selinux November 2008

selinux@lists.fedoraproject.org

25 participants
36 discussions

SELinux is preventing gdm-binary (xdm_t) "unlink" to ... and npviewer
by Antonio Olivares 17 Nov '08

17 Nov '08

Dear selinux experts, running fedora 10 preview updated to latest packages [olivares@riohigh2 ~]$ uname -r 2.6.27.5-101.fc10.i686 [olivares@riohigh2 ~]$ rpm -qa selinux* selinux-policy-3.5.13-18.fc10.noarch selinux-policy-targeted-3.5.13-18.fc10.noarch Summary: SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t). Detailed Description: SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t). The SELinux type var_spool_t, is a generic type for all files in the directory and very few processes (SELinux Domains) are allowed to write to this SELinux type. This type of denial usual indicates a mislabeled file. By default a file created in a directory has the gets the context of the parent directory, but SELinux policy has rules about the creation of directories, that say if a process running in one SELinux Domain (D1) creates a file in a directory with a particular SELinux File Context (F1) the file gets a different File Context (F2). The policy usually allows the SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for some reason a file (./force-display-on-active-vt) was created with the wrong context, this domain will be denied. The usual solution to this problem is to reset the file context on the target file, restorecon -v './force-display-on-active-vt'. If the file context does not change from var_spool_t, then this is probably a bug in policy. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy package. If it does change, you can try your application again to see if it works. The file context could have been mislabeled by editing the file or moving the file from a different directory, if the file keeps getting mislabeled, check the init scripts to see if they are doing something to mislabel the file. Allowing Access: You can attempt to fix file context by executing restorecon -v './force-display-on-active-vt' Fix Command: restorecon './force-display-on-active-vt' Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_spool_t:s0 Target Objects ./force-display-on-active-vt [ file ] Source gdm-binary Source Path /usr/sbin/gdm-binary Port <Unknown> Host riohigh2 Source RPM Packages gdm-2.24.0-12.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mislabeled_file Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-94.fc10.i686 #1 SMP Mon Nov 10 15:51:55 EST 2008 i686 athlon Alert Count 17 First Seen Mon 03 Nov 2008 07:08:33 AM CST Last Seen Thu 13 Nov 2008 04:21:21 PM CST Local ID a66adf6c-89d5-4d90-83ca-f34c94bb4d45 Line Numbers Raw Audit Messages node=riohigh2 type=AVC msg=audit(1226614881.881:36): avc: denied { unlink } for pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file node=riohigh2 type=SYSCALL msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing the npviewer.bin from using potentially mislabeled files (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). Detailed Description: SELinux has denied npviewer.bin access to potentially mislabeled file(s) (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that SELinux will not allow npviewer.bin to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access: If you want npviewer.bin to access this files, you need to relabel them using restorecon -v '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'. You might want to relabel the entire directory using restorecon -R -v '<Unknown>'. Additional Information: Source Context unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102 3 Target Context unconfined_u:object_r:user_home_t:s0 Target Objects /home/olivares/.icedteaplugin/icedtea-plugin-to- appletviewer [ fifo_file ] Source npviewer.bin Source Path /usr/lib/nspluginwrapper/npviewer.bin Port <Unknown> Host riohigh2 Source RPM Packages nspluginwrapper-1.1.2-4.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-101.fc10.i686 #1 SMP Wed Nov 12 00:50:43 EST 2008 i686 athlon Alert Count 4 First Seen Thu 13 Nov 2008 06:31:50 PM CST Last Seen Thu 13 Nov 2008 06:31:55 PM CST Local ID 81d406be-b7e4-4bf4-a8c7-f12b7c36ee27 Line Numbers Raw Audit Messages node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { write } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { read } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file node=riohigh2 type=SYSCALL msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null) Has someone else encountered these before and what should I do about them? Thanks, Antonio

3 5

type=1400 audit(1226855594.878:4): avc: denied { write } for pid=1429 comm="ip6tables-resto"
by Antonio Olivares 17 Nov '08

17 Nov '08

In trying to configure the server, iptables returns a selinux denial ip6_tables: (C) 2000-2006 Netfilter Core Team type=1400 audit(1226855594.878:4): avc: denied { write } for pid=1429 comm="ip6tables-resto" path="/0" dev=devpts ino=2 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file setroubleshooter has not kicked in, and it is configured to run: [root@localhost ~]# chkconfig setroubleshoot --list setroubleshoot 0:off 1:off 2:off 3:on 4:on 5:on 6:off [root@localhost ~]# Thanks, Antonio

2 1

Mailman AVCs
by Todd Zullinger 16 Nov '08

16 Nov '08

In response to a thread on the mailman-users list regarding problems creating a new list via mailman's web interface¹, I did some testing on CentOS 5 and Fedora 9. There are a small number of SELinux denials when using mailman with postfix that would be nice to get fixed up. For background, mailman has some nice integration with postfix which allows list aliases to be setup automatically (as opposed to having an admin manually add new list aliases to /etc/aliases or what have you). This is documented in the mailman install manual². When setting up mailman to work with postfix, the following denials are seen on Fedora 9 (they are slightly different on CentOS 5, unsurprisingly): type=AVC msg=audit(1226861409.980:83): avc: denied { search } for pid=24239 comm="postalias" name="postfix" dev=sda2 ino=213317 scontext=unconfined_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir type=AVC msg=audit(1226861409.980:83): avc: denied { read } for pid=24239 comm="postalias" name="main.cf" dev=sda2 ino=216184 scontext=unconfined_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=file type=AVC msg=audit(1226861409.990:84): avc: denied { getattr } for pid=24239 comm="postalias" path="/etc/postfix/main.cf" dev=sda2 ino=216184 scontext=unconfined_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=file type=AVC msg=audit(1226861755.237:93): avc: denied { read write } for pid=24597 comm="mailman" path="socket:[1115689]" dev=sockfs ino=1115689 scontext=system_u:system_r:mailman_mail_t:s0 tcontext=system_u:system_r:postfix_local_t:s0 tclass=udp_socket Using audit2allow, I ended up with the following policy: module mailmanpostfix 1.0; require { type mailman_cgi_t; type mailman_mail_t; type postfix_etc_t; type postfix_local_t; class dir search; class file { read getattr }; class udp_socket { read write }; } #============= mailman_cgi_t ============== allow mailman_cgi_t postfix_etc_t:dir search; allow mailman_cgi_t postfix_etc_t:file { read getattr }; #============= mailman_mail_t ============== allow mailman_mail_t postfix_local_t:udp_socket { read write }; I'd love to help get this integrated into the official SELinux policy packages for Fedora (and CentOS/RHEL if possible). I am not certain if the above policy can be tightened up or not. Any help there would be very much appreciated. ¹ http://www.mail-archive.com/mailman-users%40python.org/msg51591.html (The policy from the denials on CentOS 5 are in this thread.) ² http://www.gnu.org/software/mailman/mailman-install/node12.html and http://www.gnu.org/software/mailman/mailman-install/node13.html -- Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Happiness is like peeing on yourself. Everyone can see it, but only you can feel its warmth

1 0

logrotate problem
by Dr. Michael J. Chudobiak 12 Nov '08

12 Nov '08

Hi all, I'm having problems running logrotate from cron. The emails say: /etc/cron.daily/logrotate: error: cannot open current directory: Permission denied logrotate tries to open ".", which works out to "/root". Sure enough, selinux is blocking access to admin_home_t: type=AVC msg=audit(1226489667.211:371): avc: denied { read } for pid=2291 comm="logrotate" name="root" dev=dm-0 ino=2162689 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir type=SYSCALL msg=audit(1226489667.211:371): arch=40000003 syscall=5 success=no exit=-13 a0=80525d3 a1=8000 a2=0 a3=8000 items=0 ppid=2289 pid=2291 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=39 comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null) Is this a policy bug? An /.autorelabel didn't fix it. I'm using F10 rawhide. - Mike

2 1

Re: line 1887 is missing
by Antonio Olivares 09 Nov '08

09 Nov '08

--- On Sun, 11/9/08, Tom London <selinux(a)gmail.com> wrote: > From: Tom London <selinux(a)gmail.com> > Subject: Re: line 1887 is missing > To: olivares14031(a)yahoo.com > Date: Sunday, November 9, 2008, 9:33 AM > On Sun, Nov 9, 2008 at 8:38 AM, Antonio Olivares > <olivares14031(a)yahoo.com> wrote: > > Dear fellow testers and selinux experts, > > > > what is in line 1887, I have installed Fedora 10 > Preview and I when I try to install a package, I get the > following message: > > > > Running rpm_check_debug > > Running Transaction Test > > /etc/selinux/targeted/contexts/files/file_contexts: > line 1887 is missing fields, skipping > > /etc/selinux/targeted/contexts/files/file_contexts: > line 1887 is missing fields, skipping > > Finished Transaction Test > > Transaction Test Succeeded > > Running Transaction > > /etc/selinux/targeted/contexts/files/file_contexts: > line 1887 is missing fields, skipping > > /etc/selinux/targeted/contexts/files/file_contexts: > line 1887 is missing fields, skipping > > > > > > Smolt profile is here: > > > > > http://www.smolts.org/client/show/pub_52cf9c16-aa07-4697-8df6-7b47eb9855f4 > (public) > > > > TIA, > > > > Antonio > > > Would be helpful if you posted with the request for help: > > An example package you were trying to install, > The version of selinux policy files you have installed > (e.g., output > of "rpm -qa selinux\*" > Any local selinux policy modifications you have made (e.g., > via > semanage, semodule) > Any non-Fedora packages you have installed > > Otherwise, unless this is a "general problem" > that everyone is > experiencing, it is very difficult to respond. > > This is not happening to me on a Rawhide updated system. > > tom > -- > Tom London Tom, I am also running 4 other machines with rawhide fully updated :), however I installed to another machine Fedora 10 Preview and I encountered this, however, hard drive seems to be dying. I see errors like below ata2.0 BDMA, stat 0x4 cmd c8/00:08:54:ef:56/00:00:00:00:00 ea tag 0 dma 4096 ata2.0 BDMA, stat 0x4 res c8/00:08:54:ef:56/00:00:00:00:00 ea tag 0 dma 4096 Emask 0x9 (media error) ata 2.0:status{DRDY ERR} I will need to look for a spare hard drive for this machine. Till next time. Thanks for trying to help :) Regards, Antonio

1 0

line 1887 is missing
by Antonio Olivares 09 Nov '08

09 Nov '08

Dear fellow testers and selinux experts, what is in line 1887, I have installed Fedora 10 Preview and I when I try to install a package, I get the following message: Running rpm_check_debug Running Transaction Test /etc/selinux/targeted/contexts/files/file_contexts: line 1887 is missing fields, skipping /etc/selinux/targeted/contexts/files/file_contexts: line 1887 is missing fields, skipping Finished Transaction Test Transaction Test Succeeded Running Transaction /etc/selinux/targeted/contexts/files/file_contexts: line 1887 is missing fields, skipping /etc/selinux/targeted/contexts/files/file_contexts: line 1887 is missing fields, skipping Smolt profile is here: http://www.smolts.org/client/show/pub_52cf9c16-aa07-4697-8df6-7b47eb9855f4 (public) TIA, Antonio

1 1

SELinux is preventing perl (logwatch_t) "execute" to ./ifconfig (ifconfig_exec_t).
by Frank Murphy 09 Nov '08

09 Nov '08

restorecon\Full\fixfiles: relabel not removed avc. --------------------------- Summary: SELinux is preventing perl (logwatch_t) "execute" to ./ifconfig (ifconfig_exec_t). Detailed Description: SELinux denied access requested by perl. It is not expected that this access is required by perl and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for ./ifconfig, restorecon -v './ifconfig' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:ifconfig_exec_t:s0 Target Objects ./ifconfig [ file ] Source perl Source Path /usr/bin/perl Port <Unknown> Host frank-01 Source RPM Packages perl-5.10.0-49.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-11.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.4-79.fc10.i686 #1 SMP Tue Nov 4 21:56:37 EST 2008 i686 i686 Alert Count 1 First Seen Sun 09 Nov 2008 10:10:33 GMT Last Seen Sun 09 Nov 2008 10:10:33 GMT Local ID e3112123-9c28-4417-ba5e-71236aa7b429 Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1226225433.356:75): avc: denied { execute } for pid=24728 comm="perl" name="ifconfig" dev=dm-0 ino=4322 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:ifconfig_exec_t:s0 tclass=file node=frank-01 type=SYSCALL msg=audit(1226225433.356:75): arch=40000003 syscall=11 success=no exit=-13 a0=9ed4ebc a1=9f7d2a4 a2=bfce9130 a3=bfce8ac8 items=0 ppid=24727 pid=24728 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="perl" exe="/usr/bin/perl" subj=system_u:system_r:logwatch_t:s0 key=(null) -- gpg id EB547226 Revoked Forgot Password :( aMSN: Frankly3D http://www.frankly3d.com

1 0

Generating policies for Nagios on Fedora9 - difficulties
by Dirk H. Schulz 07 Nov '08

07 Nov '08

Hi folks, I have compiled Nagios 3.05 on Fedora9 (all updates current) and now try to get it running together with SELinux. I have piped the AVC denials from audit.log to audit2allow and generated policies which I loaded using "semodule -i POLNAME.pp". Now I have the weird state that: - Nagios still cannot check postfix' mailqueue with check_mailq - Nagios still cannot write emails to the mailqueue but there is no AVC denials any more in audit.log and Nagios stopped logging to syslog (although it still works as seen on the web pages). There is also no SETroubleshoot messages in /var/log/messages any more. Setting "setenforce 0" makes Nagios run smoothly, so the problem is still related SELinux somehow, but since nothing shows up in the logs any more it is quite difficult to troubleshoot. Logging in general does work, e. g. I can find a "Error code 69 returned from /usr/bin/mailq" in /var/log/maillog every time Nagios runs the mailq check. Changing the setenforce value leads to an entry in audit.log, so even auditd logging partially works. I have even restarted rsyslog with no effect. How do I find out why SELinux is not logging completely any more? And by the way: I also had the phenomenon that auditd claimed lots of denials of ping while Nagios did not have any difficulty pinging - that does not look very trustworthy on the part of SELinux, does it? Any hint or help is appreciated. Dirk

4 5

g-p-m SELinux policy denials
by Rahul Sundaram 05 Nov '08

05 Nov '08

Hi, I have the copied the copy of g-p-m related denials below: --- Summary: SELinux is preventing gnome-power-man (xdm_t) "create" to 10357b34dbb443572a67020848c54ed9:runtime (xdm_var_lib_t). Detailed Description: SELinux denied access requested by gnome-power-man. It is not expected that this access is required by gnome-power-man and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for 10357b34dbb443572a67020848c54ed9:runtime, restorecon -v '10357b34dbb443572a67020848c54ed9:runtime' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:xdm_var_lib_t:s0 Target Objects 10357b34dbb443572a67020848c54ed9:runtime [ lnk_file ] Source gnome-power-man Source Path /usr/bin/gnome-power-manager Port <Unknown> Host sundaram.pnq.redhat.com Source RPM Packages gnome-power-manager-2.24.1-3.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-11.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name sundaram.pnq.redhat.com Platform Linux sundaram.pnq.redhat.com 2.6.27.4-68.fc10.i686 #1 SMP Thu Oct 30 00:49:42 EDT 2008 i686 i686 Alert Count 1 First Seen Wed 05 Nov 2008 10:17:25 PM IST Last Seen Wed 05 Nov 2008 10:17:25 PM IST Local ID 5bed64ed-4506-4f5e-aea2-22bef1bd3d82 Line Numbers Raw Audit Messages node=sundaram.pnq.redhat.com type=AVC msg=audit(1225903645.809:25): avc: denied { create } for pid=8176 comm="gnome-power-man" name="10357b34dbb443572a67020848c54ed9:runtime" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_var_lib_t:s0 tclass=lnk_file node=sundaram.pnq.redhat.com type=SYSCALL msg=audit(1225903645.809:25): arch=40000003 syscall=83 success=no exit=-13 a0=8f31138 a1=8f31040 a2=6d9b660 a3=8f311e0 items=0 ppid=1 pid=8176 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="gnome-power-man" exe="/usr/bin/gnome-power-manager" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) --------------- Summary: SELinux is preventing gnome-power-man (xdm_t) "sendto" xdm_t. Detailed Description: SELinux denied access requested by gnome-power-man. It is not expected that this access is required by gnome-power-man and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Objects None [ unix_dgram_socket ] Source gnome-power-man Source Path /usr/bin/gnome-power-manager Port <Unknown> Host sundaram.pnq.redhat.com Source RPM Packages gnome-power-manager-2.24.1-3.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-11.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name sundaram.pnq.redhat.com Platform Linux sundaram.pnq.redhat.com 2.6.27.4-68.fc10.i686 #1 SMP Thu Oct 30 00:49:42 EDT 2008 i686 i686 Alert Count 1 First Seen Wed 05 Nov 2008 10:17:25 PM IST Last Seen Wed 05 Nov 2008 10:17:25 PM IST Local ID 288d421c-cab3-49b2-9b6b-ac5398816f4d Line Numbers Raw Audit Messages node=sundaram.pnq.redhat.com type=AVC msg=audit(1225903645.846:26): avc: denied { sendto } for pid=8176 comm="gnome-power-man" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=unix_dgram_socket node=sundaram.pnq.redhat.com type=SYSCALL msg=audit(1225903645.846:26): arch=40000003 syscall=102 success=no exit=-13 a0=9 a1=b7127670 a2=a0b234 a3=0 items=0 ppid=1 pid=8176 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 tty=(none) ses=4294967295 comm="gnome-power-man" exe="/usr/bin/gnome-power-manager" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) --- Rahul

2 1

libavformat and SELinux policy issue
by Rahul Sundaram 05 Nov '08

05 Nov '08

Hi, When using mplayer for the past few days, I am getting the following SELinux policy issue: ---- Summary: SELinux is preventing totem-video-thu from loading /usr/lib/sse2/libavformat.so.52.22.1 which requires text relocation. Detailed Description: The totem-video-thu application attempted to load /usr/lib/sse2/libavformat.so.52.22.1 which requires text relocation. This is a potential security problem. Most libraries do not need this permission. Libraries are sometimes coded incorrectly and request this permission. The SELinux Memory Protection Tests (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to remove this requirement. You can configure SELinux temporarily to allow /usr/lib/sse2/libavformat.so.52.22.1 to use relocation as a workaround, until the library is fixed. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Allowing Access: If you trust /usr/lib/sse2/libavformat.so.52.22.1 to run correctly, you can change the file context to textrel_shlib_t. "chcon -t textrel_shlib_t '/usr/lib/sse2/libavformat.so.52.22.1'" You must also change the default file context files on the system in order to preserve them even on a full relabel. "semanage fcontext -a -t textrel_shlib_t '/usr/lib/sse2/libavformat.so.52.22.1'" Fix Command: chcon -t textrel_shlib_t '/usr/lib/sse2/libavformat.so.52.22.1' Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Context system_u:object_r:lib_t:s0 Target Objects /usr/lib/sse2/libavformat.so.52.22.1 [ file ] Source totem-video-thu Source Path /usr/bin/totem-video-thumbnailer Port <Unknown> Host sundaram.redhat.com Source RPM Packages totem-2.24.3-1.fc10 Target RPM Packages ffmpeg-libs-0.4.9-0.51.20080908.fc10 Policy RPM selinux-policy-3.5.13-11.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_execmod Host Name sundaram.redhat.com Platform Linux sundaram.redhat.com 2.6.27.4-68.fc10.i686 #1 SMP Thu Oct 30 00:49:42 EDT 2008 i686 i686 Alert Count 719 First Seen Thu 06 Nov 2008 12:51:21 AM IST Last Seen Thu 06 Nov 2008 01:05:40 AM IST Local ID 7e3f9978-5247-4568-9b3b-f14b7db6643c Line Numbers Raw Audit Messages node=sundaram.redhat.com type=AVC msg=audit(1225913740.104:764): avc: denied { execmod } for pid=16396 comm="totem-video-thu" path="/usr/lib/sse2/libavformat.so.52.22.1" dev=dm-0 ino=70735 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lib_t:s0 tclass=file node=sundaram.redhat.com type=SYSCALL msg=audit(1225913740.104:764): arch=40000003 syscall=125 success=no exit=-13 a0=15e2000 a1=ac000 a2=5 a3=b735a350 items=0 ppid=2638 pid=16396 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="totem-video-thu" exe="/usr/bin/totem-video-thumbnailer" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) --- Rahul

2 1

Unneeded inbuilt *.pp modules
by Frank Murphy 03 Nov '08

03 Nov '08

Is it ok to backup and remove to usb stick, and inbuilt policy modules *.pp not required. ie qemu apache. Things which basically will *definitely* be running on this server. If I click booleans on selinux management, the check marks reappear immediately Frank -- gpg id EB547226 Revoked Forgot Password :( aMSN: Frankly3D http://www.frankly3d.com

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2008