December 2008 - selinux - Fedora Mailing-Lists

Memory protection and system-config-securitylevel

by Kamil J. Dudek

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

14 years, 2 months

2
3
0 / 0

mount point labels

by Clarkson, Mike R (US SSA)

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

14 years, 2 months

3
7
0 / 0

avc Dead-Letter? Fedora 10

by Frank Murphy

This is the first Fedora I've come across a files called dead-letter. I don't use sendmail, exim is installed, if relevant. Summary: SELinux is preventing the sendmail from using potentially mislabeled files (./dead.letter). Detailed Description: SELinux has denied sendmail access to potentially mislabeled file(s) (./dead.letter). This means that SELinux will not allow sendmail to use these files. It is common for users to edit files in their home directory or tmp directories and then move (mv) them to system directories. The problem is that the files end up with the wrong file context which confined applications are not allowed to access. Allowing Access: If you want sendmail to access this files, you need to relabel them using restorecon -v './dead.letter'. You might want to relabel the entire directory using restorecon -R -v './dead.letter'. Additional Information: Source Context system_u:system_r:logwatch_t:s0 Target Context system_u:object_r:admin_home_t:s0 Target Objects ./dead.letter [ dir ] Source sendmail Source Path /usr/sbin/ssmtp Port <Unknown> Host frank01.frankly3d.local Source RPM Packages ssmtp-2.61-11.7.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-34.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name home_tmp_bad_labels Host Name frank01.frankly3d.local Platform Linux frank01.frankly3d.local 2.6.27.9-159.fc10.i686 #1 SMP Tue Dec 16 15:12:04 EST 2008 i686 i686 Alert Count 1 First Seen Sun 28 Dec 2008 12:18:46 GMT Last Seen Sun 28 Dec 2008 12:18:46 GMT Local ID 6feff0bd-d81b-472e-8c9b-a4538c69479f Line Numbers Raw Audit Messages node=frank01.frankly3d.local type=AVC msg=audit(1230466726.28:154): avc: denied { add_name } for pid=4443 comm="sendmail" name="dead.letter" scontext=system_u:system_r:logwatch_t:s0 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir node=frank01.frankly3d.local type=SYSCALL msg=audit(1230466726.28:154): arch=40000003 syscall=5 success=no exit=-13 a0=97312d0 a1=441 a2=1b6 a3=440 items=0 ppid=4311 pid=4443 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sendmail" exe="/usr/sbin/ssmtp" subj=system_u:system_r:logwatch_t:s0 key=(null) ==================================================== Dead-Letter contents ==================================================== /etc/cron.daily/0logwatch: sendmail: Cannot open mail:25 /etc/cron.daily/rkhunter: send-mail: Cannot open mail:25 send-mail: Cannot open mail:25 /bin/sh: opt/f-prot/fpscan: No such file or directory

14 years, 11 months

4
5
0 / 0

GCL

by Jerry James

I have been told that the Fedora builders run with SELinux disabled. In that case, is it necessary continue with bz #472780? Can I just include the policy I attached to that bug in the GCL source RPM and stop worrying about build-time permissions? Do I need somebody's permission (no pun intended) to do that? Thanks, -- Jerry James http://loganjerry.googlepages.com/

14 years, 11 months

1
1
0 / 0

Are there any plans for generic contexts?

by Arthur Pemberton

Are there any plans for generic contexts? If not consider this a suggestion. It would be useful if there were more generic contexts, for example 'shared_content_t'. Which all targeted daemons that share files (such as httpd, smbd, vsftpd) would all have access to these files. I am aware that I can probably write my own policy to allow this, but it seems like a fairly common use case. Just tonight I wanted to make some web code I was working on available via a samba share so I could work a bit more fluidly form my laptop. But the files are already labeled for sharing under httpd. On another machine, I give access to samba to one dir, and would also like to have access form httpd. For certain situations, even vsftpd. -- Fedora 9 : sulphur is good for the skin ( www.pembo13.com )

14 years, 11 months

2
1
0 / 0

F9: Problems with Spamassassin

by Dan Thurman

I am getting bombed Spamassassin for which SELinux is complaining: Dec 22 14:03:01 gold setroubleshoot: SELinux is preventing the spamassassin (spamassassin_t) from binding to port 31120. For complete SELinux messages. run sealert -l d55ced24-a79c-4712-9ed3-854874f886e3 Please note, this is message one of *many* reports for which the port numbers are running up and down the port numbers in the thousands... and failing... Did I mis-configure Spamassassin or is this an SELinux issue? ========================================================= # sealert -l d55ced24-a79c-4712-9ed3-854874f886e3: Summary: SELinux is preventing the spamassassin (spamassassin_t) from binding to port 32733. Detailed Description: SELinux has denied the spamassassin from binding to a network port 32733 which does not have an SELinux type associated with it. If spamassassin is supposed to be allowed to listen on this port, you can use the semanage command to add this port to a port type that spamassassin_t can bind to. semanage port -l will list all port types. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy package. If spamassassin is not supposed to bind to this port, this could signal a intrusion attempt. If this system is running as an NIS Client, turning on the allow_ypbind boolean, may fix the problem. setsebool -P allow_ypbind=1. Allowing Access: If you want to allow spamassassin to bind to this port semanage port -a -t PORT_TYPE -p PROTOCOL 32733 Where PORT_TYPE is a type that spamassassin_t can bind and PROTOCOL is udp or tcp. Additional Information: Source Context system_u:system_r:spamassassin_t:s0 Target Context system_u:object_r:port_t:s0 Target Objects None [ udp_socket ] Source spamassassin Source Path /usr/bin/perl Port 32733 Host gold.cdkkt.com Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.3.1-111.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name bind_ports Host Name gold.cdkkt.com Platform Linux gold.cdkkt.com 2.6.27.7-53.fc9.i686 #1 SMP Thu Nov 27 02:29:03 EST 2008 i686 i686 Alert Count 3378 First Seen Mon Dec 22 14:00:08 2008 Last Seen Mon Dec 22 14:00:20 2008 Local ID d55ced24-a79c-4712-9ed3-854874f886e3 Line Numbers Raw Audit Messages node=gold.cdkkt.com type=AVC msg=audit(1229983220.80:14243): avc: denied { name_bind } for pid=6493 comm="spamassassin" src=32733 scontext=system_u:system_r:spamassassin_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket ========================================================= Thanks! Dan

14 years, 11 months

2
1
0 / 0

Question about SELinux Policy compilation

by Atsushi SAKAI

Hi, I have a basic question about SELinux Policy compilation on Fedora10. I do follows to # rpm -i selinux-policy-3.5.13-18.fc10.src.rpm # cd /root/rpmbuild/SPEC # rpmbuild -bp selinux-policy.spec # cd /root/rpmbuild/BUILD/serefpolicy-3.5.13 # make conf # make policy Then I met following errors. Is there any good pointer to solve this problem. Compiling refpolicy policy.23 /usr/bin/checkpolicy policy.conf -o policy.23 /usr/bin/checkpolicy: loading policy configuration from policy.conf policy/modules/services/hal.te":11:ERROR 'syntax error' at token 'typeattribute' on line 929917 #line 11 typeattribute hald_t daemon; checkpolicy: error(s) encounterd while parsing configuration make: *** [policy.23] Error1 Thanks Atsushi SAKAI

14 years, 11 months

1
0
0 / 0

Error compiling the fedora selinux policy

by Vince Le Port

Hi list, I have got a problem while compiling the fedora selinux policy sources. Here is the way I do it : #rpm -ivh selinux-policy-3.5.13-30.fc10.src.rpm #cd rpmbuild/SPECS/ #rpmbuild -bp selinux-policy.spec #cd ../BUILD/ #make install-src I modified the build.conf in that way TYPE = mcs NAME = refpolicy DISTRO = redhat DIRECT_INITRC = n MONOLITHIC = n MLS_SENS = 16 MLS_CATS = 256 MCS_CATS = 1024 QUIET = n #make conf #make policy and unhappily, I got the following error .. /usr/bin/checkmodule: loading policy configuration from base.conf policy/modules/kernel/domain.te":97:ERROR 'unknown type userdomain' at token ';' on line 9242: dontaudit domain userdomain:key search; If I comment out this line, I got others errors, so it seems unending .. How can I fix that ? Is it normal that I have errors when compiling a fedora RPM ? Regards, Vince

14 years, 11 months

2
1
0 / 0

Is SELinux blocking all forward-only mail agents? (esmtp/ssmtp)

by NMONNET

I didn't want to have a full-fledged MTA on my machines; I tried both esmtp and ssmtp, and both seem unable to work without tripping on SELinux. It looks like they always inherit the context of the calling program, which doesn't have the rights to, say, connect outside on port 25. Is there a way? Summary: SELinux is preventing sendmail (logwatch_t) "name_connect" smtp_port_t. Detailed Description: [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.] SELinux denied access requested by sendmail. It is not expected that this access is required by sendmail and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/ enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:logwatch_t:s0-s0:c0.c1023 Target Context system_u:object_r:smtp_port_t:s0 Target Objects None [ tcp_socket ] Source sendmail Source Path /usr/sbin/ssmtp Port 25 Host lin1195 Source RPM Packages ssmtp-2.61-11.7.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.13-26.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall Host Name lin1195 Platform Linux lin1195 2.6.27.5-117.fc10.x86_64 #1 SMP Tue Nov 18 11:58:53 EST 2008 x86_64 x86_64 Alert Count 1 First Seen Fri 12 Dec 2008 04:02:05 AM CET Last Seen Fri 12 Dec 2008 04:02:05 AM CET Local ID 631702fa-42b7-444d-b62e-fe50df41bf9f Line Numbers Raw Audit Messages node=lin1195 type=AVC msg=audit(1229050925.485:1082): avc: denied { name_connect } for pid=22689 comm="sendmail" dest=25 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=system_u:object_r:smtp_port_t:s0 tclass=tcp_socket node=lin1195 type=SYSCALL msg=audit(1229050925.485:1082): arch=c000003e syscall=42 success=yes exit=0 a0=3 a1=ad2d90 a2=10 a3=3b4856da70 items=0 ppid=22433 pid=22689 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=122 comm="sendmail" exe="/usr/sbin/ssmtp" subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null)

14 years, 11 months

4
5
0 / 0

suexec with fcgid-script in userdir site

by Alexander Slesarev

Hello! I have a site in my userdir working via fcgid-script. But this script is not working - SELinux prevents it. SELinux is preventing suexec (httpd_suexec_t) "getattr" to /home/nuald/public_html/codedgers/trunk/src/codedgers/site.fcgi (httpd_unconfined_script_exec_t). AVC raw messages: host=elc6002.eellc.ru type=AVC msg=audit(1227234886.189:172): avc: denied { getattr } for pid=9514 comm="suexec" path="/home/nuald/public_html/codedgers/trunk/src/codedgers/site.fcgi" dev=dm-2 ino=361072 scontext=unconfined_u:system_r:httpd_suexec_t:s0 tcontext=unconfined_u:object_r:httpd_unconfined_script_exec_t:s0 tclass=file host=elc6002.eellc.ru type=SYSCALL msg=audit(1227234886.189:172): arch=40000003 syscall=196 success=no exit=-13 a0=bff4efe1 a1=bff4c8a4 a2=2acff4 a3=bff4efe1 items=0 ppid=9328 pid=9514 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="suexec" exe="/usr/sbin/suexec" subj=unconfined_u:system_r:httpd_suexec_t:s0 key=(null) What can I do? I tried different scenarios but nothing helps. By the way - there is httpd_suexec_disable_trans boolean? I can't set it up. I'm using Fedora 10 with all latest updates. Thanks in advance. -- Best regards, Alexander Slesarev.

14 years, 11 months

3
2
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2008