selinux March 2009

selinux@lists.fedoraproject.org

29 participants
35 discussions

Rebooted, permissive, setroubleshooter going nuts.
by Gene Heskett 05 Mar '09

05 Mar '09

Greetings; And a portion of this lists archive on this box has gone missing to boot. So I can't look up the command to extract all these hits, about once every 2 minutes or so, to a logfile I can post. And when I click on the star, it tells me the connection has been lost to /var/run/setroubleshoot/setroubleshoot_server. But there is a zero length file there, generated when I rebooted to 2.6.29-rc7 5:18 ago WTH? And I just found a very short setroubleshooter.log which I will attach. It looks like it got a tummy ache just a few minutes ago. I think I will follow what I did with 29-rc7, and not build any sound modules for anything except the audigy2, cuz now I have sound, akonadi even starts! Help? -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Your motives for doing whatever good deed you may have in mind will be misinterpreted by somebody.

4 7

TCP server howto
by Jan Kasprzak 05 Mar '09

05 Mar '09

Hello, what is a recommended way of allowing a domain to act as a generic TCP server. I.e. to create a stream socket, bind(2) it to a single defined port with INADDR_ANY, listen(2) on it, accept(2) connections on it, and communicate (read/write/send*/recv*) on it. So far I am using audit2allow, and it has led me to the following setup (actual reading/writing not verified yet, more rules would probably be needed): allow $1 hi_reserved_port_t:tcp_socket name_bind; allow $1 inaddr_any_node_t:tcp_socket node_bind; allow $1 self:capability net_bind_service; However, I guess hi_reserver_port_t is not a _single_ port. I have seen the network_port() macro in corenetwork.if, but using network_port($1, tcp,654,s0); gives a syntax error. Is there any high-level macro for setting up a single port and allowing it to be bound, listened, read and written? [ my system is Fedora 10 with the targeted policy ] Thanks, -Yenya -- | Jan "Yenya" Kasprzak <kas at {fi.muni.cz - work | yenya.net - private}> | | GPG: ID 1024/D3498839 Fingerprint 0D99A7FB206605D7 8B35FCDE05B18A5E | | http://www.fi.muni.cz/~kas/ Journal: http://www.fi.muni.cz/~kas/blog/ | >> If you find yourself arguing with Alan Cox, you’re _probably_ wrong. << >> --James Morris in "How and Why You Should Become a Kernel Hacker" <<

4 5

dbus and kerneloops with selinux avc
by Antonio Olivares 05 Mar '09

05 Mar '09

Dear all, after applying the updates, I encountered the following avc courtesy of setroubleshooter: Summary: SELinux is preventing dbus-daemon-lau (system_dbusd_t) "execute" kerneloops_exec_t. Detailed Description: SELinux denied access requested by dbus-daemon-lau. It is not expected that this access is required by dbus-daemon-lau and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 Target Context system_u:object_r:kerneloops_exec_t:s0 Target Objects kerneloops [ file ] Source dbus-daemon-lau Source Path /lib/dbus-1/dbus-daemon-launch-helper Port <Unknown> Host riohigh Source RPM Packages dbus-1.2.4.4permissive-4.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.7-1.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name riohigh Platform Linux riohigh 2.6.29-0.197.rc7.fc11.i586 #1 SMP Tue Mar 3 23:01:11 EST 2009 i686 athlon Alert Count 1 First Seen Wed 04 Mar 2009 07:46:21 PM CST Last Seen Wed 04 Mar 2009 07:46:21 PM CST Local ID 71016152-e696-4ba1-af79-497748fd156b Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1236217581.391:21): avc: denied { execute } for pid=3241 comm="dbus-daemon-lau" name="kerneloops" dev=sda5 ino=8699 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:kerneloops_exec_t:s0 tclass=file node=riohigh type=SYSCALL msg=audit(1236217581.391:21): arch=40000003 syscall=11 success=no exit=-13 a0=9c95e20 a1=9c95de8 a2=9c95008 a3=9c98368 items=0 ppid=3240 pid=3241 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/lib/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null) Thanks, Antonio

2 1

Fedora 10 sendmail/smrsh denied
by Bob Richmond 03 Mar '09

03 Mar '09

Files in /etc/smrsh used to get a type of "etc_smrsh_t" that allowed files in there to be executed by smrsh on behalf of sendmail. That went away, and now sendmail can't execute mail processing programs under /etc/smrsh. Did the standard location for mail processing programs change?

1 0

avcs on rawhide new and old one
by Antonio Olivares 03 Mar '09

03 Mar '09

Summary: SELinux is preventing crontab (admin_crontab_t) "read write" unconfined_t. Detailed Description: SELinux denied access requested by crontab. It is not expected that this access is required by crontab and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0 .c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 023 Target Objects socket [ unix_stream_socket ] Source crontab Source Path /usr/bin/crontab Port <Unknown> Host riohigh Source RPM Packages cronie-1.2-6.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.6-8.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name riohigh Platform Linux riohigh 2.6.29-0.176.rc6.git5.fc11.i586 #1 SMP Sat Feb 28 20:51:15 EST 2009 i686 athlon Alert Count 16 First Seen Mon 02 Mar 2009 07:11:37 PM CST Last Seen Mon 02 Mar 2009 07:11:39 PM CST Local ID 3883b140-4d39-40f5-9262-ce2c4c4e2e16 Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1236042699.560:325): avc: denied { read write } for pid=7023 comm="crontab" path="socket:[15740]" dev=sockfs ino=15740 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1236042699.560:325): avc: denied { read write } for pid=7023 comm="crontab" path="socket:[15509]" dev=sockfs ino=15509 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1236042699.560:325): avc: denied { read write } for pid=7023 comm="crontab" path="socket:[15509]" dev=sockfs ino=15509 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1236042699.560:325): avc: denied { read write } for pid=7023 comm="crontab" path="socket:[15509]" dev=sockfs ino=15509 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1236042699.560:325): avc: denied { read write } for pid=7023 comm="crontab" path="socket:[15509]" dev=sockfs ino=15509 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1236042699.560:325): avc: denied { read write } for pid=7023 comm="crontab" path="socket:[15509]" dev=sockfs ino=15509 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1236042699.560:325): avc: denied { read write } for pid=7023 comm="crontab" path="socket:[15509]" dev=sockfs ino=15509 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=AVC msg=audit(1236042699.560:325): avc: denied { read write } for pid=7023 comm="crontab" path="socket:[15509]" dev=sockfs ino=15509 scontext=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket node=riohigh type=SYSCALL msg=audit(1236042699.560:325): arch=40000003 syscall=11 success=yes exit=0 a0=9756cc8 a1=9765140 a2=9750a18 a3=9765140 items=0 ppid=6988 pid=7023 auid=500 uid=500 gid=500 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=1 comm="crontab" exe="/usr/bin/crontab" subj=unconfined_u:unconfined_r:admin_crontab_t:s0-s0:c0.c1023 key=(null) Summary: SELinux prevented kde4-config from writing .kde. Detailed Description: SELinux prevented kde4-config from writing .kde. If .kde is a core file, you may want to allow this. If .kde is not a core file, this could signal a intrusion attempt. Allowing Access: Changing the "allow_daemons_dump_core" boolean to true will allow this access: "setsebool -P allow_daemons_dump_core=1." Fix Command: setsebool -P allow_daemons_dump_core=1 Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:root_t:s0 Target Objects .kde [ dir ] Source kde4-config Source Path /usr/bin/kde4-config Port <Unknown> Host riohigh Source RPM Packages kdelibs-4.2.1-1.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.6-8.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_daemons_dump_core Host Name riohigh Platform Linux riohigh 2.6.29-0.176.rc6.git5.fc11.i586 #1 SMP Sat Feb 28 20:51:15 EST 2009 i686 athlon Alert Count 16 First Seen Tue 17 Feb 2009 08:36:03 AM CST Last Seen Mon 02 Mar 2009 03:49:11 PM CST Local ID 6d47417b-4b4b-4c4f-9c12-6210059fc418 Line Numbers Raw Audit Messages node=riohigh type=AVC msg=audit(1236030551.278:7): avc: denied { create } for pid=2361 comm="kde4-config" name=".kde" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir node=riohigh type=SYSCALL msg=audit(1236030551.278:7): arch=40000003 syscall=39 success=no exit=-13 a0=9e843f8 a1=1c0 a2=60cf8c a3=0 items=0 ppid=2360 pid=2361 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kde4-config" exe="/usr/bin/kde4-config" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Thanks, Antonio

2 1

Re: Policy for Embedded Machine
by Spann, John W. 03 Mar '09

03 Mar '09

Do I have to be running the 2.6.28 kernel to have the ability to load the dummy policy? This seems like the approach I would take, but we must use the 2.6.27.14 kernel.

2 1

pam_mkhomedirs
by Rob Crittenden 02 Mar '09

02 Mar '09

An IPA user reported this on our mailing list. He's getting SELinux permission failures from pam_mkhomedirs when he's trying to log into a machine for the first time as a user. Is there an existing way to configure a system to handle this? thanks rob

2 1

postfix trying to access /boot AVC
by Brian Chadwick 02 Mar '09

02 Mar '09

Hi, This is happening after the last round of F10 updates involving postfix. postfix-2.5.6-1.fc10.i386.rpm selinux-policy-targeted-3.5.13-45.fc10.noarch.rpm Summary: SELinux is preventing smtpd (postfix_smtpd_t) "getattr" to /boot (boot_t). Detailed Description: [SELinux is in permissive mode, the operation would have been denied but was permitted due to permissive mode.] SELinux denied access requested by smtpd. It is not expected that this access is required by smtpd and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: Sometimes labeling problems can cause SELinux denials. You could try to restore the default system file context for /boot, restorecon -v '/boot' If this does not work, there is currently no automatic way to allow this access. Instead, you can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:postfix_smtpd_t:s0 Target Context system_u:object_r:boot_t:s0 Target Objects /boot [ dir ] Source smtpd Source Path /usr/libexec/postfix/smtpd Port <Unknown> Host admin.brianac.com.au Source RPM Packages postfix-2.5.6-1.fc10 Target RPM Packages filesystem-2.4.19-1.fc10 Policy RPM selinux-policy-3.5.13-45.fc10 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Permissive Plugin Name catchall_file Host Name admin.brianac.com.au Platform Linux admin.brianac.com.au 2.6.27.15-170.2.24.fc10.i686.PAE #1 SMP Wed Feb 11 23:35:37 EST 2009 i686 athlon Alert Count 294 First Seen Thu 26 Feb 2009 20:46:08 EST Last Seen Mon 02 Mar 2009 10:46:05 EST Local ID cbf2bcef-ae64-4d65-bd35-e8226a7d35a1 Line Numbers Raw Audit Messages node=admin.brianac.com.au type=AVC msg=audit(1235954765.372:3918): avc: denied { getattr } for pid=11567 comm="smtpd" path="/boot" dev=sda2 ino=2 scontext=system_u:system_r:postfix_smtpd_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=dir node=admin.brianac.com.au type=SYSCALL msg=audit(1235954765.372:3918): arch=40000003 syscall=195 success=yes exit=0 a0=bfe00176 a1=bfe0056c a2=811ff4 a3=bfe0017c items=0 ppid=2421 pid=11567 auid=4294967295 uid=89 gid=89 euid=89 suid=89 fsuid=89 egid=89 sgid=89 fsgid=89 tty=(none) ses=4294967295 comm="smtpd" exe="/usr/libexec/postfix/smtpd" subj=system_u:system_r:postfix_smtpd_t:s0 key=(null)

3 2

SELinux user login problem
by prakash hallalli 02 Mar '09

02 Mar '09

Hi All, I have created myuser user and i created custom module for user. i have followed same below steps. #vi myuser.te policy_module(myuser, 0.0.1) role myuser_r; userdom_unpriv_user_templete(myuser)

3 10

Re: f10 vs selinux again.
by Dominick Grift 01 Mar '09

01 Mar '09

On Sat, 2009-02-28 at 15:32 -0500, Gene Heskett wrote: > On Saturday 28 February 2009, Dominick Grift wrote: > >On Sat, 2009-02-28 at 14:15 -0500, Gene Heskett wrote: > >> On Saturday 28 February 2009, Dominick Grift wrote: > >> >On Sat, 2009-02-28 at 12:53 -0500, Gene Heskett wrote: > >> >> Greetings all; > >> >> > >> >> I have just upgraded then updated as much as possible, an F8 > > > >install to > > > >> >> F10. selinux is now denying ConsoleKit and friends, and awstats. > > > >F10 will > > > >> >> run without console-kit-daemon I find, but I went so far as to > > > >touch > > > >> >> /.autorelabel & reboot & leave it to contemplate its sins for an > > > >hour or > > > >> >> so as there is nearly 2TB of drives here. Didn't help. > >> >> > >> >> So Now I have selinux disabled, and everything it working. Can > > > >this be > > > >> >> addressed? > >> > > >> >Can you show use the avc denials related to your issues? avc denials > > > >are > > > >> >sent to /var/log/audit/audit.log and can be retrieved with the > > > >ausearch > > > >> >command. For example use: ausearch -m avc -ts today, to retrieve > > > >today's > > > >> >avc denials. > >> > >> None today, I turned it off, yesterdays is attached. > >> > >> >You state that you updated as much as possible. What did you not > > > >update? > > > >> About 70 packages are left, all the java stuff cuz I've installed from > > > >Sun, > > > >> I've nuked fedora's firefox cuz I already had 3.0.6 (had to fix that > > > >up by > > > >> hand and some of the menus are still fubar) and anytime I do a -devel, > > > >it > > > >> barfs over strigi. What the heck does that thing do anywho? > >> > >> I also am not running the F10 kernel cuz I have to set stakes and call > > > >a > > > >> surveyer to measure screen scrolling speed, so I'm running 2.6.28.7 > > > >and am > > > >> building the xorg drm and xf86-r6xx-r7xx-radeonhd trees. Now glxgears > > > >says > > > >> 275-300 fps and I can tolerate it. Anyway, from the yumex screen: > >> > >> 14:05:14 : Error in Dependency Resolution > >> 14:05:14 : Missing Dependency: xine-lib(plugin-abi) = 1.25 is needed > > > >by > > > >> package xine-lib-extras-freeworld-1.1.16.2-1.fc10.i386 > > > >(rpmfusion-free- > > > >> updates) > >> Missing Dependency: kernel-uname-r = 2.6.27.15-170.2.24.fc10.i686 is > > > >needed by > > > >> package > > > >kmod-fglrx-2.6.27.15-170.2.24.fc10.i686-8.573-1.9.1.fc10.1.i686 > > > >> (rpmfusion-nonfree-updates) > >> Missing Dependency: strigi-libs = 0.5.11-1.fc10 is needed by package > > > >strigi- > > > >> devel-0.5.11-1.fc10.i386 (fedora) > >> > >> I might be able to get a list of updates (if you need them) not done > > > >from yum. > > > >> I use yumex most of the time. > >> > >> Thanks Dominick > > > >No that is fine, thanks. Which version of selinux-policy is currently > >installed? > > > >I picked a few of the denials out of there and both were allowed in the > >rawhide policy. > > > >This leads me to think that either you are running a old version of the > >selinux-policy or that the fixes in rawhide policy have not been pushed > >to Fedora 10 policy yet. > > > I'll go for the latter as there isn't an update available. > [root@coyote Documents]# rpm -qa|grep policy > checkpolicy-2.0.16-3.fc10.i386 > selinux-policy-3.5.13-18.fc10.noarch > policycoreutils-2.0.57-11.fc10.i386 > policycoreutils-gui-2.0.57-11.fc10.i386 > selinux-policy-targeted-3.5.13-18.fc10.noarch > > >I either case you can create custom policies to allow these denials. > > > >A quick (and dirty) way is to "cat avc-denials.txt | audit2allow -M > >mydenials; /usr/sbin/semodule -i mydenials.pp > > And that upchucks. It generates mydenials.pp, then: > [root@coyote Documents]# /usr/sbin/semodule -i mydenials.pp > libsepol.link_modules: Tried to link in a non-MLS module with an MLS base. > libsemanage.semanage_link_sandbox: Link packages failed > /usr/sbin/semodule: Failed! > > Looks like I may be missing something? Can you give me to output of sestatus? you could try /usr/sbin/semodule -s targeted -i mydenials.pp You might also consider /usr/sbin/semodule -b base.pp (this should replace the base module) man semodule This looks like something that could have gone wrong during the upgrade. It claims that a MLS base module is installed but you have installed selinux-policy-targeted you should really c.c. fedora-selinux-list so that knowledgeable people like dwalsh can give suggestions as well. > >caution: i did not review all denials in your list, however most look > >like they should be allowed. > > > >You should not let issues like these persuade you to disable SELinux. > >You can also run SELinux is permissive mode which will act as an > >intrusion detection system but will not prevent policy violations. > > I am not terribly paranoid about running selinux, Dominick, I have all my > local network behind an x86 version of dd-wrt & its locked up pretty tight. > selinux is last ditch. In 2 years, no one has gotten past dd-wrt that I > didn't first give them the password to it. I see my running it as more of the > playing of a role, that of the canary in the coal mine if you will. > > >hth , Dominick > >

3 10

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux March 2009