selinux November 2008

selinux@lists.fedoraproject.org

25 participants
36 discussions

Setting context for shm created with shm_open()
by Scally, Katrina-P54861 19 Nov '08

19 Nov '08

Hello, I am creating shared memory using shm_open() as opposed to using SysV IPC. The shared memory is created as a mapped file under /dev/shm. The default type for this file is tmpfs_t. I would like to define my own type, say my_tmpfs_t, and associate it with the file in /dev/shm. With the appropriate policy in place I can do this via chcon from the command line. However, if I specify the context in the fc file it is not applied. I performed a fixfiles relabel and it didn't appear as if it was looking in this directory. Is this approach the best way to use SELinux with POSIX IPC? Can I relabel files in /dev/shm? The contents of my module are shown below: * * * .if * * * * * * .te * * * type my_tmpfs_t; files_type(my_tmpfs_t) * * * .fc * * * /dev/shm/my_data -- gen_context(system_u:object_r:my_tmpfs_t, s0) Thank you. > This email message is for the sole use of the intended recipient(s) > and may contain GDC4S confidential or privileged information. Any > unauthorized review, use, disclosure or distribution is prohibited. If > you are not an intended recipient, please contact the sender by reply > email and destroy all copies of the original message. >

2 1

MCS process transition and categories problem
by Vince Le Port 18 Nov '08

18 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear all, I am currently experiencing some trouble in modifying a process MCS category. Here is the problem: I have got a user who is in s0:c1.c2 Then this user launches a process which thus runs in the same range (s0:c1.c2) A setcon() is made to move the context process into a restriction : s0:c1 By adding, a new allow rule thanks to a module, this step works great. allow user_t self:process { setcurrent dyntransition }; Once in this restricted context, it seems impossible to run another setcon(), in order to move into s0:c2 or return into the initial context s0:c1.c2. Here is the error launched by audit : type=AVC msg=audit(1224638358.893:242): avc: denied { dyntransition } for pid=26212 comm="prog" scontext=user_u:user_r:user_t:s0:c1 tcontext=user_u:user_r:user_t:s0:c2 tclass=process Is it possible to add a rule which will allow the process to re-enter in s0:c1.c2 context or to enter into s0:c2 from s0:c1 ? Regards, Vince -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJIu73CkDrToteDh0RAj0KAKDOxJ+azZFToxlGAJx102Fpc7PxugCfawIB cNDQr9UdmyiwGZxul3Jz1IA= =9kOV -----END PGP SIGNATURE-----

1 0

avc: denied { write } for pid=5267 comm="dhcpd" name="dhcpd.pid"
by Antonio Olivares 17 Nov '08

17 Nov '08

Dear fellow selinux experts, I am trying to make one of my machines a dhcp server to connect other machines to the internet, see thread in Fedora list if applicable, I have achieved a breakthrough, but selinux denies it :( [root@localhost ~]# dhcpd -f Internet Systems Consortium DHCP Server 4.0.0 Copyright 2004-2007 Internet Systems Consortium. All rights reserved. For info, please visit http://www.isc.org/sw/dhcp/ Warning: subnet 10.154.19.0/27 overlaps subnet 10.154.19.0/24 Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file Wrote 0 leases to leases file. Listening on LPF/eth0/00:0e:a6:42:59:af/10.154.19.0/24 Sending on LPF/eth0/00:0e:a6:42:59:af/10.154.19.0/24 Sending on Socket/fallback/fallback-net ^C [root@localhost ~]# service dhcpd stop [root@localhost ~]# service dhcpd start Starting dhcpd: [ OK ] but now selinux gets in the way :( Nov 14 20:03:40 localhost kernel: type=1400 audit(1226714620.135:183): avc: denied { read } for pid=5267 comm="dhcpd" name="dhcpd.pid" dev=dm-0 ino=3244731 scontext=unconfined_u:system_r:dhcpd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file Nov 14 20:03:40 localhost kernel: type=1400 audit(1226714620.135:184): avc: denied { write } for pid=5267 comm="dhcpd" name="dhcpd.pid" dev=dm-0 ino=3244731scontext=unconfined_u:system_r:dhcpd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file Nov 14 20:03:40 localhost dhcpd: Can't create PID file /var/run/dhcpd.pid: Permission denied. How can I allow it to work? Setroubleshoot has not kicked in to warn me so I do not know a fix as of this moment :( Regards, Antonio

3 5

Handling labeling on filesystems that don't support SELinux
by Sean E. Millichamp 17 Nov '08

17 Nov '08

I have been working on SELinux support for Puppet. One issue that has cropped up is the behavior on filesystems which don't support SELinux. They all appear to get a default label, some seem to allow changing the label (VFAT) in a non-persistent manner, some seem to throw "not supported" errors (NFS). How can I detect if a file is on a filesystem which supports SELinux without trying to update the label? The best idea so far as been to parse /proc/mounts and use that to determine what type of filesystem a file lives on, then check it against a whitelist (which would include ext3, xfs, ?) but it seems like there has to be a cleaner/simpler way. What I would like would be a "getfilecon" call that returns the real label, ignoring any mount-time defaults. Any ideas? Thanks, Sean

3 5

SELinux is preventing perl (logwatch_t) "execute_no_trans" to /sbin/ifconfig, (ifconfig_exec_t).
by Frank Murphy 17 Nov '08

17 Nov '08

SELinux is preventing perl (logwatch_t) "execute_no_trans" to /sbin/ifconfig (ifconfig_exec_t). Detailed Description: SELinux denied access requested by perl. It is not expected that this access is required by perl and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /sbin/ifconfig, restorecon -v '/sbin/ifconfig' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:ifconfig_exec_t:s0 Target Objects /sbin/ifconfig [ file ] Source perl Source Path /usr/bin/perl Port <Unknown> Host frank-01 Source RPM Packages perl-5.10.0-49.fc10 Target RPM Packages net-tools-1.60-91.fc10 Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name frank-01 Platform Linux frank-01 2.6.27.5-101.fc10.i686 #1 SMP Wed Nov 12 00:50:43 EST 2008 i686 i686 Alert Count 3 First Seen Thu 13 Nov 2008 09:29:27 GMT Last Seen Sat 15 Nov 2008 08:19:22 GMT Local ID a75e0d31-b307-4710-8ad1-2185f020504d Line Numbers Raw Audit Messages node=frank-01 type=AVC msg=audit(1226737162.411:32): avc: denied { execute_no_trans } for pid=4097 comm="perl" path="/sbin/ifconfig" dev=dm-0 ino=4322 scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:ifconfig_exec_t:s0 tclass=file node=frank-01 type=SYSCALL msg=audit(1226737162.411:32): arch=40000003 syscall=11 success=no exit=-13 a0=9e01ebc a1=9eaa2a4 a2=bfb79fc0 a3=bfb79958 items=0 ppid=4096 pid=4097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="perl" exe="/usr/bin/perl" subj=system_u:system_r:logwatch_t:s0 key=(null)

2 1

SELinux is preventing gdm-binary (xdm_t) "unlink" to ... and npviewer
by Antonio Olivares 17 Nov '08

17 Nov '08

Dear selinux experts, running fedora 10 preview updated to latest packages [olivares@riohigh2 ~]$ uname -r 2.6.27.5-101.fc10.i686 [olivares@riohigh2 ~]$ rpm -qa selinux* selinux-policy-3.5.13-18.fc10.noarch selinux-policy-targeted-3.5.13-18.fc10.noarch Summary: SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t). Detailed Description: SELinux is preventing gdm-binary (xdm_t) "unlink" to ./force-display-on-active-vt (var_spool_t). The SELinux type var_spool_t, is a generic type for all files in the directory and very few processes (SELinux Domains) are allowed to write to this SELinux type. This type of denial usual indicates a mislabeled file. By default a file created in a directory has the gets the context of the parent directory, but SELinux policy has rules about the creation of directories, that say if a process running in one SELinux Domain (D1) creates a file in a directory with a particular SELinux File Context (F1) the file gets a different File Context (F2). The policy usually allows the SELinux Domain (D1) the ability to write, unlink, and append on (F2). But if for some reason a file (./force-display-on-active-vt) was created with the wrong context, this domain will be denied. The usual solution to this problem is to reset the file context on the target file, restorecon -v './force-display-on-active-vt'. If the file context does not change from var_spool_t, then this is probably a bug in policy. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy package. If it does change, you can try your application again to see if it works. The file context could have been mislabeled by editing the file or moving the file from a different directory, if the file keeps getting mislabeled, check the init scripts to see if they are doing something to mislabel the file. Allowing Access: You can attempt to fix file context by executing restorecon -v './force-display-on-active-vt' Fix Command: restorecon './force-display-on-active-vt' Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:var_spool_t:s0 Target Objects ./force-display-on-active-vt [ file ] Source gdm-binary Source Path /usr/sbin/gdm-binary Port <Unknown> Host riohigh2 Source RPM Packages gdm-2.24.0-12.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name mislabeled_file Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-94.fc10.i686 #1 SMP Mon Nov 10 15:51:55 EST 2008 i686 athlon Alert Count 17 First Seen Mon 03 Nov 2008 07:08:33 AM CST Last Seen Thu 13 Nov 2008 04:21:21 PM CST Local ID a66adf6c-89d5-4d90-83ca-f34c94bb4d45 Line Numbers Raw Audit Messages node=riohigh2 type=AVC msg=audit(1226614881.881:36): avc: denied { unlink } for pid=2090 comm="gdm-binary" name="force-display-on-active-vt" dev=sda6 ino=190494 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=file node=riohigh2 type=SYSCALL msg=audit(1226614881.881:36): arch=40000003 syscall=10 success=no exit=-13 a0=8063b84 a1=0 a2=4f86dc a3=9940400 items=0 ppid=1 pid=2090 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gdm-binary" exe="/usr/sbin/gdm-binary" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Summary: SELinux is preventing the npviewer.bin from using potentially mislabeled files (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). Detailed Description: SELinux has denied npviewer.bin access to potentially mislabeled file(s) (/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer). This means that SELinux will not allow npviewer.bin to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access: If you want npviewer.bin to access this files, you need to relabel them using restorecon -v '/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer'. You might want to relabel the entire directory using restorecon -R -v '<Unknown>'. Additional Information: Source Context unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c102 3 Target Context unconfined_u:object_r:user_home_t:s0 Target Objects /home/olivares/.icedteaplugin/icedtea-plugin-to- appletviewer [ fifo_file ] Source npviewer.bin Source Path /usr/lib/nspluginwrapper/npviewer.bin Port <Unknown> Host riohigh2 Source RPM Packages nspluginwrapper-1.1.2-4.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-18.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name riohigh2 Platform Linux riohigh2 2.6.27.5-101.fc10.i686 #1 SMP Wed Nov 12 00:50:43 EST 2008 i686 athlon Alert Count 4 First Seen Thu 13 Nov 2008 06:31:50 PM CST Last Seen Thu 13 Nov 2008 06:31:55 PM CST Local ID 81d406be-b7e4-4bf4-a8c7-f12b7c36ee27 Line Numbers Raw Audit Messages node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { write } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-plugin-to-appletviewer" dev=sda6 ino=263881 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file node=riohigh2 type=AVC msg=audit(1226622715.909:38): avc: denied { read } for pid=4732 comm="npviewer.bin" path="/home/olivares/.icedteaplugin/icedtea-appletviewer-to-plugin" dev=sda6 ino=263847 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=fifo_file node=riohigh2 type=SYSCALL msg=audit(1226622715.909:38): arch=40000003 syscall=11 success=yes exit=0 a0=9e70d28 a1=9e71d40 a2=9e72210 a3=0 items=0 ppid=3572 pid=4732 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="npviewer.bin" exe="/usr/lib/nspluginwrapper/npviewer.bin" subj=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 key=(null) Has someone else encountered these before and what should I do about them? Thanks, Antonio

3 5

type=1400 audit(1226855594.878:4): avc: denied { write } for pid=1429 comm="ip6tables-resto"
by Antonio Olivares 17 Nov '08

17 Nov '08

In trying to configure the server, iptables returns a selinux denial ip6_tables: (C) 2000-2006 Netfilter Core Team type=1400 audit(1226855594.878:4): avc: denied { write } for pid=1429 comm="ip6tables-resto" path="/0" dev=devpts ino=2 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file setroubleshooter has not kicked in, and it is configured to run: [root@localhost ~]# chkconfig setroubleshoot --list setroubleshoot 0:off 1:off 2:off 3:on 4:on 5:on 6:off [root@localhost ~]# Thanks, Antonio

2 1

Mailman AVCs
by Todd Zullinger 16 Nov '08

16 Nov '08

In response to a thread on the mailman-users list regarding problems creating a new list via mailman's web interface¹, I did some testing on CentOS 5 and Fedora 9. There are a small number of SELinux denials when using mailman with postfix that would be nice to get fixed up. For background, mailman has some nice integration with postfix which allows list aliases to be setup automatically (as opposed to having an admin manually add new list aliases to /etc/aliases or what have you). This is documented in the mailman install manual². When setting up mailman to work with postfix, the following denials are seen on Fedora 9 (they are slightly different on CentOS 5, unsurprisingly): type=AVC msg=audit(1226861409.980:83): avc: denied { search } for pid=24239 comm="postalias" name="postfix" dev=sda2 ino=213317 scontext=unconfined_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=dir type=AVC msg=audit(1226861409.980:83): avc: denied { read } for pid=24239 comm="postalias" name="main.cf" dev=sda2 ino=216184 scontext=unconfined_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=file type=AVC msg=audit(1226861409.990:84): avc: denied { getattr } for pid=24239 comm="postalias" path="/etc/postfix/main.cf" dev=sda2 ino=216184 scontext=unconfined_u:system_r:mailman_cgi_t:s0 tcontext=system_u:object_r:postfix_etc_t:s0 tclass=file type=AVC msg=audit(1226861755.237:93): avc: denied { read write } for pid=24597 comm="mailman" path="socket:[1115689]" dev=sockfs ino=1115689 scontext=system_u:system_r:mailman_mail_t:s0 tcontext=system_u:system_r:postfix_local_t:s0 tclass=udp_socket Using audit2allow, I ended up with the following policy: module mailmanpostfix 1.0; require { type mailman_cgi_t; type mailman_mail_t; type postfix_etc_t; type postfix_local_t; class dir search; class file { read getattr }; class udp_socket { read write }; } #============= mailman_cgi_t ============== allow mailman_cgi_t postfix_etc_t:dir search; allow mailman_cgi_t postfix_etc_t:file { read getattr }; #============= mailman_mail_t ============== allow mailman_mail_t postfix_local_t:udp_socket { read write }; I'd love to help get this integrated into the official SELinux policy packages for Fedora (and CentOS/RHEL if possible). I am not certain if the above policy can be tightened up or not. Any help there would be very much appreciated. ¹ http://www.mail-archive.com/mailman-users%40python.org/msg51591.html (The policy from the denials on CentOS 5 are in this thread.) ² http://www.gnu.org/software/mailman/mailman-install/node12.html and http://www.gnu.org/software/mailman/mailman-install/node13.html -- Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Happiness is like peeing on yourself. Everyone can see it, but only you can feel its warmth

1 0

logrotate problem
by Dr. Michael J. Chudobiak 12 Nov '08

12 Nov '08

Hi all, I'm having problems running logrotate from cron. The emails say: /etc/cron.daily/logrotate: error: cannot open current directory: Permission denied logrotate tries to open ".", which works out to "/root". Sure enough, selinux is blocking access to admin_home_t: type=AVC msg=audit(1226489667.211:371): avc: denied { read } for pid=2291 comm="logrotate" name="root" dev=dm-0 ino=2162689 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir type=SYSCALL msg=audit(1226489667.211:371): arch=40000003 syscall=5 success=no exit=-13 a0=80525d3 a1=8000 a2=0 a3=8000 items=0 ppid=2289 pid=2291 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=39 comm="logrotate" exe="/usr/sbin/logrotate" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null) Is this a policy bug? An /.autorelabel didn't fix it. I'm using F10 rawhide. - Mike

2 1

Re: line 1887 is missing
by Antonio Olivares 09 Nov '08

09 Nov '08

--- On Sun, 11/9/08, Tom London <selinux(a)gmail.com> wrote: > From: Tom London <selinux(a)gmail.com> > Subject: Re: line 1887 is missing > To: olivares14031(a)yahoo.com > Date: Sunday, November 9, 2008, 9:33 AM > On Sun, Nov 9, 2008 at 8:38 AM, Antonio Olivares > <olivares14031(a)yahoo.com> wrote: > > Dear fellow testers and selinux experts, > > > > what is in line 1887, I have installed Fedora 10 > Preview and I when I try to install a package, I get the > following message: > > > > Running rpm_check_debug > > Running Transaction Test > > /etc/selinux/targeted/contexts/files/file_contexts: > line 1887 is missing fields, skipping > > /etc/selinux/targeted/contexts/files/file_contexts: > line 1887 is missing fields, skipping > > Finished Transaction Test > > Transaction Test Succeeded > > Running Transaction > > /etc/selinux/targeted/contexts/files/file_contexts: > line 1887 is missing fields, skipping > > /etc/selinux/targeted/contexts/files/file_contexts: > line 1887 is missing fields, skipping > > > > > > Smolt profile is here: > > > > > http://www.smolts.org/client/show/pub_52cf9c16-aa07-4697-8df6-7b47eb9855f4 > (public) > > > > TIA, > > > > Antonio > > > Would be helpful if you posted with the request for help: > > An example package you were trying to install, > The version of selinux policy files you have installed > (e.g., output > of "rpm -qa selinux\*" > Any local selinux policy modifications you have made (e.g., > via > semanage, semodule) > Any non-Fedora packages you have installed > > Otherwise, unless this is a "general problem" > that everyone is > experiencing, it is very difficult to respond. > > This is not happening to me on a Rawhide updated system. > > tom > -- > Tom London Tom, I am also running 4 other machines with rawhide fully updated :), however I installed to another machine Fedora 10 Preview and I encountered this, however, hard drive seems to be dying. I see errors like below ata2.0 BDMA, stat 0x4 cmd c8/00:08:54:ef:56/00:00:00:00:00 ea tag 0 dma 4096 ata2.0 BDMA, stat 0x4 res c8/00:08:54:ef:56/00:00:00:00:00 ea tag 0 dma 4096 Emask 0x9 (media error) ata 2.0:status{DRDY ERR} I will need to look for a spare hard drive for this machine. Till next time. Thanks for trying to help :) Regards, Antonio

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2008