selinux February 2009

selinux@lists.fedoraproject.org

43 participants
57 discussions

MySQL-5.1.31 / mysql-server-community
by Per Sjoholm 23 Feb '09

23 Feb '09

I installed MySQL-server-5.1.31-0.glibc23.i386.rpm MySQL-client-5.1.31-0.glibc23.i386.rpm MySQL-shared-compat-5.1.31-0.glibc23.i386.rpm MySQL-devel-5.1.31-0.glibc23.i386.rpm on Fedora 9 There are some selinux issues, does anyone have a working policy ?

1 0

samba nmbd (nmbd_t) "read" to smb.ASEN20.alias (samba_etc_t)
by Per Sjoholm 22 Feb '09

22 Feb '09

On CentOS 5.2 The server is answering on different netbios names. SELinux is preventing nmbd (nmbd_t) "read" to smb.ASEN20.alias (samba_etc_t) in smb.conf the include files is in 2 halves. One for global config and one for shares/aliases I have include = /etc/samba/smb.%L.alias to get differnt shares/alias depending netbios name the alias contains [name] ... [name2] ... I link asen20 to ASEN20 to allow netbios name # ls -Z /etc/samba/smb* -r--r--r-- root root root:object_r:samba_etc_t /etc/samba/smb.asen20.alias lrwxrwxrwx root root root:object_r:samba_etc_t /etc/samba/smb.ASEN20.alias -> smb.asen20.alias /var/log/message Feb 22 11:18:29 dox nmbd[4689]: become_domain_master_browser_bcast: querying subnet 192.168.1.6 for domain master browser on workgroup OASEN Feb 22 11:18:31 dox setroubleshoot: SELinux is preventing the samba daemon from serving r/o local files to remote clients. For complete SELinux messages. run sealert -l 55450fa9-b52d-4224-ad52-58b0b9fc4b76 Feb 22 11:18:31 dox last message repeated 2 times Feb 22 11:18:31 dox setroubleshoot: SELinux is preventing nmbd (nmbd_t) "read" to smb.ASEN20.alias (samba_etc_t). For complete SELinux messages. run sealert -l 350c8d95-e127-4a23-b2a1-455771106aeb setting setsebool -P samba_export_all_ro=1 as advised in sealert -l 55450fa9-b52d-4224-ad52-58b0b9fc4b76 does not help # sealert -l 55450fa9-b52d-4224-ad52-58b0b9fc4b76 Summary: SELinux is preventing the samba daemon from serving r/o local files to remote clients. Detailed Description: SELinux has preventing the samba daemon (smbd) from reading files on the local system. If you have not exported these file systems, this could signals an intrusion. Allowing Access: If you want to export file systems using samba you need to turn on the samba_export_all_ro boolean: "setsebool -P samba_export_all_ro=1". The following command will allow this access: setsebool -P samba_export_all_ro=1 Additional Information: Source Context root:system_r:smbd_t Target Context root:object_r:samba_etc_t Target Objects smb.ASEN20.alias [ lnk_file ] Source smbd Source Path /usr/sbin/smbd Port <Unknown> Host dox.oasen.dyndns.org Source RPM Packages samba-3.0.28-1.el5_2.1 Target RPM Packages Policy RPM selinux-policy-2.4.6-137.1.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name samba_export_all_ro Host Name dox.oasen.dyndns.org Platform Linux dox.oasen.dyndns.org 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count 6 First Seen Sun Feb 22 11:01:48 2009 Last Seen Sun Feb 22 11:18:29 2009 Local ID 55450fa9-b52d-4224-ad52-58b0b9fc4b76 Line Numbers Raw Audit Messages host=dox.oasen.dyndns.org type=AVC msg=audit(1235297909.562:32001): avc: denied { read } for pid=4685 comm="smbd" name="smb.ASEN20.alias" dev=sdc3 ino=2247782 scontext=root:system_r:smbd_t:s0 tcontext=root:object_r:samba_etc_t:s0 tclass=lnk_file host=dox.oasen.dyndns.org type=SYSCALL msg=audit(1235297909.562:32001): arch=c000003e syscall=4 success=no exit=-13 a0=7fffa6dcac10 a1=7fffa6dcab60 a2=7fffa6dcab60 a3=2b560ee731f0 items=0 ppid=4684 pid=4685 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5386 comm="smbd" exe="/usr/sbin/smbd" subj=root:system_r:smbd_t:s0 key=(null) # sealert -l 350c8d95-e127-4a23-b2a1-455771106aeb Summary: SELinux is preventing nmbd (nmbd_t) "read" to smb.ASEN20.alias (samba_etc_t). Detailed Description: SELinux denied access requested by nmbd. It is not expected that this access is required by nmbd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for smb.ASEN20.alias, restorecon -v 'smb.ASEN20.alias' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context root:system_r:nmbd_t Target Context root:object_r:samba_etc_t Target Objects smb.ASEN20.alias [ lnk_file ] Source nmbd Source Path /usr/sbin/nmbd Port <Unknown> Host dox.oasen.dyndns.org Source RPM Packages samba-3.0.28-1.el5_2.1 Target RPM Packages Policy RPM selinux-policy-2.4.6-137.1.el5 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name dox.oasen.dyndns.org Platform Linux dox.oasen.dyndns.org 2.6.18-92.1.22.el5 #1 SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64 Alert Count 6 First Seen Sun Feb 22 11:01:48 2009 Last Seen Sun Feb 22 11:18:29 2009 Local ID 350c8d95-e127-4a23-b2a1-455771106aeb Line Numbers Raw Audit Messages host=dox.oasen.dyndns.org type=AVC msg=audit(1235297909.628:32004): avc: denied { read } for pid=4688 comm="nmbd" name="smb.ASEN20.alias" dev=sdc3 ino=2247782 scontext=root:system_r:nmbd_t:s0 tcontext=root:object_r:samba_etc_t:s0 tclass=lnk_file host=dox.oasen.dyndns.org type=SYSCALL msg=audit(1235297909.628:32004): arch=c000003e syscall=4 success=no exit=-13 a0=7fffca8af300 a1=7fffca8af250 a2=7fffca8af250 a3=0 items=0 ppid=4687 pid=4688 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts6 ses=5386 comm="nmbd" exe="/usr/sbin/nmbd" subj=root:system_r:nmbd_t:s0 key=(null)

2 1

VMware Server blocked but no AVCs
by Arthur Dent 21 Feb '09

21 Feb '09

Hello all, I use VMware Server on my F9 box for running other OSs in a virtualised environment. I used to use the VMware-server-1.0.* range, but recently upgraded to VMware-server-2.0.0. This version has a strange web interface rather than operating as an individual application as before. The interface loads and presents a log-on screen. It fails here with any attempt to log in to the server met with the error: "The server is not responding. Please check that the server is running and accepting connections." The strange thing is: There are *NO* AVCs It does NOT work in permissive mode It DOES work when selinux is *disabled* It also causes the system to hang when shutting down the PC. Does anyone know of a workaround or fix, or do I need to revert to v. 1.0.7 ? Thanks in advance Mark

3 2

Policy for Embedded Machine
by Spann, John W. 20 Feb '09

20 Feb '09

All, I am working with a 2.6.27.14 kernel on an embedded PowerPC 440 board. Aside from the operating system and some drivers and libraries, there will be a few custom applications written which I will need to write policy for. I am looking for the best policy writing approach for the environment. Seems like I could take the latest policy distributed with Fedora and start ripping out stuff or start with nothing and build up. Not having written much policy yet, I am seeking advice on the best approach. I also have read about SELinux Policy Editor (SEEdit) and wonder if this might be a good approach for a new policy writer. Thoughts... SpannMan

2 1

Rawhide Cant' update crontab using gnome-schedule.
by Frank Murphy 20 Feb '09

20 Feb '09

Gnome-Schedule opens, but cannot update any tasks. ~/audit/.log doesn't show any specific denials. Hpappens as pure root, (sudo, su) user sudo gnome-schedule Access denied by SELinux, must be privileged to use -u

2 2

Getting a LOT of "hotplug_t" errors.
by Dan Thurman 19 Feb '09

19 Feb '09

It seems, that these are appearing whenever I am downloading files from an F9/10 NTFS samba shared file to a remote machine. Is there anything I can do? ==================================================================== Count Description ==================================================================== 636 SELinux is preventing pidof (hotplug_t) "sys_nice" hotplug_t. ================= Raw Audit Messages node=gold.cdkkt.com type=AVC msg=audit(1235083401.426:52788): avc: denied { sys_nice } for pid=30760 comm="pidof" capability=23 scontext=system_u:system_r:hotplug_t:s0 tcontext=system_u:system_r:hotplug_t:s0 tclass=capability node=gold.cdkkt.com type=SYSCALL msg=audit(1235083401.426:52788): arch=40000003 syscall=3 success=yes exit=203 a0=4 a1=b800e000 a2=400 a3=8177628 items=0 ppid=30725 pid=30760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pidof" exe="/sbin/killall5" subj=system_u:system_r:hotplug_t:s0 key=(null) ==================================================================== Count Description ==================================================================== 636 SELinux is preventing pidof (hotplug_t) "sys_ptrace" hotplug_t. ================= Raw Audit Messages node=gold.cdkkt.com type=AVC msg=audit(1235083401.426:52789): avc: denied { sys_ptrace } for pid=30760 comm="pidof" capability=19 scontext=system_u:system_r:hotplug_t:s0 tcontext=system_u:system_r:hotplug_t:s0 tclass=capability node=gold.cdkkt.com type=SYSCALL msg=audit(1235083401.426:52789): arch=40000003 syscall=85 success=no exit=-13 a0=bfc0dcb8 a1=81777b8 a2=1000 a3=bfc0dbbe items=0 ppid=30725 pid=30760 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pidof" exe="/sbin/killall5" subj=system_u:system_r:hotplug_t:s0 key=(null) ==================================================================== Count Description ==================================================================== 212 SELinux is preventing ifdown-ipv6 (hotplug_t) "read" to net (proc_net_t). ================= Raw Audit Messages node=gold.cdkkt.com type=AVC msg=audit(1235083401.406:52783): avc: denied { read } for pid=30748 comm="ifdown-ipv6" name="net" dev=proc ino=4026531869 scontext=system_u:system_r:hotplug_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=lnk_file node=gold.cdkkt.com type=SYSCALL msg=audit(1235083401.406:52783): arch=40000003 syscall=195 success=no exit=-13 a0=865d3b0 a1=bfa834d0 a2=67fff4 a3=865d3b0 items=0 ppid=30725 pid=30748 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="ifdown-ipv6" exe="/bin/bash" subj=system_u:system_r:hotplug_t:s0 key=(null) Thanks, Dan

1 1

network-scripts problem
by Antonio Olivares 19 Feb '09

19 Feb '09

Dear fellow testers, I encountered network functions/network-scripts problem :( [root@localhost ~]# dhclient eth0 Missing /etc/sysconfig/network-scripts/network-functions, exiting. Missing /etc/sysconfig/network-scripts/network-functions, exiting. Missing /etc/sysconfig/network-scripts/network-functions, exiting. ^C [root@localhost ~]# restorecon -v 'network-scripts' restorecon: stat error on network-scripts: No such file or directory [root@localhost ~]# restorecon -v network-scripts restorecon: stat error on network-scripts: No such file or directory [root@localhost ~]# dhclient eth0 Missing /etc/sysconfig/network-scripts/network-functions, exiting. ^C You have new mail in /var/spool/mail/root [root@localhost ~]# service network status Configured devices: lo eth0 eth1 Currently active devices: lo eth1 eth0 [root@localhost ~]# service network restart Shutting down interface eth0: [ OK ] Shutting down interface eth1: [ OK ] Shutting down loopback interface: [ OK ] Disabling IPv4 packet forwarding: net.ipv4.ip_forward = 0 [ OK ] Bringing up loopback interface: [ OK ] Bringing up interface eth0: Determining IP information for eth0...Missing /etc/sysconfig/network-scripts/network-functions, exiting. ^C Got also greeted by selinux alert: Summary: SELinux is preventing dhclient-script (dhcpc_t) "search" to network-scripts (net_conf_t). Detailed Description: SELinux denied access requested by dhclient-script. It is not expected that this access is required by dhclient-script and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for network-scripts, restorecon -v 'network-scripts' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:dhcpc_t:SystemLow-SystemHigh Target Context system_u:object_r:net_conf_t Target Objects network-scripts [ dir ] Source dhclient-script Source Path /bin/bash Port <Unknown> Host localhost Source RPM Packages bash-4.0-0.4.rc1.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.6-1.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name localhost Platform Linux localhost 2.6.29-0.124.rc5.fc11.i586 #1 SMP Mon Feb 16 21:15:37 EST 2009 i686 athlon Alert Count 3 First Seen Tue 17 Feb 2009 09:32:55 AM CST Last Seen Tue 17 Feb 2009 09:33:55 AM CST Local ID 878e2548-4687-45f0-8115-d40144370614 Line Numbers Raw Audit Messages node=localhost type=AVC msg=audit(1234884835.408:131): avc: denied { search } for pid=11969 comm="dhclient-script" name="network-scripts" dev=dm-0 ino=28344324 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir node=localhost type=SYSCALL msg=audit(1234884835.408:131): arch=40000003 syscall=195 success=no exit=-13 a0=8463100 a1=bfb25c2c a2=b45ff4 a3=8463102 items=0 ppid=11968 pid=11969 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="dhclient-script" exe="/bin/bash" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) I applied it, but did not work :( restorecon -v 'network-scripts' Regards, Antonio

2 2

SELinux doesn't understand sendmail<->spamassassin interactions
by G.Wolfe Woodbury 19 Feb '09

19 Feb '09

Similar to the mailman problem, SELinux doesn't understand the interactions between sendmail and spamassassin. In this case, however, the spamassassin stuff quits working completely. This installation of spamassassin uses the "spamc" daemon, and mails are passed to that daemon from user's .procmailrc files. (This allows the user to opt-in/opt-out of spam detection on their own by altering their own .procmailrc file.) SELinux complains a lot because every message passwd from the user delivery chain gets a denial because "sendmail" (actually procmail) has no permissions to write the spamassassin spamc socket: type=AVC msg=audit(1234094494.975:3163): avc: denied { read write } for pid=612 comm="spamc" path="socket:[2166561]" dev=sockfs ino=2166561 scontext=system_u:system_r:spamc_t:s0 context=system_u:system_r:sendmail_t:s0 tclass=unix_stream_socket I don't fully understand some of the concepts used in SELinux, and am running F10+updates in "permissive" mode so that things work but I get notified of "abnormal" events. Additionally, other aspects of the sendmail/spamassassin interaction attract SELinux complaints. (getattr of spamc socket, etc) but I geet thousands of complaints about the read/write of the spamc socket. (about 8 active e-mail accounts, several of which are spam traps.) Thanks for your attention and patience. -- G.Wolfe Woodbury

2 3

Suitable type for DNSSEC private keys
by Göran Uddeborg 18 Feb '09

18 Feb '09

I'm upgrading my DNS system to DNSSEC, and now I have public and private key files in /var/named. They of course got the type named_zone_t which is the default in that directory. For the public keys, that is appropriate. The DNS server needs to read them, and they do contain zone data. But it should not be able to read the private keys, and it can not because of MAC. It seemed prudent to me to also give them another type, just in case. But what type would be appropriate? Just something generic like etc_t? Or does it exist some more specific type that would be more appropriate. I wasn't planning to add any extra policy modules or types just for this, only to add a fcontext pattern for these files. Does anybody have any good suggestions?

3 7

Rawhide: SELinux is preventing dhclient-script (dhcpc_t) "getattr"
by Frank Murphy 18 Feb '09

18 Feb '09

Summary: SELinux is preventing dhclient-script (dhcpc_t) "getattr" to /etc/sysconfig/network-scripts (net_conf_t). Detailed Description: SELinux denied access requested by dhclient-script. It is not expected that this access is required by dhclient-script and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /etc/sysconfig/network-scripts, restorecon -v '/etc/sysconfig/network-scripts' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 Target Context system_u:object_r:net_conf_t:s0 Target Objects /etc/sysconfig/network-scripts [ dir ] Source dhclient-script Source Path /bin/bash Port <Unknown> Host torrent01.frankly3d.local Source RPM Packages bash-4.0-0.4.rc1.fc11 Target RPM Packages initscripts-8.89-1 Policy RPM selinux-policy-3.6.6-1.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall_file Host Name torrent01.frankly3d.local Platform Linux torrent01.frankly3d.local 2.6.29-0.124.rc5.fc11.i586 #1 SMP Mon Feb 16 21:15:37 EST 2009 i686 i686 Alert Count 22 First Seen Wed 18 Feb 2009 18:27:50 GMT Last Seen Wed 18 Feb 2009 18:28:10 GMT Local ID b0b1e5b5-49b2-4163-8d84-e7f08502aacb Line Numbers Raw Audit Messages node=torrent01.frankly3d.local type=AVC msg=audit(1234981690.326:167): avc: denied { getattr } for pid=31049 comm="dhclient-script" path="/etc/sysconfig/network-scripts" dev=dm-3 ino=54 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir node=torrent01.frankly3d.local type=SYSCALL msg=audit(1234981690.326:167): arch=40000003 syscall=195 success=no exit=-13 a0=80e653b a1=bfcb8e2c a2=6dfff4 a3=8a147e8 items=0 ppid=31032 pid=31049 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="dhclient-script" exe="/bin/bash" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) ------------------ I have run an audit2allow against this. But figured I should post anyway. -- aMSN: Frankly3D

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux February 2009