selinux June 2007

selinux@lists.fedoraproject.org

50 participants
63 discussions

Bug in selinux-policy-strict.noarch 0:2.6.4-13.fc7
by Pierre JUHEN 11 Jun '07

11 Jun '07

I was not able to install selinux-policy-strict.noarch 0:2.6.4-13.fc7 : Here is the trace. Thanks, _______________________________________________________ yum install selinux-policy-strict Loading "installonlyn" plugin Setting up Install Process Parsing package install arguments livna 100% |=========================| 1.1 kB 00:00 fedora 100% |=========================| 2.1 kB 00:00 updates 100% |=========================| 1.9 kB 00:00 Resolving Dependencies --> Running transaction check ---> Package selinux-policy-strict.noarch 0:2.6.4-13.fc7 set to be updated Dependencies Resolved ============================================================================= Package Arch Version Repository Size ============================================================================= Installing: selinux-policy-strict noarch 2.6.4-13.fc7 updates 1.6 M Transaction Summary ============================================================================= Install 1 Package(s) Update 0 Package(s) Remove 0 Package(s) Total download size: 1.6 M Is this ok [y/N]: y Downloading Packages: (1/1): selinux-policy-str 100% |=========================| 1.6 MB 00:26 Running Transaction Test Finished Transaction Test Transaction Test Succeeded Running Transaction Installing: selinux-policy-strict ######################### [1/1] libsepol.context_from_record: type unconfined_execmem_exec_t is not defined libsepol.context_from_record: could not create context structure libsepol.context_from_string: could not create context structure libsepol.sepol_context_to_sid: could not convert system_u:object_r:unconfined_execmem_exec_t:s0 to sid /etc/selinux/strict/contexts/files/file_contexts: line 597 has invalid context system_u:object_r:unconfined_execmem_exec_t:s0 libsemanage.semanage_install_active: setfiles returned error code 1. semodule: Failed! Installed: selinux-policy-strict.noarch 0:2.6.4-13.fc7 Complete!

3 2

Firewall problem
by nichol425 11 Jun '07

11 Jun '07

Hi folks; I am having problems to add ports on my new installed Fedora7. I am using GUI tools system/administration/Firewall and SElinux the input my admin password as requested. I click otherports and find out the "add+" button is gray out. If I added the port the system will not take it. On my Fedora 6 the "add +" button is green. the other issue is I can not add time server as well. The same "add+" button is grayed out. Did I missed something ?? Can anyone advise how to fix it. Thanks Jim

2 1

Alsa and /etc/ in F7
by Matthew Saltzman 11 Jun '07

11 Jun '07

Every time I suspend my laptop, I get the following from the troubleshooter: SELinux is preventing /sbin/alsactl (alsa_t) "write" to etc (etc_t). The suggestion to restorecon /etc doesn't seem very sensible, and doesn't change anything anyway (so the suggestion is that it's a policy bug). >From the Additional Information: Source Context: system_u:system_r:alsa_t Target Context: system_u:object_r:etc_t Target Objects: etc [ dir ] Affected RPM Packages: alsa-utils-1.0.14-0.5.rc2.fc7 [application]filesystem-2.4.6-1.fc7 [target] Policy RPM: selinux-policy-2.6.4-8.fc7 Selinux Enabled: True Policy Type: targeted MLS Enabled: True Enforcing Mode: Enforcing Plugin Name: plugins.mislabeled_file

3 2

SELinux & Xen
by Jordi Prats 10 Jun '07

10 Jun '07

Hi all, I've read this brief documentation on the fedora and RHEL5 documentation page: http://fedoraproject.org/wiki/Docs/Fedora7VirtQuickStart#head-42db86c47fbb6… https://www.redhat.com/docs/manuals/enterprise/RHEL-5-manual/Virtualization… I'm understanding that this will grant access to the device to the xen daemon (xend) # semanage fcontext -a -t xen_image _t -f -b /dev/sda2 # restorecon /dev/sda2 But there's any way that you can be sure that a given domain can't acces to data on a other xen guest (a diferent device) using selinux? So, the Xen guest A could only acces to /dev/sda, and Xen guest B could only acces to /dev/sdb but they both are using the same xend daemon. Thank you very much! Jordi -- ...................................................................... __ / / Jordi Prats Català C E / S / C A Departament de Sistemes /_/ Centre de Supercomputació de Catalunya Gran Capità, 2-4 (Edifici Nexus) · 08034 Barcelona T. 93 205 6464 · F. 93 205 6979 · jprats(a)cesca.es ...................................................................... pgp:0x5D0D1321 ......................................................................

2 1

SELinux Permission Documentation
by mantaray_1 08 Jun '07

08 Jun '07

What can be sent and received as rawip to and from kernel_t, and what are the limitations of what can be done with the data? I am interested in understanding the security implications of this (and other) SELinux permissions. Is there anyone who can direct me to reference materials that explain the security implications of allowing various SELinux permissions?

2 3

selinux-policy-strict bug
by Paul Sipot 06 Jun '07

06 Jun '07

selinux-policy-strict seems to fail with allowing remote access to the sshd on Fedora7 (2.6.21-1.3194.fc7). I've installed Fedora7 with all the package collections disabled for a minimal system in the installer, installed the necessary tools for selinux and the strict policy and enabled it. Installed sshd, touched /.autorelabel and rebooted (twice). When enabling the enforced mode, and try to ssh from the LAN, I get avc messages because of denied access ("permission denied" after entering the password on the client). I tried to make a module for allowing it but I get assertions when installing the modules. ####################################################### [root@area51 sshd]# cat MYsshd.te module MYsshd 1.0; require { type staff_t; type user_home_dir_t; type sshd_t; class file { write ioctl }; class capability { audit_control audit_write }; class netlink_audit_socket { create nlmsg_relay write read }; } #============= sshd_t ============== allow sshd_t self:capability { audit_control audit_write }; allow sshd_t self:netlink_audit_socket { create nlmsg_relay read write }; #============= staff_t ============= allow staff_t user_home_dir_t:file { write ioctl }; ------------------------------------------------------- [root@area51 sshd]# semodule -i MYsshd.pp libsepol.check_assertion_helper: assertion on line 0 violated by allow sshd_t sshd_t:netlink_audit_socket { nlmsg_relay }; libsepol.check_assertion_helper: assertion on line 0 violated by allow sshd_t sshd_t:capability { audit_write }; libsepol.check_assertion_helper: assertion on line 0 violated by allow sshd_t sshd_t:capability { audit_control }; libsepol.check_assertions: 3 assertion violations occured libsemanage.semanage_expand_sandbox: Expand module failed semodule: Failed! ####################################################### cat /var/log/messages | audit2allow -M MYautogen semodule -i MYautogen.pp ------------------------------------------------------- libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_t security_t:security { load_policy }; libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_xserver_t staff_xserver_t:netlink_audit_socket { nlmsg_relay }; libsepol.check_assertion_helper: assertion on line 0 violated by allow local_login_t local_login_t:netlink_audit_socket { nlmsg_relay }; libsepol.check_assertion_helper: assertion on line 0 violated by allow sshd_t sshd_t:netlink_audit_socket { nlmsg_relay }; libsepol.check_assertion_helper: assertion on line 0 violated by allow setfiles_t setfiles_t:netlink_audit_socket { nlmsg_relay }; libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_xserver_t staff_xserver_t:capability { audit_write }; libsepol.check_assertion_helper: assertion on line 0 violated by allow local_login_t local_login_t:capability { audit_write }; libsepol.check_assertion_helper: assertion on line 0 violated by allow sshd_t sshd_t:capability { audit_write }; libsepol.check_assertion_helper: assertion on line 0 violated by allow setfiles_t setfiles_t:capability { audit_write }; libsepol.check_assertion_helper: assertion on line 0 violated by allow local_login_t local_login_t:capability { audit_control }; libsepol.check_assertion_helper: assertion on line 0 violated by allow sshd_t sshd_t:capability { audit_control }; libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_t staff_t:capability { audit_control }; libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_t staff_t:capability { sys_module }; libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_xserver_t shadow_t:file { write create }; libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_t shadow_t:file { write create }; libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_xserver_t shadow_t:file { read }; libsepol.check_assertions: 16 assertion violations occured libsemanage.semanage_expand_sandbox: Expand module failed semodule: Failed!

2 1

Re: mknod still not working after suggested fix
by Antonio Olivares 05 Jun '07

05 Jun '07

----- Original Message ---- From: Daniel J Walsh <dwalsh(a)redhat.com> To: Antonio Olivares <olivares14031(a)yahoo.com> Cc: fedora-selinux-list(a)redhat.com Sent: Tuesday, June 5, 2007 8:22:32 AM Subject: Re: mknod still not working after suggested fix Antonio Olivares wrote: > selinux is still not allowing mknod to do its job. > > I have to manually create the device node every boot > > [root@localhost ~]# mknod -m 600 /dev/slamr0 c 242 0 > [1]+ Done gedit /boot/grub/grub.conf > [root@localhost ~]# modprobe ungrab-winmodem > [root@localhost ~]# modprobe slamr > [root@localhost ~]# slmodemd -c USA /dev/slamr0 & > [1] 2709 > [root@localhost ~]# SmartLink Soft Modem: version 2.9.11 Jun 4 2007 00:14:21 > symbolic link `/dev/ttySL0' -> `/dev/pts/1' created. > modem `slamr0' created. TTY is `/dev/pts/1' > Use `/dev/ttySL0' as modem device, Ctrl+C for termination. > > > > audit(1181023411.825:4): avc: denied { mknod } for pid=673 comm="mknod" capability=27 scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability > > > [root@localhost ~]# grep insmod /var/log/audit/audit.log | audit2allow -M myinsmod > ******************** IMPORTANT *********************** > To make this policy package active, execute: > > semodule -i myinsmod.pp > > [root@localhost ~]# semodule -i myinsmod.pp > > What should I try now? > > Regards, > > Antonio > > > Are you seeing other avc messages? Please attach the myinsmod.te and your audit.log > > > ____________________________________________________________________________________ > Get the Yahoo! toolbar and be alerted to new email wherever you're surfing. > http://new.toolbar.yahoo.com/toolbar/features/mail/index.php > > -- > fedora-selinux-list mailing list > fedora-selinux-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > [root@localhost ~]# cat myinsmod.te module myinsmod 1.0; require { type insmod_t; type device_t; class dir write; } #============= insmod_t ============== allow insmod_t device_t:dir write; [root@localhost ~]# Attachment was neglected by yahoo mail, sent it to text file and attached as auditlog.txt [root@localhost audit]# cat audit.log | more type=DAEMON_START msg=audit(1180930151.012:6690) auditd start, ver=1.5.3, format =raw, auid=4294967295 pid=1558 res=success, auditd pid=1558 type=CONFIG_CHANGE msg=audit(1180930150.723:15): audit_enabled=1 old=0 by auid=4 294967295 subj=system_u:system_r:auditd_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1180930150.723:16): audit_enabled=1 old=0 by auid=4 294967295 res=1 type=CONFIG_CHANGE msg=audit(1180930150.723:17): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 type=CONFIG_CHANGE msg=audit(1180930150.723:18): audit_backlog_limit=320 old=64 by auid=4294967295 res=1 type=USER_AUTH msg=audit(1180930198.716:19): user pid=2385 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication ac ct=? : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)' type=USER_LOGIN msg=audit(1180930199.216:20): user pid=2385 uid=0 auid=429496729 5 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='acct=olivares: exe="/ bin/login" (hostname=?, addr=?, terminal=tty1 res=failed)' type=USER_AUTH msg=audit(1180930208.714:21): user pid=2385 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication ac ct=root : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' type=USER_ACCT msg=audit(1180930208.714:22): user pid=2385 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct=r oot : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' type=LOGIN msg=audit(1180930209.214:23): login pid=2385 uid=0 old auid=429496729 .... Thank you very much for your patience and your kindness with this issue. , Antonio ____________________________________________________________________________________ We won't tell. Get more on shows you hate to love (and love to hate): Yahoo! TV's Guilty Pleasures list. http://tv.yahoo.com/collections/265

1 0

rhgb avcs
by Bob Kashani 05 Jun '07

05 Jun '07

I'm getting these avcs for rhgb (rhgb works fine though). Jun 5 13:04:38 chaucer kernel: audit(1181073867.313:9): avc: denied { search } for pid=1186 comm="rhgb" name="root" dev= sda2 ino=940065 scontext=system_u:system_r:rhgb_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=dir

1 0

Re: where is list_dir_perms defined?
by Philip 05 Jun '07

05 Jun '07

Clarkson, Mike R (US SSA) wrote: > I run across things like list_dir_perms and r_file_perms in allow > rules in my SELinux policy, but I have no idea where these are > defined. Can someone point me to the location where these are defined? list_dir_perms: this is a common object permission set required for a domain to list the contents of a directory. r_file_perms is the same thing but for reading a file. For details like this you should really take a look at the reference policy sources. These things are in the directory: serefpolicy-version/policy/support/ grep -iIr 'define(`list_dir_perms' * Good luck, - Philip

1 0

where is list_dir_perms defined?
by Clarkson, Mike R (US SSA) 05 Jun '07

05 Jun '07

I run across things like list_dir_perms and r_file_perms in allow rules in my SELinux policy, but I have no idea where these are defined. Can someone point me to the location where these are defined? Thanks

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux June 2007