Re: Policy for Embedded Machine
by Spann, John W.
Do I have to be running the 2.6.28 kernel to have the ability to load
the dummy policy? This seems like the approach I would take, but we must
use the 2.6.27.14 kernel.
15 years, 1 month
pam_mkhomedirs
by Rob Crittenden
An IPA user reported this on our mailing list. He's getting SELinux
permission failures from pam_mkhomedirs when he's trying to log into a
machine for the first time as a user.
Is there an existing way to configure a system to handle this?
thanks
rob
15 years, 1 month
postfix trying to access /boot AVC
by Brian Chadwick
Hi,
This is happening after the last round of F10 updates involving postfix.
postfix-2.5.6-1.fc10.i386.rpm
selinux-policy-targeted-3.5.13-45.fc10.noarch.rpm
Summary:
SELinux is preventing smtpd (postfix_smtpd_t) "getattr" to /boot (boot_t).
Detailed Description:
[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]
SELinux denied access requested by smtpd. It is not expected that this
access is
required by smtpd and this access may signal an intrusion attempt. It is
also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to
restore
the default system file context for /boot,
restorecon -v '/boot'
If this does not work, there is currently no automatic way to allow this
access.
Instead, you can generate a local policy module to allow this access -
see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can
disable
SELinux protection altogether. Disabling SELinux protection is not
recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context system_u:system_r:postfix_smtpd_t:s0
Target Context system_u:object_r:boot_t:s0
Target Objects /boot [ dir ]
Source smtpd
Source Path /usr/libexec/postfix/smtpd
Port <Unknown>
Host admin.brianac.com.au
Source RPM Packages postfix-2.5.6-1.fc10
Target RPM Packages filesystem-2.4.19-1.fc10
Policy RPM selinux-policy-3.5.13-45.fc10
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall_file
Host Name admin.brianac.com.au
Platform Linux admin.brianac.com.au
2.6.27.15-170.2.24.fc10.i686.PAE #1 SMP
Wed Feb 11
23:35:37 EST 2009 i686 athlon
Alert Count 294
First Seen Thu 26 Feb 2009 20:46:08 EST
Last Seen Mon 02 Mar 2009 10:46:05 EST
Local ID cbf2bcef-ae64-4d65-bd35-e8226a7d35a1
Line Numbers
Raw Audit Messages
node=admin.brianac.com.au type=AVC msg=audit(1235954765.372:3918): avc:
denied { getattr } for pid=11567 comm="smtpd" path="/boot" dev=sda2
ino=2 scontext=system_u:system_r:postfix_smtpd_t:s0
tcontext=system_u:object_r:boot_t:s0 tclass=dir
node=admin.brianac.com.au type=SYSCALL msg=audit(1235954765.372:3918):
arch=40000003 syscall=195 success=yes exit=0 a0=bfe00176 a1=bfe0056c
a2=811ff4 a3=bfe0017c items=0 ppid=2421 pid=11567 auid=4294967295 uid=89
gid=89 euid=89 suid=89 fsuid=89 egid=89 sgid=89 fsgid=89 tty=(none)
ses=4294967295 comm="smtpd" exe="/usr/libexec/postfix/smtpd"
subj=system_u:system_r:postfix_smtpd_t:s0 key=(null)
15 years, 1 month
SELinux user login problem
by prakash hallalli
Hi All,
I have created myuser user and i created custom module for user.
i have followed same below steps.
#vi myuser.te
policy_module(myuser, 0.0.1)
role myuser_r;
userdom_unpriv_user_templete(myuser)
15 years, 1 month
Re: f10 vs selinux again.
by Dominick Grift
On Sat, 2009-02-28 at 15:32 -0500, Gene Heskett wrote:
> On Saturday 28 February 2009, Dominick Grift wrote:
> >On Sat, 2009-02-28 at 14:15 -0500, Gene Heskett wrote:
> >> On Saturday 28 February 2009, Dominick Grift wrote:
> >> >On Sat, 2009-02-28 at 12:53 -0500, Gene Heskett wrote:
> >> >> Greetings all;
> >> >>
> >> >> I have just upgraded then updated as much as possible, an F8
> >
> >install to
> >
> >> >> F10. selinux is now denying ConsoleKit and friends, and awstats.
> >
> >F10 will
> >
> >> >> run without console-kit-daemon I find, but I went so far as to
> >
> >touch
> >
> >> >> /.autorelabel & reboot & leave it to contemplate its sins for an
> >
> >hour or
> >
> >> >> so as there is nearly 2TB of drives here. Didn't help.
> >> >>
> >> >> So Now I have selinux disabled, and everything it working. Can
> >
> >this be
> >
> >> >> addressed?
> >> >
> >> >Can you show use the avc denials related to your issues? avc denials
> >
> >are
> >
> >> >sent to /var/log/audit/audit.log and can be retrieved with the
> >
> >ausearch
> >
> >> >command. For example use: ausearch -m avc -ts today, to retrieve
> >
> >today's
> >
> >> >avc denials.
> >>
> >> None today, I turned it off, yesterdays is attached.
> >>
> >> >You state that you updated as much as possible. What did you not
> >
> >update?
> >
> >> About 70 packages are left, all the java stuff cuz I've installed from
> >
> >Sun,
> >
> >> I've nuked fedora's firefox cuz I already had 3.0.6 (had to fix that
> >
> >up by
> >
> >> hand and some of the menus are still fubar) and anytime I do a -devel,
> >
> >it
> >
> >> barfs over strigi. What the heck does that thing do anywho?
> >>
> >> I also am not running the F10 kernel cuz I have to set stakes and call
> >
> >a
> >
> >> surveyer to measure screen scrolling speed, so I'm running 2.6.28.7
> >
> >and am
> >
> >> building the xorg drm and xf86-r6xx-r7xx-radeonhd trees. Now glxgears
> >
> >says
> >
> >> 275-300 fps and I can tolerate it. Anyway, from the yumex screen:
> >>
> >> 14:05:14 : Error in Dependency Resolution
> >> 14:05:14 : Missing Dependency: xine-lib(plugin-abi) = 1.25 is needed
> >
> >by
> >
> >> package xine-lib-extras-freeworld-1.1.16.2-1.fc10.i386
> >
> >(rpmfusion-free-
> >
> >> updates)
> >> Missing Dependency: kernel-uname-r = 2.6.27.15-170.2.24.fc10.i686 is
> >
> >needed by
> >
> >> package
> >
> >kmod-fglrx-2.6.27.15-170.2.24.fc10.i686-8.573-1.9.1.fc10.1.i686
> >
> >> (rpmfusion-nonfree-updates)
> >> Missing Dependency: strigi-libs = 0.5.11-1.fc10 is needed by package
> >
> >strigi-
> >
> >> devel-0.5.11-1.fc10.i386 (fedora)
> >>
> >> I might be able to get a list of updates (if you need them) not done
> >
> >from yum.
> >
> >> I use yumex most of the time.
> >>
> >> Thanks Dominick
> >
> >No that is fine, thanks. Which version of selinux-policy is currently
> >installed?
> >
> >I picked a few of the denials out of there and both were allowed in the
> >rawhide policy.
> >
> >This leads me to think that either you are running a old version of the
> >selinux-policy or that the fixes in rawhide policy have not been pushed
> >to Fedora 10 policy yet.
> >
> I'll go for the latter as there isn't an update available.
> [root@coyote Documents]# rpm -qa|grep policy
> checkpolicy-2.0.16-3.fc10.i386
> selinux-policy-3.5.13-18.fc10.noarch
> policycoreutils-2.0.57-11.fc10.i386
> policycoreutils-gui-2.0.57-11.fc10.i386
> selinux-policy-targeted-3.5.13-18.fc10.noarch
>
> >I either case you can create custom policies to allow these denials.
> >
> >A quick (and dirty) way is to "cat avc-denials.txt | audit2allow -M
> >mydenials; /usr/sbin/semodule -i mydenials.pp
>
> And that upchucks. It generates mydenials.pp, then:
> [root@coyote Documents]# /usr/sbin/semodule -i mydenials.pp
> libsepol.link_modules: Tried to link in a non-MLS module with an MLS base.
> libsemanage.semanage_link_sandbox: Link packages failed
> /usr/sbin/semodule: Failed!
>
> Looks like I may be missing something?
Can you give me to output of sestatus?
you could try /usr/sbin/semodule -s targeted -i mydenials.pp
You might also consider /usr/sbin/semodule -b base.pp (this should
replace the base module)
man semodule
This looks like something that could have gone wrong during the upgrade.
It claims that a MLS base module is installed but you have installed
selinux-policy-targeted
you should really c.c. fedora-selinux-list so that knowledgeable people
like dwalsh can give suggestions as well.
> >caution: i did not review all denials in your list, however most look
> >like they should be allowed.
> >
> >You should not let issues like these persuade you to disable SELinux.
> >You can also run SELinux is permissive mode which will act as an
> >intrusion detection system but will not prevent policy violations.
>
> I am not terribly paranoid about running selinux, Dominick, I have all my
> local network behind an x86 version of dd-wrt & its locked up pretty tight.
> selinux is last ditch. In 2 years, no one has gotten past dd-wrt that I
> didn't first give them the password to it. I see my running it as more of the
> playing of a role, that of the canary in the coal mine if you will.
>
> >hth , Dominick
>
>
15 years, 2 months
