selinux June 2007

selinux@lists.fedoraproject.org

50 participants
63 discussions

documentation plans
by Karsten Wade 19 Jun '07

19 Jun '07

Since the release of Fedora 7, we have been watching the statistics for our new content location, http://docs.fedoraproject.org. In a recent thread on f-docs-l[1], Google referrer statistics[2] show that SELinux questions are a sizeable percentage (over 10%) of incoming search terms. Unfortunately. Why? Because: * The content they are hitting most is the FC3 SELinux FAQ * The top search keyphrase is "disable selinux", with "selinux disable" as number four (all of which take you to the FC3 FAQ) * Users cannot find anything useful that we'd want them to have The proposal[3] of the Fedora Docs team is this: 1. We gather all content that we have[4] that is not Fedora-specific and push that up to grow and be maintained on selinuxproject.org 2. A Fedora Docs writer, Paulo Santos, will help watch that content on selinuxproject.org. This becomes a new location for us to collaborate on distro-neutral community docs. 3. Paulo works up Fedora-specific content, from what exists in Fedora and added to by all of you, and that becomes new "SELinux for Fedora" content that Fedora Docs plans to maintain. Your help is much needed. 4. In all the locations where you find SELinux content in .*fedoraproject.org, we repopulate or redirect to a single Fedora SELinux content page. From that page we link to the upstream canonical docs on selinuxproject.org and provide the Fedora variant on that content. Barring someone stepping up and putting a partial or full-time resource on this writing, a job I no longer do at Red Hat, this is going to be the best way to generate and maintain SELinux open content. By using open collaboration tools (Wiki, Plone), it will be *much* easier for someone such as Dan Walsh to do a brain dump and have it be polished, formalized, and published. Thoughts? - Karsten [1] http://www.redhat.com/archives/fedora-docs-list/2007-June/msg00084.html [2] Use your browser's keyword search to find SELinux/selinux stuff: http://fedoraproject.org/awstats/docs/awstats.docs.fedoraproject.org.html [3] http://www.redhat.com/archives/fedora-docs-list/2007-June/msg00077.html [4] This page has a short list of locations we are going to pull content from: http://fedoraproject.org/wiki/Docs/Drafts/SELinux -- Karsten Wade, 108 Editor ^ Fedora Documentation Project Sr. Developer Relations Mgr. | fedoraproject.org/wiki/DocsProject quaid.108.redhat.com | gpg key: AD0E0C41 ////////////////////////////////// \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

3 2

inability to import keys/ set firewall properties
by charles f. zeitler 19 Jun '07

19 Jun '07

when trying to import keys, rpm is unable to get a lock. using system-config-securitylevel, attempted changes do not "stick", opened ports don't show up in the "other ports" window, if firewall is disabled, it is re-enabled. is selinux keeping me from doing sysadmin things? charles zeitler : Do What Thou Wilt : : Shall Be : : The Whole of The Law :

1 0

problem trying to transition to sysadm_r
by charles f. zeitler 19 Jun '07

19 Jun '07

when i enter: newrole -r sysadm_r at the cli, i get: Couldn't get default type. can someone give me a hint/tip/clue? thanx charles zeitler : Do What Thou Wilt : : Shall Be : : The Whole of The Law :

3 3

useradd failure under ldap with tls
by Chaos Golubitsky 19 Jun '07

19 Jun '07

When i manage user data via LDAP (using pam_ldap), useradd/usermod/etc fail when run from scripts. In particular, e.g. # yum install httpd fails because the "useradd apache" commands hangs. Audit2allow suggests: allow useradd_t urandom_device_t:chr_file { getattr read }; If i modify my LDAP configuration so that connections are not encrypted using TLS, the useradd succeeds. I think that, when LDAP is in use, anyone who needs to query the passwd or group map [1] should be able to read /dev/urandom so they can initiate TLS LDAP connections. But i don't know enough about the layout of the SELinux policy to speculate on whether the problem is that: (a) The PAM/LDAP client policy is ignorant of TLS (b) The useradd/etc policy is ignorant of LDAP (c) Something else Any suggestions would be appreciated. I have "solved" this for my own purposes the hackish way (i.e. by doing what audit2allow recommends, as a standalone module), but i'd like to be able to recommend a real patch. Thanks. Chaos [1] The useradd/usermod/etc commands need to query passwd maps in order to fail with an error if a central user conflicts with the user being created.

2 3

Re: documentation plans
by John Dennis 19 Jun '07

19 Jun '07

On 6/19/07, John Dennis <jdennis(a)redhat.com> wrote: > I take it that selinuxproject.org is new. Who is hosting > this? > On Tue, 2007-06-19 at 04:12 +0200, Paulo Santos wrote: > I'm not aware of selinuxproject.org under Fedora Project > infrastructure. Silly me, this is James Morris's domain, I just didn't recognize it with the different content. -- John Dennis <jdennis(a)redhat.com>

2 1

Re: mknod problem still present denied avc's
by Antonio Olivares 15 Jun '07

15 Jun '07

----- Original Message ---- From: Daniel J Walsh <dwalsh(a)redhat.com> To: Antonio Olivares <olivares14031(a)yahoo.com> Cc: fedora-selinux-list(a)redhat.com Sent: Thursday, June 14, 2007 9:02:35 AM Subject: Re: mknod problem still present denied avc's Antonio Olivares wrote: > dmesg returns > > audit(1181681041.681:4): avc: denied { add_name } for pid=739 comm="mknod" name="slamr0" scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=dir > > After I did this again > > [olivares@localhost ~]$ su - > Password: > [root@localhost ~]# grep insmod /var/log/audit/audit.log | audit2allow -M myinsmod > ******************** IMPORTANT *********************** > To make this policy package active, execute: > > semodule -i myinsmod.pp > > [root@localhost ~]# semodule -i myinsmod.pp > [root@localhost ~]# > > Selinux troubleshooter returned this: > > avc: denied { write } for comm="mknod" dev=tmpfs egid=0 euid=0 exe="/bin/mknod" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="/" pid=2766 scontext=user_u:system_r:insmod_t:s0 sgid=0 subj=user_u:system_r:insmod_t:s0 suid=0 tclass=dir tcontext=system_u:object_r:device_t:s0 tty=pts0 uid=0 > > Yes you allowed add_name to the directory now it is complaing about the write. It is best to put the machine in permissive mode, Run the app to completion, then generate the policy and retest in enforcing mode. setenforce 0 run test grep insmod /var/log/audit/audit.log | audit2allow -M myinsmod semodule -i myinsmod.pp setenforce 1 run test > Policy RPM: selinux-policy-2.6.4-8.fc7 > > Affected RPM Packages: coreutils-6.9-2.fc7 [application]Policy RPM: selinux-policy-2.6.4-12.fc7 > > > How can I effectively fix this? > > This is my /etc/modprobe.conf > > [root@localhost Download]# cat /etc/modprobe.conf > alias eth0 8139too > alias scsi_hostadapter sata_via > alias scsi_hostadapter1 pata_via > alias snd-card-0 snd-via82xx > options snd-card-0 index=0 > options snd-via82xx index=0 > install slamr modprobe --ignore-install ungrab-winmodem ; modprobe --ignore-install slamr; test -e /dev/slamr0 || (/bin/mknod -m 660 /dev/slamr0 c 242 0 2>/dev/null && chgrp dialout /dev/slamr0) > [root@localhost Download]# > > Thanks, > > Antonio > > > > > ____________________________________________________________________________________ > Yahoo! oneSearch: Finally, mobile search > that gives answers, not web links. > http://mobile.yahoo.com/mobileweb/onesearch?refer=1ONXIC > > -- > fedora-selinux-list mailing list > fedora-selinux-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > Did as you instructed. Set Selinux to permissive mode, recreated the dev/slamr0 using mknod and upon rebooting with selinux enabled it works!! [root@localhost ~]# grep insmod /var/log/audit/audit.log | audit2allow -M myinsmod ******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i myinsmod.pp [root@localhost ~]# semodule -i myinsmod.pp [root@localhost ~]# setenforce 1 but the message still appears audit(1181873499.608:3): avc: denied { create } for pid=751 comm="mknod" name="slamr0" scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file I have checked with the troubleshooter and it recommends me to do restorecon -v /dev/slamr0 [root@localhost ~]# restorecon -v /dev/slamr0 [root@localhost ~]# ls /dev/slamr0 -l crw-rw---- 1 root root 242, 0 2007-06-14 21:11 /dev/slamr0 [root@localhost ~]# Here is the summary from setroubleshoot browser. Summary SELinux is preventing sh (insmod_t) "getattr" access to device /dev/slamr0. Detailed Description SELinux has denied the sh (insmod_t) "getattr" access to device /dev/slamr0. /dev/slamr0 is mislabeled, this device has the default label of the /dev directory, which should not happen. All Character and/or Block Devices should have a label. You can attempt to change the label of the file using restorecon -v /dev/slamr0. If this device remains labeled device_t, then this is a bug in SELinux policy. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against the selinux-policy package. If you look at the other similar devices labels, ls -lZ /dev/SIMILAR, and find a type that would work for /dev/slamr0, you can use chcon -t SIMILAR_TYPE /dev/slamr0, If this fixes the problem, you can make this permanent by executing semanage fcontext -a -t SIMILAR_TYPE /dev/slamr0 If the restorecon changes the context, this indicates that the application that created the device, created it without using SELinux APIs. If you can figure out which application created the device, please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this application. Allowing Access Attempt restorecon -v /dev/slamr0 or chcon -t SIMILAR_TYPE /dev/slamr0 Additional Information Source Context system_u:system_r:insmod_t Target Context system_u:object_r:device_t Target Objects /dev/slamr0 [ chr_file ] Affected RPM Packages Policy RPM selinux-policy-2.6.4-12.fc7 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name plugins.device Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.21-1.3226.fc7 #1 SMP Sat Jun 9 22:23:35 EDT 2007 i686 athlon Alert Count 1 First Seen Thu 14 Jun 2007 06:26:18 PM CDT Last Seen Thu 14 Jun 2007 06:26:18 PM CDT Local ID 04c18a63-7a70-462e-8937-018923ab95bf Line Numbers Raw Audit Messages avc: denied { getattr } for comm="sh" dev=tmpfs egid=0 euid=0 exe="/bin/bash" exit=0 fsgid=0 fsuid=0 gid=0 items=0 name="slamr0" path="/dev/slamr0" pid=2265 scontext=system_u:system_r:insmod_t:s0 sgid=0 subj=system_u:system_r:insmod_t:s0 suid=0 tclass=chr_file tcontext=system_u:object_r:device_t:s0 tty=(none) uid=0 Thanks for helping, Antonio ____________________________________________________________________________________ Be a better Globetrotter. Get better travel answers from someone who knows. Yahoo! Answers - Check it out. http://answers.yahoo.com/dir/?link=list&sid=396545469

2 1

new (updated) FC7 system getting auditing errors
by Phil Edwards 15 Jun '07

15 Jun '07

Hi. I've just installed FC7, updated its packages, but made few other changes so far; no changes at all to selinux (I wouldn't know how, and there is no full-time sysadmin). The messages log is filling up with stuff like this: dbus: Can't send to audit system: USER_AVC avc: received policyload notice (seqno=2) : exe="/bin/dbus-daemon" (sauid=539, hostname=?, addr=?, terminal=?) nscd: Can't send to audit system: USER_AVC avc: received policyload notice (seqno=2) : exe="?" (sauid=28, hostname=?, addr=?, terminal=?) dbus and nscd are the nosiest culprits. Googling for what look like the key phrases gets me tons of hits from 2005, but nothing recent and nothing pertaining to FC7 (but having never used an FC release before, I could be wrong). Could somebody please tell me how to turn this noise off?

2 1

Hierarchy for sensitivity levels
by Forrest Taylor 14 Jun '07

14 Jun '07

I am teaching class this week and I had an interesting question from a student. We were discussing sensitivities and categories, and a student wondered about the hierarchical nature of sensitivities and categories. Assuming that s0 is unclassified, s1 is classified, s2 is secret and s3 is top secret, and s0<s1<s2<s3. If I have access to s3, I assume that you also have access to s2, s1, s0. Is there a way to throw categories in here so that users who have access to s3 do not necessarily have access to all of s2 and lower? Thanks, Forrest

2 2

SELinux is preventing ifup-eth (udev_t) "getattr" to /etc/dhclient-eth1.conf (dhcp_etc_t).
by Matthew Saltzman 14 Jun '07

14 Jun '07

I occasionally have to remove and re-insert my ipw2200 driver module. Every time I do, the following is generated: SELinux denied access requested by ifup-eth. It is not expected that this access is required by ifup-eth and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Source Context: system_u:system_r:udev_t:SystemLow-SystemHigh Target Context: system_u:object_r:dhcp_etc_t Target Objects: /etc/dhclient-eth1.conf [ file ] Affected RPM Packages: Policy RPM: selinux-policy-2.6.4-13.fc7 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Enforcing Plugin Name: plugins.catchall_file Host Name: xxxxxxxxxxxxxxxxxx Platform: Linux xxxxxxxxxxxxxxx 2.6.20-1.2952.fc6 #1 SMP Wed May 16 18:59:18 EDT 2007 i686 i686 Alert Count: 23 First Seen: Sun 10 Jun 2007 03:15:44 AM EDT Last Seen: Wed 13 Jun 2007 09:30:46 PM EDT Local ID: 244d5474-af72-4c98-8d63-2e3a43c9457a Line Numbers: Raw Audit Messages : avc: denied { getattr } for comm="ifup-eth" dev=dm-0 egid=0 euid=0 exe="/bin/bash" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="dhclient-eth1.conf" path="/etc/dhclient-eth1.conf" pid=11020 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 sgid=0 subj=system_u:system_r:udev_t:s0-s0:c0.c1023 suid=0 tclass=file tcontext=system_u:object_r:dhcp_etc_t:s0 tty=(none) uid=0 Thanks.

1 0

"Could not change policy booleans"
by Nils Caspar 14 Jun '07

14 Jun '07

Hi I'd like to change some policy booleans. For example httpd_can_network_connect. So I tried this (as root): > /usr/sbin/setsebool -P httpd_can_network_connect=1 But than I get "Could not change policy booleans". This works: > /usr/sbin/setsebool httpd_can_network_connect=1 I could put this into a boot script ;) In /var/log/messages, I get the following entry: > Jun 3 00:02:56 localhost dbus: Can't send to audit system: USER_AVC avc: received policyload notice (seqno=3) : exe="/bin/dbus-daemon" (sauid=500, hostname=?, addr=?, terminal=?) Have you any ideas? Cu Nils

6 13

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2007