selinux May 2008

selinux@lists.fedoraproject.org

36 participants
50 discussions

RE: Samba shares...
by Dan Thurman 13 May '08

13 May '08

Stephen Smalley wrote: >> Daniel B. Thurman wrote: >> I am not sure what is going on. I am unable to get >> samba shares to work for an NTFS filesystem. I do >> have several shares working for ext3 filesystems. >> >> Here is what I did: >> >> 1) Create an empty directory: /AV >> 2) chcon -t samba_share_t /AV >> 3) chmod 775 !$ >> 4) chgrp avusers !$ >> 5) Add to fstab >> /dev/sda1 /AV ntfs defaults 1 2 > > Not sure if this will work, but try adding a > "context=system_u:object_r:samba_share_t" to the > list of options in your fstab. Sorry I was not able to get your reply in my inbox, it was spam-blocked, but I have it fixed now. Can you please tell me how to add your suggestion to the fstab as options? Thanks! Dan

2 1

Samba shares...
by Dan Thurman 13 May '08

13 May '08

I am not sure what is going on. I am unable to get samba shares to work for an NTFS filesystem. I do have several shares working for ext3 filesystems. Here is what I did: 1) Create an empty directory: /AV 2) chcon -t samba_share_t /AV 3) chmod 775 !$ 4) chgrp avusers !$ 5) Add to fstab /dev/sda1 /AV ntfs defaults 1 2 6) mount -a + ls -ldZ /AV drwxrwxrwx root root system_u:object_r:fusefs_t:s0 AV + chcon -t samba_share_t /AV chcon: failed to change context of /AV to system_u:object_r:samba_share_t:s0: Operation not supported. + umount /AV (no errors) + chcon -t samba_share_t /AV (no errors) + mount /AV (no errors) + ls -ldZ /AV drwxrwxrwx root root system_u:object_r:fusefs_t:s0 AV So... why does the system insists of fusefs_t? Does this mean that ntfs filesystems does not support samba_share_context? HELP!!! Thanks! Dan

2 1

firefox problems with: browser_confine_unconfined --> on
by Christoph A. 13 May '08

13 May '08

Hi, I'm looking forward do confine users (firefox, thunderbird). I played with xguest_u and I liked the behavior of firefox (home not writeable except ~/Downloads, ~/.mozilla), but I need other programms (thunderbird, ssh) to connect to the internet too, so I wanted to try the usual unconfined_u with browser_confine_unconfined set. I didn't find mutch about this boolean but I wanted to see, if with this boolean set, firefox of an unconfined user will behave like firefox of xguest_u. After setting the boolean firefox runs in its own domain (unconfined_mozilla_t) that looks fine. When I tried to save a picture to see if I can write to ~/ (not ~/Download) firefox hangs (immediately after klicking on "Save Image As...") and I had to use kill to terminate it. observing the audit.log file with tail -f shows: type=USER_AVC msg=audit(1210554417.821:80): user pid=1648 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.93 spid=1783 tpid=3412 scontext=system_u:system_r:hald_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_mozilla_t:s0 tclass=dbus : exe="/bin/dbus-daemon" (sauid=81, hostname=?, addr=?, terminal=?)' If I set browser_confine_unconfined to 0 this problem doesn't occur. Should firefox (unconfined_mozilla_t) behave like firefox of xguest_u, or is this boolean for something different? thanks, Christoph A. PS: I'm using FC9.

2 4

upcoming selinux ioctl permission changes
by Eric Paris 13 May '08

13 May '08

I'm planning on pushing a patch to try to simplify ioctl permission checks in SELinux. This won't be upstreamed until the 2.6.27 merge window and we would like to see some more widespread testing first. So I plan to push this into the rawhide kernel in the next day or two. We certainly don't expect it to cause any problem so I'm really only mentioning it just in case and to put people on the lookout. If you happen to notice strange denials on ioctls please file a bug and cc me or send me an e-mail! http://marc.info/?l=selinux&m=121033736222066&w=2 -Eric

1 0

SELinux, apache/php and qmail's sendmail
by D. Hilbig 09 May '08

09 May '08

I use qmail instead of sendmail on RHEL v5 and I could use some advice on setting contexts for qmail's sendmail so that apache/php can use it. Below are the files and directories involved with qmail's sendmail (and delivery to queue) allow apache/php to invoke qmail's sendmail program: /var/qmail/bin/sendmail allow qmail's sendmail to invoke qmail-inject program: /var/qmail/bin/qmail-inject allow qmail-inject to list the contents of the config files directory: /var/qmail/control allow qmail-inject to read the config files it uses: /var/qmail/control/defaultdomain /var/qmail/control/deaulthost /var/qmail/control/idhost /var/qmail/control/plusdomain /var/qmail/control/me allow qmail-inject to invoke qmail-queue program: /var/qmail/bin/qmail-queue allow qmail-queue to read the config file used by the 'taps' patch: /var/qmail/control/taps allow qmail-queue to put a message into the queue: (create, edit, delete and link files) /var/qmail/queue/pid (and subdirectories) /var/qmail/queue/mess (and subdirectories) /var/qmail/queue/intd (and subdirectories) /var/qmail/queue/todo (and subdirectories) For testing I specified the context "httpd_sys_content_t" but I know that it isn't the desired context. What context(s) should I specify for the aforementioned programs, directories and configuration files? Are there any other things I should do or consider besides setting the context(s)? Your guidance is greatly appreciated.

1 0

Pam upgrade problem
by Scally, Katrina-P54861 08 May '08

08 May '08

My original problem was With the default pam options, pam_selinux is unable to get the user context, during login it would default to system_u:system_r:local_login_t context. I got around this problem for some time by changing /etc/pam.d/login line to Session required pam_selinux.so open verbose select_context. I found on http://www.nsa.gov/selinux/list-archive/0706/21321.cfm that this was a bug in pam and by upgrading from pam-0.1.77-66.23.i386.rpm (or earlier versions) to pam-0.1.99.6.2-3.26.el5.i386.rpm would get rid of the problem. This upgrade has actually caused more problems. I can no longer even log into my virtual machine with my install in enforcing, in permissive mode it is fine. Unfortunately there are no AVC denials when. My Virtual Machine is running RHEL5, libselinux-1.1.33.4-4.el5.i386.rpm, and reference policy that came with the Bedrock tool from Tresys refpolicy-20070417.tar.bz2 Possibly I missed something while upgrading pam? I have looked through all of the files the pam-0.1.99.6.2-3.26.el5.i386.rpm has installed and they all seem correct. Thanks in advance, -K > This email message is for the sole use of the intended recipient(s) > and may contain GDC4S confidential or privileged information. Any > unauthorized review, use, disclosure or distribution is prohibited. If > you are not an intended recipient, please contact the sender by reply > email and destroy all copies of the original message. >

2 1

selinux config - no warning during upgrades
by Bruno Wolff III 08 May '08

08 May '08

I recently did a yum upgrade from Fedora Core 5 to Rawhide and afterwards I eventually noticed that I was getting warnings about a NULL security context. I then tracked this down to not having a proper selinux user configuration. Since I was using the default, I expected things would work or at least that there would be *.rpmnew files that acted as a hint that something needed to be looked at. Also, in order to find out what the default was I ended up looking at some other machines that had more recent installs, because there didn't seem to be any obvious place to look on the affected machine for what reasonable default values were.

3 6

Odd problem with dovecot
by Chris Adams 07 May '08

07 May '08

I'm trying to set up dovecot for IMAP. I'm using an external auth program and a static userdb setting to define the home directories (all owned by the same UID/GID). I set the whole directory tree to mail_spool_t (thinking I'd avoid any SELinux access issues that way). What is odd is that it fails when SELinux is in enforcing mode, but not in permissive, BUT I don't get any errors when it fails (e.g. no "denied" messages in the kernel or audit logs). I've straced the daemon, and it fails at a chdir(). I know the permissions are okay (it works when the system is in permissive mode), so I figured it has to be related to SELinux, but I can't figure out how. Suggestions? -- Chris Adams <cmadams(a)hiwaay.net> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble.

2 2

Starting stunnel from xinetd
by Ian Pilcher 04 May '08

04 May '08

Running fully updated Fedora 8, trying to start stunnel from xinetd, and getting a couple of denials: type=AVC msg=audit(1205149512.996:2338): avc: denied { write } for pid=14322 comm="stunnel" name="random_seed" dev=md1 ino=819429 scontext=unconfined_u:system_r:stunnel_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:stunnel_etc_t:s0 tclass=file type=AVC msg=audit(1205149512.998:2339): avc: denied { name_bind } for pid=14322 comm="stunnel" src=2873 scontext=unconfined_u:system_r:stunnel_t:s0-s0:c0.c1023 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket Aren't these things that stunnel should be expected to do? -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com ========================================================================

2 9

postfix with maildir delivery
by freeslkr 03 May '08

03 May '08

Hello, I'm trying out SELinux on Fedora 8 in permissive mode. I get AVCs everytime postfix delivers mail to the maildir directories. It looks like postfix doesn't have permission to create files. For example, from /var/log/messages: SELinux is preventing local (postfix_local_t) "link" to ./1208923427.P3686.myhost (mail_spool_t) from /var/log/audit/audit.log: type=AVC msg=audit(1208923427.350:95): avc: denied { link } for pid=3686 comm="local" name="1208923427.P3686.myhost" dev=dm-3 ino=819271 scontext=system_u:system_r:postfix_local_t:s0 tcontext=system_u:object_r:mail_spool_t:s0 tclass=file type=SYSCALL msg=audit(1208923427.350:95): arch=c000003e syscall=86 success=yes exit=0 a0=2aaaaad599c0 a1=2aaaaad59ba0 a2=0 a3=0 items=0 ppid=2371 pid=3686 auid=4294967295 uid=0 gid=0 euid=1000 suid=0 fsuid=1000 egid=1000 sgid=0 fsgid=1000 tty=(none) comm="local" exe="/usr/libexec/postfix/local" subj=system_u:system_r:postfix_local_t:s0 key=(null) Is my interpretation correct. If so, is it likely that this could be corrected in a future policy version? Thank you for you help

3 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2008