July 2008 - selinux - Fedora Mailing-Lists

Memory protection and system-config-securitylevel

by Kamil J. Dudek

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

13 years, 8 months

2
3
0 / 0

mount point labels

by Clarkson, Mike R (US SSA)

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

13 years, 9 months

3
7
0 / 0

Clamd getting out of hand...

by Arthur Dent

Hello All, I have been using SELinux in enforcing mode on my F8 box for some time now. I had to go through a bit of pain to get clamassassin working with clamd to scan my emails but it worked OK. This weekend I upgraded to F9 and have now had about a gazillion AVC denials related to clamd. I have therefore been forced to use audit2allow to add to the already pretty cumbersome local policy I had with F8. I list the policy below. All of the entries are as a result of some denial and subsequent audit2allow policy generation. My question is basically - can one of you gurus tell me if all this stuff is still necessary? Is there a policy in the works that might avoid all this? Thanks in advance AD ########################################## # cat myclamd.te policy_module(myclamd, 1.1.11) require { type clamscan_t; type clamd_t; class tcp_socket { write create connect }; type var_run_t; type user_home_t; class sock_file { write unlink create }; class file append; type unlabeled_t; class association recvfrom; } #============= clamd_t ============== allow clamd_t var_run_t:sock_file { unlink create }; corenet_tcp_bind_generic_port(clamd_t) userdom_read_generic_user_home_content_files(clamd_t) #============= clamscan_t ============== allow clamscan_t self:tcp_socket { write create connect }; allow clamscan_t user_home_t:file append; allow clamscan_t var_run_t:sock_file write; corenet_tcp_connect_generic_port(clamscan_t) corenet_sendrecv_unlabeled_packets(clamscan_t) mta_read_queue(clamscan_t) procmail_rw_tmp_files(clamscan_t) userdom_read_generic_user_home_content_files(clamscan_t) allow clamscan_t unlabeled_t:association recvfrom; ##########################################

14 years, 10 months

2
13
0 / 0

Running a script from Samba

by Tony Molloy

This is on Centos not Fedora but that shouldn't matter. If I want Samba to run a script ( logon logout scripts ) what context should I set the scripts to. Thanks,, Tony

14 years, 10 months

3
5
0 / 0

selinux and denied gconf errors

by Antonio Olivares

Dear all, A group of selinux errors and denied avcs follows: Summary: SELinux is preventing updatedb (locate_t) "getattr" to /home/olivares/.gconfd (unlabeled_t). Detailed Description: SELinux denied access requested by updatedb. It is not expected that this access is required by updatedb and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /home/olivares/.gconfd, restorecon -v '/home/olivares/.gconfd' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:locate_t Target Context system_u:object_r:unlabeled_t Target Objects /home/olivares/.gconfd [ dir ] Source updatedb Source Path /usr/bin/updatedb Port <Unknown> Host localhost.localdomain Source RPM Packages mlocate-0.21-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-3.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.26-0.44.rc4.git2.fc10.i686 #1 SMP Thu May 29 13:44:38 EDT 2008 i686 i686 Alert Count 2 First Seen Wed 30 Jul 2008 09:26:20 PM CDT Last Seen Thu 31 Jul 2008 01:31:21 PM CDT Local ID 01cdf1be-4f1a-4058-bc41-81cc1c834598 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1217529081.437:33): avc: denied { getattr } for pid=10222 comm="updatedb" path="/home/olivares/.gconfd" dev=dm-0 ino=476292 scontext=system_u:system_r:locate_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1217529081.437:33): arch=40000003 syscall=196 success=no exit=-13 a0=9893169 a1=bfcfd748 a2=c1cff4 a3=9893169 items=0 ppid=10216 pid=10222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="updatedb" exe="/usr/bin/updatedb" subj=system_u:system_r:locate_t:s0 key=(null) Summary: SELinux is preventing updatedb (locate_t) "getattr" to /home/olivares/.gconf (unlabeled_t). Detailed Description: SELinux denied access requested by updatedb. It is not expected that this access is required by updatedb and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /home/olivares/.gconf, restorecon -v '/home/olivares/.gconf' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:locate_t Target Context system_u:object_r:unlabeled_t Target Objects /home/olivares/.gconf [ dir ] Source updatedb Source Path /usr/bin/updatedb Port <Unknown> Host localhost.localdomain Source RPM Packages mlocate-0.21-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-3.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.26-0.44.rc4.git2.fc10.i686 #1 SMP Thu May 29 13:44:38 EDT 2008 i686 i686 Alert Count 2 First Seen Wed 30 Jul 2008 09:26:20 PM CDT Last Seen Thu 31 Jul 2008 01:31:21 PM CDT Local ID 62d1f886-f58a-4fa3-8222-c3ba79bf4989 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1217529081.436:32): avc: denied { getattr } for pid=10222 comm="updatedb" path="/home/olivares/.gconf" dev=dm-0 ino=476270 scontext=system_u:system_r:locate_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1217529081.436:32): arch=40000003 syscall=196 success=no exit=-13 a0=9892f89 a1=bfcfd748 a2=c1cff4 a3=9892f89 items=0 ppid=10216 pid=10222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="updatedb" exe="/usr/bin/updatedb" subj=system_u:system_r:locate_t:s0 key=(null) Summary: SELinux is preventing updatedb (locate_t) "getattr" to /home/olivares/.config/gtk-2.0 (unlabeled_t). Detailed Description: SELinux denied access requested by updatedb. It is not expected that this access is required by updatedb and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /home/olivares/.config/gtk-2.0, restorecon -v '/home/olivares/.config/gtk-2.0' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:locate_t Target Context system_u:object_r:unlabeled_t Target Objects /home/olivares/.config/gtk-2.0 [ dir ] Source updatedb Source Path /usr/bin/updatedb Port <Unknown> Host localhost.localdomain Source RPM Packages mlocate-0.21-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-3.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.26-0.44.rc4.git2.fc10.i686 #1 SMP Thu May 29 13:44:38 EDT 2008 i686 i686 Alert Count 2 First Seen Wed 30 Jul 2008 09:26:19 PM CDT Last Seen Thu 31 Jul 2008 01:31:21 PM CDT Local ID e551c492-3193-4a8b-9885-2c0a9330caf8 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1217529081.12:31): avc: denied { getattr } for pid=10222 comm="updatedb" path="/home/olivares/.config/gtk-2.0" dev=dm-0 ino=426550 scontext=system_u:system_r:locate_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1217529081.12:31): arch=40000003 syscall=196 success=no exit=-13 a0=9893509 a1=bfcfd5c8 a2=c1cff4 a3=9893509 items=0 ppid=10216 pid=10222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="updatedb" exe="/usr/bin/updatedb" subj=system_u:system_r:locate_t:s0 key=(null) Summary: SELinux is preventing updatedb (locate_t) "getattr" to /root/.gconfd (unlabeled_t). Detailed Description: SELinux denied access requested by updatedb. It is not expected that this access is required by updatedb and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /root/.gconfd, restorecon -v '/root/.gconfd' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:locate_t Target Context system_u:object_r:unlabeled_t Target Objects /root/.gconfd [ dir ] Source updatedb Source Path /usr/bin/updatedb Port <Unknown> Host localhost.localdomain Source RPM Packages mlocate-0.21-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-3.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.26-0.44.rc4.git2.fc10.i686 #1 SMP Thu May 29 13:44:38 EDT 2008 i686 i686 Alert Count 2 First Seen Wed 30 Jul 2008 09:26:40 PM CDT Last Seen Thu 31 Jul 2008 01:31:31 PM CDT Local ID 9abda88c-0b21-4d95-914b-8a8e43658f2b Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1217529091.176:37): avc: denied { getattr } for pid=10222 comm="updatedb" path="/root/.gconfd" dev=dm-0 ino=33243 scontext=system_u:system_r:locate_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1217529091.176:37): arch=40000003 syscall=196 success=no exit=-13 a0=9892f15 a1=bfcfd8c8 a2=c1cff4 a3=9892f15 items=0 ppid=10216 pid=10222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="updatedb" exe="/usr/bin/updatedb" subj=system_u:system_r:locate_t:s0 key=(null) Summary: SELinux is preventing updatedb (locate_t) "getattr" to /root/.gnome2 (unlabeled_t). Detailed Description: SELinux denied access requested by updatedb. It is not expected that this access is required by updatedb and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /root/.gnome2, restorecon -v '/root/.gnome2' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:locate_t Target Context system_u:object_r:unlabeled_t Target Objects /root/.gnome2 [ dir ] Source updatedb Source Path /usr/bin/updatedb Port <Unknown> Host localhost.localdomain Source RPM Packages mlocate-0.21-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-3.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.26-0.44.rc4.git2.fc10.i686 #1 SMP Thu May 29 13:44:38 EDT 2008 i686 i686 Alert Count 2 First Seen Wed 30 Jul 2008 09:26:40 PM CDT Last Seen Thu 31 Jul 2008 01:31:31 PM CDT Local ID 94a6e1e9-462b-4288-a2c9-9678abafa22c Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1217529091.179:38): avc: denied { getattr } for pid=10222 comm="updatedb" path="/root/.gnome2" dev=dm-0 ino=33245 scontext=system_u:system_r:locate_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1217529091.179:38): arch=40000003 syscall=196 success=no exit=-13 a0=9892e95 a1=bfcfd8c8 a2=c1cff4 a3=9892e95 items=0 ppid=10216 pid=10222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="updatedb" exe="/usr/bin/updatedb" subj=system_u:system_r:locate_t:s0 key=(null) Summary: SELinux is preventing updatedb (locate_t) "getattr" to /root/.gconf (unlabeled_t). Detailed Description: SELinux denied access requested by updatedb. It is not expected that this access is required by updatedb and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /root/.gconf, restorecon -v '/root/.gconf' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:locate_t Target Context system_u:object_r:unlabeled_t Target Objects /root/.gconf [ dir ] Source updatedb Source Path /usr/bin/updatedb Port <Unknown> Host localhost.localdomain Source RPM Packages mlocate-0.21-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-3.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.26-0.44.rc4.git2.fc10.i686 #1 SMP Thu May 29 13:44:38 EDT 2008 i686 i686 Alert Count 2 First Seen Wed 30 Jul 2008 09:26:40 PM CDT Last Seen Thu 31 Jul 2008 01:31:31 PM CDT Local ID 72df776e-7cd5-4444-bfd7-173e26d0814c Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1217529091.174:36): avc: denied { getattr } for pid=10222 comm="updatedb" path="/root/.gconf" dev=dm-0 ino=33242 scontext=system_u:system_r:locate_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1217529091.174:36): arch=40000003 syscall=196 success=no exit=-13 a0=9892e21 a1=bfcfd8c8 a2=c1cff4 a3=9892e21 items=0 ppid=10216 pid=10222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="updatedb" exe="/usr/bin/updatedb" subj=system_u:system_r:locate_t:s0 key=(null) Summary: SELinux is preventing updatedb (locate_t) "getattr" to /root/.config/gtk-2.0 (unlabeled_t). Detailed Description: SELinux denied access requested by updatedb. It is not expected that this access is required by updatedb and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /root/.config/gtk-2.0, restorecon -v '/root/.config/gtk-2.0' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:locate_t Target Context system_u:object_r:unlabeled_t Target Objects /root/.config/gtk-2.0 [ dir ] Source updatedb Source Path /usr/bin/updatedb Port <Unknown> Host localhost.localdomain Source RPM Packages mlocate-0.21-1.fc10 Target RPM Packages Policy RPM selinux-policy-3.5.1-3.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost.localdomain Platform Linux localhost.localdomain 2.6.26-0.44.rc4.git2.fc10.i686 #1 SMP Thu May 29 13:44:38 EDT 2008 i686 i686 Alert Count 2 First Seen Wed 30 Jul 2008 09:26:40 PM CDT Last Seen Thu 31 Jul 2008 01:31:31 PM CDT Local ID fe2c17eb-dbce-4a97-9cb8-77588b788ab7 Line Numbers Raw Audit Messages host=localhost.localdomain type=AVC msg=audit(1217529091.123:35): avc: denied { getattr } for pid=10222 comm="updatedb" path="/root/.config/gtk-2.0" dev=dm-0 ino=35023 scontext=system_u:system_r:locate_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir host=localhost.localdomain type=SYSCALL msg=audit(1217529091.123:35): arch=40000003 syscall=196 success=no exit=-13 a0=98930d1 a1=bfcfd748 a2=c1cff4 a3=98930d1 items=0 ppid=10216 pid=10222 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="updatedb" exe="/usr/bin/updatedb" subj=system_u:system_r:locate_t:s0 key=(null) Thanks in Advance, Antonio

14 years, 10 months

3
3
0 / 0

Re: Can't export samba share

by Steve Blackwell

> On Fri, Jul 25, 2008 at 7:27 PM, Steve Blackwell <zephod(a)cfl.rr.com> > wrote: >> I've been out of town for a few days but there were no new postings >> while I was away and I still don't have a solution for this. >> > > Might I suggest posting the AVC's so that everyone can see what is > going on.\ I'm going to give it one more day and after that I'm going to have to turn selinux off. This is from audit.log: type=AVC msg=audit(1217030414.315:34): avc: denied { read } for pid=7099 comm="smbd" name="/" dev=sdb1 ino=5 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=dir type=SYSCALL msg=audit(1217030414.315:34): arch=40000003 syscall=5 success=no exit=-13 a0=b926ff00 a1=98800 a2=379d9c a3=b9293478 items=0 ppid=2649 pid=7099 auid=4294967295 uid=501 gid=0 euid=501 suid=0 fsuid=501 egid=501 sgid=0 fsgid=501 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null) type=AVC msg=audit(1217030414.317:35): avc: denied { read } for pid=7099 comm="smbd" name="/" dev=sdb1 ino=5 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=dir Steve

14 years, 10 months

3
3
0 / 0

writing a policy. Confused about domain transition.

by yiruli＠ccsl.carleton.ca

Hi, I am practising to write a policy for a music player called soundjuicer. Policy Tool I used: selinux-polgengui The beginning part of soundjuicer1.te is as follows: ---------------------------------------------------- type soundjuicer1_t; type soundjuicer1_exec_t; application_domain(soundjuicer1_t, soundjuicer1_exec_t) role user_r types soundjuicer1_t; ..... ------------------------------------------------------- The context of login id is (id -Z): user_u:user_r:user_t I loaded the module. And then I run the music player both from terminal and GUI. I checked the context of the soundjuicer process. The context of the process is : user_u:user_r:user_t Question: With the context for the process, user_u:user_r:user_t, can I say that the security policy for the program is not being enforced, because of the failure of domain transition? Should the context of the process be: user_u:user_r:soundjuicer1_t? thanks Yiru Li

14 years, 10 months

2
1
0 / 0

Apache Httpd, PHP, Smarty and SELinux

by Ingemar Nilsson

Hi. Yesterday I set up a small PHP web service on one of our CentOS 5 servers. It uses Smarty for templating, with the dynamically compiled templates being stored in a directory with SELinux context root:object_r:httpd_sys_content_t. The system runs with SELinux in enforcing mode, with httpd using the context root:system_u:httpd_t. For the fun of it, I looked through the SELinux policy allow rules, but I couldn't find a rule that says that processes in the httpd_t domain can write to files labeled httpd_sys_content_t, but it does anyway. I got the (supposedly) complete list of active policy rules using the command sesearch -a Running the command sesearch -a | grep 'httpd_t ' | grep httpd_sys_content_t produces the following list: allow httpd_t httpd_sys_content_t : file { ioctl read getattr lock }; allow httpd_t httpd_sys_content_t : dir { ioctl read getattr lock search }; allow httpd_t httpd_sys_content_t : lnk_file { ioctl read getattr lock }; allow httpd_t httpd_sys_content_t : file { ioctl read getattr lock }; allow httpd_t httpd_sys_content_t : dir { ioctl read getattr lock search }; allow httpd_t httpd_sys_content_t : lnk_file { read getattr }; type_transition httpd_t httpd_sys_content_t : process httpd_sys_script_t; I don't see any rule that allows httpd_t processes to write to httpd_sys_content_t directories. What is going on? Regards Ingemar

14 years, 10 months

2
2
0 / 0

ANN: CDS Framework version 3.0

by David Sugar

Version 3.0 of the CDS Framework Toolkit from Tresys Technology is now available for download from the Tresys Open Source website at http://oss.tresys.com The CDS Framework Toolkit is an Eclipse plug-in that allows engineers to leverage the power of SELinux when designing and implementing cross domain solutions without requiring that they have in depth knowledge of the complex details of underlying SELinux security policies. In particular the CDS Framework Toolkit provides the following benefits to CDS developers on SELinux systems: * An integrated development environment for creating security policy * Graphical editing of information flow for developing security policy * SELinux policy generation * Integration with SLIDE and Reference Policy (also available on http://oss.tresys.com) Version 3.0 highlights: * Support for Multi-Level Security (MLS), as well as the previously supported type enforcement and Role-Based Access Control (RBAC) mechanisms * Support for labeled networking to allow for inter-system interactions * Enhanced usability by providing better end user customization of generated SELinux policy and an increase in the granularity of what can be specified within the Framework * Addition of form editors to edit linkage files * Display of custom additions (linkage and dictionary files) in the framework navigator * Display of backflow information with ability to customize in dictionary * Ability to hide enters and entrypoints * Enhancements to the new resource wizard * Bug fixes including problems with nested control resources, accesses to base domains, dictionary problems Dave Sugar Tresys Technology, LLC

14 years, 10 months

1
0
0 / 0

Re: SELinux concerning /home symlink?

by Paul Howarth

max bianco wrote: > On Fri, Jul 25, 2008 at 8:18 PM, Paul Howarth <paul(a)city-fan.org> wrote: >> On Fri, 25 Jul 2008 21:54:51 +0000 (UTC) >> Mike <mike.cloaked(a)gmail.com> wrote: >> >>> Mike <mike.cloaked <at> gmail.com> writes: >>> >>>> Thanks everyone - I will try bind mounting this evening.... >>> I got the /home pointing to /opt/Local/home just fine - but ...now >>> doing mail: >>> >>> Having just been pretty pleased with myself for getting my system >>> running I now find a problem.... This question was also posted to >>> Fedora list. >>> >>> First I have my home directory bind mounted from /home >>> to /opt/Local/home with no problems, and I bind mount using an fstab >>> entry like /opt/Local/home /home ext3 bind 0 0 >>> >>> The context for /home is system_u:object_r:home_root_t:s0 >>> and for /opt/Local/home it is the same. >>> >>> The mount works fine during boot - so I tried the same with my mail. >>> >>> I have an fstab entry >>> /opt/Local/spool/mail /var/spool/mail ext3 bind 0 0 >>> >>> The context for /var/spool/mail is system_u:object_r:mail_spool_t:s0 >>> and for /opt/Local/spool/mail it is also the same. >>> >>> I can manually do >>> mount /var/spool/mail and the bind mount works fine. >>> >>> However on boot I get an avc denial, with kernel: type=1400 and >>> and avc: denied {mounton} .... comm="mount" path="/var/spool/mail" >>> dev=sda5 ino=419655 scontext=system_u:system_r:mount_t:so >>> tcontext=system_u:object_r:mail_spool_t:so class=dir >>> >>> I am not sure what to change to make this work? >> First temporarily unmount the bind mount: >> # umount /var/spool/mail >> >> Then change the context of the original /var/spool/mail to make it >> suitable for use as a mount point: >> # chcon -t mnt_t /var/spool/mail >> >> Mount at boot should now work. You can simulate this without actually >> rebooting by doing: >> # service netfs start >> >> Cheers, Paul. >> > Could I trouble you to be slightly more verbose so novices like myself > can get a better handle on the solution, because otherwise every > situation even remotely like this is going to get this solution > applied and this may not always be appropriate or suitable. Sure. The underlying problem is that "mount", when run confined by SELinux, is only allowed to mount filesystems on mount points that have specific context types, such as mnt_t. If you set up your partitioning at install time, the installer generally sets the context types of the directories to be used as mount points correctly. However, if you change your filesystem arrangement at a later date then the mount point directory you're using will probably have some other context type, such as mail_spool_t in this case, which mount isn't normally allowed to use as a mount point, and you get the AVC denials and failure to mount as a result. The fix is simply to label the mount point directory appropriately for a mount point. The other issue is why the original setup fails at boot time when it works just fine manually. The reason for this is that if you run "mount" manually, it runs unconfined (as do most programs, e.g. httpd) but if you run it from an initscript (as happens at boot time), the mount process transitions to the correct confined domain. So you get the denials at boot time but not when running "mount" manually. For this reason, I always now use "service netfs start" rather than "mount -a" after making changes to my filesystem layouts to check for SELinux issues. Hope that clears it up. Cheers, Paul.

14 years, 10 months

5
5
0 / 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2008