November 2008 - selinux - Fedora mailing-lists

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

selinux denying a cups printer
by Gene Heskett 02 Dec '08

02 Dec '08

Greetings; Uptodate F8, targeted setting host=coyote.coyote.den type=AVC msg=audit(1227891049.940:679): avc: denied { execute } for pid=6486 comm="cupsd" name="lp3" dev=sda3 ino=104400725 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cupsd_rw_etc_t:s0 tclass=file host=coyote.coyote.den type=SYSCALL msg=audit(1227891049.940:679): arch=40000003 syscall=33 success=no exit=-13 a0=bff13656 a1=1 a2=b7f17ff4 a3=b7f18a3c items=0 ppid=6485 pid=6486 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="cupsd" exe="/usr/sbin/cupsd" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null) The troubleshooters recommended fix is a restorecon -v './lp3' The only ./lp3 I could find was in /etc/cups.d/interfaces/lp3, and while it did change the context of the file, it does not fix the problem. This particular driver ppd is the lpr and cupswrapper of the HL2140 driver kit from Brother, and apparently is installed in a /usr/local/Brother subdir by their rpms. All this did work flawlessly before I had a drive failure, and it worked after an Fu8 install, but failed sometime in the nearly 2 weeks uptime, as did all my other printer profiles, which I have now deleted and rebuilt, and work except for this one. I am going to try touching /.autorelabel and reboot again see if that helps. However, nothing happened the last time I tried that 2 weeks ago... -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Q: How many IBM CPU's does it take to do a logical right shift? A: 33. 1 to hold the bits and 32 to push the register.

2 2

Setroubleshootd on FC8 has a major memory leak
by spo 02 Dec '08

02 Dec '08

Hello, after 9 days of running it used over 2G (virt, rss ~1G). Greetings, Edek

2 1

preventing unconfined users exec in home and tmp
by Murray McAllister 02 Dec '08

02 Dec '08

Hi, I have turned "allow_unconfined_exec_content" off, but unconfined users (unconfined_u) can still execute files in their home directories and /tmp/. I tried adding a user with "useradd -Z unconfined_u". This user can still execute. I could not find any dontaudit rules. Am I missing something? Thanks.

2 2

installing xine from source yields lots of selinux denials
by Antonio Olivares 02 Dec '08

02 Dec '08

Dear all, Trying to install xine-lib from source *to put in the missing pieces* gives selinux denials with chcon Summary: SELinux is preventing chcon (unconfined_t) "mac_admin" unconfined_t. Detailed Description: SELinux denied access requested by chcon. It is not expected that this access is required by chcon and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0 Target Context unconfined_u:unconfined_r:unconfined_t:s0 Target Objects None [ capability2 ] Source chcon Source Path /usr/bin/chcon Port <Unknown> Host emachines-3 Source RPM Packages coreutils-6.12-17.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name emachines-3 Platform Linux emachines-3 2.6.27.5-109.fc10.x86_64 #1 SMP Thu Nov 13 20:12:05 EST 2008 x86_64 x86_64 Alert Count 60 First Seen Tue 18 Nov 2008 07:47:03 AM CST Last Seen Tue 18 Nov 2008 07:48:36 AM CST Local ID 395c28ed-1aab-4d88-9105-57cecfd55b14 Line Numbers Raw Audit Messages node=emachines-3 type=AVC msg=audit(1227016116.77:132): avc: denied { mac_admin } for pid=3757 comm="chcon" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=capability2 node=emachines-3 type=SYSCALL msg=audit(1227016116.77:132): arch=c000003e syscall=188 success=no exit=-22 a0=133e670 a1=6236f9 a2=133fa40 a3=21 items=0 ppid=3751 pid=3757 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="chcon" exe="/usr/bin/chcon" subj=unconfined_u:unconfined_r:unconfined_t:s0 key=(null) Thanks, Antonio

3 3

Re: How to HTTP Serve Fedora Distribution
by David Highley 26 Nov '08

26 Nov '08

"Murray McAllister wrote:" > > David Highley wrote: > > How can we set up HTTP serving of Fedora distribution since we can not > > label the files in the ISO? What we have tried: > > - copy ISO file into web tree > > - loopback mount the ISO to /mnt > > - symlink /mnt into the web tree > > or > > - create directory in web tree > > - loopback mount the ISO to directory in web tree > > > > Selinux blocks access to the distribution. The only solution we are > > aware of is to drop the pants on selinux by going to permissive mode. > > > > David Highley > > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > Hi, > > Paul seemed to have answered your question. There are some examples of > overriding SELinux contexts with the mount command here: > > <http://docs.fedoraproject.org/selinux-user-guide/f10/en-US/sect-Security-En…> > > Hope that helps, > > Cheers. > Yes, Paul did answer my question. We were not aware that options had been added to the mount command.

1 0

How to HTTP Serve Fedora Distribution
by David Highley 26 Nov '08

26 Nov '08

How can we set up HTTP serving of Fedora distribution since we can not label the files in the ISO? What we have tried: - copy ISO file into web tree - loopback mount the ISO to /mnt - symlink /mnt into the web tree or - create directory in web tree - loopback mount the ISO to directory in web tree Selinux blocks access to the distribution. The only solution we are aware of is to drop the pants on selinux by going to permissive mode. David Highley

2 1

Which permission to execute a script?
by Bruno Wolff III 24 Nov '08

24 Nov '08

I was making a modified version of the guest policy that needed to be able to edit and run some perl scripts that also are visible to the web server. I used the manage_files macro and allowed execute, but I can't run the script directly. But I can run it via perl. For example: [tomarndt@wolff area]$ ./newcheck.pl -bash: ./newcheck.pl: /usr/bin/perl: bad interpreter: Permission denied [tomarndt@wolff area]$ perl ./newcheck.pl Ownership counts: Ownership of games with owners owning less than 10 new games. newcheck.pl starts with: #!/usr/bin/perl This is the modified policy for tom_t: policy_module(tom,1.0.0) ######################################## # # Declarations # userdom_restricted_user_template(tom) require { type httpd_sys_content_t; type httpd_sys_script_exec_t; type postgresql_tmp_t; type postgresql_t; } ######################################## # # tom local policy # optional_policy(` qmail_per_role_template(tom,tom_t,tom_r) ') manage_dirs_pattern(tom_t, httpd_sys_content_t, httpd_sys_content_t) manage_files_pattern(tom_t, httpd_sys_content_t, httpd_sys_content_t) manage_files_pattern(tom_t, httpd_sys_script_exec_t, httpd_sys_script_exec_t) allow tom_t postgresql_tmp_t:sock_file write; allow tom_t postgresql_t:unix_stream_socket connectto; allow tom_t httpd_sys_script_exec_t:file execute;

3 10

GCL
by Jerry James 24 Nov '08

24 Nov '08

Once upon a time on fedora-devel-list, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > +/usr/bin/gcl -- gen_context(system_u:object_r:execmem_exec_t,s0) > > > Will be in selinux-policy-3.5.13-19.fc10 I've done some experimenting, and I think I need a couple of modifications to this. First, it turns out that GCL needs both execmem and execheap permissions. Do I need to create a gcl_exec_t type to combine those? Second, /usr/bin/gcl is just a shell script. It does an exec of /usr/lib/gcl-%{version}/unixport/saved_ansi_gcl, which is the saved Lisp image, along with appropriate command line options. I don't expect permissions to persist across an exec (but tell me if I'm wrong), so I think I need the policy to mention the saved image instead of /usr/bin/gcl. There are some problems associated with this: 1) The /usr/lib prefix is used on both 32-bit and 64-bit platforms, which is bad. I'll see if I can get that fixed, but it appears to require some code changes (i.e., not just makefile changes). 2) The GCL build process can produce multiple image files, with various combinations of options (such as profiling, ANSI vs. CLtL1 support, a GUI, etc.). Fedora has only ever shipped one image, but I can see an argument for producing a profiling version of the standard image and making /usr/bin/gcl choose between them based on command line arguments. In any case, all of the image names start with "saved_". The upshot of all this is that, to make the policy future-proof, I really need the execmem + execheap permissions for all files that match this pattern: /usr/lib*/gcl-*/unixport/saved_* Is that okay? If so, how do I proceed? Thanks for helping out an SELinux newbie. -- Jerry James http://loganjerry.googlepages.com/

2 4

F10 Logwatch and avc(s) long post
by Frank Murphy 24 Nov '08

24 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------A snip from the logwatch included at end----------------- Summary: SELinux is preventing netstat (logwatch_t) "search" to <Unknown> (sysctl_net_t). Detailed Description: SELinux denied access requested by netstat. It is not expected that this access is required by netstat and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for <Unknown>, restorecon -v '<Unknown>' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:sysctl_net_t:s0 Target Objects None [ dir ] Source ifconfig Source Path /sbin/ifconfig Port <Unknown> Host frank-01 Source RPM Packages net-tools-1.60-91.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.5-117.fc10.i686 #1 SMP Tue Nov 18 12:19:59 EST 2008 i686 i686 Alert Count 4 First Seen Sat 22 Nov 2008 09:17:13 GMT Last Seen Sat 22 Nov 2008 09:17:13 GMT Local ID 144ff94f-abf9-47ba-8ab6-bda6cceb41e8 Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1227345433.820:48): avc: denied { search } for pid=4085 comm="netstat" scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir node=frank-01 type=SYSCALL msg=audit(1227345433.820:48): arch=40000003 syscall=33 success=no exit=-13 a0=805f195 a1=4 a2=ffffffff a3=8064020 items=0 ppid=4084 pid=4085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netstat" exe="/bin/netstat" subj=system_u:system_r:logwatch_t:s0 key=(null) Summary: SELinux is preventing netstat (logwatch_t) "read" to ./unix (proc_net_t). Detailed Description: SELinux denied access requested by netstat. It is not expected that this access is required by netstat and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./unix, restorecon -v './unix' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:proc_net_t:s0 Target Objects ./unix [ file ] Source ifconfig Source Path /sbin/ifconfig Port <Unknown> Host frank-01 Source RPM Packages net-tools-1.60-91.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.5-117.fc10.i686 #1 SMP Tue Nov 18 12:19:59 EST 2008 i686 i686 Alert Count 2 First Seen Sat 22 Nov 2008 09:17:13 GMT Last Seen Sat 22 Nov 2008 09:17:13 GMT Local ID c323266d-4b2a-4e47-9b13-eeb640939573 Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1227345433.820:45): avc: denied { read } for pid=4085 comm="netstat" name="unix" dev=proc ino=4026531984 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file node=frank-01 type=SYSCALL msg=audit(1227345433.820:45): arch=40000003 syscall=33 success=no exit=-13 a0=805c8b9 a1=4 a2=ffffffff a3=8064360 items=0 ppid=4084 pid=4085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netstat" exe="/bin/netstat" subj=system_u:system_r:logwatch_t:s0 key=(null) Summary: SELinux is preventing netstat (logwatch_t) "read" to ./if_inet6 (proc_net_t). Detailed Description: SELinux denied access requested by netstat. It is not expected that this access is required by netstat and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./if_inet6, restorecon -v './if_inet6' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:proc_net_t:s0 Target Objects ./if_inet6 [ file ] Source ifconfig Source Path /sbin/ifconfig Port <Unknown> Host frank-01 Source RPM Packages net-tools-1.60-91.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.5-117.fc10.i686 #1 SMP Tue Nov 18 12:19:59 EST 2008 i686 i686 Alert Count 4 First Seen Sat 22 Nov 2008 09:17:13 GMT Last Seen Sat 22 Nov 2008 09:17:13 GMT Local ID 9de63b84-aff8-4a49-bc45-510abd4637b3 Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1227345433.820:46): avc: denied { read } for pid=4085 comm="netstat" name="if_inet6" dev=proc ino=4026532168 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file node=frank-01 type=SYSCALL msg=audit(1227345433.820:46): arch=40000003 syscall=33 success=no exit=-13 a0=805f29e a1=4 a2=ffffffff a3=8064180 items=0 ppid=4084 pid=4085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netstat" exe="/bin/netstat" subj=system_u:system_r:logwatch_t:s0 key=(null) Summary: SELinux is preventing netstat (logwatch_t) "read" to ./dev (proc_net_t). Detailed Description: SELinux denied access requested by netstat. It is not expected that this access is required by netstat and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./dev, restorecon -v './dev' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:proc_net_t:s0 Target Objects ./dev [ file ] Source ifconfig Source Path /sbin/ifconfig Port <Unknown> Host frank-01 Source RPM Packages net-tools-1.60-91.fc10 Target RPM Packages filesystem-2.4.19-1.fc10 Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.5-117.fc10.i686 #1 SMP Tue Nov 18 12:19:59 EST 2008 i686 i686 Alert Count 6 First Seen Sat 22 Nov 2008 09:17:13 GMT Last Seen Sat 22 Nov 2008 09:17:13 GMT Local ID 44eb7259-6162-4669-9b01-b5d48a63aaa5 Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1227345433.855:51): avc: denied { read } for pid=4085 comm="netstat" name="dev" dev=proc ino=4026531957 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file node=frank-01 type=SYSCALL msg=audit(1227345433.855:51): arch=40000003 syscall=5 success=no exit=-13 a0=805ff47 a1=0 a2=1b6 a3=0 items=0 ppid=4084 pid=4085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="netstat" exe="/bin/netstat" subj=system_u:system_r:logwatch_t:s0 key=(null) Logwatch: --------------------- Network Report Begin ------------------------ Warning: cannot open /proc/net/dev (Permission denied). Limited output. Warning: cannot open /proc/net/dev (Permission denied). Limited output. Warning: cannot open /proc/net/dev (Permission denied). Limited output. ------------- Network Interfaces --------------- Ethernet : 1 Other : 1 Total : 2 ------------- Ethernet ------------------------- eth1 Link encap:Ethernet HWaddr 00:19:E0:7A:40:4C ------------- Other ---------------------------- lo Link encap:Local Loopback ------------- Network Interfaces --------------- ------------- Network statistics --------------- 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000 link/ether 00:19:e0:7a:40:4c brd ff:ff:ff:ff:ff:ff inet 192.168.0.5/24 brd 192.168.0.255 scope global eth1 inet6 fe80::219:e0ff:fe7a:404c/64 scope link valid_lft forever preferred_lft forever Warning: cannot open /proc/net/dev (Permission denied). Limited output. Warning: cannot open /proc/net/dev (Permission denied). Limited output. Warning: cannot open /proc/net/dev (Permission denied). Limited output. Iface MTU RX-ERR TX-ERR eth1 1500 no BMRU lo 16436 no LRU ------------- Network statistics --------------- ---------------------- Network Report End ------------------------- - -- gpg id EB547226 Revoked Forgot Password :( aMSN: Frankly3D http://www.frankly3d.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkknz/8ACgkQzrcOE0b3RmITUgCfR/8BYJmpAiluEAH0SWqOtXnr QUgAn1bhRbsmlsZGyJEsTlwl2MNcp57J =fMiJ -----END PGP SIGNATURE-----

3 4

selinux denies iptables
by Antonio Olivares 24 Nov '08

24 Nov '08

Dear all, I am still having trouble setting up the dhcp server because selinux denies iptables type=1400 audit(1227530280.458:4): avc: denied { write } for pid=1430 comm="ip6tables-resto" path="/0" dev=devpts ino=2 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file Thanks in Advance, Antonio

2 2

restorecon isn't restoring what matchpathcon shows
by Chuck Anderson 21 Nov '08

21 Nov '08

There are a bunch of files and directories in my F10 home dirs that have type unconfined_u:object_r:user_home_t, but matchpathcon says they are supposed to be system_u:object_r:user_home_t. I tried to run restorecon but it isn't changing the type: [root@l 9:06:49 /home/install]#matchpathcon /home/install/Templates /home/install/Templates system_u:object_r:user_home_t:s0 [root@l 9:06:51 /home/install]#ls -lZd Templates drwxr-xr-x install install unconfined_u:object_r:user_home_t:s0 Templates/ [root@l 9:06:56 /home/install]#restorecon -R Templates [root@l 9:07:07 /home/install]#ls -lZd Templates drwxr-xr-x install install unconfined_u:object_r:user_home_t:s0 Templates/ [root@l 9:07:10 /home/install]#su - install [install@l ~]$ restorecon -R . [install@l ~]$ restorecon -R Templates/ [install@l ~]$ logout [root@l 9:08:23 /home/install]#ls -lZd Templates drwxr-xr-x install install unconfined_u:object_r:user_home_t:s0 Templates/ Why does this happen?

4 4

Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.439:5): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin"
by Antonio Olivares 21 Nov '08

21 Nov '08

Dear fellow selinux experts, npviewer is causing lots of trouble. Firefox freezes and I have to kill it/terminate it and restart it just to post :( What should I do, I have filed bugs on this several times :( Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.439:5): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.548:6): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.659:7): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.694:8): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.732:9): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.764:10): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.790:11): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.816:12): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:13:55 localhost kernel: type=1400 audit(1227100435.841:13): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Nov 19 07:14:02 localhost kernel: __ratelimit: 42 callbacks suppressed Nov 19 07:14:02 localhost kernel: type=1400 audit(1227100442.317:28): avc: denied { unix_read unix_write } for pid=3833 comm="npviewer.bin" key=5678293 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=sem Thanks, Antonio

2 5

Installing MLS policy on Fedora 9
by Elihu Smails 21 Nov '08

21 Nov '08

I have installed Fedora 9 and wanted to install the MLS Policy. I performed the following steps: 1. Install Fedora 9 2. Install Patches 3. Reboot 4. yum install -y selinux-policy-mls 5. Open /etc/selinux/config and change the following: SELINUX=enforcing SELINUXTYPE=targeted to SELINUX=permissive SELINUXTYPE=mls 6. touch /.autorelabel 7. Reboot. The relabelling works fine 8. Set SELINUX to enforcing in /etc/selinux/config 9. Reboot. I get many error messages about the file system and it drops me into a single user shell. Can someone please tell me what the proper steps are. Thank you.

2 1

selinux is denying iptables, how can I get the dhcp server working
by Antonio Olivares 21 Nov '08

21 Nov '08

Dear all, After I got the rules and many things down, now selinux comes in and denies iptables http://fcp.surfsite.org/modules/newbb/viewtopic.php?topic_id=64110&forum=12 https://www.redhat.com/archives/fedora-list/2008-November/msg01208.html https://www.redhat.com/archives/fedora-list/2008-November/msg01640.html I see the following: type=1400 audit(1227217617.326:6): avc: denied { write } for pid=10490 comm="iptables-save" path="/etc/sysconfig/iptables" dev=dm-0 ino=28345626 scontext=unconfined_u:unconfined_r:iptables_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file Thanks, Antonio

2 1

Selinux issues in user-compiled code
by Jason L Tibbitts III 20 Nov '08

20 Nov '08

A while back I made the decision to enable selinux on all of my user desktops. It hasn't really been all that painful; generally the issues I have are with proprietary software, essentially all of which it seems has one issue or another. This morning I received the following question from a user: ----- Can you explain why I often get a linker error: "cannot restore segment prot after reloc: Permission denied" running code I've built in my home directory.But then if I rerun once or twice it will execute properly. It's not always the same library that the linker complains about.... ----- Unfortunately I don't really know how to answer. I can handle selinux at a system level, because if I know some program has an issue I can just change a file context and things work. But I've no idea how to deal with code that users might compile, or where to point them for info in writing code that doesn't have these issues. - J<

2 1

root vs system cron jobs (MLS_LEVEL)
by Nikolas Lam 20 Nov '08

20 Nov '08

Hi On Fedora 9, we've got a symlink in /etc/cron.daily/ to /usr/local/bin/checkmailspool which ultimately tries to run /usr/sbin/postqueue -p It works if you call it via the root user's crontab, but not when you put the script in /etc/cron.daily/. (I've included the sealert output below). When called by the "system" cron (in which the denial occurs) id -Z output is system_u:system_r:system_crond_t:s0-s0:c0.c1023 OTOH, the root cron (which works) shows root:unconfined_r:unconfined_t:s0-s0:c0.c1023 I've just read crontab(5) which mentions setting MLS_LEVEL on the first line of the crontab, but it seems to suggest that this would apply (perhaps unnecessarily) to all the jobs run in that crontab. What's the recommended method to get this one script working from within /etc/cron.daily/ ? Regards, Nik Lam Summary: SELinux is preventing postqueue (postfix_postqueue_t) "connectto" to /var/spool/postfix/public/showq (unconfined_t). Detailed Description: SELinux denied access requested by postqueue. It is not expected that this access is required by postqueue and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:postfix_postqueue_t:s0-s0:c0.c10 23 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects /var/spool/postfix/public/showq [ unix_stream_socket ] Source postqueue Source Path /usr/sbin/postqueue Port <Unknown> Host replaced.example.com Source RPM Packages postfix-2.5.5-1.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-107.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name replaced.example.com Platform Linux replaced.example.com 2.6.25.14-108.fc9.i686 #1 SMP Mon Aug 4 14:08:11 EDT 2008 i686 i686 Alert Count 38 First Seen Tue Nov 4 05:04:42 2008 Last Seen Thu Nov 20 05:04:42 2008 Local ID f5f4066b-d167-44ca-9c00-afd71f485225 Line Numbers Raw Audit Messages host=replaced.example.com type=AVC msg=audit(1227117882.675:17773): avc: denied { connectto } for pid=15651 comm="postqueue" path="/var/spool/postfix/public/showq" scontext=system_u:system_r:postfix_postqueue_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket host=replaced.example.com type=SYSCALL msg=audit(1227117882.675:17773): arch=40000003 syscall=102 success=no exit=-13 a0=3 a1=bfa89e00 a2=b808eff4 a3=bfa89e6a items=0 ppid=15647 pid=15651 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=90 sgid=90 fsgid=90 tty=(none) ses=2419 comm="postqueue" exe="/usr/sbin/postqueue" subj=system_u:system_r:postfix_postqueue_t:s0-s0:c0.c1023 key=(null)

1 0

seliux denying spamd write access to its own user home dir
by Gene Heskett 20 Nov '08

20 Nov '08

Greetings; Just recovering from a drive failure, and just now managed to get enough perl deps installed to run spamassassin. I modified the spamassassin script in /etc/init.d to run it as the same user that fetches the mail, also fixed the spamassassin in /etc/sysconfig to match, and according to htop, the spamd's are running as that user. But, selinux is still having a cow for every incoming message. ========= Source Context: system_u:system_r:spamd_t:s0 Target Context: system_u:object_r:home_root_t:s0 Target Objects: ./user_prefs [ file ] ===temp end of snip >From that, here is that file: [root@coyote .spamassassin]# ls -l user_prefs -rw-r--r-- 1 gene gene 1164 2006-01-16 13:45 user_prefs [root@coyote .spamassassin]# ls -l --context user_prefs -rw-r--r-- gene gene system_u:object_r:home_root_t:s0 user_prefs ===back to troubleshooter output host=coyote.coyote.den type=AVC msg=audit(1227116423.127:797): avc: denied { write } for pid=7118 comm="spamd" name="user_prefs" dev=sda3 ino=74942440 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=file host=coyote.coyote.den type=SYSCALL msg=audit(1227116423.127:797): arch=40000003 syscall=5 success=no exit=-13 a0=9a83590 a1=8241 a2=1b6 a3=8241 items=0 ppid=7116 pid=7118 auid=0 uid=501 gid=501 euid=501 suid=501 fsuid=501 egid=501 sgid=501 fsgid=501 tty=(none) ses=1 comm="spamd" exe="/usr/bin/perl" subj=system_u:system_r:spamd_t:s0 key=(null) ========= Secondary Q: when are we going to be able to copy & paste from the selinuxtroubleshooter screen and preserve the ^%$*^%$( formatting? I have performed the troubleshooter recommended fix: setsebool -P spamd_enable_home_dirs=1 and restarted spamassassin several times. Perms or context problem with the /home dirs? A bug? Or I need to do an autorelabel? The /home dirs, FWIW, were copied from another drive by mc & then 'chown -R user:user' when the copy was finished which may not have been the correct thing to do FAIK. But it was the only way I could preserve an email corpus that is in the 10Gb area for size. There are no entries for spamassassin or spamd in /etc/group that I could use to make that file a member of. Fix please? Thanks. -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) "Truth never comes into the world but like a bastard, to the ignominy of him that brought her birth." -- Milton

2 3

Further on SElinux and kismet
by mike cloaked 19 Nov '08

19 Nov '08

Some days ago I was trying to run kismet on a system with F9 running SElinux and kismet failed to start and complained about being unable to write to the file ssid_map which was in the normal user main dir. There was an AVC denial indicating that kismet was not permitted to access that file. It was suggested that I make kismet look at /var/lib/kismet instead. Having tried again this evening and changed kismet.conf so that %h/ was changed to /var/lib/kismet/ then kismet still fails to start and the terminal window gives: Will attempt to put networkmanager to sleep... Allowing clients to fetch WEP keys. WARNING: Disabling GPS logging. SSID cloak file did not exist, it will be created. FATAL: Could not open SSID track file '/var/lib/kismet/ssid_map' for writing: Permission denied Sending termination request to channel control child 3538... Waiting for channel control child 3538 to exit... WARNING: Sometimes cards don't always come out of monitor mode cleanly. If your card is not fully working, you may need to restart or reconfigure it for normal operation. Trying to wake networkmanager back up... WARNING: Failed to connect to DBUS system, will not be able to control networkmanager: Failed to connect to socket /var/run/dbus/system_bus_socket: Permission denied WARNING: Failed to send 'wake' command to networkmanager via DBUS, NM may still be inactive.Kismet exiting. Done. I checked the contexts: [root@lapmike2 kismet]# ll -Zld /var/lib/kismet drwxrwx--- 2 system_u:object_r:kismet_var_lib_t:s0 root kismet 4096 2008-11-18 20:59 /var/lib/kismet [root@lapmike2 kismet]# ll -Z /var/lib/kismet -rw-rw-rw- root root unconfined_u:object_r:kismet_var_lib_t:s0 ssid_map Any ideas how to fix this - in the above there is no AVC denial but I am guessing that SElinux may still be involved?

2 1

Setting context for shm created with shm_open()
by Scally, Katrina-P54861 19 Nov '08

19 Nov '08

Hello, I am creating shared memory using shm_open() as opposed to using SysV IPC. The shared memory is created as a mapped file under /dev/shm. The default type for this file is tmpfs_t. I would like to define my own type, say my_tmpfs_t, and associate it with the file in /dev/shm. With the appropriate policy in place I can do this via chcon from the command line. However, if I specify the context in the fc file it is not applied. I performed a fixfiles relabel and it didn't appear as if it was looking in this directory. Is this approach the best way to use SELinux with POSIX IPC? Can I relabel files in /dev/shm? The contents of my module are shown below: * * * .if * * * * * * .te * * * type my_tmpfs_t; files_type(my_tmpfs_t) * * * .fc * * * /dev/shm/my_data -- gen_context(system_u:object_r:my_tmpfs_t, s0) Thank you. > This email message is for the sole use of the intended recipient(s) > and may contain GDC4S confidential or privileged information. Any > unauthorized review, use, disclosure or distribution is prohibited. If > you are not an intended recipient, please contact the sender by reply > email and destroy all copies of the original message. >

2 1

MCS process transition and categories problem
by Vince Le Port 18 Nov '08

18 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear all, I am currently experiencing some trouble in modifying a process MCS category. Here is the problem: I have got a user who is in s0:c1.c2 Then this user launches a process which thus runs in the same range (s0:c1.c2) A setcon() is made to move the context process into a restriction : s0:c1 By adding, a new allow rule thanks to a module, this step works great. allow user_t self:process { setcurrent dyntransition }; Once in this restricted context, it seems impossible to run another setcon(), in order to move into s0:c2 or return into the initial context s0:c1.c2. Here is the error launched by audit : type=AVC msg=audit(1224638358.893:242): avc: denied { dyntransition } for pid=26212 comm="prog" scontext=user_u:user_r:user_t:s0:c1 tcontext=user_u:user_r:user_t:s0:c2 tclass=process Is it possible to add a rule which will allow the process to re-enter in s0:c1.c2 context or to enter into s0:c2 from s0:c1 ? Regards, Vince -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJIu73CkDrToteDh0RAj0KAKDOxJ+azZFToxlGAJx102Fpc7PxugCfawIB cNDQr9UdmyiwGZxul3Jz1IA= =9kOV -----END PGP SIGNATURE-----

1 0

avc: denied { write } for pid=5267 comm="dhcpd" name="dhcpd.pid"
by Antonio Olivares 17 Nov '08

17 Nov '08

Dear fellow selinux experts, I am trying to make one of my machines a dhcp server to connect other machines to the internet, see thread in Fedora list if applicable, I have achieved a breakthrough, but selinux denies it :( [root@localhost ~]# dhcpd -f Internet Systems Consortium DHCP Server 4.0.0 Copyright 2004-2007 Internet Systems Consortium. All rights reserved. For info, please visit http://www.isc.org/sw/dhcp/ Warning: subnet 10.154.19.0/27 overlaps subnet 10.154.19.0/24 Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file Wrote 0 leases to leases file. Listening on LPF/eth0/00:0e:a6:42:59:af/10.154.19.0/24 Sending on LPF/eth0/00:0e:a6:42:59:af/10.154.19.0/24 Sending on Socket/fallback/fallback-net ^C [root@localhost ~]# service dhcpd stop [root@localhost ~]# service dhcpd start Starting dhcpd: [ OK ] but now selinux gets in the way :( Nov 14 20:03:40 localhost kernel: type=1400 audit(1226714620.135:183): avc: denied { read } for pid=5267 comm="dhcpd" name="dhcpd.pid" dev=dm-0 ino=3244731 scontext=unconfined_u:system_r:dhcpd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file Nov 14 20:03:40 localhost kernel: type=1400 audit(1226714620.135:184): avc: denied { write } for pid=5267 comm="dhcpd" name="dhcpd.pid" dev=dm-0 ino=3244731scontext=unconfined_u:system_r:dhcpd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file Nov 14 20:03:40 localhost dhcpd: Can't create PID file /var/run/dhcpd.pid: Permission denied. How can I allow it to work? Setroubleshoot has not kicked in to warn me so I do not know a fix as of this moment :( Regards, Antonio

3 5

Handling labeling on filesystems that don't support SELinux
by Sean E. Millichamp 17 Nov '08

17 Nov '08

I have been working on SELinux support for Puppet. One issue that has cropped up is the behavior on filesystems which don't support SELinux. They all appear to get a default label, some seem to allow changing the label (VFAT) in a non-persistent manner, some seem to throw "not supported" errors (NFS). How can I detect if a file is on a filesystem which supports SELinux without trying to update the label? The best idea so far as been to parse /proc/mounts and use that to determine what type of filesystem a file lives on, then check it against a whitelist (which would include ext3, xfs, ?) but it seems like there has to be a cleaner/simpler way. What I would like would be a "getfilecon" call that returns the real label, ignoring any mount-time defaults. Any ideas? Thanks, Sean

3 5

SELinux is preventing perl (logwatch_t) "execute_no_trans" to /sbin/ifconfig, (ifconfig_exec_t).
by Frank Murphy 17 Nov '08

17 Nov '08

SELinux is preventing perl (logwatch_t) "execute_no_trans" to /sbin/ifconfig (ifconfig_exec_t). Detailed Description: SELinux denied access requested by perl. It is not expected that this access is required by perl and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /sbin/ifconfig, restorecon -v '/sbin/ifconfig' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:ifconfig_exec_t:s0 Target Objects /sbin/ifconfig [ file ] Source perl Source Path /usr/bin/perl Port <Unknown> Host frank-01 Source RPM Packages perl-5.10.0-49.fc10 Target RPM Packages net-tools-1.60-91.fc10 Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.5-101.fc10.i686 #1 SMP Wed Nov 12 00:50:43 EST 2008 i686 i686 Alert Count 3 First Seen Thu 13 Nov 2008 09:29:27 GMT Last Seen Sat 15 Nov 2008 08:19:22 GMT Local ID a75e0d31-b307-4710-8ad1-2185f020504d Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1226737162.411:32): avc: denied { execute_no_trans } for pid=4097 comm="perl" path="/sbin/ifconfig" dev=dm-0 ino=4322 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:ifconfig_exec_t:s0 tclass=file node=frank-01 type=SYSCALL msg=audit(1226737162.411:32): arch=40000003 syscall=11 success=no exit=-13 a0=9e01ebc a1=9eaa2a4 a2=bfb79fc0 a3=bfb79958 items=0 ppid=4096 pid=4097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="perl" exe="/usr/bin/perl" subj=system_u:system_r:logwatch_t:s0 key=(null)

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2008