April 2007 - selinux - Fedora mailing-lists

Confining TeX
by Jan Kasprzak 09 Oct '07

09 Oct '07

Hello, I am implementing a remote TeX server for our users, and I would like to confine it using SELinux (FC6, targeted policy). I need help or suggestions on possible approaches. What I want to do is the following: - I have a TeX installation in a separate directory - I want local users to be able to run TeX commands without restrictions - I want to have a daemon, running under a separate user, which will handle remote requests for TeX compilation. Under this user/daemon the TeX commands should be confined, so that they can only read TeX data files (the texmf/ tree), execute the TeX sub-commands (i.e. files under <texroot>/bin/ directory) - including the rights to the system libraries, locales, etc. as necessary. And the confined processes should write only to the texmf-var tree (autogenerated bitmap fonts, etc.) and to the temporary directory, reserved for TeX outputs (logs, DVI files, dvips outputs, etc.). My current solution is to create the tex_t domain, and tex_exec_t, tex_data_t, and tex_tmp_t file types, and make the daemon run "runcon -t tex_t -- tex myfile.tex" instead of plain "tex myfile.tex". Maybe there are better approaches than this: - maybe the "runcon" is not necessary, and TeX executables can be made to enter the tex_t domain automatically, when started by the UNIX user under which the daemon runs. - or maybe I should use SELinux users or roles instead of domains (?) - or maybe the daemon should run under its own special domain? The "runcon" approach allows local users to compile also untrusted TeX sources - i.e. they can be able to run TeX either under their own context, or via "runcon" in the confined mode. Any suggestions? -Yenya -- | Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> | | GPG: ID 1024/D3498839 Fingerprint 0D99A7FB206605D7 8B35FCDE05B18A5E | | http://www.fi.muni.cz/~kas/ Journal: http://www.fi.muni.cz/~kas/blog/ | > I will never go to meetings again because I think face to face meetings < > are the biggest waste of time you can ever have. --Linus Torvalds <

2 2

Nagios Web Interface and SELinux
by Ryan Skadberg 12 Sep '07

12 Sep '07

I have been trying to get nagios up and running on 2 different machines. One running FC5 and one running FC6. Nagios itself starts up fine, but the web interface fails miserably. When looking at /var/log/messages, I see things like: Dec 3 11:38:17 xray kernel: audit(1165174697.348:289): avc: denied { execute_no_trans } for pid=22237 comm="httpd" name="tac.cgi" dev=dm-0 ino=11272226 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file I noticed in the selinux-policy-targeted Changelog: * Wed Jul 26 2006 Dan Walsh <dwalsh(a)redhat.com> 2.3.3-13 - Add nagios policy This may have been for the program itself or maybe the web interface, but it sure doesn't seem to be working for me. Both systems are set to: SELINUX=enforcing SELINUXTYPE=targeted SETLOCALDEFS=0 Anyone have any advice on how to fix this? Thanks! Skadz

3 4

apache 4.1 & SELinux on FC6
by Philip 09 May '07

09 May '07

List, I'm performing a bit of an experiment setting up some software on FC6 and confining it in an SELinux domain. In taking a survey of potential obstacles, I've run into something that I'm hoping y'all can provide some guidance on. The application I'm setting up was initially deployed on RHEL4 (SELinux disabled) and thus depends on MySQL (version 4.1). In developing policy I'd really like to use the most up to date modular policy from FC6 (anticipating our transition to RHEL5), but the MySQL packaged in FC6 is 5.0. From my perspective, my options are: (1) try using MySQL 5.0 and hope the application doesn't break (cross your fingers) (2) install MySQL 4.1 (from source / older package) and try to use the FC6 policy for MySQL 5.0 and hope that works. I'm not really sure which is the best choice (though option 1 does seem like higher risk) so I thought I'd ask for some advice. Has anyone used the FC6 MySQL policy with older versions of MySQL? Am I nuts for even trying this? There's another team working to bring this software up to date for deployment on RHEL5 but naturally our efforts are in parallel so I can't benefit from their work just yet (nor can I, or do I want to monkey around in their Java code). I could always develop my policy on the older RHEL4 platform and use our standard build but when integration begins that would put me way behind the ball as (from what I understand) the policy in RHEL5 is vastly improved / different, which is why I'm trying to use FC6 in my initial tests. Any help / guidance / insight would be much appreciated. TIA, - Philip

1 1

trouble using runcon
by Clarkson, Mike R (US SSA) 02 May '07

02 May '07

Whenever I use runcon in my script, I get the error "root:system_r:datalabeler_t:s0-s15:c0.c255 is not a valid context", regardless of the user, role, type, and mls level that I specify with the runcon command. Infact, even when I specify the context that I'm already running in with the runcon statement, I get the above error. So for instance, if I run the script WITHOUT the runcon command, it runs fine with the following security context (verified with a ps -efZ command): root:system_r:datalabeler_t:s0-s15:c0.c255. But if I run the script with a runcon statement that specifies the exact same user, role, type, and mls level I get the error shown above. My script runs in a domain named datalabeler_t (I don't have the problem when running a similar script in the unconfined_t domain). It kicks off a java process with the following line: java mls.SimulatedImport.SimulatedDataLabeler $argv[*] When I add the runcon statement, I get the above error: runcon -u root -r system_r -t datalabeler_t java mls.SimulatedImport.SimulatedDataLabeler $argv[*] I am using an selinux policy that I built as an mls policy off the targeted policy. Ultimately what I'd like to be able to do is to use the runcon statement to specify an mls level, but I need to get past this first. Any help would be appreciated. Thanks

2 2

portcon in a policy module?
by Rob Myers 30 Apr '07

30 Apr '07

hello- i tried to assign a port type in a policy module like so: portcon tcp 1521 system_u:object_r:oracle_port_t:s0; which fails unless i rebuild as a monolithic policy. should this fail or have i got something wrong? i have found that using "semanage port -a -t oracle_port_t -p tcp 1521" in the rpm post install script works. what is the proper way to assign a port in a policy module? thanks for any clues! rob.

3 2

getcon/setcon
by Clarkson, Mike R (US SSA) 30 Apr '07

30 Apr '07

getcon and all of its variants as well as setcon do not seem to be installed on my RHEL5 system. Are these commands part of a separate rpm that I need to install?

3 2

service and system-config-services restart daemons in incorrect type under mls policy
by Joe Nall 27 Apr '07

27 Apr '07

I'm running an mls/permissive policy on FC6 and service and system- config-services start daemons in the user's selinux context rather than those in /etc/selinux/mls/contexts/initrc_context. Since our policies use init_daemon_domain to establish domain transitions, they are not transitioning into the correct domain on user initiated (re) starts. "run_init service <service> restart" - works, but leaves us in a situation where documentation doesn't match experience. What is the right approach to getting the transitions to work properly? Patch service and friends? Write a more generic transition? joe

3 5

What is special about /home?
by Forrest Taylor 27 Apr '07

27 Apr '07

I have a .fc file that contains: /home/dir(/.*)? system_u:object_r:tmp_t:s0 When I create the directory, it gets user_home_dir_t and files in the directory get user_home_t. After I load the module, restorecon will not change the permissions on the directory or files. So, what is special about those types? I thought at first that they may be customizable types, but they aren't listed in the file. semanage fcontext doesn't show them either. Any clues? Thanks, Forrest

2 3

Helper program for a daemon
by Al Pacifico 26 Apr '07

26 Apr '07

I (a greenhorn with selinux) am writing a policy for a daemon that streams music files over my home network to a music player client (a Slimdevices Squeezebox). My OS is FC5. The main daemon (/usr/sbin/slimserver) is a perl script that serves the music files and is started with an init script. My questions have to do with a secondary program (/usr/sbin/slimserver-scanner, also a perl script) that scans the music on the server, reading mp3 tags and such, and generates a database of stored music that is stored in a MySQL database. /usr/sbin/slimserver-scanner is invoked by the /usr/sbin/slimserver daemon and might be invoked by the user (although I can't recall ever doing so in several years of owning a Squeezebox). I've been following the example posted by Dan Walsh in a blog at http://danwalsh.livejournal.com/8707.html?thread=39171 which has been extremely helpful. My (2) questions: 1. What is the appropriate file context for the scanner program? system_u:object_r:sbin_t? system_u:object_r:slimserver_t? system_u:object_r:slimserver_exec_t? The generated slimserver.fc file contains: # slimserver executable will have: # label: system_u:object_r:slimserver_exec_t # MLS sensitivity: s0 # MCS categories: <none> /usr/sbin/slimserver -- gen_context(system_u:object_r:slimserver_exec_t,s0) /var/run/slimserver.pid gen_context(system_u:object_r:slimserver_var_run_t,s0) /var/log/slimserver gen_context(system_u:object_r:slimserver_var_log_t,s0) and the slimserver.if file contains: interface(`slimserver_domtrans',` gen_require(` type slimserver_t, slimserver_exec_t; ') domain_auto_trans($1,slimserver_exec_t,slimserver_t) allow $1 slimserver_t:fd use; allow slimserver_t $1:fd use; allow slimserver_t $1:fifo_file rw_file_perms; allow slimserver_t $1:process sigchld; ') 2. There is no reason to add the scanner program be added to slimserver.fcthat was generated by policygentool, is there? The file itself just needs to be labeled appropriately, right? Or does that file play some role in policy compilation in a step that I did not explicitly executed when I invoked 'make -f /usr/share/selinux/devel/Makefile'? Thanks in advance. -al -- Al Pacifico Seattle, WA

3 7

bind-chroot selinux problems on log file
by Thomas Vander Stichele 25 Apr '07

25 Apr '07

I want to take this particular bug as a way of figuring out how to "fix" bigs and provide patches. On FC5, with bind-chroot installed, /var/named/chroot/var/log is labeled as S_Context: system_u:object_r:named_conf_t This causes audit messages like: audit(1177506082.955:23904): avc: denied { getattr } for pid=2781 comm="named" name="debug.log" dev=dm-0 ino=2850829 scontext=root:system_r:named_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file and the log files aren't being written to. When I manually change files: chcon -R system_u:object_r:var_log_t log/ it works. Of course, a restorecon resets to named_conf_t. Is the best way to fix this, straight in the selinux source policy ? Or should I create an add-on .te and load it to override ? Thomas

2 1

RE : fedora-selinux-list Digest, Vol 38, Issue 17
by sonie darabe 25 Apr '07

25 Apr '07

--> answer in your mail body! fedora-selinux-list-request(a)redhat.com a écrit : Send fedora-selinux-list mailing list submissions to fedora-selinux-list(a)redhat.com To subscribe or unsubscribe via the World Wide Web, visit https://www.redhat.com/mailman/listinfo/fedora-selinux-list or, via email, send a message with subject or body 'help' to fedora-selinux-list-request(a)redhat.com You can reach the person managing the list at fedora-selinux-list-owner(a)redhat.com When replying, please edit your Subject line so it is more specific than "Re: Contents of fedora-selinux-list digest..." Today's Topics: 1. using runcon -l s1 (Clarkson, Mike R (US SSA)) 2. Re: using runcon -l s1 (Daniel J Walsh) 3. Re: Helper program for a daemon (Al Pacifico) ---------------------------------------------------------------------- Message: 1 Date: Mon, 23 Apr 2007 10:22:11 -0700 From: "Clarkson, Mike R $US SSA$" Subject: using runcon -l s1 To: Message-ID: Content-Type: text/plain; charset="us-ascii" I am trying to figure out how to get "runcon -l s1" to work while having selinux in enforcing mode. So far, I can only use the runcon command successfully with selinux in permissive mode. Here is the error I get when in enforcing mode: >runcon -l s1 ./SimulatedImport /home/m252/SimulatedImport/output/junk execvp: Permission denied --> you should know that enforcing mode makes that SELinux will be fully activated that meens policies are respected ans as a user you have a role and this role will assign to you specific permissions!!! that's why you get this message your role doesn't give you access to this permission. this the principal way for protection of SELinux. My shell is running as root in the unconfined_t domain. Here is the output of id -Z: root:system_r:unconfined_t:s0-s15:c0.c255 -->this context is assigned to root as défault context. you can modify it with newrole The executable that I'm trying to run with runcon is "SimulatedImport". This is a very simple program which simply creates a small text file. I have created a domain named "import_t" for this program. I have an selinux policy that I built as an mls policy off the targeted policy. When I run audit2allow I get the following: audit2allow -i /var/log/audit/audit.log -l -v -r require { class dir search; class file { getattr read }; class process transition; type auditd_log_t; type unconfined_t; role system_r; }; allow unconfined_t auditd_log_t:dir search; #TYPE=AVC MSG=audit(1177347232.381:45684): COMM="audit2allow" NAME="audit" : search #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" NAME="audit" : search allow unconfined_t auditd_log_t:file { getattr read }; #TYPE=AVC MSG=audit(1177347344.098:45699): COMM="audit2allow" NAME="audit.log" : getattr #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" NAME="audit.log" : read allow unconfined_t self:process transition; #TYPE=AVC MSG=audit(1177347223.780:45683): COMM="runcon" NAME="SimulatedImport" : transition Adding "allow unconfined_t self:process transition;" to my "import" module seems to have no effect. -->i think you should use allow for transition from a domain to another so i don't thik that this rule you added is right. Any help would be appreciated. Thanks, Mike -------------- next part -------------- An HTML attachment was scrubbed... URL: https://www.redhat.com/archives/fedora-selinux-list/attachments/20070423/f6… ------------------------------ Message: 2 Date: Tue, 24 Apr 2007 08:31:49 -0400 From: Daniel J Walsh Subject: Re: using runcon -l s1 To: "Clarkson, Mike R (US SSA)" Cc: fedora-selinux-list(a)redhat.com Message-ID: <462DF8B5.5060301(a)redhat.com> Content-Type: text/plain; charset=windows-1252; format=flowed Clarkson, Mike R (US SSA) wrote: > > I am trying to figure out how to get runcon l s1 to work while > having selinux in enforcing mode. So far, I can only use the runcon > command successfully with selinux in permissive mode. Here is the > error I get when in enforcing mode: > > >runcon -l s1 ./SimulatedImport /home/m252/SimulatedImport/output/junk > > execvp: Permission denied > > My shell is running as root in the unconfined_t domain. Here is the > output of id Z: > > root:system_r:unconfined_t:s0-s15:c0.c255 > > The executable that Im trying to run with runcon is > SimulatedImport. This is a very simple program which simply creates > a small text file. I have created a domain named import_t for this > program. > > I have an selinux policy that I built as an mls policy off the > targeted policy. > > When I run audit2allow I get the following: > > audit2allow -i /var/log/audit/audit.log -l -v -r > > require { > > class dir search; > > class file { getattr read }; > > class process transition; > > type auditd_log_t; > > type unconfined_t; > > role system_r; > > }; > > allow unconfined_t auditd_log_t:dir search; > > #TYPE=AVC MSG=audit(1177347232.381:45684): COMM="audit2allow" > NAME="audit" : search > > #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" > NAME="audit" : search > > allow unconfined_t auditd_log_t:file { getattr read }; > > #TYPE=AVC MSG=audit(1177347344.098:45699): COMM="audit2allow" > NAME="audit.log" : getattr > > #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" > NAME="audit.log" : read > > allow unconfined_t self:process transition; > > #TYPE=AVC MSG=audit(1177347223.780:45683): COMM="runcon" > NAME="SimulatedImport" : transition > > Adding allow unconfined_t self:process transition; to my import > module seems to have no effect. > I think you are being prevented by a constraint of MLS As a guess I would suggest trying: mls_process_set_level(unconfined_t) > > > Any help would be appreciated. > > Thanks, > > Mike > > ------------------------------------------------------------------------ > > -- > fedora-selinux-list mailing list > fedora-selinux-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-selinux-list ------------------------------ Message: 3 Date: Tue, 24 Apr 2007 08:36:01 -0700 From: "Al Pacifico" Subject: Re: Helper program for a daemon To: fedora-selinux-list(a)redhat.com Cc: Daniel J Walsh Message-ID: <5d3cd4150704240836q7d6627a0qc931aa67461f9082(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" On 4/19/07, Daniel J Walsh wrote: > > Al Pacifico wrote: > > I (a greenhorn with selinux) am writing a policy for a daemon that > > streams music files over my home network to a music player client (a > > Slimdevices Squeezebox). My OS is FC5. > > > > The main daemon (/usr/sbin/slimserver) is a perl script that serves > > the music files and is started with an init script. My questions have > > to do with a secondary program (/usr/sbin/slimserver-scanner, also a > > perl script) that scans the music on the server, reading mp3 tags and > > such, and generates a database of stored music that is stored in a > > MySQL database. /usr/sbin/slimserver-scanner is invoked by the > > /usr/sbin/slimserver daemon and might be invoked by the user (although > > I can't recall ever doing so in several years of owning a Squeezebox). > > > > I've been following the example posted by Dan Walsh in a blog at > > http://danwalsh.livejournal.com/8707.html?thread=39171 which has been > > extremely helpful. > > > > My (2) questions: > > 1. What is the appropriate file context for the scanner program? > > system_u:object_r:sbin_t? > > system_u:object_r:slimserver_t? > > system_u:object_r:slimserver_exec_t? > > > That depends on your security goals. If you want the slimserver-scanner > to have the same privs as slimserver you would label it sbin_t and allow > slimserver to corecmd_exec_sbin(). If you want to go with least privs, > you would create a new policy for slimserver-scanner > (slimserver_scanner_t with file context of slimserver_scanner_exec_t) > and then add a rule to slimserver_t to domtrans > slimserver_scanner_domtrans(slimserver_t) I'm a little confused about this. I want to limit privileges of slimserver and slimserver-scanner to accessing only certain files. If I label slimserver-scanner as 'sbin_t', when a user executes slimserver-scanner, won't he/she have more privileges than slimserver then? > The generated slimserver.fc file contains: > > # slimserver executable will have: > > # label: system_u:object_r:slimserver_exec_t > > # MLS sensitivity: s0 > > # MCS categories: > > > > /usr/sbin/slimserver -- > > gen_context(system_u:object_r:slimserver_exec_t,s0) > > /var/run/slimserver.pid > > gen_context(system_u:object_r:slimserver_var_run_t,s0) > > /var/log/slimserver > > gen_context(system_u:object_r:slimserver_var_log_t,s0) > > > > and the slimserver.if file contains: > > interface(`slimserver_domtrans',` > > gen_require(` > > type slimserver_t, slimserver_exec_t; > > ') > > > > domain_auto_trans($1,slimserver_exec_t,slimserver_t) > > > > allow $1 slimserver_t:fd use; > > allow slimserver_t $1:fd use; > > allow slimserver_t $1:fifo_file rw_file_perms; > > allow slimserver_t $1:process sigchld; > > ') > > > > 2. There is no reason to add the scanner program be added to > > slimserver.fc that was generated by policygentool, is there? > Only if you are creating a context for slimserver_scanner_exec_t, > otherwise just let it be labeled sbin_t. > > The file itself just needs to be labeled appropriately, right? Or does > > that file play some role in policy compilation in a step that I did > > not explicitly executed when I invoked 'make -f > > /usr/share/selinux/devel/Makefile'? > > > > Thanks in advance. > > -al > > -- > > Al Pacifico > > Seattle, WA > > ------------------------------------------------------------------------ > > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > -- Al Pacifico Seattle, WA -------------- next part -------------- An HTML attachment was scrubbed... URL: https://www.redhat.com/archives/fedora-selinux-list/attachments/20070424/4e… ------------------------------ -- fedora-selinux-list mailing list fedora-selinux-list(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list End of fedora-selinux-list Digest, Vol 38, Issue 17 *************************************************** --------------------------------- Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses.

1 0

using runcon -l s1
by Clarkson, Mike R (US SSA) 24 Apr '07

24 Apr '07

I am trying to figure out how to get "runcon -l s1" to work while having selinux in enforcing mode. So far, I can only use the runcon command successfully with selinux in permissive mode. Here is the error I get when in enforcing mode: >runcon -l s1 ./SimulatedImport /home/m252/SimulatedImport/output/junk execvp: Permission denied My shell is running as root in the unconfined_t domain. Here is the output of id -Z: root:system_r:unconfined_t:s0-s15:c0.c255 The executable that I'm trying to run with runcon is "SimulatedImport". This is a very simple program which simply creates a small text file. I have created a domain named "import_t" for this program. I have an selinux policy that I built as an mls policy off the targeted policy. When I run audit2allow I get the following: audit2allow -i /var/log/audit/audit.log -l -v -r require { class dir search; class file { getattr read }; class process transition; type auditd_log_t; type unconfined_t; role system_r; }; allow unconfined_t auditd_log_t:dir search; #TYPE=AVC MSG=audit(1177347232.381:45684): COMM="audit2allow" NAME="audit" : search #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" NAME="audit" : search allow unconfined_t auditd_log_t:file { getattr read }; #TYPE=AVC MSG=audit(1177347344.098:45699): COMM="audit2allow" NAME="audit.log" : getattr #TYPE=AVC MSG=audit(1177347344.098:45698): COMM="audit2allow" NAME="audit.log" : read allow unconfined_t self:process transition; #TYPE=AVC MSG=audit(1177347223.780:45683): COMM="runcon" NAME="SimulatedImport" : transition Adding "allow unconfined_t self:process transition;" to my "import" module seems to have no effect. Any help would be appreciated. Thanks, Mike

2 1

labeling files for multiple daemons
by Thomas Vander Stichele 23 Apr '07

23 Apr '07

I have two particular cases I want to make possible: a) have a tree under /home/mirror that can be offered both by httpd and over nfs. How should I label these files ? I assume default file contexts are either/or, so maybe I need to create a custom context type and load custom policy to tell httpd and nfs about it ? Or is there an easier way ? b) Suppose I have /home/file where users can upload files through ftp and webdav, and I again want to export these files over NFS. So, variant on case a) Any help appreciated, Thomas

1 0

Squid cachemgr.cgi AVC denied
by Lamont R. Peterson 23 Apr '07

23 Apr '07

On RHEL5 and FC6, I'm seeing an AVC denied message when trying to use cachemgr.cgi: type=AVC msg=audit(1177002702.300:787): avc: denied { search } for pid=18199 comm="cachemgr.cgi" name="squid" dev=hda5 ino=346594 scontext=root:system_r:httpd_t:s0 tcontext=system_u:object_r:squid_conf_t:s0 tclass=dir If I'm reading this correctly, the problem is that the policy doesn't allow cachmgr.cgi to get it's /etc/squid/cachemgr.conf file because the /etc/squid/ directory (and the cachemgr.conf) file are labeled: # ll -Zd /etc/squid/ drwxr-xr-x root root system_u:object_r:squid_conf_t /etc/squid/ # ll -Z /etc/squid/cachemgr.conf -rw-r--r-- root squid system_u:object_r:squid_conf_t /etc/squid/cachemgr.conf Shall I file a bug for this or is it already known, fixed, work-around-is-available? -- Lamont Peterson <lamont(a)gurulabs.com> Senior Instructor Guru Labs, L.C. [ http://www.GuruLabs.com/ ] NOTE: All messages from this email address should be digitally signed with my 0xDC0DD409 GPG key. It is available on the pgp.mit.edu keyserver as well as other keyservers that sync with MIT's.

2 3

Backing out of changes to file contexts specification
by Al Pacifico 23 Apr '07

23 Apr '07

This is related to the daemon question I asked earlier. I created a problem using policygentool by specifying that a log file is written to by two different binaries with different policies. My thread about "Helper program for a daemon" provides some context (no pun intended). I didn't realize that installing the policy would change the file context specification database (although it makes perfect sense in retrospect). Now, I've inadvertently specified that /var/log/slimserver be labelled under two different contexts in /etc/selinux/targeted/contexts/files/file_contexts and wish to remove the second set of entries. Output of setfiles -n /etc/selinux/targeted/contexts/files/file_contexts $filename includes several messages of the form: /etc/selinux/targeted/contexts/files/file_contexts: Multiple different specifications for /var/log/slimserver (system_u:object_r:slimserver_scanner_var_log_t and system_u:object_r:slimserver_var_log_t). My policy module didn't install correctly because of this error, but the file contexts specification is now incorrect. What is the best way to correct this? 1. Just use sed or vi to eliminate the second specification? 2.Remove both installed policies that I wrote (which are the only non-stock policy modules installed on my FC5 box) using semodule and restore /etc/selinux/targeted/contexts/files/file_contexts from the rpm package file? Keep in mind I'm doing this over ssh to a box with no GUI, so I must use the command line, vi, etc. -al -- Al Pacifico Seattle, WA

3 4

MySQL custom datadir location - other daemons too
by Florin Andrei 23 Apr '07

23 Apr '07

I'm building a log analysis server that's running a big MySQL database. Logs are imported in the database and then are processed for statistical analysis and stuff like that. The system is running CentOS5 64bit (almost identical to RHEL 5). I'm keeping the database on a separate RAID array, for obvious reasons. So I mounted that array as /db and then moved the MySQL datadir via /etc/my.cnf: datadir=/db/mysql tmpdir=/db/tmp/ basedir=/db I made sure to move /var/lib/mysql to /db/mysql in such a way as to preserve all the attributes, including SELinux. But, of course, MySQL fails to run: type=AVC msg=audit(1177025497.442:254): avc: denied { search } for pid=7453 comm="mysqld" name="/" dev=sdb1 ino=2 scontext=root:system_r:mysqld_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir type=SYSCALL msg=audit(1177025497.442:254): arch=c000003e syscall=87 success=no exit=-13 a0=7fff6ee35150 a1=0 a2=0 a3=3 items=0 ppid=7417 pid=7453 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mysqld" exe="/usr/libexec/mysqld" subj=root:system_r:mysqld_t:s0 key=(null) type=AVC msg=audit(1177025497.442:255): avc: denied { search } for pid=7453 comm="mysqld" name="/" dev=sdb1 ino=2 scontext=root:system_r:mysqld_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir type=SYSCALL msg=audit(1177025497.442:255): arch=c000003e syscall=2 success=no exit=-13 a0=7fff6ee35350 a1=42 a2=1b6 a3=3 items=0 ppid=7417 pid=7453 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mysqld" exe="/usr/libexec/mysqld" subj=root:system_r:mysqld_t:s0 key=(null) type=AVC msg=audit(1177025497.442:256): avc: denied { search } for pid=7453 comm="mysqld" name="/" dev=sdb1 ino=2 scontext=root:system_r:mysqld_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir Now, I can definitely customize the policy, I guess the first rule would be like this and I'll keep tweaking it until it works: allow mysqld_t file_t:dir search; But this seems like a hack. I mean, moving the datadir to a different location is probably something that MySQL admins do all the time when building big servers (or maybe even not that big). I wish there was a SELinux variable, or a place where I can tell SELinux that the datadir has moved, that XYZ is the new location, and just let me use it (provided that the SELinux attributes are OK within the MySQL datadir per se). Same thing happens with many servers when moving their default data locations. Examples that I had issues with: Cyrus-IMAPd, Squid. Sure, one can customize the policy the "normal", step-by-step way, but that doesn't seem the right thing. I'm strictly speaking from the sysadmin's perspective. It just looks like a natural thing to be able to customize SELinux via a simple variable or something, and make it "aware" (sort of) that, hey, I only moved the data dir to a new location, stop panicking about that. Thanks, -- Florin Andrei http://florin.myip.org/

3 8

Denied despite permissive mode?
by Andrew Ziem 21 Apr '07

21 Apr '07

Hi, 1. Should I be getting denied in permissive mode? 2. How do I get ntpd working? (Also, smartd has the same problem, but they both used to work some months ago.) [root@z ~]# getsebool -a | grep exec allow_execheap --> on allow_execmem --> on allow_execmod --> on allow_execstack --> on allow_java_execstack --> off httpd_ssi_exec --> on httpd_suexec_disable_trans --> off [root@z ~]# getenforce Permissive [root@z ~]# /sbin/service ntpd start Starting ntpd: SELinux denied execmem. [FAILED] [root@z ~]# cat /etc/fedora-release Fedora Core release 5 (Bordeaux) [root@z ~]# uname -a Linux z.localdomain 2.6.20-1.2312.fc5 #1 Tue Apr 10 15:09:44 EDT 2007 i686 athlon i386 GNU/Linux Andrew

2 2

vlc x86 libs requires text relocation.
by Nicolas Chauvet 20 Apr '07

20 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello! I would like to solve the Selinux context issue with vlc x86 It is supposed to do the same purpose as mplayer do with 32bit codecs dll if there are present on the end-user system. This affect vlc for Fedora release 5, 6 and devel only for x86 (not ppc or x86_64) from https://bugzilla.livna.org/show_bug.cgi?id=1404 - ---- SELinux is preventing /usr/bin/vlc from loading /usr/lib/vlc/codec/libdmo_plugin.so which requires text relocation. SELinux is preventing /usr/bin/vlc from loading /usr/lib/vlc/codec/librealaudio_plugin.so which requires text relocation. I'm not sure if this can be fixed in the vlc package or if it would need to be fixed in the selinux policy package. I'll attach the saved output from setroubleshoot for these denials. - ---- libdmo_plugin denial - ----- Summary SELinux is preventing /usr/bin/vlc from loading /usr/lib/vlc/codec/libdmo_plugin.so which requires text relocation. Detailed Description The /usr/bin/vlc application attempted to load /usr/lib/vlc/codec/libdmo_plugin.so which requires text relocation. This is a potential security problem. Most libraries do not need this permission. Libraries are sometimes coded incorrectly and request this permission. The http://people.redhat.com/drepper/selinux-mem.html web page explains how to remove this requirement. You can configure SELinux temporarily to allow /usr/lib/vlc/codec/libdmo_plugin.so to use relocation as a workaround, until the library is fixed. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Allowing Access If you trust /usr/lib/vlc/codec/libdmo_plugin.so to run correctly, you can change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t /usr/lib/vlc/codec/libdmo_plugin.so" The following command will allow this access: chcon -t textrel_shlib_t /usr/lib/vlc/codec/libdmo_plugin.so Additional Information: Source Context: user_u:system_r:unconfined_t Target Context: system_u:object_r:lib_t Target Objects: /usr/lib/vlc/codec/libdmo_plugin.so [ file ] Affected RPM Packages: vlc-0.8.6a-1.lvn6.1 [application]vlc-0.8.6a-1.lvn6.1 [target] Policy RPM: selinux-policy-2.4.6-27.fc6 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Enforcing Plugin Name: plugins.allow_execmod Host Name: rusharri-lnx2 Platform: Linux rusharri-lnx2 2.6.19-1.2895.fc6 #1 SMP Wed Jan 10 19:28:18 EST 2007 i686 i686 Alert Count: 1 Line Numbers: Raw Audit Messages: avc: denied { execmod } for comm="vlc" dev=dm-0 egid=162433 euid=162433 exe="/usr/bin/vlc" exit=-13 fsgid=162433 fsuid=162433 gid=162433 items=0 name="libdmo_plugin.so" path="/usr/lib/vlc/codec/libdmo_plugin.so" pid=10856 scontext=user_u:system_r:unconfined_t:s0 sgid=162433 subj=user_u:system_r:unconfined_t:s0 suid=162433 tclass=file tcontext=system_u:object_r:lib_t:s0 tty=pts1 uid=162433 - -------- librealaudio_plugin denial - -------- Summary SELinux is preventing /usr/bin/vlc from loading /usr/lib/vlc/codec/librealaudio_plugin.so which requires text relocation. Detailed Description The /usr/bin/vlc application attempted to load /usr/lib/vlc/codec/librealaudio_plugin.so which requires text relocation. This is a potential security problem. Most libraries do not need this permission. Libraries are sometimes coded incorrectly and request this permission. The http://people.redhat.com/drepper/selinux-mem.html web page explains how to remove this requirement. You can configure SELinux temporarily to allow /usr/lib/vlc/codec/librealaudio_plugin.so to use relocation as a workaround, until the library is fixed. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Allowing Access If you trust /usr/lib/vlc/codec/librealaudio_plugin.so to run correctly, you can change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t /usr/lib/vlc/codec/librealaudio_plugin.so" The following command will allow this access: chcon -t textrel_shlib_t /usr/lib/vlc/codec/librealaudio_plugin.so Additional Information: Source Context: user_u:system_r:unconfined_t Target Context: system_u:object_r:lib_t Target Objects: /usr/lib/vlc/codec/librealaudio_plugin.so [ file ] Affected RPM Packages: vlc-0.8.6a-1.lvn6.1 [application]vlc-0.8.6a-1.lvn6.1 [target] Policy RPM: selinux-policy-2.4.6-27.fc6 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Enforcing Plugin Name: plugins.allow_execmod Host Name: rusharri-lnx2 Platform: Linux rusharri-lnx2 2.6.19-1.2895.fc6 #1 SMP Wed Jan 10 19:28:18 EST 2007 i686 i686 Alert Count: 1 Line Numbers: Raw Audit Messages: avc: denied { execmod } for comm="vlc" dev=dm-0 egid=162433 euid=162433 exe="/usr/bin/vlc" exit=-13 fsgid=16243 - ---------- Thx for your advices: Nicolas (kwizart) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFGJSfBlNdbIlsB+AERAgqAAKCAe3oBN3TvicHhQCVkJGpclzNNPwCdFIRv BfH3xDwe78OSJyOwd/rQ6Yk= =8pOY -----END PGP SIGNATURE-----

2 1

SELinux is preventing /usr/sbin/semodule (semanage_t) "getattr" to / (security_t).
by Antonio Olivares 20 Apr '07

20 Apr '07

Dear list(s), currently running Rawhide and setroubleshoot browser fires up with a denial Summary SELinux is preventing /usr/sbin/semodule (semanage_t) "getattr" to / (security_t). Detailed Description SELinux denied access requested by /usr/sbin/semodule. It is not expected that this access is required by /usr/sbin/semodule and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access You can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context user_u:system_r:semanage_t Target Context system_u:object_r:security_t Target Objects / [ filesystem ] Affected RPM Packages policycoreutils-2.0.2-3.fc7 [application]filesystem-2.4.2-1.fc7 [target] Policy RPM selinux-policy-2.5.4-1.fc7 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall Host Name localhost Platform Linux localhost 2.6.20-1.2949.fc7 #1 SMP Mon Feb 26 18:37:35 EST 2007 i686 athlon Alert Count 1 First Seen Wed 04 Apr 2007 06:46:19 AM CDT Last Seen Wed 04 Apr 2007 06:46:19 AM CDT Local ID 32e2ac76-301c-4f3f-b971-e8b7da4fff73 Line Numbers Raw Audit Messages avc: denied { getattr } for comm="semodule" dev=selinuxfs egid=0 euid=0 exe="/usr/sbin/semodule" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="/" pid=8883 scontext=user_u:system_r:semanage_t:s0 sgid=0 subj=user_u:system_r:semanage_t:s0 suid=0 tclass=filesystem tcontext=system_u:object_r:security_t:s0 tty=pts1 uid=0 Summary SELinux is preventing /usr/sbin/useradd (useradd_t) "read write" to faillog (var_log_t). Detailed Description SELinux denied access requested by /usr/sbin/useradd. It is not expected that this access is required by /usr/sbin/useradd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for faillog, restorecon -v faillog If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package. Additional Information Source Context user_u:system_r:useradd_t Target Context system_u:object_r:var_log_t Target Objects faillog [ file ] Affected RPM Packages shadow-utils-4.0.18.1-13.fc7 [application] Policy RPM selinux-policy-2.5.12-5.fc7 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name plugins.catchall_file Host Name localhost Platform Linux localhost 2.6.20-1.3088.fc7 #1 SMP Wed Apr 18 15:12:44 EDT 2007 i686 athlon Alert Count 1 First Seen Thu 19 Apr 2007 06:19:42 PM CDT Last Seen Thu 19 Apr 2007 06:19:42 PM CDT Local ID 2eacf14b-bf35-4d12-bb8e-13e35aeaaf6a Line Numbers Raw Audit Messages avc: denied { read, write } for comm="useradd" dev=dm-0 egid=0 euid=0 exe="/usr/sbin/useradd" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="faillog" pid=3370 scontext=user_u:system_r:useradd_t:s0 sgid=0 subj=user_u:system_r:useradd_t:s0 suid=0 tclass=file tcontext=system_u:object_r:var_log_t:s0 tty=pts0 uid=0 Thanks for any help/suggestions on this. Regards, Antonio __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

packaging selinux modules into rpms ?
by Jan-Frode Myklebust 19 Apr '07

19 Apr '07

I've been building RPMs for syslog-ng and argus, that needs to contain selinux-modules to work on enforcing RHEL5. Are there any recommendations for how to package these with RPM? In http://tanso.net/yum/repodata/repoview/syslog-ng-0-2.0.3-1.el5.html I build the module by checkmodule/semodule_package/semodule -i in the rpm %post, but maybe I should have done this in the source-rpm, and just installed the .pp in the binary-rpm %post ? -jf

2 1

Re: autoreconf fails in setools of revision 4290
by NZzi 19 Apr '07

19 Apr '07

J. Tang wrote: > On Wed, 2007-04-18 at 10:06 +0800, Ken YANG wrote: >> the build tools i use are: >> >> automake-1.10-5 >> autoconf-2.61-8.fc7 >> make-3.81-6.fc7 > > Hello Ken. > > I was able to reproduce your issue on a Rawhide system. The reason is > due to automake. Fedora Core 6 (which is what SETools was tested upon) > ships with automake 1.9; Rawhide has automake 1.10. This newer version > of automake now considers GNU make extensions to be fatal errors, > whereas previous versions of automake ignored them. > > Quick Answer: From SVN checkout, do this as the first step: > > $ autoreconf -Wno-portability -i > >> as i mentioned before, the 3.1 tags in svn also failed with this error >> but the 3.1 version of fc7 can be built without any errors: > > This is because the source RPM contains the distributed, post-automake > files. That is, it has the result of a 'make dist'. thanks very much for your guiding. > >> apol had "segmentation fault" errors in analyzing "all base" policy, >> i.e. all modules in "module.conf" are changed into "base" > > There is a critical error in libsepol-2.0.2 that prevents SETools from > opening source policies. Unfortunately, recompiling SETools against > libsepol-2.0.3 is not sufficient; it also requires a fix that is only in > the development branch of SETools. > >> "setools(a)tresys.com" is the mailing list of setools? if yes, i will send > > Yes. if i have some setools problems(maybe bugs) in future, where can i send? i can not find "subscribe" of setools mailing list, but i find the "Active Tickets" in setools wiki. actually, i don't know what this mean. i find there are bug and feature. if the setools mailing list is private, i will send problem/bug to the fedora-selinux mailing list in future, ok? >

1 0

ANN: SELinux Policy IDE (SLIDE) version 1.1
by David Sugar 18 Apr '07

18 Apr '07

Version 1.1 of the SELinux Policy IDE (SLIDE) from Tresys is now available for download from the Tresys Open Source website at http://oss.tresys.com. SLIDE is an Eclipse plug-in that integrates with the SELinux Reference Policy to provide a development environment for building SELinux policy. SLIDE features: * A graphical user interface for policy development, including policy syntax highlighting, context suggestions, and integrated compilation. * Integration with SELinux Reference Policy, including quick lookup and documentation for interfaces. * Wizards and easy to use templates to automate common tasks from creating a new SELinux policy to adding an interface into an existing module. * Integrated remote policy installation and audit log monitoring, to facilitate policy testing. * Seamless integration with the power of standard Eclipse. Version 1.1 highlights: * Disabled interfaces indicated in module editor. * Improved documentation on the open source web site. * Updates to SLIDERemote to work with SETools version 3.1. * Support for new fields in build.conf editor. * Fixed problems with the Console output. If you would like to contribute, currently the best help would be to test and provide feedback on the SLIDE plugin and SLIDE Remote.

1 0

rawhide update errors
by Richard Hally 18 Apr '07

18 Apr '07

from todays yum update from rawhide: Updating : selinux-policy-strict ##################### [ 29/121] Updating : selinux-policy-mls ##################### [ 30/121] Updating : selinux-policy-targeted ##################### [ 31/121] /sbin/fixfiles: line 62: 17611 Done sed -r -e 's,:s0, ,g' $FC 17612 | sort -u 17613 Done(1) | /usr/bin/diff -b ${PREFCTEMPFILE} - 17614 | grep '^[<>]' 17615 | cut -c3- 17616 | grep ^/ 17617 | egrep -v '(^/home|^/root|^/tmp|^/dev)' 17618 | sed -r -e 's,[[:blank:]].*,,g' -e 's|$([/[:alnum:]]+)$\?|{\1,}|g' -e 's|([/[:alnum:]])\?|{\1,}|g' -e 's|\?.*|*|g' -e 's|$.*|*|g' -e 's|\[.*|*|g' -e 's|\.\*.*|*|g' -e 's|\.\+.*|*|g' 17619 | sort -u 17620 | sort -d 17621 | while read pattern; do if ! echo "$pattern" | grep -q -f ${TEMPFILE} 2> /dev/null; then echo "$pattern"; case "$pattern" in *"*") echo "$pattern" | sed 's,\*$,,g' >> ${TEMPFILE} ;; esac; fi; done 17622 Done(1) | while read pattern; do find $pattern ! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o -fstype xfs $ -prune -o $ -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev $ -prune -o -print; done 2> /dev/null 17623 Segmentation fault | ${RESTORECON} $2 -v -f - Updating : selinux-policy-devel ##################### [ 32/121] Updating : policycoreutils-gui ##################### [ 33/121] Updating : libsepol-devel ##################### [ 34/121] Richard

1 0

Re: autoreconf fails in setools of revision 4290
by NZzi 18 Apr '07

18 Apr '07

Jeremy A. Mowery wrote: > On Tuesday 17 April 2007 04:46, you wrote: >> hi all, >> >> i use autoconf-2.61-8.fc7 in fc7 rawhide >> >> autoreconf of this version fails in building setools of >> revision 4290. >> >> i also test setools 3.1 tags, it fails with the same errors: >> >> ...... >> sediff/Makefile.am:45: notdir $@: non-POSIX variable name >> sediff/Makefile.am:45: (probably a GNU make extension) >> sediff/Makefile.am:48: notdir $@: non-POSIX variable name >> sediff/Makefile.am:48: (probably a GNU make extension) >> sediff/Makefile.am:51: notdir $@: non-POSIX variable name >> sediff/Makefile.am:51: (probably a GNU make extension) >> autoreconf: automake failed with exit status: 1 >> > We were unable to reproduce this error. > We are currently building with: > autoconf (GNU Autoconf) 2.59 > automake (GNU automake) 1.9.6 > GNU Make 3.80 > > Could you send further information about the build tools you are using? the build tools i use are: automake-1.10-5 autoconf-2.61-8.fc7 make-3.81-6.fc7 as i mentioned before, the 3.1 tags in svn also failed with this error but the 3.1 version of fc7 can be built without any errors: setools-3.1-3.fc7.src.rpm by the way, when i use the setools in fc7 rawhide: setools-3.1-4.fc7.src.rpm apol had "segmentation fault" errors in analyzing "all base" policy, i.e. all modules in "module.conf" are changed into "base" the same errors occured in setools-3.1-3.fc7.src.rpm. but apol from setools-3.1-3.src.rpm can analyze the same base.pp without any errors. i forget where i got this srpm, maybe from tresys website, but i am sure that it is not from fc repos. finally, it seems that this problem is not belong to selinux list, so i CC to fedora-selinux list. "setools(a)tresys.com" is the mailing list of setools? if yes, i will send similar problems to this list. > > - Jeremy A. Mowery >> thanks in advance >> >> Ken YANG >

1 0

Targeted policy does not allow lvm output redirection ?
by Davide Bolcioni 16 Apr '07

16 Apr '07

Greetings, I tried the following: lvm vgs -o vg_name,vg_extent_size --units=k | cat > /tmp/vgs2 lvm vgs -o vg_name,vg_extent_size --units=k > /tmp/vgs1 and obtained -rw-r--r-- 1 root root 0 Apr 15 11:49 /tmp/vgs1 -rw-r--r-- 1 root root 28 Apr 15 11:49 /tmp/vgs2 but as you can see in the attached /var/log/audit.d/audit.log fragment, writing from an executable running in the lvm_t context to an object labeled with the tmp_t context is not allowed by the targeted policy. My setup: libselinux-1.33.4-2.fc6 selinux-policy-targeted-2.4.6-49.fc6 selinux-policy-2.4.6-49.fc6 Should I open a Bugzilla for this ? Thank you for your consideration, Davide Bolcioni -- There is no place like /home.

2 1

setrans.conf
by Ivan Makale 16 Apr '07

16 Apr '07

I'm studying SELinux and I'd like to find a clear explanation of the syntax used in the setrans.conf file. Have anybody a web resource to suggest? So to give an example, s0-s0:c0.c1023=SystemLow-SystemHigh s0:c0.c1023=SystemHigh Is '-' indicating a range between sensitivity levels and the ''.' a range between categories? What's the difference between "s0" only and "s0-s0"? And so on... Thank you, Ivan Makale

2 1

X server won't start using MLS policy
by Elihu Smails 11 Apr '07

11 Apr '07

I have followed the instructions at http://fedoraproject.org/wiki/SELinux/FedoraMLSHowto on how to install the MLS policy. I have it working under Fedora Core 6, but when I boot to runlevel 5, I get an error saying that the X server cannot be started. Does anyone know how to fix this problem? Thanks -- ..Cheers Mark

2 1

Latest selinux update & ping
by Jouni Viikari 11 Apr '07

11 Apr '07

Hi, After the latest selinux updates I get a lot of these messages at my log: SELinux is preventing /bin/ping (ping_t) "search" to locale (locale_t) or audit log: denied { search } for pid=16255 comm="ping" name="locale" dev=dm-0 ino=3113039 scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=dir type=SYSCALL msg=audit(1176300990.257:65255): arch=40000003 syscall=5 success=no exit=-13 a0=bf91d6e0 a1=0 a2=1b6 a3=8816018 items=0 ppid=18973 pid=18974 auid=4294967295 uid=507 gid=507 euid=0 suid =0 fsuid=0 egid=507 sgid=507 fsgid=507 tty=(none) comm="ping" exe="/bin/ping" subj=system_u:system_r:ping_t:s0 key=(null) type=AVC msg=audit(1176300990.257:65256): avc: denied { search } for pid=18974 comm="ping" name="locale" dev=dm-0 ino=3113039 scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:loca le_t:s0 tclass=dir The last line repeats itself many times. The pings are run by Big Brother which as a one task pings my network to see all is up. Is this a local problem here, selinux problem or ping problem? -Jouni

2 1

Many to one translations in setrans.conf
by Joe Nall 11 Apr '07

11 Apr '07

We have been using /etc/selinux/mls/setrans.conf files that use multiple equivalent translations to support common aliases. For example: s2:c1.c225,c227.c253=CONFIDENTIAL//REL FU s2:c1.c225,c227.c253=C O N F I D E N T I A L REL FU s2:c1.c225,c227.c253=C O N F I D E N T I A L RELEASABLE TO FU s2:c1.c225,c227.c253=CONFIDENTIAL//REL BAR s2:c1.c225,c227.c253=C O N F I D E N T I A L REL BAR s2:c1.c225,c227.c253=C O N F I D E N T I A L RELEASABLE TO BAR This has the effect of mapping all of these labels to a common context. This context maps back to the first translation (CONFIDENTIAL//REL FU). 'semanage translation -a -T ...' has different behavior. When a translation is added, it rewrites the file using the last (C O N F I D E N T I A L RELEASABLE TO BAR) translation and deletes the other translations. It also moves all of the comments to the top, moving them away from the translation they are documenting. Should we be using this many to one behavior to support aliases? Is it broken in other ways that we have not discovered yet? joe

2 1

Re: denied avcs Rawhide how to troubleshoot
by Antonio Olivares 11 Apr '07

11 Apr '07

----- Original Message ---- From: Daniel J Walsh <dwalsh(a)redhat.com> To: Antonio Olivares <olivares14031(a)yahoo.com> Cc: fedora-selinux-list(a)redhat.com Sent: Tuesday, April 10, 2007 12:46:29 PM Subject: Re: denied avcs Rawhide how to troubleshoot Antonio Olivares wrote: Dear list, > I am running rawhide and I get these denied avcs > > [olivares@localhost ~]$ cat /etc/fedora-release > Fedora release 6.92 (Rawhide) > [olivares@localhost ~]$ > > There is a tool semanage, but I do not know how to use it. Is there any reference to this new tool. > How do I fix this using chcon -? or other tools to troubleshoot this. > > audit(1176209974.281:4): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1440" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:5): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1680" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:6): avc: denied { create } for pid=991 comm="cIreate_floppy_d" name="fd0u1722" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:7): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1743" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:8): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1760" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:9): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1920" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:10): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1840" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:11): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1600" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:12): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u360" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:13): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u720" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:14): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u820" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:15): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u830" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:16): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1040" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:17): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1120" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:18): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u800" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > > > > > Thanks, > > Antonio > > > > > > ____________________________________________________________________________________ > Don't pick lemons. > See all the new 2007 cars at Yahoo! Autos. > http://autos.yahoo.com/new_cars.html > > -- > fedora-selinux-list mailing list > fedora-selinux-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > Please submit this as a udev bug. Done! https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235953 Regards, Antonio ____________________________________________________________________________________ Don't pick lemons. See all the new 2007 cars at Yahoo! Autos. http://autos.yahoo.com/new_cars.html

1 0

denied avcs Rawhide how to troubleshoot
by Antonio Olivares 10 Apr '07

10 Apr '07

Dear list, I am running rawhide and I get these denied avcs [olivares@localhost ~]$ cat /etc/fedora-release Fedora release 6.92 (Rawhide) [olivares@localhost ~]$ There is a tool semanage, but I do not know how to use it. Is there any reference to this new tool. How do I fix this using chcon -? or other tools to troubleshoot this. audit(1176209974.281:4): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1440" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:5): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1680" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:6): avc: denied { create } for pid=991 comm="cIreate_floppy_d" name="fd0u1722" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:7): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1743" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:8): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1760" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:9): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1920" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:10): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1840" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:11): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1600" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:12): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u360" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:13): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u720" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:14): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u820" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:15): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u830" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:16): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1040" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:17): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1120" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file audit(1176209974.281:18): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u800" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file Thanks, Antonio ____________________________________________________________________________________ Don't pick lemons. See all the new 2007 cars at Yahoo! Autos. http://autos.yahoo.com/new_cars.html

3 2

cups-lpd: Unable to reserve port: Permission denied
by Garry Williams 06 Apr '07

06 Apr '07

I recently noted that print jobs from my FC6 machine sent to my remote lpd print server take over five minutes to actually be spooled to print server. When I strace the cups process that connects to the remote lpd, I see repeated attempts to bind() to port numbers below 1024. Each attempt fails with EACCES even though the process is running as root. After each failure, the lpd client waits for one second, then decrements the port number and tries again. This sequence repeats until port number 631 is tried. That succeeds and the client calls connect() and the print job is sent to the remote printer. My theory (based on suggestions from the fedora-user mailing list) is that there is a new selinux policy that restricts the cupsd process and its children to only be able to bind to port 631. If this is true, I believe it is incorrect. I think that there are some older lpd servers that insist on validating clients based on their source port numbers, refusing to allow connections from clients using ports over 1024. This behavior will probably be judged silly (at best) these days, but there seems to be a need to support it even today. Consequently, the default behavior of cups-lpd seems to insist on a low port number before calling connect(). I got around the problem by specifying a printer URI that suppresses that behavior. (That wasn't obvious to me -- I got there from a suggestion from David Hull, replying to my question on the fedora-user list.) But the cups developers think this is OK behavior for their client when it needs to talk to some servers. I think the new policy is wrong. Regardless, why don't I see avc log messages on this? -- Garry T. Williams --- +1 678 656-4579

3 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux April 2007