February 2007 - selinux - Fedora mailing-lists

Confining TeX
by Jan Kasprzak 09 Oct '07

09 Oct '07

Hello, I am implementing a remote TeX server for our users, and I would like to confine it using SELinux (FC6, targeted policy). I need help or suggestions on possible approaches. What I want to do is the following: - I have a TeX installation in a separate directory - I want local users to be able to run TeX commands without restrictions - I want to have a daemon, running under a separate user, which will handle remote requests for TeX compilation. Under this user/daemon the TeX commands should be confined, so that they can only read TeX data files (the texmf/ tree), execute the TeX sub-commands (i.e. files under <texroot>/bin/ directory) - including the rights to the system libraries, locales, etc. as necessary. And the confined processes should write only to the texmf-var tree (autogenerated bitmap fonts, etc.) and to the temporary directory, reserved for TeX outputs (logs, DVI files, dvips outputs, etc.). My current solution is to create the tex_t domain, and tex_exec_t, tex_data_t, and tex_tmp_t file types, and make the daemon run "runcon -t tex_t -- tex myfile.tex" instead of plain "tex myfile.tex". Maybe there are better approaches than this: - maybe the "runcon" is not necessary, and TeX executables can be made to enter the tex_t domain automatically, when started by the UNIX user under which the daemon runs. - or maybe I should use SELinux users or roles instead of domains (?) - or maybe the daemon should run under its own special domain? The "runcon" approach allows local users to compile also untrusted TeX sources - i.e. they can be able to run TeX either under their own context, or via "runcon" in the confined mode. Any suggestions? -Yenya -- | Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> | | GPG: ID 1024/D3498839 Fingerprint 0D99A7FB206605D7 8B35FCDE05B18A5E | | http://www.fi.muni.cz/~kas/ Journal: http://www.fi.muni.cz/~kas/blog/ | > I will never go to meetings again because I think face to face meetings < > are the biggest waste of time you can ever have. --Linus Torvalds <

2 2

Nagios Web Interface and SELinux
by Ryan Skadberg 12 Sep '07

12 Sep '07

I have been trying to get nagios up and running on 2 different machines. One running FC5 and one running FC6. Nagios itself starts up fine, but the web interface fails miserably. When looking at /var/log/messages, I see things like: Dec 3 11:38:17 xray kernel: audit(1165174697.348:289): avc: denied { execute_no_trans } for pid=22237 comm="httpd" name="tac.cgi" dev=dm-0 ino=11272226 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file I noticed in the selinux-policy-targeted Changelog: * Wed Jul 26 2006 Dan Walsh <dwalsh(a)redhat.com> 2.3.3-13 - Add nagios policy This may have been for the program itself or maybe the web interface, but it sure doesn't seem to be working for me. Both systems are set to: SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 Anyone have any advice on how to fix this? Thanks! Skadz

3 4

selinux-policy-2.5.4
by Steve G 26 Feb '07

26 Feb '07

Hi, I am curious about the testing process for policy releases. Seems like everytime a new upstream policy is pulled in, we suddenly have a bunch of avcs. For the newest policy, 2.5.4, I have all these: allow avahi_t unlabeled_t : packet { recv send }; allow bluetooth_t lib_t : file execute_no_trans; allow mount_t security_t : filesystem getattr; allow postfix_local_t mail_spool_t : file append; allow postfix_local_t unlabeled_t : packet send; allow postfix_master_t security_t : filesystem getattr; allow restorecon_t security_t : filesystem getattr; allow setrans_t security_t : filesystem getattr; allow setroubleshootd_t mail_spool_t : lnk_file read; allow setroubleshootd_t security_t : filesystem getattr; allow vpnc_t security_t : filesystem getattr; allow vpnc_t unlabeled_t : packet { recv send }; These are simply from booting and connecting to the network. I haven't even tried to start X or do any serious work. -Steve ____________________________________________________________________________________ No need to miss a message. Get email on-the-go with Yahoo! Mail for Mobile. Get started. http://mobile.yahoo.com/mail

2 2

SELinux stats
by Casper Gasper 25 Feb '07

25 Feb '07

I'm looking for some figures on the success rate of SELinux, a count of vulnerabilities for RHEL/Fedora which are mitigated with targeted mode. I'm sure people must have done assessments on it efficacy, but so far my googling skills have failed me. thanks, Casper.

1 0

[ANN] SELinux Policy Editor 2.1.0
by Yuichi Nakamura 25 Feb '07

25 Feb '07

Hi, I would like to announce SELinux Policy Editor(SEEdit) 2.1.0 is released. SEEdit is a tool that makes SELinux easy. It supports Fedora Core 6 and Cent OS4. * Changes from 2.0: - Merged to Fedora Extras CVS You can get seedit more easily for Fedora! - Improved rpm package - Thanks to reviewers in Fedora bugzilla - New icons - Improved performance of policy generation tool - Created new button "guess policy" For detail please visit http://seedit.sourceforge.net/ -- Yuichi Nakamura Hitachi Software Engineering Co., Ltd. SELinux Policy Editor: http://seedit.sourceforge.net/

1 0

login role transition failing on mls livecd
by Joe Nall 23 Feb '07

23 Feb '07

I've been working on a fedora livecd that runs the mls policy. When I login as root via ssh [root@livecd ~]# id -Z root:staff_r:staff_t:SystemLow-SystemHigh but if I login via the console [root@livecd ~]# id -Z system_u:system_r:local_login_t:SystemLow-SystemHigh I'm not transitioning into the correct role/type on a console login. Any pointers on where to look/what I forgot to create would be appreciated. joe ls -Z `tty` crw--w---- root tty system_u:object_r:tty_device_t:SystemLow /dev/tty4 Audit from a login local login: type=USER_AUTH msg=audit(1172236367.222:134): user pid=2395 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='PAM: authentication acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' type=USER_ACCT msg=audit(1172236367.222:135): user pid=2395 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='PAM: accounting acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' type=LOGIN msg=audit(1172236367.228:136): login pid=2395 uid=0 old auid=4294967295 new auid=0 type=USER_ROLE_CHANGE msg=audit(1172236367.246:137): user pid=2395 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='pam: default-context=root:sysadm_r:sysadm_t:s0-s15:c0.c1023 selected-context=?: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' type=USER_START msg=audit(1172236367.246:138): user pid=2395 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='PAM: session open acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' type=USER_LOGIN msg=audit(1172236367.248:140): user pid=2395 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'type=AVC msg=audit(1172236367.248:141): avc: denied { execute_no_trans } for pid=2401 comm="login" name="bash" dev=dm-0 ino=32771 scontext=system_u:system_r:local_login_t:s0-s15:c0.c1023 tcontext=system_u:object_r:shell_exec_t:s0 tclass=filetype=SYSCALL msg=audit(1172236367.248:141): arch=40000003 syscall=11 success=yes exit=0 a0=91d56d0 a1=bfde41c0 a2=91d7978 a3=804d2e8 items=0 ppid=2395 pid=2401 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 comm="bash" exe="/bin/bash" subj=system_u:system_r:local_login_t:s0-s15:c0.c1023 key=(null) type=AVC_PATH msg=audit(1172236367.248:141): path="/bin/bash" type=AVC msg=audit(1172236367.301:142): avc: denied { execute } for pid=2411 comm="bash" name="hostname" dev=dm-0 ino=32832 scontext=system_u:system_r:local_login_t:s0-s15:c0.c1023 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file type=AVC msg=audit(1172236367.301:142): avc: denied { execute_no_trans } for pid=2411 comm="bash" name="hostname" dev=dm-0 ino=32832 scontext=system_u:system_r:local_login_t:s0- s15:c0.c1023 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file sestatus -v SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: permissive Policy version: 21 Policy from config file: mls Process contexts: Current context: system_u:system_r:local_login_t:SystemLow-SystemHigh Init context: system_u:system_r:init_t:SystemLow- SystemHigh /sbin/mingetty system_u:system_r:getty_t:SystemLow- SystemHigh /usr/sbin/sshd system_u:system_r:sshd_t:SystemLow- SystemHigh File contexts: Controlling term: system_u:object_r:tty_device_t:SystemLow /etc/passwd system_u:object_r:etc_t:SystemLow /etc/shadow system_u:object_r:shadow_t:SystemLow /bin/bash system_u:object_r:shell_exec_t:SystemLow /bin/login system_u:object_r:login_exec_t:SystemLow /bin/sh system_u:object_r:bin_t:SystemLow -> system_u:object_r:shell_exec_t:SystemLow /sbin/agetty system_u:object_r:getty_exec_t:SystemLow /sbin/init system_u:object_r:init_exec_t:SystemLow /sbin/mingetty system_u:object_r:getty_exec_t:SystemLow /usr/sbin/sshd system_u:object_r:sshd_exec_t:SystemLow /lib/libc.so.6 system_u:object_r:lib_t:SystemLow -> system_u:object_r:shlib_t:SystemLow /lib/ld-linux.so.2 system_u:object_r:lib_t:SystemLow -> system_u:object_r:ld_so_t:SystemLow

2 2

Re: Posttinstall scriptlets failing ?
by Stephen Smalley 23 Feb '07

23 Feb '07

On Fri, 2007-02-23 at 15:33 +0100, Davide Bolcioni wrote: > On Friday 23 February 2007 13:50:21 you wrote: > > On Thu, 2007-02-22 at 13:56 -0500, Daniel J Walsh wrote: > > > Davide Bolcioni wrote: > > > > Greeetings, > > > > I just tried the following: > > > > > > > > yum install kernel-devel.x86_64 > > > > > > > > and got > > > > > > > > Installing: kernel-devel ######################### > > > > [1/1] error: %post(kernel-devel-2.6.19-1.2911.fc6.x86_64) scriptlet > > > > failed, exit status 255 > > > > > > > > the failure seems to be related to the following in the audit log: > > > > > > > > type=AVC msg=audit(1172166288.763:92): avc: denied { transition } for > > > > pid=7023 comm="yum" name="bash" dev=dm-1 ino=409636 > > > > scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 > > > > tcontext=system_u:system_r:rpm_script_t:s0-s0:c0.c1023 tclass=process > > > > type=SYSCALL msg=audit(1172166288.763:92): arch=c000003e syscall=59 > > > > success=no exit=-13 a0=3b5afef a1=7fff58604730 a2=4112960 a3=5f74c70 > > > > items=0 ppid=6779 pid=7023 auid=503 uid=0 gid=0 euid=0 suid=0 fsuid=0 > > > > egid=0 sgid=0 fsgid=0 tty=pts0 comm="yum" exe="/usr/bin/python" > > > > subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) > > > > type=AVC_PATH msg=audit(1172166288.763:92): path="/bin/bash" > > > > > > > > which I understand being a failure to exec() bash, correct ? > > > > > > > > Apparently, yum is running as system_u:system_r:xdm_t, which I find > > > > somewhat surprising, but still. > > > > > > > > Thank you for your consideration, > > > > Davide Bolcioni > > > > > > There is a problem in the latest version of pam_selinux that is causing > > > this problem. > > > > > > You can either revert to the previous version of pam or wait for the > > > next update. > > > > gdm at least doesn't use pam_selinux AFAICS, so it wouldn't be affected > > by the pam_selinux bug. > > > > If you log out and log back in, is your session still running in xdm_t? > > That is definitely wrong. > > I am using kdm, which definitely includes pam_selinux.so in /etc/pam.d/kdm. > Why doesn't gdm use pam_selinux ? IIRC the point of PAM was to separate > authentication, was it ? gdm has direct selinux support integrated into it. IIRC, we tried using pam_selinux with it but it performs the pam_open_session() from a different process than the one that ultimately exec's the user shell, so it didn't work. pam_selinux isn't authentication; it is setting the security context for the user shell. Whether or not it belongs in pam is open to debate, e.g. setting of the uid for the shell doesn't happen in pam either. -- Stephen Smalley National Security Agency

1 0

SpamAssassin Log explosion issue following update
by Ted Rule 23 Feb '07

23 Feb '07

I recently updated SpamAssassin on my FC6/strict box to spamassassin-3.1.8-2.fc6. FWIW, the selinux-policy is currently on selinux-policy-strict-2.4.6-37.fc6 It seems that the installation may well have partially failed because I ran "yum update spamassassin" whilst still in enforcing mode. I erroneously assumed that spamd continued to run Ok, as I saw no error messages during the "yum update". Sadly, to my horror earlier today, I found that the /var partition was completely full of log messages from SELinux/spamd, viz: ... Feb 22 12:08:25 topaz kernel: audit(1172146105.931:9462050): avc: denied { search } for pid=10329 comm="spamd" name="/" dev=hda2 ino=2 scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=dir Feb 22 12:08:25 topaz kernel: audit(1172146105.932:9462051): avc: denied { search } for pid=10329 comm="spamd" name="/" dev=hda2 ino=2 scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=dir Feb 22 12:08:25 topaz kernel: audit(1172146105.932:9462052): avc: denied { search } for pid=10329 comm="spamd" name="/" dev=hda2 ino=2 scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=dir Feb 22 12:08:25 topaz kernel: audit(1172146105.932:9462053): avc: denied { search } for pid=10329 comm="spamd" name="/" dev=hda2 ino=2 scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=dir .... In other words, for some reason the "broken" update left the process running in the unlabeled_t domain, which is a little bizarre. In any event, I then got a continuous stream of these denials in the log which eventually filled the log within a few hours. Note to self: presumably using auditd instead of syslog-ng for storing these messages would have avoided the filesystem overload. Similarly, I have yet to check the manual pages for syslog-ng for a max-logfile-size option which might have avoided the ensuing embarrassment. After clearing out the massive log files to give spamd and syslog-ng room to manoeuvre, I then tried looking for the spamd[10329] in the process list, but found that it was invisible(!), presumably because it was running as unlabeled_t. I then tried temporarily enabling the "allow_ptrace" boolean to see if that helped make the process visible, to no avail. Finally, I was forced to drop into permissive mode to locate the rogue PID running in "unlabeled_t". So then I stopped spamd, went back to enforcing mode, and restarted spamd, which duly ran in its proper spamd_t domain. >From previous experiences I think the strict policy, and perhaps the targeted policy also, is missing several permissions which allow various init scripts to be called from within "yum update". To satisfy my own curiousity, can someone explain how spamd ended up running in unlabeled_t? Is it somehow related to a process continuing to run which has no corresponding executable binary? Following this experience, can I make some suggestions: a. Please test that rpm/yum update runs without error for any RPM update on both a strict/enforcing box and a targeted/enforcing box before the RPM is released to mirrors. b. Don't expect that yum update can be run in enforcing mode, especially on packages associated with running daemons. c. Please can we add a policy permission so that sysadm_t can seek and destroy unlabeled_t processes with extreme prejudice without recourse to permissive mode? Ted # ps axf | grep 103 14549 pts/1 S+ 0:00 \_ grep 103 # setsebool allow_ptrace=1 # getsebool -a| grep ptrace allow_ptrace --> on # ps axf | grep 103 14561 pts/1 S+ 0:00 \_ grep 103 # setenforce 0 # ps axf | grep 103 10329 ? Ss 12:44 /usr/bin/spamd -d -c -m5 -H -r /var/run/spamd.pid 10331 ? Z 1:23 \_ [spamd] <defunct> 10332 ? Z 0:06 \_ [spamd] <defunct> 14564 pts/1 S+ 0:00 \_ grep 103 # ps axfZ | grep 103 system_u:object_r:unlabeled_t 10329 ? Ss 12:44 /usr/bin/spamd -d -c -m5 -H -r /var/run/spamd.pid system_u:object_r:unlabeled_t 10331 ? Z 1:23 \_ [spamd] <defunct> system_u:object_r:unlabeled_t 10332 ? Z 0:06 \_ [spamd] <defunct> staff_u:sysadm_r:sysadm_t 14566 pts/1 S+ 0:00 \_ grep 103 # setenforce 1 # ps axfZ | grep 103 staff_u:sysadm_r:sysadm_t 14569 pts/1 S+ 0:00 \_ grep 103 # setenforce 0 # run_init service spamassassin stop Authenticating root. Password: Stopping spamd: [ OK ] # ps axf | grep spam 14591 pts/1 S+ 0:00 \_ grep spam # setenforce 1 # run_init service spamassassin start Authenticating root. Password: Starting spamd: [ OK ] # ps axfZ | grep spam staff_u:sysadm_r:sysadm_t 14617 pts/1 S+ 0:00 \_ grep spam system_u:system_r:spamd_t 14612 ? Ss 0:01 /usr/bin/spamd -d -c -m5 -H -r /var/run/spamd.pid system_u:system_r:spamd_t 14614 ? S 0:00 \_ spamd child system_u:system_r:spamd_t 14615 ? S 0:00 \_ spamd child # -- Ted Rule Director, Layer3 Systems Ltd W: http://www.layer3.co.uk/

3 4

Posttinstall scriptlets failing ?
by Davide Bolcioni 23 Feb '07

23 Feb '07

Greeetings, I just tried the following: yum install kernel-devel.x86_64 and got Installing: kernel-devel ######################### [1/1] error: %post(kernel-devel-2.6.19-1.2911.fc6.x86_64) scriptlet failed, exit status 255 the failure seems to be related to the following in the audit log: type=AVC msg=audit(1172166288.763:92): avc: denied { transition } for pid=7023 comm="yum" name="bash" dev=dm-1 ino=409636 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:rpm_script_t:s0-s0:c0.c1023 tclass=process type=SYSCALL msg=audit(1172166288.763:92): arch=c000003e syscall=59 success=no exit=-13 a0=3b5afef a1=7fff58604730 a2=4112960 a3=5f74c70 items=0 ppid=6779 pid=7023 auid=503 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="yum" exe="/usr/bin/python" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) type=AVC_PATH msg=audit(1172166288.763:92): path="/bin/bash" which I understand being a failure to exec() bash, correct ? Apparently, yum is running as system_u:system_r:xdm_t, which I find somewhat surprising, but still. Thank you for your consideration, Davide Bolcioni -- There is no place like /home.

3 2

more prelink AVCs
by Tom London 20 Feb '07

20 Feb '07

Running latest rawhide, targeted/enforcing. Getting AVCs for prelink for sudo_exec_t type=AVC msg=audit(1171985725.828:47): avc: denied { read } for pid=32139 comm="prelink" name="sudoedit" dev=dm-0 ino=5474778 scontext=system_u:system_r:prelink_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sudo_exec_t:s0 tclass=file type=SYSCALL msg=audit(1171985725.828:47): arch=40000003 syscall=5 success=no exit=-13 a0=a02bcf8 a1=8000 a2=0 a3=0 items=0 ppid=32130 pid=32139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="prelink" exe="/usr/sbin/prelink" subj=system_u:system_r:prelink_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1171985739.772:48): avc: denied { read } for pid=32139 comm="prelink" name="sudo" dev=dm-0 ino=5474778 scontext=system_u:system_r:prelink_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sudo_exec_t:s0 tclass=file type=SYSCALL msg=audit(1171985739.772:48): arch=40000003 syscall=5 success=no exit=-13 a0=a02bcf8 a1=8000 a2=0 a3=0 items=0 ppid=32130 pid=32139 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="prelink" exe="/usr/sbin/prelink" subj=system_u:system_r:prelink_t:s0-s0:c0.c1023 key=(null) tom -- Tom London

1 0

Re: Cron mail problem with FC6/strict
by Ted Rule 18 Feb '07

18 Feb '07

Since my previous posting on this matter, I've performed a few more tests, slightly amended policy, and found a somewhat surprising result. Because earlier tests indicated that individual Jobs could initiate mail themselves from system_crond_t, but NOT crond itself, I reasoned that maybe there was perhaps something in one or all of policy / crond / libselinux / kernel which prevented crond - which had already performed a setexeccon - to exec another process which directly required a domain transition. Therefore, I made use of crond's "-m" option to provide a shell wrapper to sendmail itself employing the same command line params as crond invokes, as in: [root@topaz ~]# cat /usr/sbin/sendmail.sendmail.crond #!/bin/sh /usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t [root@topaz ~]# I also labelled the wrapper as sendmail_exec_t: [root@topaz ~]# ls -lZ /usr/sbin/sendmail.sendmail* -rwxr-sr-x root smmsp system_u:object_r:sendmail_exec_t /usr/sbin/sendmail.sendmail -rwxr-xr-x root root staff_u:object_r:sendmail_exec_t /usr/sbin/sendmail.sendmail.crond [root@topaz ~]# Because of findings from previous tests, I added an entrypoint to SELinux policy which appears to be required: domain_entry_file(system_crond_t, sendmail_exec_t) And then I invoked the wrapper via /etc/sysconfig/crond: [root@topaz ~]# cat /etc/sysconfig/crond # Settings for the CRON daemon. # CRONDARGS= : any extra command-line startup arguments for crond # CRON_VALIDATE_MAILRCPTS=1:a non-empty value of this variable will # enable vixie-cron-4.1's validation of # mail recipient names, which would then be # restricted to contain only the chars # from this tr(1) set : [@!:%-_.,:alnum:] # otherwise mailing is not attempted. #CRONDARGS= CRONDARGS="-m/usr/sbin/sendmail.sendmail.crond" [root@topaz ~]# With all this in place, I found that Crond COULD launch the wrapper script, which in turn launched sendmail itself, and Cron mail WAS delivered. If I simply comment out the CRONDARGS setting to revert crond to "normal" operation, it succeeds in executing /usr/sbin/sendmail, but fails to transition to system_mail_t and no mail is delivered. As a next test, I further emulated /usr/sbin/sendmail itself by adding group membership, setgid flags and selinux ownership: [root@topaz ~]# ls -lZ /usr/sbin/sendmail.* -rwxr-sr-x root smmsp system_u:object_r:sendmail_exec_t /usr/sbin/sendmail.sendmail -rwxr-sr-x root smmsp system_u:object_r:sendmail_exec_t /usr/sbin/sendmail.sendmail.crond [root@topaz ~]# This still appears to work Ok. All in all, I appear to have a workround for the problem. It DOES seem to require one tweak to the existing policy - the extra domain_entry_file setting. However, I'm still very much in the dark as to why the wrapper script works and the binary copy of sendmail doesn't. Ted On Wed, 2007-01-24 at 10:19 +0000, Ted Rule wrote: > Quoting "Christopher J. PeBenito" <cpebenito(a)tresys.com>: > > > On Sun, 2007-01-21 at 23:05 +0000, Ted Rule wrote: > >> A little while ago, I found that anacron wasn't running correctly under > >> FC6/strict, which led to me add a temporary fixup .te for its operation. > >> Once I had that in place, I finally received the cron.daily and logwatch > >> Emails every day shortly after bootup. > >> > >> With that in place, I recently took to leaving the machine powered > >> overnight, which of course led to all the Cron jobs running via crond > >> instead of anacron. > >> > >> Oddly, I noticed that the logwatch Email arrived, but NOT the cron.daily > >> summary Email. > >> > >> Looking further, I found this odd avc: > >> > >> Jan 21 21:29:51 topaz kernel: audit(1169414991.423:988): avc: denied > >> { entrypoint } for pid=4891 comm="crond" name="sendmail.sendmail" > >> dev=hda6 ino=1313020 > >> scontext=system_u:system_r:system_crond_t:s0-s0:c0.c1023 > >> tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file > >> > >> i.e. the crond child process running in system_crond_t was apparently > >> unable to run sendmail. > > > > Is this supposed to be cron emailing the output of the cron jobs or the > > cron job itself emailing something? > > The former: as mentioned above, my tests indicate that the latter seems > to work > Ok. > > As far as I can tell, what happens is that crond starts in > crond_t, forks a crond child, setexeccon's to system_crond_t to run the > Job, and > then forks a sendmail process to pick up the stdout/stderr from the > Job. Hence I > think you end up with something like this: > > 101 crond_t crond > 102 system_crond_t \ crond > 103 system_crond_t \ cron-job-script > 104 system_mail_t \ sendmail > > where stdout/stderr from the cron-job-script is routed into the > sendmail stdin, > with email subject line and similar parameters injected from pid 102. I also > believe that pid 104 is not created at all until some output is generated by > pid 103 - hence silent Cron Jobs don't create the avc denials for sendmail. > > sendmail directly or indirectly launched by pid 103 is Ok according to > my tests, > but seemingly sendmail launched by pid 102 itself gronks. > > > > > > -- > > Chris PeBenito > > Tresys Technology, LLC > > (410) 290-1411 x150 > > > > > -- Ted Rule Director, Layer3 Systems Ltd W: http://www.layer3.co.uk/

1 2

re-configuring PHP
by Bruce Therrien 14 Feb '07

14 Feb '07

Hi, Go-daddy insists that I re-configure PHP to use GD. Can someone tell me where PHP is located on my server. All I can find is php.ini........ I'm running core 6, with PHP 5.0.4, but I need the GD support. I have the configure text ready to execute, but where? I use Putty for access. Here's the text: ./configure --build=i386-redhat-linux --host=i386-redhat-linux --target=i386-redhat-linux-gnu --program-prefix= --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/usr/com --mandir=/usr/share/man --infodir=/usr/share/info --cache-file=../config.cache --with-libdir=lib --with-config-file-path=/etc --with-config-file-scan-dir=/etc/php.d --disable-debug --with-pic --disable-rpath --with-bz2 --with-curl --with-exec-dir=/usr/bin --with-freetype-dir=/usr --with-png-dir=/usr --enable-gd-native-ttf --with-gdbm --with-gd --with-gettext --with-gmp --with-iconv --with-jpeg-dir=/usr --with-openssl --with-png --with-pspell --with-expat-dir=/usr --with-pcre-regex=/usr --with-zlib --with-layout=GNU --enable-exif --enable-ftp --enable-magic-quotes --enable-sockets --enable-sysvsem --enable-sysvshm --enable-sysvmsg --enable-track-vars --enable-trans-sid --enable-yp --enable-wddx --with-pear=/usr/share/pear --with-kerberos --enable-ucd-snmp-hack --with-unixODBC=shared,/usr --enable-memory-limit --enable-shmop --enable-calendar --enable-dbx --enable-dio --with-mime-magic=/etc/httpd/conf/magic --without-sqlite --without-mysql --without-gd --without-odbc --disable-dom --disable-dba Together, Bruce Therrien <bruce.therrien(a)wm-mw.org> Vice-president, Online systems WebMusic-MusiqueWeb The only on line international music network owned by all of its Affiliates... Together International Foundation 146 ch du Tour-du-Lac Lac-Beauport, Quebec G3B 0T3 Canada Quebec City Phone : 1.418.694.9700 New-York City Phone : 1.646.808.0236 Hartford IP Phone : 1.860.819.3723 Office IP Phone : 1.747.668.5625 Michel's Pager : 1.418.650.8494 Skype : musicweb http://wm-mw.org http://t-i-f.org "We are sharing a vision, and determined to share that vision with all who wish to be a part of it. Dedicated to promote and enhance the concept, and will do whatever it takes to ensure that people from around the world will no longer be taken in by false promises of security." - SID '98 This is the end of the internet. Please turn around and go back.

4 3

Re: Mail problems...
by melaina＠libero.it 13 Feb '07

13 Feb '07

Hello, a follow-up to my last e-mail. I fear part of the problem may be caused by the policy shipping with Plesk, contained in the file plesk.te. Could this transition be causing the issue? # qmail permissions # always enabled allow system_mail_t system_mail_t:fifo_file rw_file_perms; can_exec(system_mail_t, sendmail_exec_t) r_dir_file(system_mail_t, sendmail_exec_t) ifdef(`mta.te', ` domain_auto_trans(httpd_sys_script_t, sendmail_exec_t, system_mail_t) ') ---------- Initial Header -----------

2 1

an easy way to edit security policies in fc6
by selinux＠lucullo.it 12 Feb '07

12 Feb '07

hi, i'm new to selinux and i need to know how can i easy modify a selinux targeted policy rule in fc6. my apache can't write in a /var subdir. my idea is to start looking in to logs and then edit the policy (or the files attributes) to avoid problems. is there an easy tool for editing policy source? is there a complete how to (for fc6 targeted selinux)? excuse me for my bad english. thank you in advance.

3 2

Selinux error help - continued
by Dan Track 09 Feb '07

09 Feb '07

On Wed, 2007-02-07 at 16:34 +0000, Dan Track wrote: > Hi Stephen > > Firstly apologies for sending to the wrong list. Ok, then take follow-ups to fedora-selinux-list please. > Thanks for the advice it was really an eye opener. I trawlled through > the assert.te file in my selinux src directory, however I can tell > which rule to remove, could you please guide to which rule it is. > Currently my file looks like this: > > neverallow { domain -unrestricted -snmpd_t -pegasus_t } > unconfined_t:process ~sigchld; The rule above. Rather than removing it entirely, you could adjust it to make a specific exception for this case. What do you truly need your process to be able to do? > # Confined domains must never see unconfined domain's /proc/pid entries. > neverallow { domain -unrestricted -snmpd_t -pegasus_t } > unconfined_t:dir { getattr search }; This one will also get in your process' way if it truly needs to operate on unconfined processes. Naturally, if you go too far in this direction, you are effectively removing any real restriction on httpd and might as well just disable its protection altogether (via the corresponding boolean). Hi Stephen. I've moved the conversation over to the selinux list. My program is actually Beltane which is a web front end for managing samhain ( a filesystem integrity checker). The point at which the problem arises is when a setuid binary (belatne_cp) wants to write to a file it creates in the /tmp directory and then it wants to move that file to the /var/lib/yule/profiles directory. Its at this point I get the selinux error: Feb 7 14:26:10 jupiter kernel: audit(1170858370.177:2547): avc: denied { getsession } for pid=555 comm="httpd" scontext=root:system_r:httpd_t tcontext=root:system_r:unconfined_t tclass=process Feb 7 14:26:27 jupiter kernel: audit(1170858387.985:2548): avc: denied { getattr } for pid=14295 comm="beltane_cp" name="TMPFILIyEqoa" dev=sda3 ino=147699 scontext=root:system_r:httpd_sys_script_t tcontext=root:object_r:httpd_var_lib_t tclass=file This beltane_cp file is called by apache. Hope this helps in making clear what I'm trying to do. Thanks again Dan

2 15

ANN: SETools Release
by Christopher J. PeBenito 08 Feb '07

08 Feb '07

A new release of SETools is now available on the Tresys OSS site, from http://oss.tresys.com. The primary change in this release is the addition of support for loading sets of policy modules in all of the tools. This enables analysis of the policy with nearly all of the information available from the original source policy, such as original attribute names. The complete change log for this release follows. SETools 3.1: SETools: * All tools that open a policy now support loadable policy modules. Command line tools expect the first module to be a base module followed optionally by any other modules. Graphical tools have a new open policy dialog to select a base module and any number of additional modules. * Release of RPM packages that are compatible with Fedora Core 5 and 6. The spec and support files are in packages/rpm. libapol: * New class apol_policy_path_t to represent a base policy and any number of modules. Use this whenever referring to the file or files constituting a policy. libqpol: * Policy features such as attribute names or MLS can now be queried individally via qpol_policy_has_capability() rather than inferred by policy type and version. * New class qpol_module_t to represent a particular policy module prior to it being linked into a base policy (qpol_policy_t). libseaudit: * Rewrite of library to have proper namespaces. libseaudit is now fully documented and suitable for third-party users. seaudit: * Rewrite to use new libseaudit. * Numerous tweaks to the interface to be more user friendly. seaudit-report: * Rewrite to use new libseaudit. sediffx: * Numerous tweaks to the interface to be more user friendly. -- Chris PeBenito Tresys Technology, LLC (410) 290-1411 x150

1 0

ANN: NSA Director of Information Assurance to be Keynote Speaker at SELinux Symposium
by Frank Mayer 07 Feb '07

07 Feb '07

All, we just announced that Richard Schaeffer, NSA Director of Information Assurance, will be a keynote speaker at the SELinux symposium this March (I've attached the press release below). He joins Daniel Frye of IBM as our two keynote speakers this year. As a reminder early registration ends February 23. After that date the conference rate goes up some, but as important, the block of reserved hotel rooms for the conference are no longer assured. So if you are planning to come to the symposium this year, I recommend you register by that date. Regards, Frank -=-=-=-=-=-=-=-=-=-=-=-=-=- FOR IMMEDIATE RELEASE CONTACT: info(a)selinux-symposium.org National Security Agency Director of Information Assurance to be Keynote Speaker at Third Security Enhanced Linux Symposium Baltimore, MarylandFebruary 7, 2007 Richard Schaeffer, Director of Information Assurance for the National Security Agency (NSA), will be a keynote speaker for the third annual Security Enhanced Linux (SELinux) Symposium (www.selinux-symposium.org) scheduled for March 12-16, 2007 in Baltimore, Maryland. The Information Assurance Directorate (IAD) is the NSA mission element charged with providing products and services critical to protecting the United States¹ national security systems. IAD is also responsible for defining and implementing the Information Assurance Strategy to protect the Department of Defense¹s (DoD) Global Information Grid (GIG). Moreover, IAD supports ongoing military operations against terrorism by delivering solutions that allow the secure and dynamic sharing of information across security domains at multiple classification levels in today¹s net-centric environment. Consistent with its national security mission, NSA originally developed and publicly released SELinux as a demonstration that high-end security access control features could be successfully integrated into mainstream open source technology. At this year¹s symposium, Mr. Schaeffer will present a keynote address entitled ³SELinux: An Example of a Better Path to Information Assurance through Partnership.² In this address, Mr. Schaeffer will discuss the benefits to both Government and business organizations that can be gained by working with the open source community. About the SELinux Symposium The Security Enhanced Linux (SELinux) Symposium is an annual exchange of ideas, technology, and research involving SELinux. SELinux is emerging technology that adds flexible, strong mandatory access control security to Linux. The third annual symposium is scheduled for March 12-16, 2007 in Baltimore, Maryland, USA. This year's symposium is sponsored by Hewlett-Packard, IBM, Red Hat, and Tresys Technology. The event brings together experts from business, government, and academia to share research, development, and application experiences using SELinux. For information on registration and sponsorship opportunities, see www.selinux-symposium.org.

1 0

Mail problems...
by melaina＠libero.it 06 Feb '07

06 Feb '07

Hello! I have just started playing a bit with SELinux in permissive mode on my system. I have qmail with spamassassin installed; the only AVC denied messages I get (after I relabeled the system and fixed domains on a couple of log files), is the following: Jan 30 20:23:13 drake kernel: audit(1170210193.998:8): avc: denied { read } for pid=11862 comm="sendmail" name="RsmVLSTr" dev=loop0 ino=20 scontext=user_u: system_r:system_mail_t tcontext=user_u:object_r:httpd_sys_script_rw_t tclass=fil e Jan 30 20:23:13 drake kernel: audit(1170210193.998:9): avc: denied { read wr ite } for pid=11862 comm="sendmail" name="jk-runtime-status" dev=hda5 ino=49827 49 scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:httpd_log_t tclass=file Jan 30 20:23:14 drake kernel: audit(1170210194.019:10): avc: denied { ioctl } for pid=11863 comm="qmail-scanner-q" name="error_log" dev=hda5 ino=4984894 sc ontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:httpd_log_t tcla ss=file Jan 30 20:23:14 drake kernel: audit(1170210194.026:11): avc: denied { read } for pid=11863 comm="sperl5.8.5" name="mounts" dev=proc ino=777453584 scontext= user_u:system_r:system_mail_t tcontext=user_u:system_r:system_mail_t tclass=file Jan 30 20:23:14 drake kernel: audit(1170210194.026:12): avc: denied { getatt r } for pid=11863 comm="sperl5.8.5" name="mounts" dev=proc ino=777453584 sconte xt=user_u:system_r:system_mail_t tcontext=user_u:system_r:system_mail_t tclass=f ile Jan 30 20:23:15 drake kernel: audit(1170210195.204:13): avc: denied { append } for pid=11863 comm="perl5.8.5" name="qmail-queue.log" dev=hda5 ino=5130271 s context=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tcl ass=file Jan 30 20:23:15 drake kernel: audit(1170210195.204:14): avc: denied { ioctl } for pid=11863 comm="perl5.8.5" name="qmail-queue.log" dev=hda5 ino=5130271 sc ontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tcla ss=file Jan 30 20:23:15 drake kernel: audit(1170210195.205:15): avc: denied { getatt r } for pid=11863 comm="perl5.8.5" name="qmail-queue.log" dev=hda5 ino=5130271 scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tc lass=file Jan 30 20:23:15 drake kernel: audit(1170210195.206:16): avc: denied { read } for pid=11863 comm="perl5.8.5" name="qmail-scanner-queue-version.txt" dev=hda5 ino=5130273 scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:v ar_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.208:17): avc: denied { write } for pid=11863 comm="perl5.8.5" name="tmp" dev=hda5 ino=5195094 scontext=user_ u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.208:18): avc: denied { add_na me } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com1170210195772118 63" scontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:var_spool_ t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.208:19): avc: denied { create } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863 " scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:var_spool_t tc lass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.409:20): avc: denied { create } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863 " scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:var_spool_t tc lass=file Jan 30 20:23:15 drake kernel: audit(1170210195.410:21): avc: denied { ioctl } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.410:22): avc: denied { getatt r } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com11702101957721186 3" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:o bject_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.414:23): avc: denied { write } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.418:24): avc: denied { link } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:obje ct_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.419:25): avc: denied { remove _name } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com1170210195772 11863" dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=syst em_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.419:26): avc: denied { unlink } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863 " dev=hda5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:ob ject_r:var_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.424:27): avc: denied { read w rite } for pid=11864 comm="sh" name="tty" dev=tmpfs ino=1804 scontext=user_u:sy stem_r:system_mail_t tcontext=system_u:object_r:devtty_t tclass=chr_file Jan 30 20:23:15 drake kernel: audit(1170210195.431:28): avc: denied { read } for pid=11865 comm="sh" name="drake.mydomain.com117021019577211863" dev=hda 5 ino=5276868 scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:va r_spool_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.434:29): avc: denied { write } for pid=11865 comm="reformime" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5408221 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.434:30): avc: denied { add_na me } for pid=11865 comm="reformime" name="1170210195.11865-0.drake.mydomain. com" scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.739:31): avc: denied { read } for pid=11863 comm="perl5.8.5" name="drake.mydomain.com117021019577211863" dev=hda5 ino=5408221 scontext=user_u:system_r:system_mail_t tcontext=user_u:obje ct_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.755:32): avc: denied { read } for pid=11863 comm="perl5.8.5" name="tmp" dev=hda5 ino=4980740 scontext=user_u :system_r:system_mail_t tcontext=system_u:object_r:var_t tclass=lnk_file Jan 30 20:23:15 drake kernel: audit(1170210195.795:33): avc: denied { execut e } for pid=11867 comm="perl5.8.5" name="find" dev=hda5 ino=5297451 scontext=us er_u:system_r:system_mail_t tcontext=system_u:object_r:file_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.796:34): avc: denied { execut e_no_trans } for pid=11867 comm="perl5.8.5" name="find" dev=hda5 ino=5297451 sc ontext=user_u:system_r:system_mail_t tcontext=system_u:object_r:file_t tclass=fi le Jan 30 20:23:15 drake kernel: audit(1170210195.796:35): avc: denied { read } for pid=11867 comm="perl5.8.5" name="find" dev=hda5 ino=5297451 scontext=user_ u:system_r:system_mail_t tcontext=system_u:object_r:file_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.798:36): avc: denied { search } for pid=11867 comm="find" name="selinux" dev=hda5 ino=557257 scontext=user_u :system_r:system_mail_t tcontext=system_u:object_r:selinux_config_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.798:37): avc: denied { read } for pid=11867 comm="find" name="config" dev=hda5 ino=557274 scontext=user_u:sy stem_r:system_mail_t tcontext=user_u:object_r:selinux_config_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.798:38): avc: denied { getatt r } for pid=11867 comm="find" name="config" dev=hda5 ino=557274 scontext=user_u :system_r:system_mail_t tcontext=user_u:object_r:selinux_config_t tclass=file Jan 30 20:23:15 drake kernel: audit(1170210195.860:39): avc: denied { read } for pid=11871 comm="rm" name="qscan" dev=hda5 ino=5130256 scontext=user_u:syst em_r:system_mail_t tcontext=system_u:object_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.860:40): avc: denied { remove _name } for pid=11871 comm="rm" name="1170210195.11865-0.drake.mydomain.com" dev=hda5 ino=5408222 scontext=user_u:system_r:system_mail_t tcontext=user_u:obj ect_r:var_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.861:41): avc: denied { rmdir } for pid=11871 comm="rm" name="drake.mydomain.com117021019577211863" dev=hd a5 ino=5408221 scontext=user_u:system_r:system_mail_t tcontext=user_u:object_r:v ar_spool_t tclass=dir Jan 30 20:23:15 drake kernel: audit(1170210195.873:42): avc: denied { sigchl d } for pid=1 comm="init" scontext=user_u:system_r:system_mail_t tcontext=user_ u:system_r:unconfined_t tclass=process Any directions to fix this? Thanks! ------------------------------------------------------ Mutuo da 200.000 ? Tassi ridotti da 4.25%. Solo per richieste online. Mutuionline.it http://click.libero.it/mutuionline31ge07

2 1

prelink AVC
by Tom London 06 Feb '07

06 Feb '07

Latest rawhide, targeted/enforcing: type=AVC msg=audit(1170548651.391:53): avc: denied { read } for pid=7741 comm="prelink" name="ssh-agent" dev=dm-0 ino=5479875 context=system_u:system_r:prelink_t:s0-s0:c0.c1023 context=system_u:object_r:ssh_agent_exec_t:s0 tclass=file type=SYSCALL msg=audit(1170548651.391:53): arch=40000003 syscall=5 success=no exit=-13 a0=9022ce8 a1=8000 a2=0 a3=0 items=0 ppid=7732 pid=7741 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="prelink" exe="/usr/sbin/prelink" subj=system_u:system_r:prelink_t:s0-s0:c0.c1023 key=(null) tom -- Tom London

2 1

Crossover
by Göran Uddeborg 06 Feb '07

06 Feb '07

Crossover installs under /opt/cxoffice by default. The rules for wine-style programs does not seem to cover that hierarchy, and just trying to run things gives a lot of denied execmods. I assume just mirroring the settings for regular wine is fine for Crossover too: /opt/cxoffice/lib/wine/.+\.so system_u:object_r:textrel_shlib_t:s0 /opt/cxoffice/bin/wine system_u:object_r:wine_exec_t:s0 I changed the files (only directly with chcon) and it appears to work. At least so far, we have not used this too much yet. Does this make sense? Do you want a bugzilla about it?

2 1

audit message on shutdown
by Davide Bolcioni 04 Feb '07

04 Feb '07

Greetings, I have been seeing an elusive message on shutdown, along the lines of audit(...) user uid=0 auid=4294967295 subj=system_u:system_r:hwclock_t:s0 msg='changing system time ... res=success)' and apparently harmless, since the clock is running ok on subsequent boot (but I am using NTP). Is it safe to ignore this or should I dig deeper ? Thank you for your consideration, Davide Bolcioni -- There is no place like /home.

2 1

making a user create files as "user_u:system_r:httpd_t"
by Hugo Martin Campos V. 01 Feb '07

01 Feb '07

Hello list, I am analyzing a HTTPd server working with SELinux in permissive mode before I enforce it. The problem I've seen so far begins when the .html .php files get uploaded by the person in charge and they are labeled as "system_u:object_r:default_t" and the label needs to be "user_u:system_r:httpd_t" The resulting error: avc: denied { getattr } for pid=8244 comm="httpd" name="/" dev=hda5 ino=2 scontext=user_u:system_r:httpd_t tcontext=system_u:object_r:default_t tclass=dir I added that folder to be labeled as "user_u:system_r:httpd_t" in "/etc/selinux/targeted/src/policy/file_contexts/file_contexts" to relabel it with "fixfiles restore" (and it works) but it's not practical to relabel everything everytime that user uploads a webpage. What should I do?? My knowledge goes as far as labeling, do I need to set roles? or should I follow audit2allow advice for now. It would just be cool to autolabel every file uploaded by that user as "user_u:system_r:httpd_t" Thanks, Hugo Martin --------------------------------- Preguntá. Respondé. Descubrí. Todo lo que querías saber, y lo que ni imaginabas, está en Yahoo! Respuestas (Beta). Probalo ya!

3 3

Java problems on FC6/strict
by Ted Rule 01 Feb '07

01 Feb '07

To begin at the beginning... I was trying to configure my FC6 machine so that I could run the OpenOffice SVG Import Filter here: http://www.ipd.uka.de/~hauma/svg-import/ I also wanted to be able to run Java as a plugin to Firefox-2.0.0.1. FFX2 runs Ok on FC6 - it just needs a few minor SELinux workrounds. The big problem with the SVG Import Filter is that it requires Java 1.5, so I've always assumed that the GNU Java 1.4.2 compatible RPMs won't support some of the more esoteric Java API functions. Hence the perceived need to install the latest Sun Java RPMs. I previously had both Sun-Java/Firefox and OpenOffice/SVG-Import working Ok on FC4 - again with a few minor policy patches. So I duly installed Sun's jre-1.5.0_10 RPM, and for good measure I manually adjusted the /etc/alternatives/java settings to make /usr/bin/java point to Sun. I also "execstack -l"'ed all the Sun Libraries so as to reduce the propensity for it to need exectack/execmem/execmod permissions. With all this in place, I ran up OpenOffice, going to Tools -> Options -> Java in an attempt to select Sun Java as the prefered JVM. Needless to say, avc's galore showed up in /var/log/messages. After quite a while trying to tweak SELinux policy to suit, I gave up the fight and decided that my next best option was to simply tweak file labels and policy so that Java was executed in user_t rather than user_javaplugin_t. I therefore gave bin/java bin/java_vm and bin/javaws in Sun-jre a "java_notrans_exec_t" label, and added can_exec(user_t, java_notrans_exec_t) The last hurdle was that Sun JRE is full of execstack/execmem/execmod problems - still - so I had to enable the global allow_execmem boolean - only. With all of this in place, and with NO relabel of the GNU Java binaries on the same box or any other policy changes to user_t permissions, I was finally able to see Sun Java as a valid JVM from inside OpenOffice. However, I noted that GNU Java was still throwing up lots of avc's when I opened OpenOffice -> Tools -> Options -> Java As an example of the avc's generated by staff_javaplugin_t trying to open GNU Java from OpenOffice, I have this log snippet: [root@topaz log]# grep gij messages| grep 14:26:47 | grep -v granted Feb 1 14:26:47 topaz kernel: audit(1170340007.573:4914): avc: denied { write } for pid=6774 comm="gij" name="[32609]" dev=pipefs ino=32609 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=fifo_file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4915): avc: denied { write } for pid=6774 comm="gij" name="[32610]" dev=pipefs ino=32610 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=fifo_file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4916): avc: denied { read } for pid=6774 comm="gij" name="[32525]" dev=pipefs ino=32525 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=fifo_file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4917): avc: denied { write } for pid=6774 comm="gij" name="[32525]" dev=pipefs ino=32525 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=fifo_file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4918): avc: denied { read } for pid=6774 comm="gij" name="[32528]" dev=pipefs ino=32528 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=fifo_file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4919): avc: denied { write } for pid=6774 comm="gij" name="[32528]" dev=pipefs ino=32528 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=fifo_file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4920): avc: denied { read } for pid=6774 comm="gij" name="[32529]" dev=pipefs ino=32529 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=fifo_file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4921): avc: denied { write } for pid=6774 comm="gij" name="[32529]" dev=pipefs ino=32529 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=staff_u:staff_r:staff_t:s0 tclass=fifo_file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4922): avc: denied { read } for pid=6774 comm="gij" name="ooo680en-US.res" dev=hda6 ino=1760867 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4923): avc: denied { read } for pid=6774 comm="gij" name="ofa680en-US.res" dev=hda6 ino=1760866 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4924): avc: denied { read } for pid=6774 comm="gij" name="ooo680en-US.res" dev=hda6 ino=1760867 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4925): avc: denied { read } for pid=6774 comm="gij" name="sfx680en-US.res" dev=hda6 ino=1760876 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4926): avc: denied { read } for pid=6774 comm="gij" name="vcl680en-US.res" dev=hda6 ino=1760888 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4927): avc: denied { read } for pid=6774 comm="gij" name="sw680en-US.res" dev=hda6 ino=1760881 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4928): avc: denied { read } for pid=6774 comm="gij" name="svx680en-US.res" dev=hda6 ino=1760880 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4929): avc: denied { read } for pid=6774 comm="gij" name="svt680en-US.res" dev=hda6 ino=1760879 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.574:4930): avc: denied { read write } for pid=6774 comm="gij" name="svdb.tmp" dev=hda5 ino=219746 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=staff_u:object_r:staff_tmp_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.826:4952): avc: denied { getattr } for pid=6774 comm="gij" name="JREProperties.class" dev=hda6 ino=1729341 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.826:4953): avc: denied { getattr } for pid=6774 comm="gij" name="JREProperties.class" dev=hda6 ino=1729341 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.827:4954): avc: denied { getattr } for pid=6774 comm="gij" name="JREProperties.class" dev=hda6 ino=1729341 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.827:4955): avc: denied { read } for pid=6774 comm="gij" name="JREProperties.class" dev=hda6 ino=1729341 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file Feb 1 14:26:47 topaz kernel: audit(1170340007.847:4960): avc: denied { execute } for pid=6783 comm="gij" name="addr2line" dev=hda6 ino=359825 scontext=staff_u:staff_r:staff_javaplugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file [root@topaz log]# Running up Sun Java inside Firefox I came across a similar set of problems, and was similarly forced to run Sun java in user_mozilla_t instead of user_javaplugin_t to get it to work. I haven't bothered to try and run GNU Java inside Firefox, as yet. As with user_t, I had to grant user_mozilla_t execmem permissions because of the broken Sun binaries. The Java "test page" I was using in Firefox is here, FWIW: http://www.java.com/en/download/help/testvm.xml Meanwhile, for historical background: Looking back at the FC4 policy, I seems that Java run from user_t has no corresponding javaplugin_domain() definition in base_user_macros.te and hence would always have run in user_t. Meanwhile, on FC4, Java run from user_mozilla_t would run in user_mozilla_javaplugin_t. By contrast, FC6 seems to run java in user_javaplugin_t irrespective of whether one starts from user_t or user_mozilla_t; this just seems a bit odd to me. To ease the problems associated with running Java from OpenOffice, could I therefore request that an extra boolean be added to policy, namely "disable_java_trans", which defaults OFF, and can be enabled to achieve the same effect as my manual relabel for both user_t and user_mozilla_t domains. I would also like to try and disable the execmem boolean, but obviously that requires a recompile of the entire Sun RPM from scratch. Does anyone on this list know who we might approach at Sun so as to get them to rebuild their JVM with a newer/cleaner compiler toolkit? As with previous postings, I'm currently running selinux-policy-strict-2.4.6-27 -- Ted Rule Director, Layer3 Systems Ltd W: http://www.layer3.co.uk/

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux February 2007