selinux July 2007

selinux@lists.fedoraproject.org

35 participants
45 discussions

user home - disable execution
by Hal 25 Jul '07

25 Jul '07

Hi all I am new to selinux and I want to use it to acheive 3 main goals: 1. disable execution of any executables located in users' home dir trees. 2. disable users to see what other users exist on the system. 3. disable users to see who is logged in and what processes is running. Does anybody have any policy modules doing something similar? I need a starting point. A clue, what ever to point me the right direction. I have been reading "Selinux by example" and "SELINUX NSA'a open source Security Enhabced linux" but both books seem quite out of date. All I have learned is how to write useless rules, because I do not know how to make a modile how to use module to override the default policy etc. Thanks in advance! Hal ____________________________________________________________________________________ Building a website is a piece of cake. Yahoo! Small Business gives you all the tools to get online. http://smallbusiness.yahoo.com/webhosting

3 8

Re: Debian testing +selinux
by Justin Conover 24 Jul '07

24 Jul '07

On 7/23/07, Stephen Smalley <sds(a)tycho.nsa.gov> wrote: > > On Mon, 2007-07-23 at 09:23 -0500, Justin Conover wrote: > > > > > > On 7/23/07, Stephen Smalley <sds(a)tycho.nsa.gov> wrote: > > On Mon, 2007-07-23 at 09:09 -0500, Justin Conover wrote: > > > I'm not sure if there is a regular selinux mailing list or > > not, I > > > mainly use Fedora but thought someone here might be able to > > help. > > > > http://www.nsa.gov/selinux/info/list.cfm > > > > > > Thank you, I saw that list but it said "SELinux Developers mailing > > list" and I'm not a developer so I thought that excluded me :) > > Nope. > > > So if I remove the rule entirely, does that mean take it out of > > local.te? The parts talking about hald. > > Only one that is relevant to this assertion is the one between hald_t > and memory_device_t. > > -- > Stephen Smalley > National Security Agency > > Ok, I have removed the hald_t memory_device part: comatose:~# grep hald local.te type hald_t; #============= hald_t ============== #allow hald_t memory_device_t:chr_file read; allow hald_t var_t:file { read getattr }; comatose:~# checkmodule -M -m -o local.mod local.te checkmodule: loading policy configuration from local.te checkmodule: policy configuration loaded checkmodule: writing binary representation (version 6) to local.mod comatose:~# semodule_package -o local.pp -m local.mod comatose:~# semodule -i local.pp comatose:~# Another question, does doing this audit2allow method sort of mean "I have no idea what I'm doing, so allow it all", or is that why it caught the hald_t memory portion and said NO, don't do this!

3 3

Debian testing +selinux
by Justin Conover 23 Jul '07

23 Jul '07

I'm not sure if there is a regular selinux mailing list or not, I mainly use Fedora but thought someone here might be able to help. I'm playing with selinux on Debian Testing and decided to try and write a policy from following the fc5 faq http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385 Here is what I have done: comatose:~# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: permissive Policy version: 21 Policy from config file: refpolicy-targeted comatose:~# audit2allow -m local -l -i /var/log/audit/audit.log > local.te comatose:~# checkmodule -M -m -o local.mod local.te checkmodule: loading policy configuration from local.te checkmodule: policy configuration loaded checkmodule: writing binary representation (version 6) to local.mod comatose:~# semodule_package -o local.pp -m local.mod comatose:~# semodule -i local.pp libsepol.check_assertion_helper: assertion on line 0 violated by allow hald_t memory_device_t:chr_file { read }; libsepol.check_assertions: 1 assertion violations occured libsemanage.semanage_expand_sandbox: Expand module failed semodule: Failed! comatose:~# cat local.te module local 1.0; require { type unconfined_t; type lib_t; type xserver_log_t; type mount_t; type var_run_t; type syslogd_t; type etc_runtime_t; type initrc_t; type xdm_t; type udev_t; type device_t; type hald_t; type xdm_xserver_t; type memory_device_t; type insmod_t; type dhcpc_t; type var_t; type etc_t; type security_t; class fifo_file write; class process { execstack execmem signal }; class unix_stream_socket { read write }; class chr_file read; class fd use; class file { write rename getattr append read create unlink execute_no_trans }; class filesystem getattr; class dir { write remove_name create add_name rmdir }; } #============= dhcpc_t ============== allow dhcpc_t etc_runtime_t:file unlink; #============= hald_t ============== allow hald_t memory_device_t:chr_file read; allow hald_t var_t:file { read getattr }; #============= insmod_t ============== allow insmod_t xdm_t:fd use; allow insmod_t xdm_xserver_t:unix_stream_socket { read write }; allow insmod_t xserver_log_t:file write; #============= mount_t ============== allow mount_t security_t:filesystem getattr; #============= syslogd_t ============== allow syslogd_t device_t:fifo_file write; #============= udev_t ============== allow udev_t etc_t:dir { write remove_name add_name }; allow udev_t etc_t:file { write rename create unlink append }; allow udev_t initrc_t:process signal; allow udev_t lib_t:file execute_no_trans; allow udev_t var_run_t:dir { create rmdir }; #============= unconfined_t ============== allow unconfined_t self:process { execstack execmem };

2 1

insmod_t wants sys_nice ....
by Tom London 21 Jul '07

21 Jul '07

After installing this morning's Rawhide, including selinux-policy-targeted-3.0.3-3.fc8, selinux-policy-3.0.3-3.fc8 and selinux-policy-devel-3.0.3-3.fc8, I get lots of Jul 21 10:39:01 localhost kernel: audit(1185039533.420:74): avc: denied { sys_nice } for pid=1796 comm="modprobe" capability=23 scontext=system_u:system_r:insmod_t:s0 tcontext=system_u:system_r:insmod_t:s0 tclass=capability Jul 21 10:39:01 localhost kernel: audit(1185039533.920:75): avc: denied { sys_nice } for pid=1829 comm="modprobe" capability=23 scontext=system_u:system_r:insmod_t:s0 tcontext=system_u:system_r:insmod_t:s0 tclass=capability in /var/log/messages, and similar type=AVC msg=audit(1185039594.415:93): avc: denied { sys_nice } for pid=3157 comm="modprobe" capability=23 scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability type=SYSCALL msg=audit(1185039594.415:93): arch=40000003 syscall=128 success=yes exit=0 a0=b7f13008 a1=180f4 a2=a0166f8 a3=a0166f8 items=0 ppid=3133 pid=3157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="modprobe" exe="/sbin/modprobe" subj=system_u:system_r:insmod_t:s0-s0:c0.c1023 key=(null) in /var/log/audit/audit.log tom -- Tom London

1 0

gconf AVCs....
by Tom London 20 Jul '07

20 Jul '07

Login spawns these: type=USER_LOGIN msg=audit(1184940747.700:30): user pid=3063 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)' type=AVC msg=audit(1184940749.700:31): avc: denied { associate } for pid=3234 comm="gconfd-2" name=".testing.writeability" scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem type=SYSCALL msg=audit(1184940749.700:31): arch=40000003 syscall=5 success=no exit=-13 a0=811ef20 a1=41 a2=1c0 a3=811ef20 items=0 ppid=1 pid=3234 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="gconfd-2" exe="/usr/libexec/gconfd-2" subj=system_u:system_r:unconfined_t:s0 key=(null) type=AVC msg=audit(1184940756.200:32): avc: denied { associate } for pid=3234 comm="gconfd-2" name=".testing.writeability" scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem type=SYSCALL msg=audit(1184940756.200:32): arch=40000003 syscall=5 success=no exit=-13 a0=8345d90 a1=41 a2=1c0 a3=8345d90 items=0 ppid=1 pid=3234 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="gconfd-2" exe="/usr/libexec/gconfd-2" subj=system_u:system_r:unconfined_t:s0 key=(null) type=AVC msg=audit(1184940779.699:33): avc: denied { associate } for pid=3234 comm="gconfd-2" name="saved_state.tmp" scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem type=SYSCALL msg=audit(1184940779.699:33): arch=40000003 syscall=5 success=no exit=-13 a0=834c8a0 a1=241 a2=1c0 a3=811d230 items=0 ppid=1 pid=3234 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) comm="gconfd-2" exe="/usr/libexec/gconfd-2" subj=system_u:system_r:unconfined_t:s0 key=(null) tom -- Tom London

2 5

EnCase
by Marcio B. Jr. 20 Jul '07

20 Jul '07

Dear list, is there any documentation regarding SE Linux and the forensic solution named EnCase Enterprise? Thank you in advance, -- Marcio Barbado, Jr. ============== ==============

1 0

Text console not setting category
by Forrest Taylor 20 Jul '07

20 Jul '07

I have a user that has a category different than the default. When I log in to the GUI or via ssh, the category is set. However, when I login to the text console, the category is not set. Is this a bug in login or do I have unreasonable expectations? # semanage translation -l s0:c1 admin1 # semanage login -l student user_u admin1 Through ssh/GUI: $ id -Z user_u:system_r:unconfined_t:admin1 Through text console: $ id -Z system_u:system_r:unconfined_t:SystemLow-SystemHigh Now that I write this, I notice that the user and role have changed as well. I also notice this in the audit log: type=USER_ROLE_CHANGE msg=audit(1184777815.107:4063): user pid=5517 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=user_u:system_r:unconfined_t:s0:c1 selected- context=?: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' This is running on RHEL 5.0.0 targeted policy. Any clues? Thanks, Forrest

2 6

mindterm (java_t) AVCs
by Tom London 20 Jul '07

20 Jul '07

Running latest rawhide, targeted enforcing: Running 'java -jar mindterm.jar' with mindterm-3.1.2 produced AVC. Putting in permissive mode and running, I get these: type=AVC msg=audit(1184596927.029:42): avc: denied { unix_read } for pid=3208 comm="X" key=0 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:java_t:s0 tclass=shm type=AVC msg=audit(1184596927.029:42): avc: denied { read } for pid=3208 comm="X" key=0 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:java_t:s0 tclass=shm type=SYSCALL msg=audit(1184596927.029:42): arch=40000003 syscall=117 success=yes exit=0 a0=15 a1=110017 a2=1000 a3=bfd97ef8 items=0 ppid=3206 pid=3208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty7 comm="X" exe="/usr/bin/Xorg" subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1184596927.029:43): avc: denied { getattr associate } for pid=3208 comm="X" key=0 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:java_t:s0 tclass=shm type=SYSCALL msg=audit(1184596927.029:43): arch=40000003 syscall=117 success=yes exit=0 a0=18 a1=110017 a2=102 a3=0 items=0 ppid=3206 pid=3208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty7 comm="X" exe="/usr/bin/Xorg" subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1184596928.029:44): avc: denied { unix_write } for pid=3208 comm="X" key=0 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:java_t:s0 tclass=shm type=AVC msg=audit(1184596928.029:44): avc: denied { write } for pid=3208 comm="X" key=0 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:java_t:s0 tclass=shm type=SYSCALL msg=audit(1184596928.029:44): arch=40000003 syscall=117 success=yes exit=0 a0=15 a1=118017 a2=0 a3=bfd97ef8 items=0 ppid=3206 pid=3208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty7 comm="X" exe="/usr/bin/Xorg" subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null) or allow xdm_xserver_t java_t:shm { write unix_read getattr unix_write associate read }; BTW, the app appears to run in enforcing mode, even with the AVC. Here is the only enforcing AVC: type=AVC msg=audit(1184596881.529:40): avc: denied { unix_read } for pid=3208 comm="X" key=0 scontext=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:java_t:s0 tclass=shm type=SYSCALL msg=audit(1184596881.529:40): arch=40000003 syscall=117 success=no exit=-13 a0=15 a1=108017 a2=1000 a3=bfd97ef8 items=0 ppid=3206 pid=3208 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty7 comm="X" exe="/usr/bin/Xorg" subj=system_u:system_r:xdm_xserver_t:s0-s0:c0.c1023 key=(null) tom -- Tom London

3 2

cups AVC...
by Tom London 20 Jul '07

20 Jul '07

Seem to be getting this one from cups. Haven't seen 'anon_inodefs' before.... Printing to HP5MP seems to work however.... tom type=AVC msg=audit(1184938825.408:32): avc: denied { ioctl } for pid=5296 comm="cupsd" name="[eventpoll]" dev=anon_inodefs ino=385 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file type=SYSCALL msg=audit(1184938825.408:32): arch=40000003 syscall=54 success=no exit=-13 a0=1 a1=5401 a2=bfda72ac a3=bfda73cc items=0 ppid=5295 pid=5296 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="cupsd" exe="/usr/sbin/cupsd" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null) type=AVC_PATH msg=audit(1184938825.408:32): path="anon_inode:[eventpoll]" type=LABEL_LEVEL_CHANGE msg=audit(1184938825.408:33): user pid=5296 uid=0 auid=500 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=HP5MP uri=hp:/par/HP_LaserJet_5MP?device=/dev/parport0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)' -- Tom London

3 2

Messages from update to selinux-policy-3.0.3-2.fc8
by Tom London 20 Jul '07

20 Jul '07

[root@localhost Downloads]# rpm -Uvh selinux* Preparing... ########################################### [100%] 1:selinux-policy ########################################### [ 33%] 2:selinux-policy-devel ########################################### [ 67%] 3:selinux-policy-targeted########################################### [100%] libsemanage.semanage_commit_sandbox: Error while renaming /etc/selinux/targeted/modules/active to /etc/selinux/targeted/modules/previous. /usr/sbin/semanage: Could not add SELinux user guest_u libsemanage.semanage_commit_sandbox: Error while renaming /etc/selinux/targeted/modules/active to /etc/selinux/targeted/modules/previous. /usr/sbin/semanage: Could not add SELinux user xguest_u [root@localhost Downloads]# Got this AVC: type=AVC msg=audit(1184939434.913:47): avc: denied { rename } for pid=5453 comm="semanage" name="active" dev=dm-0 ino=11076264 scontext=system_u:system_r:semanage_t:s0 tcontext=system_u:object_r:selinux_config_t:s0 tclass=dir type=SYSCALL msg=audit(1184939434.913:47): arch=40000003 syscall=38 success=no exit=-13 a0=85a0d40 a1=85a0d70 a2=1975c4 a3=bf9eec98 items=0 ppid=5443 pid=5453 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="semanage" exe="/usr/bin/python" subj=system_u:system_r:semanage_t:s0 key=(null) type=USER_ROLE_CHANGE msg=audit(1184939434.913:48): user pid=5453 uid=0 auid=500 subj=system_u:system_r:semanage_t:s0 msg='op=add SELinux user record acct="xguest_u" old-seuser=? old-role=? old-range=? new-seuser=xguest_u new-role=xguest_r new-range=s0 exe=/usr/sbin/semanage (hostname=?, addr=?, terminal=pts/0 res=failed)' [similar one for 'guest_u'] tom -- Tom London

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2007