote: > I'm working on Aurora, which is a rebuild of Fedora Core for SPARC. > Lately, I've been testing with selinux enabled on the targeted policy, > but I haven't gotten very far. When I try to boot on a sparc64, I get > the following (copied by hand, apologies for any typos, I tried to be > accurate): > [CC'ing selinux list] > EXT3-fs: mounted filesystem with ordered data mode. > audit(1168807648.026:2): enforcing=1 old_enforcing=0 auid=4294967295 > security: 3 users, 6 roles, 1584 types, 172 bools, 1 sens, 1024 cats > security: 59 classes, 49650 rules > security: class dccp_socket not defined in policy > security: permission dccp_recv in class node not defined in policy > security: permission dccp_send in class node not defined in policy > security: permission dccp_recv in class netif not defined in policy > security: permission dccp_send in class netif not defined in policy Seems that there is a mismatch between your policy and the kernel. > SELinux: Completing initialization > SELinux: Setting up existing superblocks. > SELinux: initialized (dev dm-0, type ext3), uses xattr > SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs > SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts > SELinux: initialized (dev selinuxfs, type selinuxfs), uses > genfs_contexts > SELinux: initialized (dev mqueue, type mqueue), uses transition SIDs > SELinux: initialized (dev hugetlbfs, type hugetlbfs), uses > genfs_contexts > SELinux: initialized (dev devpts, type devpts), uses transition SIDs > SELinux: initialized (dev eventpollfs, type eventpollfs), uses task SIDs > SELinux: initialized (dev inotifyfs, type inotifyfs), uses > genfs_contexts > SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs > SELinux: initialized (dev futexfs, type futexfs), uses genfs_contexts > SELinux: initialized (dev pipefs, type pipefs), uses task SIDs > SELinux: initialized (dev sockfs, type sockfs), uses task SIDs > SELinux: initialized (dev proc, type proc), uses genfs_contexts > SELinux: initialized (dev bdev, type bdev), uses genfs_contexts > SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts > SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts > audit(1168807652.930:3): policy loaded auid=4294967295 > audit(1168807653.174:4): avc: denied { execmem } for pid=1 > comm="init" scontext=system_u:system_r:kernel_t:s0 > tcontext=system_u:system_r:kernel_t:s0 tclass=process > > ...And there it sits, as init is denied. :) > Init requiring execmem is surprising to say the least - it certainly doesn't on i386. Are you seeing a lot of execmem denials in the logs? I don't really know what is going on, but there is likely a kernel or compiler / toolchain issue causing overly broad execmem requests. As a work around you can do (after booting into permissive): setsebool -P allow_execmem=1 The next reboot will allow this globally and you may get farther in permissive. You can also change this default in the policy packages. Karl -- fedora-selinux-list mailing list fedora-selinux-list(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list

1 0

FlashPlayer 9 Beta refuses to process some Flash content with SELinux enforcing
by Temlakos 15 Jan '07

15 Jan '07

Everyone: Has anyone noticed SELinux to refuse permissions to the Flash Player plug-in (or standalone)? And while I'm on the subject: How might I clear one particular application to do something weird, without having to grant such clearance to every such application? For example: VideoLAN Client needs permission to make its memory stack executable. How can I grant such permission to vlc alone and not across the board? Temlakos

2 1

Postgres directory context
by James Young 15 Jan '07

15 Jan '07

Does selinux check context on the whole directory hierarchy when making a decision about permission to enter a directory? That is, when I try to access /home/Data/pgsql, will it check the context on /home, then /home/Data, and then on /home/Data/pgsql? Or will it only check the context on /home/Data/pgsql? I want to put a Postgres database in a /home/Data/pgsql/data directory, but the initrc script will not run it there. I can run it as the postgres user. The contexts mirror the /var/lib/pgsql/data directory: user_u:object_r:postgres_db_t. The context of /home/Data/pgsql is system_u:object_r:var_lib_t. It does run fine with initrc in /var/lib/pgsql. When I leave the pgstartup.log in /var/lib/pgsql, I see the errors below. It doesn't matter whether the database is already initialized or not. The contexts for the /home/Data/pgsql directory are listed below as well. /home/Data is system_u:object_r:user_home_dir_t. I don't see anything in /var/log/audit/audit.log, but I think dontaudit rules may be in effect. Does Fedora use the reference policy from Tresys exactly? If not, where can I find the source policy for Fedora. All I can find are the if files. Finally, are there any better references for selinux. Everything I've read seems dated. Thanks, Jim Young pgstartup.log: ------------------------- could not change directory to "/home/Data/pgsql" initdb: could not access directory "/home/Data/pgsql/data": Permission denied The files belonging to this database system will be owned by user "postgres". This user must also own the server process. The database cluster will be initialized with locale en_US.UTF-8. The default database encoding has accordingly been set to UTF8. postmaster cannot access the server configuration file "/home/Data/pgsql/data/postgresql.conf": Permission denied could not change directory to "/home/Data/pgsql" initdb: could not access directory "/home/Data/pgsql/data": Permission denied The files belonging to this database system will be owned by user "postgres". This user must also own the server process. The database cluster will be initialized with locale en_US.UTF-8. The default database encoding has accordingly been set to UTF8. postmaster cannot access the server configuration file "/home/Data/pgsql/data/postgresql.conf": Permission denied ----------- directory contexts: ------------------------------- ls -Zd /home/Data/pgsql drwx------ postgres postgres system_u:object_r:var_lib_t /home/Data/pgsql ls -Z /home/Data/pgsql drwx------ postgres postgres system_u:object_r:var_lib_t backups drwx------ postgres postgres system_u:object_r:postgresql_db_t data -rw------- postgres postgres system_u:object_r:postgresql_log_t pgstartup.log ls -Z /home/Data/pgsql/data drwx------ postgres postgres user_u:object_r:postgresql_db_t base drwx------ postgres postgres user_u:object_r:postgresql_db_t global drwx------ postgres postgres user_u:object_r:postgresql_db_t pg_clog -rw------- postgres postgres user_u:object_r:postgresql_db_t pg_hba.conf -rw------- postgres postgres user_u:object_r:postgresql_db_t pg_ident.conf drwx------ postgres postgres user_u:object_r:postgresql_db_t pg_log drwx------ postgres postgres user_u:object_r:postgresql_db_t pg_multixact drwx------ postgres postgres user_u:object_r:postgresql_db_t pg_subtrans drwx------ postgres postgres user_u:object_r:postgresql_db_t pg_tblspc drwx------ postgres postgres user_u:object_r:postgresql_db_t pg_twophase -rw------- postgres postgres user_u:object_r:postgresql_db_t PG_VERSION drwx------ postgres postgres user_u:object_r:postgresql_db_t pg_xlog -rw------- postgres postgres user_u:object_r:postgresql_db_t postgresql.conf -rw------- postgres postgres user_u:object_r:postgresql_db_t postmaster.opts

2 2

Access attempts
by mantaray_1 13 Jan '07

13 Jan '07

I was hoping someone could help me to understand what might be happening to trigger the access attempts I am blocking with my policy which are listed below. They only seem to appear when I am logged in to the "Blackboard" program at the university I attend. I have already taken several steps to limit what my browser can do, and I do not understand how it can trigger such attempts. ********************** ********************** Jan 11 15:39:17 schoolhost kernel: audit(1168555157.756:587): avc: denied { rawip_send } for saddr=192.168.0.2 src=60945 daddr=129.219.10.40 dest=443 netif=eth0 scontext=system_u:system_r:kernel_t:s15:c0.c255 tcontext=system_u:object_r:netif_eth0_t:s0-s15:c0.c255 tclass=netif Jan 11 15:39:17 schoolhost kernel: audit(1168555157.992:588): avc: denied { rawip_send } for saddr=192.168.0.2 src=60945 daddr=129.219.10.40 dest=443 netif=eth0 scontext=system_u:system_r:kernel_t:s15:c0.c255 tcontext=system_u:object_r:netif_eth0_t:s0-s15:c0.c255 tclass=netif Jan 11 15:39:18 schoolhost kernel: audit(1168555158.212:590): avc: denied { rawip_send } for saddr=192.168.0.2 src=45910 daddr=129.219.10.30 dest=443 netif=eth0 scontext=system_u:system_r:kernel_t:s15:c0.c255 tcontext=system_u:object_r:netif_eth0_t:s0-s15:c0.c255 tclass=netif Jan 11 15:39:19 schoolhost kernel: audit(1168555159.433:600): avc: denied { rawip_send } for pid=2465 comm="X" saddr=192.168.0.2 src=60945 daddr=129.219.10.40 dest=443 netif=eth0 scontext=system_u:system_r:kernel_t:s15:c0.c255 tcontext=system_u:object_r:netif_eth0_t:s0-s15:c0.c255 tclass=netif ********************** ********************** Thanks in advance, Ken.

1 0

more setroubleshoot troubles ;)
by Tom London 12 Jan '07

12 Jan '07

Running latest rawhide, targeted enforcing. Installing latest python-libs (fixes execstack issue in _ctypes.so) other packages, and rebooting, I get the following AVCs: type=AVC msg=audit(1167943082.579:7): avc: denied { execute } for pid=2331 comm="sh" name="ldconfig" dev=dm-0 ino=11337788 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=SYSCALL msg=audit(1167943082.579:7): arch=40000003 syscall=11 success=no exit=-13 a0=91d4dd8 a1=91d4e58 a2=91d4330 a3=0 items=0 ppid=2330 pid=2331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sh" exe="/bin/bash" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC msg=audit(1167943082.646:8): avc: denied { getattr } for pid=2331 comm="sh" name="ldconfig" dev=dm-0 ino=11337788 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=SYSCALL msg=audit(1167943082.646:8): arch=40000003 syscall=195 success=no exit=-13 a0=91d4dd8 a1=bfcbee10 a2=47818ff4 a3=0 items=0 ppid=2330 pid=2331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sh" exe="/bin/bash" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC_PATH msg=audit(1167943082.646:8): path="/sbin/ldconfig" type=AVC msg=audit(1167943082.647:9): avc: denied { getattr } for pid=2331 comm="sh" name="ldconfig" dev=dm-0 ino=11337788 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=SYSCALL msg=audit(1167943082.647:9): arch=40000003 syscall=195 success=no exit=-13 a0=91d4dd8 a1=bfcbed30 a2=47818ff4 a3=91d4dd8 items=0 ppid=2330 pid=2331 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sh" exe="/bin/bash" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC_PATH msg=audit(1167943082.647:9): path="/sbin/ldconfig" type=AVC msg=audit(1167943082.756:10): avc: denied { execute_no_trans } for pid=2340 comm="ldd" name="ld-2.5.90.so" dev=dm-0 ino=7209012 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:ld_so_t:s0 tclass=file type=SYSCALL msg=audit(1167943082.756:10): arch=40000003 syscall=11 success=no exit=-13 a0=8196308 a1=8196988 a2=819cd48 a3=40 items=0 ppid=2339 pid=2340 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ldd" exe="/bin/bash" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC_PATH msg=audit(1167943082.756:10): path="/lib/ld-2.5.90.so" type=AVC msg=audit(1167943082.758:11): avc: denied { write } for pid=2253 comm="setroubleshootd" name="tmp" dev=dm-0 ino=2686977 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1167943082.758:11): arch=40000003 syscall=5 success=no exit=-13 a0=88b4970 a1=280c2 a2=180 a3=280c2 items=0 ppid=1 pid=2253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC msg=audit(1167943082.759:12): avc: denied { write } for pid=2253 comm="setroubleshootd" name="tmp" dev=dm-0 ino=65540 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1167943082.759:12): arch=40000003 syscall=5 success=no exit=-13 a0=8921b50 a1=280c2 a2=180 a3=280c2 items=0 ppid=1 pid=2253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC msg=audit(1167943082.759:13): avc: denied { write } for pid=2253 comm="setroubleshootd" name="tmp" dev=dm-0 ino=65540 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1167943082.759:13): arch=40000003 syscall=5 success=no exit=-13 a0=8921b50 a1=280c2 a2=180 a3=280c2 items=0 ppid=1 pid=2253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC msg=audit(1167943082.760:14): avc: denied { unlink } for pid=2253 comm="setroubleshootd" name="Yp9cip" dev=dm-0 ino=164238 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file type=SYSCALL msg=audit(1167943082.760:14): arch=40000003 syscall=10 success=no exit=-13 a0=88c80c0 a1=1 a2=ae50b4 a3=874f1b0 items=0 ppid=1 pid=2253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC msg=audit(1167943082.765:15): avc: denied { execute } for pid=2342 comm="sh" name="ldconfig" dev=dm-0 ino=11337788 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=SYSCALL msg=audit(1167943082.765:15): arch=40000003 syscall=11 success=no exit=-13 a0=8bd4dd8 a1=8bd4e58 a2=8bd4330 a3=0 items=0 ppid=2341 pid=2342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sh" exe="/bin/bash" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC msg=audit(1167943082.765:16): avc: denied { getattr } for pid=2342 comm="sh" name="ldconfig" dev=dm-0 ino=11337788 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=SYSCALL msg=audit(1167943082.765:16): arch=40000003 syscall=195 success=no exit=-13 a0=8bd4dd8 a1=bfa425c0 a2=47818ff4 a3=0 items=0 ppid=2341 pid=2342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sh" exe="/bin/bash" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC_PATH msg=audit(1167943082.765:16): path="/sbin/ldconfig" type=AVC msg=audit(1167943082.766:17): avc: denied { getattr } for pid=2342 comm="sh" name="ldconfig" dev=dm-0 ino=11337788 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file type=SYSCALL msg=audit(1167943082.766:17): arch=40000003 syscall=195 success=no exit=-13 a0=8bd4dd8 a1=bfa424e0 a2=47818ff4 a3=8bd4dd8 items=0 ppid=2341 pid=2342 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sh" exe="/bin/bash" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC_PATH msg=audit(1167943082.766:17): path="/sbin/ldconfig" type=AVC msg=audit(1167943082.782:18): avc: denied { execute_no_trans } for pid=2345 comm="ldd" name="ld-2.5.90.so" dev=dm-0 ino=7209012 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:ld_so_t:s0 tclass=file type=SYSCALL msg=audit(1167943082.782:18): arch=40000003 syscall=11 success=no exit=-13 a0=84f4308 a1=84f4988 a2=84fad48 a3=40 items=0 ppid=2344 pid=2345 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ldd" exe="/bin/bash" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC_PATH msg=audit(1167943082.782:18): path="/lib/ld-2.5.90.so" type=AVC msg=audit(1167943082.784:19): avc: denied { write } for pid=2253 comm="setroubleshootd" name="tmp" dev=dm-0 ino=2686977 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1167943082.784:19): arch=40000003 syscall=5 success=no exit=-13 a0=88c9600 a1=280c2 a2=180 a3=280c2 items=0 ppid=1 pid=2253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC msg=audit(1167943082.785:20): avc: denied { write } for pid=2253 comm="setroubleshootd" name="tmp" dev=dm-0 ino=65540 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1167943082.785:20): arch=40000003 syscall=5 success=no exit=-13 a0=8921b50 a1=280c2 a2=180 a3=280c2 items=0 ppid=1 pid=2253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC msg=audit(1167943082.786:21): avc: denied { write } for pid=2253 comm="setroubleshootd" name="tmp" dev=dm-0 ino=65540 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=dir type=SYSCALL msg=audit(1167943082.786:21): arch=40000003 syscall=5 success=no exit=-13 a0=8921b50 a1=280c2 a2=180 a3=280c2 items=0 ppid=1 pid=2253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) type=AVC msg=audit(1167943082.787:22): avc: denied { unlink } for pid=2253 comm="setroubleshootd" name="PRdzmq" dev=dm-0 ino=164259 scontext=system_u:system_r:setroubleshootd_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file type=SYSCALL msg=audit(1167943082.787:22): arch=40000003 syscall=10 success=no exit=-13 a0=88d22a0 a1=1 a2=ae50b4 a3=874f1b0 items=0 ppid=1 pid=2253 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="setroubleshootd" exe="/usr/bin/python" subj=system_u:system_r:setroubleshootd_t:s0 key=(null) tom -- Tom London

2 5

Re: SE Linux preventing mounting an iso on FC5 through nfs
by Matthew Shapiro 12 Jan '07

12 Jan '07

>>> Stephen Smalley <sds(a)tycho.nsa.gov> 01/11/07 3:07 PM >>> >audit2allow -M local < /var/log/messages >semodule -i local.pp Wow that makes life simple. Thanks a lot! >Did you look at the Fedora SELinux FAQ and wiki pages? >http://fedora.redhat.com/docs/selinux-faq-fc5/ >http://fedoraproject.org/wiki/SELinux/ Actually I did not know about these (the HOWTO's I found was a policy HOWTO and a general (focused on debian) SELinux introduction). This look like great resources though. > Are you actually using strict policy? It isn't the default in Fedora. Ah that explains it. I actually got confused with the versions (installed the strict src from fc3 by accident, targeted wouldn't install) and that explains why my last attempt didn't work. I confirmed and it is setup to use targeted. Though the loadable modules that I now know about make doing this much easier anyways. >nfs_t is a file type, not a process domain, and you want to allow >mount_t to read nfs_t:file, not transition into it. Gotcha. From the documentation I read it made it seem like the _t denoted a domain. Guess I have some more reading to do to fully understand everything that is going on. Thanks for your help and quick response! It's now working, and I"m going to do some more research to learn more about SE Linux now that I'm not fighting with it :) --Matthew Shapiro

2 1

SE Linux preventing mounting an iso on FC5 through nfs
by Matthew Shapiro 12 Jan '07

12 Jan '07

Hey all, A SE Linux newbie here. I am trying to learn SE Linux to fix this one issue we are having on our servers and I was hoping someone here might be able to give me some insight into the problem and tell me if I am following the correct line of thinking or not. We have FC5 systems with an automount point that mounts a directory on our main server for the cluster. Inside this mountpoint are some directories, which contain a list of rpms. Each of these rpms is really just a symlink to another automount point that automounts a certain Fedora Core iso image which really contains the real rpm. This makes it really easy to install the rpms without having to scour all four FC5 cds manually. The problem is that SE Linux doesn't seem to want us to mount the iso image automatically from nfs. When I directly use the mount command on the iso it mounts perfectly fine, but when I try to have the automounter mount it, it fails with the following error in /var/log/messages: avc: denied { read } for pid=1709 comm="mount" name="FC3-i386-disc1.iso" dev=0:17 no=1188825 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=file After reading various SE Linux HOWTO's and pieces of documentation what it looks like to me (a SE Linux newbie) is that the mount_t domain does not have access to read files under the nfs_t domain security context. So after various reading I thought all I would have to do is create a domain transition from the mount_t domain to the nfs_t domain. I created the file /etc/selinux/strict/src/policy/domains/misc/mmae.te and added the following line: domain_auto_trans(mount_t, mount_exec_t, nfs_t) Unfortunatly, when I did a make load I got the following two errors assertion on line 226661 violated by allow nfs_t mount_t:process { sigchld }; assertion on line 226508 violated by allow mount_t nfs_t:process { transition }; Line 226661 of policy.conf contains neverallow ~{ domain unlabeled_t } *:process *; and line 226508 of policy.conf contains neverallow domain ~domain:process transition; Unfortunatly, with my limited knowledge in SE Linux I am unsure of what is wrong with my statement, why it violates those two rules, what those two rules really mean and even if I am following the correct path. I also tried to switch mount_t and nfs_t in the domain_auto_trans function which resulted in the same assertions. Finally, I decided to take a stab in the dark and try a different approach without dealing with domains. The only information I could deduce from those previous error messages were that one of those was not an actual domain. After looking at various entries in the policy.conf I commented out the domain transition and instead put in: allow mount_t nfs_t:file { read }; thinking that this would allow processes in the mount_t security context to read files in the nfs_t context. I then ran make load, which didn't give any hassle, looked in the policy.conf to make sure it was listed in there (which it was), and tried again. It still gave the original error. After reading various threads on mailing lists (found through google) I decided to try giving the main directory a different security context so it wasn't in the nfs_t domain. So I edited the /etc/auto.misc entry for the original mountpoint to include context=system_u:object_r:tmp_t, which failed with the message: SELinux: security_context_to_sid(system_u:object_r/tmp_t) failed for (dev 0:17, type nfs) errno=-22 which I am guessing means it doesn't have access to change security contexts. I am really stumped as to how to proceed from here. If anyone could give me any advice I would really appreciate it. Thanks --Matthew Shapiro

2 1

Problem with label on /
by Adam Huffman 11 Jan '07

11 Jan '07

Rather unwisely I followed through some advice from setroubleshootd on a new FC6 test system without thinking through the implications. It advised me to run: chcon -R -t xen_image_t / because xend was having some trouble with virtual disk files. This had some interesting consequences, most of which I have been able to fix via relabelling. However, there are still errors being reported for various daemons. E.g. SELinux is preventing /usr/sbin/cupsd (cupsd_t) "search" access to / (xen_image_t). Is there any way of fixing this? Adam

3 6

cricket grapher.cgi
by Chuck Anderson 11 Jan '07

11 Jan '07

I'm trying to get cricket (cricket.sf.net) to work on FC6 with SELinux targeted enforcing. I get the following AVC when trying to view the grapher.cgi from my web browser: type=AVC msg=audit(1168459205.932:49631): avc: denied { read } for pid=5499 comm="grapher.cgi" name="cricket" dev=dm-4 ino=5242884 scontext=user_u:system_r:httpd_sys_script_t:s0 tcontext=user_u:object_r:httpd_sys_script_exec_t:s0 tclass=lnk_file type=SYSCALL msg=audit(1168459205.932:49631): arch=40000003 syscall=195 success=no exit=-13 a0=8e10010 a1=bff4190c a2=42378ff4 a3=8e10010 items=0 ppid=5314 pid=5499 auid=10002 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) comm="grapher.cgi" exe="/usr/bin/perl" subj=user_u:system_r:httpd_sys_script_t:s0 key=(null) The ino number in the AVC is /var/cricket/cricket. The application is installed in /var/cricket (from the legacy install) but if necessary I can move bits and pieces around to accomodate SELinux standards. I relabeled the entire /var/cricket tree to httpd_script_exec_t. drwxr-xr-x cricket cricket system_u:object_r:httpd_sys_script_exec_t bin/ lrwxrwxrwx root root user_u:object_r:httpd_sys_script_exec_t cricket -> cricket-1.0.5/ drwxr-xr-x cricket cricket system_u:object_r:httpd_sys_script_exec_t cricket-1.0.5/ drwxr-xr-x cricket cricket system_u:object_r:httpd_sys_script_exec_t cricket-config/ drwxr-xr-x cricket cricket system_u:object_r:httpd_sys_script_exec_t cricket-config-attic/ drwxr-xr-x cricket cricket system_u:object_r:httpd_sys_script_exec_t cricket-data/ drwxr-xr-x cricket cricket system_u:object_r:httpd_sys_script_exec_t cricket-logs/ drwxr-xr-x cricket cricket system_u:object_r:httpd_sys_script_exec_t public_html/ Here is my relavent Apache config: AddHandler cgi-script .cgi NameVirtualHost *:80 <VirtualHost *:80> ServerAdmin root@localhost DocumentRoot /var/cricket/public_html ServerName server.host.name ErrorLog /var/log/httpd/cricket/error_log CustomLog /var/log/httpd/cricket/access_log common </VirtualHost> <Directory "/var/cricket/public_html"> AllowOverride Options FileInfo AuthConfig Limit Order allow,deny Allow from all </Directory> Has anyone had success running cricket with SELinux? Thanks.

3 3

SELinux Symposium: Head of IBM Linux Development to be Keynote Speaker
by Frank Mayer 11 Jan '07

11 Jan '07

All, FYI we just announced that Dan Frye, head of Linux development at IBM as a keynote speaker at this year's SELinux Symposium. I expect a second keynote speaker to be announced later this month. Hope to see you all there. Frank -=-=-=-=-=-=-=-=-=-=-=- FOR IMMEDIATE RELEASE CONTACT: info(a)selinux-symposium.org Head of IBM Linux Development to be Keynote Speaker at Third Security Enhanced Linux Symposium Baltimore, Maryland-January 10, 2007- Daniel Frye, Vice President, IBM Open Systems Development, will be a keynote speaker for the third annual Security Enhanced Linux (SELinux) Symposium (www.selinux-symposium.org) scheduled for March 12-16, 2007 in Baltimore, Maryland. Dr. Frye is the head of IBM's UNIX development team, principally responsible for Linux and AIX development. He is additionally responsible for overseeing IBM's Linux technical strategy, IBM's participation in the open source Linux development community, and the IBM Linux Technology Center (LTC). The goal of Dr. Frye's Linux organization is to help the global open source community make Linux better, to ensure Enterprise-level Linux support for IBM's hardware, software, and services brands, and to help expand the reach of Linux into new markets. Dr. Frye will present a keynote address entitled "Open and Secure: Linux Today and Tomorrow." In this address, Dr. Frye will discuss the impact of SELinux on Linux, and how open software helps in the proliferation of new security technology. About the SELinux Symposium The Security Enhanced Linux (SELinux) Symposium is an annual exchange of ideas, technology, and research involving SELinux. SELinux is emerging technology that adds flexible, strong mandatory access control security to Linux. The third annual symposium is scheduled for March 12-16, 2007 in Baltimore, Maryland, USA. This year's symposium is sponsored by Hewlett-Packard, IBM, Red Hat, and Tresys Technology. The event brings together experts from business, government, and academia to share research, development, and application experiences using SELinux. For information on registration and sponsorship opportunities, see www.selinux-symposium.org.

1 0

[ANN] Madison policy generation tools
by Karl MacMillan 10 Jan '07

10 Jan '07

The first public release of the Madison SELinux policy generation tools can be found at http://et.redhat.com/madison/. Madison is a new project to create command line and GUI policy generation tools that: * Create more readable and secure policy by leveraging the reference policy development environment. * Provide administrators with guidance and information to help them make good security decisions. This release focuses on the creation of a foundation library (in python). It only includes a single tool - audit2policy - that is a drop in replacement for audit2allow with better reference policy interface call generation (using the undocumented -R audit2allow flag). Contributions are very welcome. I'm looking for help with: * Testing (particularly interface call generation and module generation) * Documenation * Unit test creation * Code / tool development See the website for more details on contributing. To the authors of other policy generation tools: I would like to avoid duplication of effort where possible. The current release focuses on areas that other tools have not explored thoroughly. Moving forward I would to discuss how we can best work together. Please send any feedback to the selinux development list. Thanks - Karl

2 2

policy build failure
by Michael Thomas 09 Jan '07

09 Jan '07

I just tried rebuilding the policy files for a package that I am working on (cyphesis), and started getting this syntax error in Rawhide: % make NAME=strict -f /usr/share/selinux/devel/Makefile cat: /selinux/mls: No such file or directory Compiling strict cyphesis module tmp/all_interfaces.conf:7820:ERROR 'syntax error' at token 'allow' on line 3871: allow staff_evolution_alarm_t staff_t:fifo_file { getattr write }; /usr/bin/checkmodule: error(s) encountered while parsing configuration /usr/bin/checkmodule: loading policy configuration from tmp/cyphesis.tmp This was done using the latest: checkpolicy 1.33.1-2.fc7 selinux-policy 2.4.6-21.fc7 selinux-policy-devel 2.4.6-21.fc7 policycoreutils 1.33.6-9.fc7 Any ideas on how to work around this? --Wart

3 4

Re: oracle and selinux
by bastard operater 09 Jan '07

09 Jan '07

>From: Steve Grubb <sgrubb(a)redhat.com> > >On Saturday 06 January 2007 18:43, Adam Turk wrote: > > I guess I will try the install with selinux enabled and see what >happens. > >Yes and please tell us if you get any AVCs. I asked for the update because there was some talk back on April 13, 2004 about Russell Coker working on a selinux policy for oracle. The install is scheduled for the end of the month. I will put selinux in enforcing mode and let the list know what happens. Thanks, _________________________________________________________________ Find sales, coupons, and free shipping, all in one place! MSN Shopping Sales & Deals http://shopping.msn.com/content/shp/?ctid=198,ptnrid=176,ptnrdata=200639

1 0

Post FC6 upgrade SELinux problem
by Kirk Lowery 09 Jan '07

09 Jan '07

After upgrading from FC5 to FC6, my first clue was that X-Windows wouldn't come up because it could not find the 'fixed' font. This meant the xfs server wasn't working. Sure enough, dmesg showed: audit(1167922474.426:78): avc: denied { read } for pid=2399 comm="xfs" name="fonts.dir" dev=hda5 ino=3260727 scontext=system_u:system_r:xfs_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file Looking through dmesg, I discovered many other "avc: denied" messages: audit(1167922423.998:4): avc: denied { audit_write } for pid=376 comm="hwclock" capability=29 scontext=system_u:system_r:hwclock_t:s0 tcontext=system_u:system_r:hwclock_t:s0 tclass=capability audit(1167922427.986:5): avc: denied { getattr } for pid=1369 comm="pam_console_app" name="adsp1" dev=tmpfs ino=5904 scontext=system_u:system_r:pam_console_t:s0-s0:c0.c255 tcontext=system_u:object_r:device_t:s0 tclass=chr_file audit(1167922462.739:7): avc: denied { search } for pid=2083 comm="auditd" name="bin" dev=hda5 ino=1042531 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=dir audit(1167922463.659:12): avc: denied { write } for pid=2132 comm="dbus-daemon" name=".setrans-unix" dev=hda5 ino=423906 scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:object_r: var_run_t:s0 tclass=sock_file audit(1167922464.088:15): avc: denied { setuid } for pid=2154 comm="mount" capability=7 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:mount_t:s0 tclass=capability audit(1167922464.089:16): avc: denied { setgid } for pid=2154 comm="mount" capability=6 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:mount_t:s0 tclass=capability audit(1167922464.531:23): avc: denied { search } for pid=2193 comm="automount" name="1" dev=proc ino=65538 scontext=system_u:system_r:automount_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=dir audit(1167922470.796:75): avc: denied { search } for pid=2249 comm="ntpd" name="net" dev=proc ino=-268435432 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=dir audit(1167922474.229:76): avc: denied { write } for pid=2396 comm="restorecon" name=".setrans-unix" dev=hda5 ino=423906 scontext=system_u:system_r:restorecon_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file audit(1167922474.426:78): avc: denied { read } for pid=2399 comm="xfs" name="fonts.dir" dev=hda5 ino=3260727 scontext=system_u:system_r:xfs_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file ....and many, many more. Clearly, my SELinux policies were seriously broken during the upgrade. So, how to recover? If I could get X-Windows up, would the new SELinux GUI be the way to go? Do I need to reinstall an SELinux package(s)? If so, which one(s)? Suggestions, pointers much appreciated! TIA, Kirk

2 1

Process for creating Fedora selinux-policy packages
by Rich Fearn 09 Jan '07

09 Jan '07

Hello, Due to an SELinux bug I reported in August, I've been tyring to understand the selinux-policy packages to see how they're built. I understand the principle of taking the upstream refpolicy, modifying it and building the Fedora-specific packages. However, I'm struggling to see where the refpolicy is coming from. For example, as I write this, the latest FC6 selinux-policy package pushed to the repositories is 2.4.6-1. According to the "sources" file in CVS, this package is built using serefpolicy-2.4.6.tgz. If I get serefpolicy-2.4.6.tgz from the lookaside repository then the VERSION file in it says 20061018. However, the contents of serefpolicy-2.4.6.tgz differ a great deal from the "official" 20061018 version of the reference policy from Tresys. I could understand it if the Fedora selinux-policy packages were directly based on the 20061018 version of the refpolicy from Tresys, but there seems to be an intermediate stage of development that produces the serefpolicy-2.x.x.tgz files in the lookaside repository. My question is: is there a CVS repository somewhere for a "Fedora reference policy", that is used to build all these serefpolicy files? Thanks Richard Fearn

3 2

RE: FC5, Apache, Bugzilla, SELinux issues
by R Edmonds 05 Jan '07

05 Jan '07

Indeed I did. Oh well at least I got 3 posts in before making an ass of myself.. OK, next hurdle. The step in Pauls instructions: # ln -s /usr/share/selinux/devel/Makefile . I don't have a devel directory in that path. Again, some prerequisite i'm missing? I double checked for typos this time ;) Bear with me folks! > > You typed "sgi" rather than "cgi"? > > getsebool -a will display all booleans and their settings. > > -- > Stephen Smalley > National Security Agency > >

5 8

FC5, Apache, Bugzilla, SELinux issues
by R Edmonds 04 Jan '07

04 Jan '07

Greetings out there in Penguin-land! I'm going through the rather painful process of installing Bugzilla on an SELinux FC5 box. I'm almost there now, I think, however I'm trying to add a local policy to SELinux for allowing Apache to execute .cgi scripts, and have hit a brick wall. When I try to hit the Bugzilla page from a browser on the network I get this: tail -f /var/log/messages output: kernel: audit(1167911234.610:20): avc: denied { execute_no_trans } for pid=28833 comm="httpd" name=" index.cgi" dev=dm-0 ino=34931972 scontext=root:system_r:httpd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file So, following the guide in the fedora docs Here<http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385>I generated a local.te using *audit2allow -m local -l -i /var/log/messages > local.te *, compiled it using *checkmodule -M -m -o local.mod local.te*, packaged it using *semodule_package -o local.pp -m local.mod*, then attempted to add it to the current running policy using *semodule -i local.pp *. This point is where I get stuck. i'm seeing this output when I execute the command: tail -f /var/log/messages output: Jan 4 11:56:13 svn kernel: security: 3 users, 6 roles, 1481 types, 152 bools, 1 sens, 256 cats Jan 4 11:56:13 svn kernel: security: 58 classes, 43474 rules Jan 4 11:56:13 svn dbus: Can't send to audit system: USER_AVC avc: received policyload notice (seqno=7) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?) Jan 4 11:56:13 svn dbus: Can't send to audit system: USER_AVC avc: 0 AV entries and 0/512 buckets used, longest chain length 0 : exe="?" (sauid=81, hostname=?, addr=?, terminal=?) Jan 4 11:56:13 svn kernel: audit( 1167911773.820:21): policy loaded auid=4294967295 After looking around, I saw on this mailing list that this might be a bug in SELinux-Policy that was fixed in version 2.3.14-3. Yum doesn't seem to know about this newer version. Am I barking up the wrong tree?

3 5

Problems with sudo on FC6
by Ted Rule 04 Jan '07

04 Jan '07

I'm trying to build a new FC6 machine to replace my aging FC4 box. As with the FC4 box, I'd like to retain SELinux's strict policy in enforcing mode. Eventually, I would like to run the machine up to run-level 5 in strict enforcing as I had done with FC4. For the present, all the testing is in run-level 3 on the console itself, as GDM login currently fails with SELinux enforcing and I haven't yet enabled sshd. The first big hurdle I'm facing is sudo. On my old FC4 machine, I was able to add a user to /etc/sudoers, enable the "user_canbe_sysadm" tunable and recompile and reload the policy. Admittedly, I had to tweak policy to allow sudo's stdout to be pipeable, but asides from that I mostly had the ability to leave the machine permanently in strict/enforcing. The FC6 machine was installed on a fresh disk, whereafter I reset /etc/sysconfig/selinux SELINUXTYPE=strict, touched /.autorelabel and rebooted. I've updated the machine to all the latest FC6-Updates, in particular: kernel-2.6.18-1.2869.i686.rpm selinux-policy-strict-2.4.6-13.fc6.noarch.rpm Having amended /etc/sudoers to grant a "fred" test user sudo permission, I saw AVC's indicating the inability of sudo to write into /var/run/sudo, as well as an AVC indicating that sudo wasn't allowed to execute /bin/cat, i.e.: type=USER_AUTH msg=audit(1167906300.693:29): user pid=3072 uid=0 auid=500 subj=user_u:user_r:user_sudo_t:s0 msg='PAM: authentication acct=fred : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=tty2 res=success)' type=USER_ACCT msg=audit(1167906300.700:30): user pid=3072 uid=0 auid=500 subj=user_u:user_r:user_sudo_t:s0 msg='PAM: accounting acct=fred : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=tty2 res=success)' type=AVC msg=audit(1167906300.700:31): avc: denied { write } for pid=3072 comm="sudo" name="fred" dev=hda7 ino=420634 scontext=user_u:user_r:user_sudo_t:s0 tcontext=user_u:object_r:pam_var_run_t:s0 tclass=dir type=SYSCALL msg=audit(1167906300.700:31): arch=40000003 syscall=5 success=no exit=-13 a0=8c1afd0 a1=241 a2=180 a3=8c1afd0 items=0 ppid=3013 pid=3072 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=500 fsgid=0 tty=tty2 comm="sudo" exe="/usr/bin/sudo" subj=user_u:user_r:user_sudo_t:s0 key=(null) type=CRED_ACQ msg=audit(1167906300.702:32): user pid=3072 uid=0 auid=500 subj=user_u:user_r:user_sudo_t:s0 msg='PAM: setcred acct=root : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=tty2 res=success)' type=AVC msg=audit(1167906300.702:33): avc: denied { search } for pid=3072 comm="sudo" scontext=user_u:user_r:user_sudo_t:s0 tcontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tclass=key type=SYSCALL msg=audit(1167906300.702:33): arch=40000003 syscall=288 success=no exit=-13 a0=0 a1=fffffffd a2=0 a3=0 items=0 ppid=3013 pid=3072 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty2 comm="sudo" exe="/usr/bin/sudo" subj=user_u:user_r:user_sudo_t:s0 key=(null) type=USER_START msg=audit(1167906300.703:34): user pid=3072 uid=0 auid=500 subj=user_u:user_r:user_sudo_t:s0 msg='PAM: session open acct=root : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=tty2 res=success)' type=USER_END msg=audit(1167906300.703:35): user pid=3072 uid=0 auid=500 subj=user_u:user_r:user_sudo_t:s0 msg='PAM: session close acct=root : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=tty2 res=success)' type=AVC msg=audit(1167906300.704:36): avc: denied { execute } for pid=3072 comm="sudo" name="cat" dev=hda2 ino=323546 scontext=user_u:user_r:user_sudo_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file type=SYSCALL msg=audit(1167906300.704:36): arch=40000003 syscall=11 success=no exit=-13 a0=806e2e0 a1=bfd618e8 a2=8c26500 a3=8c26500 items=0 ppid=3013 pid=3072 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty2 comm="sudo" exe="/usr/bin/sudo" subj=user_u:user_r:user_sudo_t:s0 key=(null) Somewhat bizarrely, of course, sudo continues to run even if it fails to write into /var/run/sudo. I guess this is arguably a bug in sudo itself, albeit relatively harmless. Setting SELinux to permissive, sudo worked Ok. I also tried changing "fred" from user_u to staff_u, since FC4 defaulted to only allowing for staff_u to use sudo, as in: # semanage login -a -s staff_u fred I then rm -rf'ed /var/run/sudo/*, and restorecon'ed /home/fred to correct the home directory labelling. This also failed with SELinux enforcing, and worked in permissive, giving similar AVC's where previous references to "user_..." appeared instead as "staff_..." I had a look at the various booleans available in the policy, and none seem to be relevant to this problem. All in all, I can't see an easy way of making sudo work, but the fact that the user_sudo_t and staff_sudo_t domains exist implies that the policy contains support for running sudo from either user_r or staff_r. Can anyone assist me in getting sudo to work on FC6/strict? Thanks, -- Ted Rule Director, Layer3 Systems Ltd W: http://www.layer3.co.uk/

2 1

vmware beta....needs mount/unmount?
by Tom London 02 Jan '07

02 Jan '07

Running latest rawhide, targeted/enforcing. I'm testing the latest vmware beta (6?). Seems to want to mount on /proc/fs/vmware-block/mountPoint: none on /proc/fs/vmware-block/mountPoint type vmware-block (rw) This produces the following AVC during boot: type=AVC msg=audit(1167500297.368:6): avc: denied { mount } for pid=2225 comm="mount" name="/" dev=vmware-block ino=1 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem type=SYSCALL msg=audit(1167500297.368:6): arch=40000003 syscall=21 success=yes exit=0 a0=937cdd8 a1=937ce00 a2=937cde8 a3=c0ed0000 items=0 ppid=2212 pid=2225 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0 key=(null) I believe this is the associated AVC from 'unmount' during shutdown: type=AVC msg=audit(1167502331.621:34): avc: denied { unmount } for pid=4269 comm="umount" scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem type=SYSCALL msg=audit(1167502331.621:34): arch=40000003 syscall=22 success=yes exit=0 a0=9f20120 a1=bffc51f0 a2=9f20148 a3=9f20121 items=0 ppid=4268 pid=4269 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="umount" exe="/bin/umount" subj=system_u:system_r:mount_t:s0 key=(null) This appears to be the script from /etc/init.d/vmware: # Start the file system blocking driver vmware_start_vmblock() { mkdir -p /tmp/VMwareDnD && chmod 777 /tmp/VMwareDnD vmware_exec 'Loading module' vmware_load_module $vmblock exitcode=`expr $exitcode + $?` mount -t vmware-block none /proc/fs/vmware-block/mountPoint } # Stop the file system blocking driver vmware_stop_vmblock() { umount /proc/fs/vmware-block/mountPoint vmware_unload_module $vmblock } Right way to fix? tom -- Tom London

2 2

How to 'fix' webalizer problem since FC4?
by Stephen John Smoogen 02 Jan '07

02 Jan '07

I installed a new system, and saw that I was getting a set of selinux messages everytime cron runs. It looks like it is this bug: Bug 169434 Processed: selinux prevents webalizer running from cron The message from audit2allow is allow webalizer_t fs_t:filesystem getattr; audit2why shows: type=AVC msg=audit(1167649332.157:607): avc: denied { getattr } for pid=2739 comm="webalizer" name="/" dev=dm-3 ino=2 scontext=system_u:system_r:webalizer_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem Was caused by: Missing or disabled TE allow rule. Allow rules may exist but be disabled by boolean settings; check boolean settings. You can see the necessary allow rules by running audit2allow with this audit message as input. type=AVC msg=audit(1167649332.273:608): avc: denied { getattr } for pid=2737 comm="webalizer" name="/" dev=dm-3 ino=2 scontext=system_u:system_r:webalizer_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem Was caused by: Missing or disabled TE allow rule. Allow rules may exist but be disabled by boolean settings; check boolean settings. You can see the necessary allow rules by running audit2allow with this audit message as input. -- Stephen J Smoogen. -- CSIRT/Linux System Administrator How far that little candle throws his beams! So shines a good deed in a naughty world. = Shakespeare. "The Merchant of Venice"

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2007