May 2007 - selinux - Fedora Mailing-Lists

Need to handle xorg-x11-drv-nvidia with selinux-policy!

by Nicolas Chauvet

Hello >From here http://www.nvnews.net/vbulletin/showthread.php?t=72490 There is a need to handle xorg-x11-drv-nvidia package with Selinux: This was previously documented to be done manually on documentation that uses livna package... The nvidia installer detect it but livna package uses a different scheme so it has be be handled somewhere else... This can be done into the xorg-x11-drv-nvidia package or into selinux-policy (the second is the prefered choice if possible). Because it deal with versioned libs i wonder if i can be possible to handle it easily with the selinux-policy package ? Thx for any advices (i will submit a bug for selinux-policy if it is possible) Nicolas (kwizart)

16 years, 11 months

2
3
0 / 0

[SCRIPT] avctree 1.0.4

by Lee Kok Seng

Hello, Here is version 1.0.4 of the script previously posted. a. Added regular expression (perl) to select messages to display e.g avctree --re="context=~/java/" will show any avc message that has 'java' in scontext *or* tcontext. e.g avctree --re="*=~/initrc/" will show any avc messages that has 'su' anywhere. b. Added message selection based on age of message e.g avctree --age 3h will show avc messages not older than 3 hours from when you run the script. c. Added 'unique' format of print e.g avctree --uniq will show avc messages that are unique once, i.e. scontext, tcontext, comm, name, dev, ino, key all match up (except time tag, audit tag, pid ... so, use with this in mind) Try this: avctree --uniq --age 1d /ks p/s: This post may have duplicates resulting in problem in posting this update. Sorry if so. This will also be 'it' for the time being, having got this script to give me the productivity I need to work with selinux. ------------------------------------------------------ cut --------------------------------------------- #!/usr/bin/perl -w sub lmsg { print <<LMSG;; # Copyright (C) 2007, LEE, "Kok Seng" (kokseng at ieee dot org) # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; either version 2 of # the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA # 02111-1307 USA # LMSG } # History # 1.0.0 Format avc messages # 1.0.1 added --re option to select messages to print # 1.0.2 --re option allow context to mean scontext or tcontext, all to mean any key # 1.0.3 added --age option to select based on age of message # 1.0.4 added --uniq option to show messages that are unique my $version='1.0.4+'; use strict; use warnings; my ($thisScript) = ($0 =~ /.*?\/*(\w+)$/); # ------------------------------------------------------------------------ ---------------------- use Getopt::Long; sub usage { lmsg; print "Usage:\n"; print <<USAGETXT; $thisScript version $version Utility to format avc messages for readability ----------------------------------------------------------------------- --------------------- $thisScript [[options] ...] Options: --log=[ all | file,...] : List log files to parse, delimited by comma. no argument or all => /var/log/ messages, /var/log/kernel --tags : Show time and audit tags --key=key,... : List messages indexed-sorted by specified key no argument or all => all keys Not specified => scontext,tcontext,action,comm,name --trim=yes|no|1|0 : Trim context string. Default: yes --re="expr" : Filter using rsupplied regular expression special: a. To match either scontext or tcontext, specify --re="context=~/^(dhcp|su)/" which will match scontext or tcontext if either starts wuth dhcp or su. b. To match any key's value, specify --re="*=~/dhcp|su/" which will print all messages that has dhcp or su in any key's value --age[=time-spec] : Show messages that are not older than specified age. time spec := numeric[unit] numeric := integer or float default: 10 unit := s | m | h | d | w default: m --uniq : Show in unique format. --help ----------------------------------------------------------------------- --------------------- Examples: a. $thisScript --key=scontext Print avc messages indexed-sorted by source context. b. $thisScript --key=tcontext Print avc messages indexed-sorted by target context. c. $thisScript --key=comm Print avc messages indexed-sorted by command executed. d. $thisScript --key=name Print avc messages indexed-sorted by target object's name. e. $thisScript --key=all or $thisScript --key Print avc messages indexed-sorted by all keys. f. $thisScript Print avc messages indexed-sorted by scontext, tcontext, comm, name (default) g. $thisScript --trim=no Print avc messages without trimming context string. h. $thisScript --log=/var/log/messages,/var/log/messages.1,/var/ log/messages.2 Print avc messages from log files listed (delimited by comma). i. $thisScript --tags Print avc messages, including in each message the log time tag and audit tag. j. $thisScript --re="name=~/dhcp/ && comm=~/dhcp/" Print avc messages which has dhcp in name or comm USAGETXT exit -1; } # my $logARG; # Log files to parse my $tagsARG; # Show time and audit tags my $catARG; # Categories to print my $helpARG; # Help my $trimARG; # Trim context string for readability my $ageARG; # Age specification my $reARG; # Regular Expression my $uniqARG; # Unique format usage(), exit unless GetOptions( 'log:s' => \$logARG, 'tags!' => \$tagsARG, 'key:s' => \$catARG, 'trim:s' => \$trimARG, 're:s' => \$reARG, 'age:s' => \$ageARG, 'uniq!' => \$uniqARG, 'help!' => \$helpARG ); usage() if (defined($helpARG)); ## ------------------------------------------------------------------------ ---------------------- ## Option: skip tags my $skiptags = defined($tagsARG)?0:1; ## Option: log files my @logOPT = grep -e $_, split /,|\n|\r/, $logARG if (defined ($logARG)); @logOPT = ('/var/log/messages','/var/log/kernel','/var/log/debug','/ var//log/audit') if (defined($logARG) && ((!scalar @logOPT) || grep /all/, @logOPT)); @logOPT = ('/var/log/audit') if (!scalar @logOPT && -e '/var/log/ audit'); @logOPT = ('/var/log/kernel') if (!scalar @logOPT && -e '/var/log/ kernel'); @logOPT = ('/var/log/messages') if (!scalar @logOPT); ## Option: Category my @catOPT = split /,|\n|\r/, $catARG if (defined($catARG)); my @catDEF = ('scontext','tcontext','comm','name'); ## Option: Trim my $trimOPT = defined($trimARG) ? ($trimARG =~ /no|0|/i ? 0 : 1 ) : 1; ## Option: regular expression my @reOPT = split /,|\n|\r/, $reARG if (defined($reARG)); ## Option: age my @ageOPT = split /,|\n|\r/, $ageARG if (defined($ageARG)); @ageOPT = ('10m') if (defined($ageARG) && !scalar @ageOPT); my ($age, $tu) = ($ageOPT[0] =~ /\s*([\d\.]+)\s*([smhdw]).*/); undef $ageARG if (!defined($age)); $age *= defined($tu)?($tu eq 'm'?60:($tu eq 'h'?3600:($tu eq 'd'? 86400:($tu eq 'w'?604800:1)))):1 if (defined($ageARG)); ## ------------------------------------------------------------------------ ---------------------- # ## Regular expression for parsing avc's 'denied' messages my $avcRE = qr/^(\w{3}\s+\d{2}\s+\d{2}:\d{2}:\d{2})[\s\w]+:\s*audit\ (([\d.:]+)\)\s*:\s*avc\s*:\s*denied\s+\{\s+([\w\s]+)\s+}\s+for\s+(.*)/; ## Holds indexed avc message records my %avc; my $epoch = time(); ## ------------------------------------------------------------------------ ---------------------- ## contextFMT # Format context string for readability sub contextFMT { my $ctxt = shift; my ($u,$r,$t,$l) = split /:/, $ctxt; $u =~ s/(.*)_./$1/; $r =~ s/(.*)_./$1/; $t =~ s/(.*)_./$1/; return $u . '-' . $r . '-' . $t; } ## ------------------------------------------------------------------------ ---------------------- ## prepRE reference-avc reference-re-list # Prepare regular expression from user supplied string sub prepRE { my $avc = shift; my $reOPT = shift; my @re = @$reOPT; if (grep /\*\s*=~/, @re) { my @restr; push @restr, /\s*\*\s*=~\s*\/([^\/]+)\/\s*/g foreach (@re); my $str = "{my \$ret=0; (\$ret |= ("; s/(.*)/\$this{\$_}=~\/$_\// foreach (@restr); $str .= join ' || ', @restr; $str .= ")) foreach (keys \%this); \$ret;}"; #print "\nprepRE=$str"; return $str; } else { # tbd : improve on regex / ... / parsing s/\s*context\s*(=~\s*\/[^\/]+\/)\s*/$scontext$1||tcontext$1$/g foreach (@re); s/\s*(\w+)\s*=~/\$this\{\'$1\'\} =~/g foreach (@re); my $str = '(' . join(' ) || ( ' , @re) . ')'; $str =~ s/\|\|\s*$\s*$//g; return $str; } } ## ------------------------------------------------------------------------ ---------------------- ## readLOG log-file-name # Reads the specified log file sub readLOG { my $avc = shift; my $logfile = shift; my $reopt = shift; my $logsn = ($logfile =~ /.*\/(.*)$/)[0]; my $tmax = defined($avc->{'_tcontext_max_'})?$avc-> {'_tcontext_max_'}:0; my $smax = defined($avc->{'_scontext_max_'})?$avc-> {'_scontext_max_'}:0; my $rex = undef; open LOGF, '<' . $logfile || die "Cannot open input file: $logfile"; while (<LOGF>) { s/\r|\n//g; next if (!$_); next if (!/\s+avc:\s+/); my ($timetag, $audit, $action, $detail) = ($_ =~ /$avcRE/); next if (!defined($action)||!defined($detail)||!defined($timetag)||! defined($audit)); # okay, we have a avc 'denied' message my %this; # this hash will keep the message's key=value my @fields = split /\s|\r|\n/, $detail; foreach (@fields) { next if (!$_); my ($key,$val) = split/=/; next if (!$key||!$val); $val =~ s/[\"\']*([^\"\']*)[\"\']*/$1/; $this{"$key"} = $val; } # check age of message if (defined($ageARG) && defined($audit)) { my ($tm) = ($audit =~ /([\d+\.]+).*/); next if (defined($tm) && $epoch - $tm > $age); } # Filter, if specified $rex = prepRE($avc, $reopt) if (!defined($rex) && defined($reopt)); next if (defined($rex) && ! eval $rex ); $this{'action'} = $action; $this{'timetag'} = $timetag; $this{'audit'} = $audit; $this{'file'}= $logsn; if ($trimOPT) { $this{'scontext'} = contextFMT($this{'scontext'}); $this{'tcontext'} = contextFMT($this{'tcontext'}); } $smax = length($this{'scontext'}) if ($smax < length($this {'scontext'})); $tmax = length($this{'tcontext'}) if ($tmax < length($this {'tcontext'})); # Check if this message is unique my $uniq = 1; if (defined($uniqARG)&&defined($avc{'scontext'})&&defined($avc {'scontext'}->{$this{'scontext'}})) { foreach (@{$avc{'scontext'}->{$this{'scontext'}}}) { if ($_->{'tcontext'} eq $this{'tcontext'} && ($_->{'comm'} eq $this{'comm'})&& ($_->{'name'} eq $this{'name'}) && ($_->{'tclass'} eq $this{'tclass'}) && ($_->{'action'} eq $this{'action'}) && (!defined($_->{'dev'}) || $_->{'dev'} eq $this{'dev'}) && (!defined($_->{'ino'}) || $_->{'ino'} eq $this{'ino'}) && (!defined($_->{'key'}) || $_->{'key'} eq $this{'key'}) ) { $_->{'_same_'} = [()] if (!defined($_->{'_same_'})); push @{$_->{'_same_'}}, \%this; $uniq = 0; last; } } } next if (!$uniq); # Okay, let's index the records with various keys foreach (keys %this) { next if (/audit|timetag|file|_same_/); $avc->{$_} = {} if (!defined($avc->{$_})); $avc->{$_}->{$this{$_}} = [()] if (!defined($avc->{$_}->{$this {$_}})); push @{$avc->{$_}->{$this{$_}}}, \%this; } } close LOGF; $avc->{'_scontext_max_'} = $smax; $avc->{'_tcontext_max_'} = $tmax; } ## ------------------------------------------------------------------------ ---------------------- ## # keyTREE key # Show selected key in a tree view sub keyTREE { my $avc = shift; my $kcat = shift; my $showfile = shift; my $hcat = $avc->{$kcat}; my $lvl = 1; my $isSctx = ($kcat =~ /scontext/); my $isTctx = ($kcat =~ /tcontext/); my $smax = $isSctx ? 0 : $avc->{'_scontext_max_'}; my $tmax = $isTctx ? 0 : $avc->{'_tcontext_max_'}; return if (/_scontext_max_|_tcontext_max_/); print "\n# "; for ($_=0; $_ < 80; $_++) {print "-";} print "[", $kcat, "]\n"; foreach my $kmsg (sort keys %$hcat) { printf "|\n+-[%-*s]\n", $smax, $hcat->{$kmsg}[0]->{$kcat}; $lvl++; my $buf; my $i; my $cnt = scalar @{$hcat->{$kmsg}}; foreach my $hmsg (@{$hcat->{$kmsg}}) { $buf .= sprintf "%s %-*s %s %-*s %s%s(%s) : %s : %s %s%s%s\n", $isTctx? '+<-' : '+->', $smax, $isSctx?'':$hmsg->{'scontext'}, $isTctx||$isSctx ? '' : '-+->', $tmax, $isTctx?'':$hmsg->{'tcontext'}, defined($showfile)? $hmsg->{'file'}.'> ':'', $hmsg->{'comm'}, $hmsg->{'pid'}, $hmsg->{'tclass'}, $hmsg->{'action'}, defined($hmsg->{'name'})?': '.$hmsg->{'name'}:'', defined($hmsg->{'key'})?' : '.$hmsg->{'key'}:'', defined($hmsg->{'dev'})?' : '.$hmsg->{'dev'} . (defined($hmsg-> {'ino'})?' : '.$hmsg->{'ino'}:'') : '' ; $i = $lvl; $buf = '| ' . $buf while (--$i); print $buf; $buf = ""; foreach my $kmsg (sort keys %$hmsg) { next if ($kmsg =~ /file|scontext|tcontext|comm|pid|tclass|action| name|dev|ino|key|_same_|$kcat/); next if ($skiptags && $kmsg =~ /timetag|audit/); $buf .= sprintf "%s=%s ", $kmsg, $hmsg->{$kmsg}; } $buf .= sprintf "+-[%u] similar message%s", scalar @{$hmsg-> {'_same_'}}, scalar @{$hmsg->{'_same_'}} > 1 ? 's':'' if (defined($uniqARG) && defined($hmsg->{'_same_'})); if ($buf) { $buf = sprintf "%*s%s\n", ($cnt==1)?$smax+$tmax+10+2:$smax+$tmax +10, ,"", $buf; $i = (--$cnt)? $lvl:$lvl-1; $buf = '| ' . $buf while ($i--); print $buf; $buf = ""; } } $lvl--; } $lvl--; } ## ------------------------------------------------------------------------ ---------------------- # Parse log files my @logLIST=@logOPT; readLOG(\%avc, $_, scalar @reOPT?\@reOPT:undef) foreach (@logLIST); # Decide which category to print @catOPT = (sort keys %avc) if (defined($catARG) && (! scalar @catOPT) || grep /all/,@catOPT ) ; @catOPT = @catDEF if (!defined($catARG)); print "\n> $thisScript version $version, Copyright (C) 2007, LEE, \"Kok Seng\" (kokseng at ieee dot org)"; print "\n> Notice: get help and condition of usage inforamtion regarding this script: $thisScript --help"; print "\n> File(s) parsed: ", join ', ', @logOPT, " Key(s) : ", join ', ', @catOPT; print "\n> Regular expression = ", join ' or ', @reOPT if (scalar @reOPT); print "\n> Age not more than ", $ageARG, " (", $age, " seconds)" if (defined($ageARG)); print "\n> Unique mode is ON" if (defined($uniqARG)); print "\n"; keyTREE(\%avc, $_,scalar @logOPT > 1?1:undef) foreach (@catOPT); ## ------------------------------------------------------------------------ ---------------------- # vim :ts=4:sw=4: 1;

16 years, 12 months

4
6
0 / 0

link error when using getcon

by Clarkson, Mike R (US SSA)

Can anyone help me out with this link error? % g++ -L/usr/lib64 -lselinux -o SimulatedImport SimulatedImport.cc /tmp/cc2AWYzw.o(.text+0x1ab): In function `main': : undefined reference to `getcon(char**)' collect2: ld returned 1 exit status I thought that all I needed to link in was libselinux.a, located at /usr/lib64/libselinux.a I have the following lines in SimulatedImport.cc: security_context_t *context = 0; int gcrtn = getcon(context); Thanks, Mike

16 years, 12 months

2
3
0 / 0

runcon cmd preventing default domain transition

by Clarkson, Mike R (US SSA)

I have my policy set up to do a domain transition from the datalabeler_t domain to the import_t domain when the datalabeler_t domain executes the SimulatedImport (type import_exec_t) executable. This works fine until I execute the SimulatedImport executable using a runcon command: "runcon -l s1 SimulatedImport" The intent is to start the import_t domain at the s1 level, but the runcon command prevents the default domain transition from occurring. I found I had to use the following to force the domain transition while also setting the level of the process: "runcon -t import_t -l s1 SimulatedImport" Can anyone tell me why I have to explicitly set the type to get the domain transition to occur? The policy is set up to do the domain transition by default when the ImportExecutable is executed in the datalabeler_t domain, and this works fine when I don't use the runcon command, but then the import_t domain is not running at the level that I want. Thanks, Mike

16 years, 12 months

2
2
0 / 0

[SCRIPT] avctree

by Lee Kok Seng

Hello, While diagnosing avc messages, I found the log message too spread-out to form a mental picture, since the lack of some rules often result in several domain domains barking. This reminds me of unforgiving Ada compilers spilling out loads of messages. I did not want to use audit2allow too quickly until I understood what the machine is not happy with. So, I needed a message format that let me to that. Here is a simple perl script to parse log files for avc denial messages, index, sort them, and print them in tree (single depth) view, which I hastily put together last night. I hope it will help others as it did for me. Please feel free to modify it for your own use. You can index the message by any key, for example scontext, tcontext, action, name and etc. You can also specify the log files to parse. By default, the script trim the context string of the _u, _r and _t, which are good for rule readability in source files, but clutter diagnostic print out. However, if this bothers you, disable trimming by --trim=no option. To get help and condition of usage, avctree --help. It is best to pipe the output to less so that you can navigate. A typical partial print out is as follows (this one indexed by tcontext): # ------------------------------------------------------------------------ --------[tcontext] | +-[root-object-default ] | +<- system-system-initrc_su su(1753) : dir : search : home : dm-0 : 49182 | +-[root-object-selinux_config] | +<- root-system-semanage semodule(3584) : dir : rename : active : sdb1 : 49833 | +-[root-object-user_home ] | +<- root-system-semanage semodule(10359) : lnk_file : read : targeted : sdb1 : 98758 | +<- root-system-semanage semodule(11006) : lnk_file : read : policy : sdb1 : 98764 | +<- root-system-semanage semodule(3584) : lnk_file : read : targeted : sdb1 : 98758 | +-[system-object-default ] | +<- system-system-initrc_su su(1753) : dir : search : / : dm-0 : 2 | +<- system-system-hald hald(1958) : dir : getattr : / : dm-0 : 2 | No PP module for this script yet. This script use basic Perl features, so, as along you have base Perl package installed, it should work. Be happy to hear any comments or suggestion for improving this. /ks #------------------------------------------- cut here ----------------------------------------- #!/usr/bin/perl -w sub lmsg { print <<LMSG;; # Copyright (C) 2007, LEE, "Kok Seng" (kokseng at ieee dot org) # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; either version 2 of # the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA # 02111-1307 USA # LMSG } my $version='1.0.0'; use strict; use warnings; my $thisScript = $0; $thisScript =~ s#([^/]+[/]|)(\w+)#$2#; # ------------------------------------------------------------------------ ---------------------- use Getopt::Long; sub usage { lmsg; print "Usage:\n"; print <<USAGETXT; Utility to format avc messages for readability ----------------------------------------------------------------------- --------------------- $thisScript [[options] ...] Options: --log=[ all | file,...] : List log files to parse, delimited by comma. no argument or all => /var/log/ messages, /var/log/kernel --tags : Show time and audit tags --key=key,... : List messages indexed-sorted by specified key no argument or all => all keys Not specified => scontext,tcontext,action,comm,name --trim=yes|no|1|0 : Trim context string. Default: yes --help ----------------------------------------------------------------------- --------------------- Examples: a. $thisScript --key=scontext Print avc messages indexed-sorted by source context. b. $thisScript --key=tcontext Print avc messages indexed-sorted by target context. c. $thisScript --key=comm Print avc messages indexed-sorted by command executed. d. $thisScript --key=name Print avc messages indexed-sorted by target object's name. e. $thisScript --key=all or $thisScript --key Print avc messages indexed-sorted by all keys. f. $thisScript Print avc messages indexed-sorted by scontext, tcontext, comm, name (default) g. $thisScript --trim=no Print avc messages without trimming context string. h. $thisScript --log=/var/log/messages,/var/log/messages.1,/var/ log/messages.2 Print avc messages from log files listed (delimited by comma). i. $thisScript --tags Print avc messages, including in each message the log time tag and audit tag. USAGETXT exit -1; } # my $logARG; # Log files to parse my $tagsARG; # Show time and audit tags my $catARG; # Categories to print my $helpARG; # Help my $trimARG; # Trim context string for readability usage(), exit unless GetOptions( 'log:s' => \$logARG, 'tags!' => \$tagsARG, 'key:s' => \$catARG, 'trim:s' => \$trimARG, 'help!' => \$helpARG ); usage() if (defined($helpARG)); ## ------------------------------------------------------------------------ ---------------------- ## Option: skip tags my $skiptags = defined($tagsARG)?0:1; ## Option: log files my @logOPT = grep -d $_, split /,|\n|\r/, $logARG if (defined($logARG)); @logOPT = ('/var/log/messages','/var/log/kernel','/var/log/debug') if (defined($logARG) && ((!scalar @logOPT) || grep /all/, @logOPT)); @logOPT = ('/var/log/kernel') if (!scalar @logOPT && -d '/var/log/ kernel'); @logOPT = ('/var/log/messages') if (!scalar @logOPT); ## Option: Category my @catOPT = split /,|\n|\r/, $catARG if (defined($catARG)); my @catDEF = ('scontext','tcontext','comm','name'); ## Option: Trim my $trimOPT = defined($trimARG) ? ($trimARG =~ /no|0|/i ? 0 : 1 ) : 1; ## ------------------------------------------------------------------------ ---------------------- # ## Regular expression for parsing avc's 'denied' messages my $avcRE = qr/^(\w{3}\s+\d{2}\s+\d{2}:\d{2}:\d{2})[\s\w]+:\s*audit\ (([\d.:]+)\)\s*:\s*avc\s*:\s*denied\s+\{\s+(\w+)\s+}\s+for\s+(.*)/; ## Holds indexed avc message records my %avc; ## ------------------------------------------------------------------------ ---------------------- ## contextFMT # Format context string for readability sub contextFMT { my $ctxt = shift; my ($u,$r,$t,$l) = split /:/, $ctxt; $u =~ s/(.*)_./$1/; $r =~ s/(.*)_./$1/; $t =~ s/(.*)_./$1/; return $u . '-' . $r . '-' . $t; } ## ------------------------------------------------------------------------ ---------------------- ## readLOG log-file-name # Reads the specified log file sub readLOG { my $avc = shift; my $logfile = shift; my $logsn = ($logfile =~ /.*\/(.*)$/)[0]; my $tmax = defined($avc->{'_tcontext_max_'})?$avc-> {'_tcontext_max_'}:0; my $smax = defined($avc->{'_scontext_max_'})?$avc-> {'_scontext_max_'}:0; open LOGF, '<' . $logfile || die "Cannot open input file: $logfile"; while (<LOGF>) { s/\r|\n//g; next if (!$_); next if (!/\s+avc:\s+/); my ($timetag, $audit, $action, $detail) = ($_ =~ /$avcRE/); next if (!defined($action)||!defined($detail)||!defined($timetag)||! defined($audit)); # okay, we have a avc 'denied' message my %this; # this hash will keep the message's key=value my @fields = split /\s|\r|\n/, $detail; foreach (@fields) { next if (!$_); my ($key,$val) = split/=/; next if (!$key||!$val); $val =~ s/[\"\']*([^\"\']*)[\"\']*/$1/; $this{"$key"} = $val; } next if (!defined($this{'scontext'}) || !defined($this{'tcontext'})); $this{'action'} = $action; $this{'timetag'} = $timetag; $this{'audit'} = $audit; $this{'file'}= $logsn; if ($trimOPT) { $this{'scontext'} = contextFMT($this{'scontext'}); $this{'tcontext'} = contextFMT($this{'tcontext'}); } $smax = length($this{'scontext'}) if ($smax < length($this {'scontext'})); $tmax = length($this{'tcontext'}) if ($tmax < length($this {'tcontext'})); # Okay, let's index the records with various keys foreach (keys %this) { next if (/audit|timetag|file/); $avc->{$_} = {} if (!defined($avc->{$_})); $avc->{$_}->{$this{$_}} = [()] if (!defined($avc->{$_}->{$this {$_}})); push @{$avc->{$_}->{$this{$_}}}, \%this; } } close LOGF; $avc->{'_scontext_max_'} = $smax; $avc->{'_tcontext_max_'} = $tmax; } ## ------------------------------------------------------------------------ ---------------------- ## # keyTREE key # Show selected key in a tree view sub keyTREE { my $avc = shift; my $kcat = shift; my $showfile = shift; my $hcat = $avc->{$kcat}; my $lvl = 1; my $isSctx = ($kcat =~ /scontext/); my $isTctx = ($kcat =~ /tcontext/); my $smax = $isSctx ? 0 : $avc->{'_scontext_max_'}; my $tmax = $isTctx ? 0 : $avc->{'_tcontext_max_'}; return if (/_scontext_max_|_tcontext_max_/); print "\n# "; for ($_=0; $_ < 80; $_++) {print "-";} print "[", $kcat, "]\n"; foreach my $kmsg (sort keys %$hcat) { printf "|\n+-[%-*s]\n", $smax, $hcat->{$kmsg}[0]->{$kcat}; $lvl++; my $buf; my $i; my $cnt = scalar @{$hcat->{$kmsg}}; foreach my $hmsg (@{$hcat->{$kmsg}}) { $buf .= sprintf "%s %-*s %s %-*s %s%s(%s) : %s : %s %s%s%s\n", $isTctx? '+<-' : '+->', $smax, $isSctx?'':$hmsg->{'scontext'}, $isTctx||$isSctx ? '' : '-+->', $tmax, $isTctx?'':$hmsg->{'tcontext'}, defined($showfile)? $hmsg->{'file'}.'> ':'', $hmsg->{'comm'}, $hmsg->{'pid'}, $hmsg->{'tclass'}, $hmsg->{'action'}, defined($hmsg->{'name'})?': '.$hmsg->{'name'}:'', defined($hmsg->{'key'})?' : '.$hmsg->{'key'}:'', defined($hmsg->{'dev'})?' : '.$hmsg->{'dev'} . (defined($hmsg-> {'ino'})?' : '.$hmsg->{'ino'}:'') : '' ; $i = $lvl; $buf = '| ' . $buf while (--$i); print $buf; $buf = ""; foreach my $kmsg (sort keys %$hmsg) { next if ($kmsg =~ /file|scontext|tcontext|comm|pid|tclass|action| name|dev|ino|key|$kcat/); next if ($skiptags && $kmsg =~ /timetag|audit/); $buf .= sprintf "%s=%s ", $kmsg, $hmsg->{$kmsg}; } if ($buf) { $buf = sprintf "%*s%s\n", ($cnt==1)?$smax+$tmax+10+2:$smax+$tmax +10, ,"", $buf; $i = (--$cnt)? $lvl:$lvl-1; $buf = '| ' . $buf while ($i--); print $buf; $buf = ""; } } $lvl--; } $lvl--; } ## ------------------------------------------------------------------------ ---------------------- # Parse log files readLOG(\%avc, $_) foreach (@logOPT); # Decide which category to print @catOPT = (sort keys %avc) if (defined($catARG) && (! scalar @catOPT) || grep /all/,@catOPT ) ; @catOPT = @catDEF if (!defined($catARG)); print "\n> Copyright (C) 2007, LEE, \"Kok Seng\" (kokseng at ieee dot org)"; print "\n> Notice: get help and condition of usage inforamtion regarding this script: $thisScript --help\n"; keyTREE(\%avc, $_,scalar @logOPT > 1?1:undef) foreach (@catOPT); ## ------------------------------------------------------------------------ ---------------------- # vim :ts=4:sw=4: 1;

17 years

1
0
0 / 0

Fedora core 5

by Souhail Snoussi

Avec un grand respect que je madresse à vous et jespère que vous maider, Merci. Jai installé Fedora Core 5 sur mon PC Portable (Toshiba version A 100-483) et jai trouvé un problème concernant la carte Wifi car il ne détecte pas les réseaux et même le périphérique Wireless. De même jai un modem ADSL que je lai utilisé avant sous Windows et maintenant je ne sais pas comment linstallé sous linux puisque je ne possède que le cd dinstallation sous Windows. Merci pour votre attention et jattend votre aide. --------------------------------- Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

17 years

2
1
0 / 0

[PATCH] genhomedircon

by Lee Kok Seng

I believe the logic in testing the file_contexts fc regular expression against candidate home directory listed in /etc/passwd for non-system user may have a problem. For example, I have postgresql installed under /opt/pgsql, database at /pgsql/pgdb and have a username pgsql, setting the home directory to /pgsql/home. Currently, FC5 selinux policy has serveral fc rules like this: /var/lib/pgsql/data/* Due to the way python's re.search is called, instead of using all possible fc rules in file_context to try match the candidate home directory, it does it the other way. Resulting in erroneously flagging rule conflict. Have I confused myself? If not, the following patch will fix the problem, which it did for me. Note that if you do not place home directories away from /home, you may never experience this problem, and hence has no need for this patch. /ks ------------------------------------------------------------------------ ------------------------------------ --- /usr/sbin/genhomedircon.orig 2006-06-07 23:10:33.000000000 +0800 +++ /usr/sbin/genhomedircon 2007-05-09 15:14:23.000000000 +0800 @@ -295,8 +295,8 @@ regex = re.sub("$\/\.\*$\?", "", regex) regex = regex + "/*$" - if re.search(home, regex, 0): - return 1 + if re.search(regex, home, 0): + return 1 except: continue return 0

17 years

2
1
0 / 0

New packages and custom Selinux policies

by Peter Smith

I wrote an in-house RPM that is getting installed without error. However, on SELinux Enforcing machines using the targeted policy, it doesn't allow executing my app. I have the following questions about this. *) What's the recommended method for supporting non-core apps to be installed *and* be supported under SELinux policies? I figured I'd create a 2nd RPM that provides a compiled SELinux policy to be added at runtime to the system policy. a) If it is recommended to make 2 seperate RPMs for an application--one for the app and one for the policy--how do you ensure the policy is always loaded with the system? I've opted to create an init script to handle this. b) Should the policy get compiled during the SRPM-RPM build process or should it be compiled out-of-band and then just packaged into the RPM. In other words, with custom policies, is the expectation that you'd need to rebuild them whenever updating SELinux in any way? It appears that there's no provision to support 3rd-party non-core applications as far as SELinux policies are concerned. Thanks, Peter

17 years

4
4
0 / 0

audit2allow broken?

by Hongwei Li

Hi, I have a fc6 linux box: kernel-2.6.20-1.2944.fc6, selinux-policy-2.4.6-62.fc6 and selinux-policy-targeted-2.4.6-62.fc6, audit-1.4.2-5.fc6. The system works and I was trying to add some settings to the selinux policy by running audit2allow. It was okay before noon: # audit2allow -M local < /var/log/audit/audit.log # semodule -i local.pp The new modules were added and it works. However, later, I can't do it again, but always get error: # audit2allow -M local < /var/log/audit/audit.log compilation failed: (unknown source)::ERROR 'syntax error' at token '' on line 6: /usr/bin/checkmodule: error(s) encountered while parsing configuration /usr/bin/checkmodule: loading policy configuration from local.te and the file local.te has only one line: module local 1.0; not like before. Can somebody tell what is wrong? "on line 6" of what file? I reboot the system, still the same. Thanks a lot! Hongwei Li

17 years

2
6
0 / 0

Allowing a apache to access a user folder by using semanage

by Josef Meile

Hi, I'm trying to allow apache to read a user folder as follows: % semanage fcontext -a -t httpd_t "/home/zopeuser/data(/.*)?" However I still get: May 9 13:42:38 my_host kernel: audit(1178710958.544:17691): avc: denied { search } for pid=4103 comm="httpd" name="data" dev=hda4 ino=2121605 scontext=user_u:system_r:httpd_t:s0 tcontext=user_u:object_r:user_home_t:s0 tclass=dir This is what semanage reports: & semanage fcontext -l | grep zope /home/zopeuser/data(/.*)? all files system_u:object_r:httpd_t:s0 I know you can do that with audit2allow by generating modules from the error messages. Indeed I cached four errors, generated four modules, then finally I combined them in to this: ---> zopefull.te module zopefull 1.0; require { type httpd_t; type user_home_t; class file read; class file getattr; class lnk_file read; class dir search; } #============= httpd_t ============== allow httpd_t user_home_t:file read; allow httpd_t user_home_t:file getattr; allow httpd_t user_home_t:lnk_file read; allow httpd_t user_home_t:dir search; <--- zopefull.te Which I indeed worked; however, I think it is a complicated and long way, and it does much more than what I want; in fact this gives access to all user folders to httpd and not just to the desired one. Is possible to do this with semanage? By the way, I'm using Fedora Core 6 without X and kernel 2.6.20-1.2948. Best regards Josef Meile

17 years

4
9
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2007