Feature request: Tomcat5-Policy
by Christoph Höger
Hi,
here is a sample policy for Tomcat5. Could we integrate this (or a
reviewed and much better version) into fedora?
regards
christoph
16 years, 3 months
more avc denials
by Michael Thomas
While testing some changes to the cyphesis selinux module in Rawhide, I
started getting the following denials:
type=AVC msg=audit(1200547499.303:66): avc: denied { write } for
pid=2722 comm="cyphesis" name="context" dev=selinuxfs ino=5
scontext=unconfined_u:system_r:cyphesis_t:s0
tcontext=system_u:object_r:security_t:s0 tclass=file
type=AVC msg=audit(1200547499.303:67): avc: denied { check_context }
for pid=2722 comm="cyphesis"
scontext=unconfined_u:system_r:cyphesis_t:s0
tcontext=system_u:object_r:security_t:s0 tclass=security
What would cause these?
--Wart
16 years, 3 months
postfix sendmail and GeoIP
by John Griffiths
I use postfix and installed GeoIP so that country of origin can be
determined from the IP. postfix.sendmail is constrained so that it
cannot read the GeoIP database file, /usr/share/GeoIP/GeoIP.dat .
The AVC is:
avc: denied { read } for comm=sendmail dev=dm-0 egid=48 euid=48
exe=/usr/sbin/sendmail.postfix exit=0 fsgid=48 fsuid=48 gid=48
items=0 path=/usr/share/GeoIP/GeoIP.dat pid=27728
scontext=system_u:system_r:system_mail_t:s0 sgid=48
subj=system_u:system_r:system_mail_t:s0 suid=48 tclass=file
tcontext=system_u:object_r:usr_t:s0 tty=(none) uid=48
I ran audit2allow -M which produced the following policy:
module postfixSendmail 1.0;
require {
type system_mail_t;
type usr_t;
class file read;
}
#============= system_mail_t ==============
allow system_mail_t usr_t:file read;
I don't think allowing postfix.sendmail to read all files of type usr_t
is the right thing to do, yet, I do need to allow postfix.sendmail to
read the GeoIP data file.
Any suggestions?
Regards,
John
16 years, 3 months
Fedora 8 odds and sods
by Paul Howarth
Today I've done a bit of a clean-up of the local policy modules I've had
in use over the last couple of Fedora releases, removing bits that are
no longer needed and consolidating the remaining ones into a single
"localmisc" module. The results of this is:
policy_module(localmisc, 0.1.34)
require {
attribute mailserver_delivery;
type depmod_t;
type httpd_t;
type load_policy_t;
type procmail_t;
type procmail_tmp_t;
type pptp_t;
type restorecon_t;
type sendmail_t;
type setfiles_t;
type soundd_port_t;
type squid_t;
type useradd_t;
type var_t;
};
# ========================================
# Things that probably need to go upstream
# ========================================
# Milter sockets, why did this work before?
#allow sendmail_t initrc_t:unix_stream_socket { read write connectto };
init_stream_connect_script(mailserver_delivery)
init_rw_script_stream_sockets(mailserver_delivery)
# Allow misc command output to be sent to a pipe, needed for rpm scriptlets
# Probably not needed since Fedora 8
#unconfined_rw_pipes(depmod_t)
#unconfined_rw_pipes(load_policy_t)
#unconfined_rw_pipes(setfiles_t)
#unconfined_rw_pipes(useradd_t)
# Allow pptp to manage its own processes
allow pptp_t self:process signal;
# Allow sendmail to read procmail tempfiles for forwarding
# (would need a new interface in procmail.if to do this properly)
allow sendmail_t procmail_tmp_t:file { read write getattr ioctl };
# Not sure what this is, needed when network is congested
allow sendmail_t self:process signull;
# ==============
# Local oddities
# ==============
# Allow restorecon to restore file contexts via the /var/www -> /srv/www
symlink
allow restorecon_t var_t:lnk_file read;
# Allow httpd to read /var/www -> /srv/www symlink
allow httpd_t var_t:lnk_file { getattr read };
# Allow squid to connect to websites on port 8000 (defined in policy as
soundd_port_t)
allow squid_t soundd_port_t:tcp_socket name_connect;
Not a lot left there, so I thought I'd post them here in their entirety
for discussion and hopefully inclusion (at least in part) in a future
policy update.
Paul.
16 years, 3 months
SELinux is preventing access to files with the label, file_t.
by Antonio Olivares
Is anybody else seeing this?
I have seen it before. I have not added other
disks/drives. I do not know what file_t is?
I ask why should I do this:
"touch /.autorelabel; reboot"
?
It takes a big while. I have already allowed a stack
from new firefox3.0 beta.
[root@localhost ~]# chcon -t unconfined_execmem_exec_t
/usr/lib/firefox-3.0b3pre/firefox
because it complains as well.
Thanks,
Antonio
Summary:
SELinux is preventing access to files with the label,
file_t.
Detailed Description:
SELinux permission checks on files labeled file_t are
being denied. file_t is
the context the SELinux kernel gives to files that do
not have a label. This
indicates a serious labeling problem. No files on an
SELinux box should ever be
labeled file_t. If you have just added a new disk
drive to the system you can
relabel it using the restorecon command. Otherwise you
should relabel the entire
files system.
Allowing Access:
You can execute the following command as root to
relabel your computer system:
"touch /.autorelabel; reboot"
Additional Information:
Source Context
system_u:system_r:tmpreaper_t
Target Context system_u:object_r:file_t
Target Objects
/tmp/virtual-olivares.p28akz [ dir ]
Source
tmpwatch(/usr/sbin/tmpwatch)
Port <Unknown>
Host localhost
Source RPM Packages
Target RPM Packages
Policy RPM
selinux-policy-3.2.5-12.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name file
Host Name localhost
Platform Linux localhost
2.6.24-0.150.rc7.git4.fc9 #1 SMP
Sat Jan 12 11:44:09 EST
2008 i686 athlon
Alert Count 1
First Seen Wed 16 Jan 2008 08:48:19
AM CST
Last Seen Wed 16 Jan 2008 08:48:19
AM CST
Local ID
ac67f7f5-25da-43ef-8f11-682504e2a274
Line Numbers
Raw Audit Messages
host=localhost type=AVC msg=audit(1200494899.124:38):
avc: denied { getattr } for pid=3073
comm="tmpwatch" path="/tmp/virtual-olivares.p28akz"
dev=dm-0 ino=31391794
scontext=system_u:system_r:tmpreaper_t:s0
tcontext=system_u:object_r:file_t:s0 tclass=dir
host=localhost type=SYSCALL
msg=audit(1200494899.124:38): arch=40000003
syscall=196 success=no exit=-13 a0=99f65bb a1=bfc24780
a2=5feff4 a3=99f6008 items=0 ppid=3071 pid=3073
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) comm="tmpwatch"
exe="/usr/sbin/tmpwatch"
subj=system_u:system_r:tmpreaper_t:s0 key=(null)
____________________________________________________________________________________
Be a better friend, newshound, and
know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ
16 years, 3 months
SELinux newbie
by Sietjp
Hi all,
Sorry for this newbie post.
I'm running fedora 8 and lamp.
All is wroking fine except of emails. Apache is not able to send emails via
sendmail.
I tried setenforce 0, and then all is working fine.
But as I'm not a lazy guy, I would like to keep SELInux active and understand
what is giong wrong.
Please help :)
I don't ask for the solution but maybe a starting point or a link, thx :)
JP
16 years, 3 months
audit log for "setenforce" changes?
by Chuck Anderson
Is there any way to tell from the audit log or elsewhere when
someone/something changed SELinux from enforcing to permissive or vice
versa?
16 years, 3 months
Is 'search' on home_root_t always bad?
by Christoph Höger
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
currently I encounter a denial for openvpn which tries to "search"
home_root_t. Is that generally a bad idea (and openvpn should be fixed)
or should it be allowed?
regards
christoph
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iD8DBQFHizokhMBO4cVSGS8RAks+AKCcEkPPdz76HvYj/4IQoDcX1ZRaGQCgnhVP
BaGsILyaQZcZ+pF9TbYTdc8=
=blai
-----END PGP SIGNATURE-----
16 years, 3 months
AVC generated from virtual terminal switch ('Ctl-Alt-F1/Ctl-Alt-F7')
by Tom London
Running Rawhide, targeted enforcing.
Booting into gdm/gnome, entering 'Ctl-Alt-F1' and logging in as the
same user generates the following audit messages:
type=USER_AUTH msg=audit(1199979217.226:28): user pid=2602 uid=0
auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='op=PAM:authentication acct=tbl exe="/bin/login" (hostname=?,
addr=?, terminal=tty1 res=failed)'
type=USER_LOGIN msg=audit(1199979217.266:29): user pid=2602 uid=0
auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty1
res=failed)'
type=USER_AUTH msg=audit(1199979226.383:30): user pid=2602 uid=0
auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='op=PAM:authentication acct=tbl exe="/bin/login" (hostname=?,
addr=?, terminal=tty1 res=failed)'
type=USER_LOGIN msg=audit(1199979226.384:31): user pid=2602 uid=0
auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty1
res=failed)'
type=USER_AUTH msg=audit(1199979234.098:32): user pid=2602 uid=0
auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='op=PAM:authentication acct=tbl exe="/bin/login" (hostname=?,
addr=?, terminal=tty1 res=success)'
type=USER_ACCT msg=audit(1199979234.106:33): user pid=2602 uid=0
auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='op=PAM:accounting acct=tbl exe="/bin/login" (hostname=?, addr=?,
terminal=tty1 res=success)'
type=LOGIN msg=audit(1199979234.108:34): login pid=2602 uid=0 old
auid=4294967295 new auid=500
type=USER_ROLE_CHANGE msg=audit(1199979234.130:35): user pid=2602
uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0
selected-context=unconfined_u:unconfined_r:unconfined_t:s0:
exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
type=AVC msg=audit(1199979234.132:36): avc: denied { link } for
pid=2602 comm="login"
scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=key
type=SYSCALL msg=audit(1199979234.132:36): arch=40000003 syscall=288
success=no exit=-13 a0=8 a1=fffffffc a2=fffffffd a3=1f4 items=0 ppid=1
pid=2602 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=tty1 comm="login" exe="/bin/login"
subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
type=USER_START msg=audit(1199979234.142:37): user pid=2602 uid=0
auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='op=PAM:session_open acct=tbl exe="/bin/login" (hostname=?,
addr=?, terminal=tty1 res=success)'
type=CRED_ACQ msg=audit(1199979234.142:38): user pid=2602 uid=0
auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='op=PAM:setcred acct=tbl exe="/bin/login" (hostname=?, addr=?,
terminal=tty1 res=success)'
type=USER_LOGIN msg=audit(1199979234.145:39): user pid=2602 uid=0
auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023
msg='uid=500: exe="/bin/login" (hostname=?, addr=?, terminal=tty1
res=success)'
Putting system into permissive mode and retrying appears to generate
no new AVCs.
Does
#============= local_login_t ==============
allow local_login_t xdm_t:key link;
make sense?
tom
--
Tom London
16 years, 3 months
RE: ALSA problems.
by Dan Thurman
Eric Paris wrote:
>what problems are you having, why do you believe this is an selinux
>issue, please, tell us what is happening, what you are seeing and
>provide output of errors? If this is selinux you will find message in
>either /var/log/messages or /var/log/audit/audit.log which will be most
>interesting to the people on this list.
>
>-Eric
>
>>Daniel B. Thurman wrote:
>> I was forced to install ALSA manually in my F8 system and
>unfortunately,
>> I discovered that setting /.autorelabel did not correctly
>set ALSA permissions.
>>
>> I did note that a bug report was filed for this.
>>
>> Meanwhile, I would like a solution to solve my issue, if
>there is one?
>>
>> Kind regards,
>> Dan
>>
This is something I just found when searching the /var/log/message file
but this is not related to ALSA, but to rhgb:
Jan 7 13:11:44 localhost kernel: audit(1199740241.970:9): avc: denied { read write } for pid=1775 comm="consoletype" path="/dev/pts/0" dev=devpts ino=2 scontext=system_u:system_r:consoletype_t:s0 tcontext=system_u:object_r:rhgb_devpts_t:s0 tclass=chr_file
As for ALSA issues, there was a problem writing to /etc/asound.state and to ~/.asoundrc
but this is not recorded where I can find it. It only happens during logoff/shutdown
and I see it very briefly and it appears to be an 'alsactl store' command failure and
*maybe* the log below is related to it but I cannot confirm it.
Jan 8 12:28:30 gold kernel: audit(1199823854.622:4): avc: denied { getattr } for pid=1264 comm="salsa" path="/usr/share/alsa/alsa.conf" dev=sda5 ino=147458 scontext=system_u:system_r:alsa_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=file
I DO know that alsactl is not able to set the volume control settings for which
I am forced to reset every time at login after a boot. There was some months
ago that Daniel Walsh wrote as a bug report in getting the /etc/asound.state
moved to /var/lib directory and it was written on Sept 17, 2007.
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.5.516 / Virus Database: 269.17.13/1213 - Release Date: 1/7/2008 9:14 AM
16 years, 3 months
