July 2009 - selinux - Fedora mailing-lists

Memory protection and system-config-securitylevel
by Kamil J. Dudek 28 Sep '09

28 Sep '09

Hello everybody Forgive me, if this subject has already been mentioned here, but I simply couldn't find answer anywhere. Few days ago I started system-config-securitylevel. I found something interesting in "Modify SELinux policies". A memory protection - there are four options in there. Two of them are enabled, with a description that if having this enabled is required by some program, it should be reported to bugzilla. I didn't do it, because of very strange effects after turning it off. Disabling "Allow all executable files to map memory areas as executable and readable, which is dangerous and such program should be reported to bugzilla" and "Allow all executable files to mark stack as executable.That shouldn't ever be required" option(translation from polish) made system act very strange. First thing I've observed was that Kobo game stopped working. GMPC stopped playing. Also stuff outside of Fedora like Java and NVidia drivers failed. So I should have "reported to bugzilla" to many application to make it have any sense. Such bug report would be only annoying but according to system-config-securitylevel... What is it with these two options? To make everything work properly they should be enabled, but their description that they should be disabled is confusing. Thank you and forgive me any mess I've done by this post -- Pozdrawiam - Kamil J. Dudek

2 3

mount point labels
by Clarkson, Mike R (US SSA) 14 Sep '09

14 Sep '09

I'm attempting to create the labeled mount point with the following command: mount -t nfs -o context=system_u:object_r:import_file_t:s0 nas:/vol/home /home/SimulatedImport/output/home The mount point is created without any errors, but the label that I specify in the mount command is not used. Instead of system_u:object_r:import_file_t, the context of the /home/SimulatedImport/output/home is system_u:object_r:nfs_t:s0. ls -dZ /home/SimulatedImport/output/home drwxr-xr-x root root system_u:object_r:nfs_t:s0 /home/m252/SimulatedImport/output/home I'm running RHEL5 with a policy built as mls off of the targeted policy. Does anyone know why the context label is not taking? Thanks

3 7

add a transition rule
by Vadym Chepkov 03 Aug '09

03 Aug '09

Hi, I have a script, executed by apache, which is running in httpd_svn_script_t domain. This script calls svn-mailer(bin_t) which in turns calls /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined, sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What would be the proper rule to add to the local policy to make sendmail running in the proper domain, sendmail_t? And for that matter if httpd_can_sendmail --> on, shouldn't it be happening automatically? Thank you. Sincerely yours, Vadym Chepkov

4 5

ausearch and terminal
by Vadym Chepkov 03 Aug '09

03 Aug '09

Hi, I observe a very strange behavior of the ausearch utility. audit-1.7.7-6.el5_3.3 # cat /root/bin/autest.sh /sbin/ausearch -m avc| wc -l If I run it, I get expected results: # /root/bin/autest.sh 1563 But if I run it from cron, I get this in e-mail: <no matches> 0 Why?? Sincerely yours, Vadym Chepkov

2 3

Help with SELinux Policy for Usability Study
by Cliffe 30 Jul '09

30 Jul '09

Dear SELinux Gurus, I am a PhD candidate conducting research into the usability of security mechanisms. I would really appreciate some help regarding the use of SELinux. Let me know if this is not the right place to be asking these types of questions. I generated a policy for opera using polgengui. I then ran the generated ./opera.sh. Although SELinux was still set to enforcing mode opera seemed to run unconfined. The executable and process was labelled as expected (unconfined_u:unconfined_r:opera_t). AVCs were generated, but not enforced. I added to opera.te using grep opera /var/log/audit/audit.log | audit2allow >> opera.te and reran ./opera.sh until no AVCs were generated. Looking at opera.te I noticed the line "permissive opera_t", and not knowing exactly what this line does, I thought it may be placing this domain into permissive mode (although the gui tools suggest otherwise). Removing the line causes "/bin/sh: /usr/bin/opera: Permission denied". No AVCs are generated. So I am not sure why opera seams to be unconfined, or if removing the permissive line was on the right track. Any advice? Also I tried creating a policy for kwrite. This time the created policy seemed to be in effect as soon as I ran the kwrite.sh script. I set setenforce 0 and added to kwrite.te (as above for opera) until no error msgs were generated. Then I reran ./kwrite.sh. Now kwrite exists with "kwrite(2533): Couldn't register name '"org.kate-editor.kwrite-2533'" with DBUS -- another process owns it already!". When setenforce 0 it runs without AVCs. Again I am sure I am missing something simple and your advice will help a lot. I need to resolve this asap and will really appreciate any advice. Soon I will be running a comparative study comparing a number of security mechanisms and I need to sort this out. Thank you, Cliffe.

4 5

Selinux Audit "Unmatched Entries"?
by Frank Murphy 30 Jul '09

30 Jul '09

Waht does all this mean from logwatch, What are in plain speak unmatched entries? --------------------- Selinux Audit Begin ------------------------ Number of audit daemon starts: 5 Number of audit daemon stops: 6 **Unmatched Entries** audit(1248863231.539:55834): auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 op=remove rule key=(null) list=2 res=1 audit(1248863231.539:55835): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 res=1 audit(1248865986.300:28653): auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 op=remove rule key=(null) list=2 res=1 audit(1248865986.300:28654): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 res=1 audit(1248867118.172:28695): auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 op=remove rule key=(null) list=2 res=1 audit(1248867118.172:28696): audit_enabled=0 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:readahead_t:s0 res=1 config change requested by pid=9598 auid=500 subj=unconfined_u:system_r:initrc_t:s0 audit(1248871767.418:3339) config changed, auid=500 pid=9598 subj=unconfined_u:system_r:initrc_t:s0 res=success ---------------------- Selinux Audit End ------------------------- -- Regards, Frank jabber | msn | skype: frankly3d http://www.frankly3d.com

2 3

latest fc10 kernel and policy seem to be out of sync (kernel_service)
by Ted Toth 30 Jul '09

30 Jul '09

With kernel-2.6.29.6-93.fc10 we are seeing errors in dmesg about kernel_service class not defined in policy. Looking at the selinux-policy source I find no definition of this class. Ted

1 0

Rawhide F12 and Skype AVC
by Frank Murphy 27 Jul '09

27 Jul '09

Following is AVC Do I replace '<unknown>' with skype? > Summary: > > SELinux is preventing skype from changing a writable memory segment executable. > > Detailed Description: > > The skype application attempted to change the access protection of memory (e.g., > allocated using malloc). This is a potential security problem. Applications > should not be doing this. Applications are sometimes coded incorrectly and > request this permission. The SELinux Memory Protection Tests > (http://people.redhat.com/drepper/selinux-mem.html) web page explains how to > remove this requirement. If skype does not work and you need it to work, you can > configure SELinux temporarily to allow this access until the application is > fixed. Please file a bug report > (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. > > Allowing Access: > > If you trust skype to run correctly, you can change the context of the > executable to execmem_exec_t. "chcon -t execmem_exec_t '<Unknown>'". You must > also change the default file context files on the system in order to preserve > them even on a full relabel. "semanage fcontext -a -t execmem_exec_t '<Unknown>'" > > Fix Command: > > chcon -t execmem_exec_t '<Unknown>' > > Additional Information: > > Source Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 > 023 > Target Context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1 > 023 > Target Objects None [ process ] > Source skype > Source Path <Unknown> > Port <Unknown> > Host (removed) > Source RPM Packages > Target RPM Packages > Policy RPM selinux-policy-3.6.22-2.fc12 > Selinux Enabled True > Policy Type targeted > MLS Enabled True > Enforcing Mode Enforcing > Plugin Name allow_execmem > Host Name (removed) > Platform Linux internet01.frankly3d.local > 2.6.31-0.86.rc3.git5.fc12.x86_64 #1 SMP Wed Jul 22 > 15:31:34 EDT 2009 x86_64 x86_64 > Alert Count 1 > First Seen Fri 24 Jul 2009 17:38:51 IST > Last Seen Fri 24 Jul 2009 17:38:51 IST > Local ID 6c5beb61-0671-4497-b86d-cd1bf0944901 > Line Numbers > > Raw Audit Messages > > node=internet01.frankly3d.local type=AVC msg=audit(1248453531.351:24900): avc: denied { execmem } for pid=2079 comm="skype" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process > > node=internet01.frankly3d.local type=SYSCALL msg=audit(1248453531.351:24900): arch=c000003e syscall=59 per=400000 success=no exit=-13 a0=1dae08f a1=1c0bcd0 a2=7fff70be3b38 a3=7fff70be2410 items=0 ppid=2078 pid=2079 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="skype" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) > > -- Regards, Frank jabber | msn | skype: frankly3d http://www.frankly3d.com

3 3

postfix_smtp_t
by Christoph Höger 27 Jul '09

27 Jul '09

Hi, this is a rather special use case, but I think it is valid. According to Pauls hints at http://marilyn.frields.org:8080/~paul/wordpress/?p=2616 I configured postfix to relay my local mail via some mail servers. But since I like a clean approach I did not want the sasl_password files in /etc/ so that the admin (me) has to handle plain text passwords there. Postfix seems to support multiple db files at arbitrary positions. But SELinux does not. I guess the transition to postfix_smtp_t is a little too early (before chroot). So I changed the context of my sasl_passwd files to postfix_smtp_t, just to notice that: 1. I (as a user) cannot do this 2. After I did it nevertheless I cannot edit those files So here is my proposal: Introduce postfix_userconfig_t and let postfix_smtp_t read it, and allow transitions and read/write access from unconfined_t to it. I know that this is suboptimal because it effectively becomes unconfinded_t, but since the admin _must_ add those files to /etc/postfix/main.cf (and should allow only harmless files) I guess that this is ok. any objections or shall I try to write a patch for the policy?

2 3

SELinux is preventing clamd.scan (system_cronjob_t) "write" crond_t
by Edward Kuns 25 Jul '09

25 Jul '09

Just in the past few days I've received seven of this AVC complaint, and I haven't seen any of this complaint before that. On 11 July, I updated selinux to 3.6.12-62.fc11. I currently have clamav-0.95.1-2.fc11.i586, installed on 1 July. I am not aware of anything that changed on or just before the 17th. Any ideas? Here's the sealert: Thanks Eddie Summary: SELinux is preventing clamd.scan (system_cronjob_t) "write" crond_t. Detailed Description: SELinux denied access requested by clamd.scan. It is not expected that this access is required by clamd.scan and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:system_cronjob_t:s0 Target Context system_u:system_r:crond_t:s0-s0:c0.c1023 Target Objects pipe [ fifo_file ] Source clamd.scan Source Path /bin/bash Port <Unknown> Host kilroy.chi.il.us Source RPM Packages bash-4.0-6.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-62.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name kilroy.chi.il.us Platform Linux kilroy.chi.il.us 2.6.29.5-191.fc11.i686.PAE #1 SMP Tue Jun 16 23:19:53 EDT 2009 i686 i686 Alert Count 7 First Seen Fri Jul 17 10:36:13 2009 Last Seen Mon Jul 20 16:36:12 2009 Local ID 39c625f5-4b31-49f2-bb14-57835e8afc61 Line Numbers Raw Audit Messages node=kilroy.chi.il.us type=AVC msg=audit(1248125772.619:80082): avc: denied { write } for pid=3642 comm="clamd.scan" path="pipe:[8230868]" dev=pipefs ino=8230868 scontext=system_u:system_r:system_cronjob_t:s0 tcontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tclass=fifo_file node=kilroy.chi.il.us type=SYSCALL msg=audit(1248125772.619:80082): arch=40000003 syscall=11 success=yes exit=0 a0=9ef08f0 a1=9ef0910 a2=9eeecb8 a3=9ef0910 items=0 ppid=509 pid=3642 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2000 comm="clamd.scan" exe="/bin/bash" subj=system_u:system_r:system_cronjob_t:s0 key=(null)

4 5

restorecon question
by Vadym Chepkov 23 Jul '09

23 Jul '09

Hi, Could you explain me, please, the behavior of the restorecon utility. I added the following in the local.fc file # phpbb /var/www/phpbb/cache(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t,s0) /var/www/phpbb/files(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t,s0) compiled and installed policy, seems to be in place. # semanage fcontext -l|grep phpbb /var/www/phpbb/cache(/.*)? all files system_u:object_r:httpd_sys_script_rw_t:s0 /var/www/phpbb/files(/.*)? all files system_u:object_r:httpd_sys_script_rw_t:s0 But when now I run restorecon -vR /var/www/phpbb/ it doesn't do anything. I would expect it to changed context on two directories and files in them. Only if I specify -F (force) I relabel everything. I can't quite grasp why sometimes I don't have to supply -F and sometimes I do. Thank you. Sincerely yours, Vadym Chepkov

5 9

httpd interface question
by Vadym Chepkov 21 Jul '09

21 Jul '09

Hi, I have a question about httpd interface on RedHat 5.3 selinux-policy-targeted-2.4.6-203.el5 I have httpd_unified --> off and I defined domain for subversion: apache_content_template(svn) I labeled my subversion hooks as httpd_svn_script_exec_t and I expected it will be able to read files labeled as httpd_svn_content_t, but it is not the case: type=AVC msg=audit(1247931060.612:40993): avc: denied { read } for pid=21405 comm="svn-mailer" name="svn-mailer.cfg" dev=sda1 ino=773360 scontext=user_u:system_r:httpd_svn_script_t:s0 tcontext=system_u:object_r:httpd_svn_content_t:s0 tclass=file # sesearch -a -s httpd_svn_script_t -t httpd_svn_content_t Found 1 av rules: allow httpd_svn_script_t httpd_svn_content_t : dir { getattr search }; The question is, why only this and nothing else? Sincerely yours, Vadym Chepkov

2 2

policy database
by Stefano Carucci 21 Jul '09

21 Jul '09

Hello all! I would like to ask you experts some details about how the policy binary is managed by the security server. While looking through the code I noticed that the avtab (in security/selinux/ss/avtab.h/c) stores all the needed information about the rules in a hash-table. Then, on the other side there is a policy database, that, as far as I understood is meant for configuration parameters only. So my question is: what is the link betweem the policy binary file and the avtab? Are all the rules loaded into the avtab from the binary file? Is there any mechanism to fast policy lookup from the binary file? Thank you in advance. Stefano _________________________________________________________________ 25 GB di spazio sempre con te. Accedi a SkyDrive! http://www.windowslive.it/skyDrive.aspx

1 0

Trying to cause a denial with rsync and SELinux
by Scott Radvan 20 Jul '09

20 Jul '09

Hello all, I'm having troubles invoking _any_ denial whatsoever for rsync related tasks, in order for me to demonstrate in my book how to then work around it. I've made a custom init script for rsync as there is no existing one in Fedora 11, so I labeled it initrc_exec_t so that the rsync daemon transitions to rsync_t: # ps -eZ | grep rsync unconfined_u:system_r:rsync_t:s0 326 ? 00:00:00 rsync According to the information I have, now that it's running as rsync_t, the following Booleans should have an effect: allow_rsync_anon_write No mattter the state of this Boolean, I can still write to public_content_rw_t files, locally or over the LAN. rsync_client I have very little information on this Boolean and what it actually implies, what it requires in terms of labels, etc. but no matter its state, rsync operates normally as a client reading and writing to a daemonized process on another machine. rsync_export_all_ro Perhaps I'm misinterpreting this one as well, but no matter its state, I can read _and_ write the test files in the directory specified by the rsync daemon, locally and over the network. Really, I'm probably misinterpreting these Booleans and their actual implications, or doing something completely wrong. I simply need a way that I can get SELinux to give me a denial related to rsync (running as a daemon) which I can then document and demonstrate the work-around for. My problem remains that everything works too _well_ and SELinux doesn't seem to be denying any of the access or transfers I'm performing, whatever the state of these Booleans, based on my limited understanding of them. Does anyone have a better understanding of these particular Booleans, what they actually imply, what labels the files need in order to be affected by them, any other condition they require to enforce upon the system...and mainly how I can intentionally invoke a denial based on one of them? Thanks in advance, -- Scott Radvan Content Author, Platform (Installation and Deployment) Red Hat Asia Pacific (Brisbane) http://www.apac.redhat.com

1 0

Would SELinux prevent that with the current policy?
by Christoph Höger 19 Jul '09

19 Jul '09

Hi, after looking at: http://blog.cr0.org/2009/07/old-school-local-root-vulnerability-in.html I wondered if SELinux would not be the right answer to those re-exec exploits. I guess that pulseaudio should run as something like pulseaudio_t which has all caps it needs. Re-exec should not change that as pulseaudio does not need any transformation of context. So short question: Does it work that way?

4 5

Re: spamassassin pre-compiled rules
by Vadym Chepkov 13 Jul '09

13 Jul '09

--- On Mon, 7/13/09, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > Vadym, can you create a patch for them to add a restorecon > after they create the libraries. You mean to the Fedora package? Sure, I can try, I will cc you on it. It's a perl script so I am not sure how keen maintainer will be to include it 'system' call.

1 0

Re: spamassassin pre-compiled rules
by Vadym Chepkov 13 Jul '09

13 Jul '09

sa-compile scripts puts them there, it runs manually from the cron. sa-compile call is not part of the standard Fedora package and as I said earlier, this context already exists in the standard policy, furthermore, Dan, you added it the by my request :) But even though it exists, it is being ignored when the library is created, I am not really sure how sa-compile script does it, but 'restorecon -R' afterward seems like an appropriate workaround. Sincerely yours, Vadym Chepkov --- On Mon, 7/13/09, Daniel J Walsh <dwalsh(a)redhat.com> wrote: > From: Daniel J Walsh <dwalsh(a)redhat.com> > Subject: Re: spamassassin pre-compiled rules > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Monday, July 13, 2009, 11:06 AM > On 07/11/2009 08:06 AM, Vadym Chepkov > wrote: > > spamassassin rules got updated recently and I got this > avc > > > > type=AVC msg=audit(1247216252.200:31900): avc: > denied { execute } for pid=24001 comm="spamd" > path="/var/lib/spamassassin/compiled/5.010/3.002005/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so" > dev=dm-3 ino=124989 scontext=system_u:system_r:spamd_t:s0 > tcontext=system_u:object_r:spamd_var_lib_t:s0 tclass=file > > > > audit2allow suggests this > > #============= spamd_t ============== > > allow spamd_t spamd_var_lib_t:file execute; > > seems reasonable, but why is it missing in standard > policy? > > > > Sincerely yours, > > Vadym Chepkov > > > > -- > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > Vadym, What puts the files in this directory? Are > they all shared libraries? > > One solution would be to label this directory > > # semanage fcontext -a -t lib_t > '/var/lib/spamassassin/compiled(/.*)?' > # restorecon -R -v /var/lib/spamassassin > > >

2 1

semodule/dbus
by Vadym Chepkov 13 Jul '09

13 Jul '09

Everytime I install or update a local selinux module I get a log entry, like this. Jul 11 08:10:36 hut dbus: Can't send to audit system: USER_AVC avc: received policyload notice (seqno=5)#012: exe="?" (sauid=81, hostname=?, addr=?, terminal=?) I wonder what is it about? It doesn't seem to affect anything, but still. Sincerely yours, Vadym Chepkov

3 2

spamassassin pre-compiled rules
by Vadym Chepkov 13 Jul '09

13 Jul '09

spamassassin rules got updated recently and I got this avc type=AVC msg=audit(1247216252.200:31900): avc: denied { execute } for pid=24001 comm="spamd" path="/var/lib/spamassassin/compiled/5.010/3.002005/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so" dev=dm-3 ino=124989 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:spamd_var_lib_t:s0 tclass=file audit2allow suggests this #============= spamd_t ============== allow spamd_t spamd_var_lib_t:file execute; seems reasonable, but why is it missing in standard policy? Sincerely yours, Vadym Chepkov

3 3

selinux denying ifconfig, Fedora 11
by Antonio Olivares 13 Jul '09

13 Jul '09

[olivares@ET1161-05 ~]$ dmesg | grep 'avc' type=1400 audit(1247281500.625:4): avc: denied { read } for pid=871 comm="ifconfig" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:ifconfig_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file [olivares@ET1161-05 ~]$ [olivares@ET1161-05 ~]$ cat /etc/fedora-release Fedora release 11 (Leonidas) [olivares@ET1161-05 ~]$ uname -r 2.6.30.1 smoltProfile here after install if it is useful? http://www.smolts.org/client/show/pub_bf6b4475-b2d9-4796-8965-112b094912de I only called command to check that I was connected while using dialup # ifconfig -a That was it, I saw setroubleshoot pop up but my fonts are very small, and I used above command to give me back avc. Regards, Antonio

3 2

dhclient denial F-11
by Paul Howarth 13 Jul '09

13 Jul '09

I get one of these every time my DHCP lease is renewed: type=AVC msg=audit(1247181873.317:23522): avc: denied { create } for pid=31499 comm="mv" name="yp.conf.predhclient.br0" scontext=unconfined_u:system_r:dhcpc_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file type=SYSCALL msg=audit(1247181873.317:23522): arch=c000003e syscall=2 success=no exit=-13 a0=7fff9e36ebcc a1=c1 a2=180 a3=65726373662f7274 items=0 ppid=31485 pid=31499 auid=1012 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="mv" exe="/bin/mv" subj=unconfined_u:system_r:dhcpc_t:s0 key=(null) It originates from /etc/dhcp/dhclient.d/nis.sh in the ypbind package. Paul..

4 6

Re: Domain transition missing
by Vadym Chepkov 13 Jul '09

13 Jul '09

It would be nice if the interface would be smart enough and allow output from the cron job to be sent, but no one is perfect :) ---- type=AVC msg=audit(1246715821.417:10142): avc: denied { write } for pid=11916 comm="winbind" path="pipe:[591689]" dev=pipefs ino=591689 scontext=system_u:system_r:system_cronjob_t:s0 tcontext=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 tclass=fifo_file ---- type=AVC msg=audit(1246715821.780:10143): avc: denied { write } for pid=11925 comm="winbindd" path="pipe:[591689]" dev=pipefs ino=591689 scontext=system_u:system_r:winbind_t:s0 tcontext=unconfined_u:system_r:crond_t:s0-s0:c0.c1023 tclass=fifo_file Sincerely yours, Vadym Chepkov --- On Sat, 7/4/09, Vadym Chepkov <chepkov(a)yahoo.com> wrote: > From: Vadym Chepkov <chepkov(a)yahoo.com> > Subject: Re: Domain transition missing > To: "Dominick Grift" <domg472(a)gmail.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 4, 2009, 10:00 AM > This worked well too, thank you > > system_u:system_r:winbind_t:SystemLow root > 11926 1 0 09:57 ? > 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11928 > 11926 0 09:57 ? 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11954 > 11926 0 09:57 ? 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11956 > 11926 0 09:57 ? 00:00:00 winbindd > system_u:system_r:winbind_t:SystemLow root 11957 > 11926 0 09:57 ? 00:00:00 winbindd > > > Sincerely yours, > Vadym Chepkov > > > --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> > wrote: > > > From: Dominick Grift <domg472(a)gmail.com> > > Subject: Re: Domain transition missing > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > Date: Saturday, July 4, 2009, 9:28 AM > > On Sat, 2009-07-04 at 06:18 -0700, > > Vadym Chepkov wrote: > > > That would be unfortunate. Mine approach is not > > uncommon. If you look closely you will see the same > > technique in wast scripts. spamassassin restarts > itself when > > it updates anti-spam rules, clamav does that > (antivirus) and > > on and on. I use Fedora 11, by the way. > > > > > > For now, instead of creating a new policy I just > added > > 'runcon -t unconfind_t ' in the cron, and it seemed to > did > > the trick. > > > > > > Sincerely yours, > > > Vadym Chepkov > > > > > > > Looking here: > > http://oss.tresys.com/projects/refpolicy/browser/trunk/policy/modules/servi… > > line 235 to line 269. > > > > That seems like a interface one might use in your > > situation: > > > > cron_system_entry(winbind_t, winbind_exec_t) > > > > I admit that using cron with SELinux is not very easy > > currently > > > > > --- On Sat, 7/4/09, Dominick Grift <domg472(a)gmail.com> > > wrote: > > > > > > > From: Dominick Grift <domg472(a)gmail.com> > > > > Subject: Re: Domain transition missing > > > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > > > Date: Saturday, July 4, 2009, 8:57 AM > > > > On Sat, 2009-07-04 at 05:48 -0700, > > > > Vadym Chepkov wrote: > > > > > I really get used to running my > scripts > > unconfined, > > > > how I can accomplish it in this scenario? > > > > > > > > > > Sincerely yours, > > > > > Vadym Chepkov > > > > > > > > > > > > > if you want the system to run jobs you will > need > > to write > > > > some policy or > > > > extend the system_cronjob_t domain i think > > > > > > > > > > > > Were those the only avc denial you got? I > would > > expect more > > > > denials. > > > > > > > > > --- On Sat, 7/4/09, Dominick Grift > <domg472(a)gmail.com> > > > > wrote: > > > > > > > > > > > From: Dominick Grift <domg472(a)gmail.com> > > > > > > Subject: Re: Domain transition > missing > > > > > > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > > > > > > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > > > > > > Date: Saturday, July 4, 2009, 8:41 > AM > > > > > > On Sat, 2009-07-04 at 14:38 > +0200, > > > > > > Dominick Grift wrote: > > > > > > > On Sat, 2009-07-04 at 05:11 > -0700, > > Vadym > > > > Chepkov > > > > > > wrote: > > > > > > > > Hi, > > > > > > > > > > > > > > > > Last night I got a > nasty > > surprise from > > > > selinux. I > > > > > > am using winbind for external > > authentication and > > > > since it > > > > > > has history of failures I have a > simple > > watchdog > > > > implemented > > > > > > to check the status and restart it > if > > necessary. > > > > That > > > > > > is what happened last night and > > as a law > > > > abiding > > > > > > selinux citizen I used 'service > winbind > > restart', > > > > but it > > > > > > seems the proper domain > transitions is > > missing > > > > and winbind > > > > > > was started in system_cronjob_t > domain > > instead of > > > > winbind_t > > > > > > and none of other domains could > connect > > to it. > > > > > > > > > > > > > > > > I think jobs running > from > > cron should > > > > be granted > > > > > > the same transition rules as > > from > > > > unconfined_t. > > > > > > > > > > > > > > > > I will file bugzilla > report > > about it, > > > > but could > > > > > > somebody help me with modifying > my > > local policy > > > > until/if it > > > > > > gets implemented, please? Thank > you. > > > > > > > > > > > > > > > > Sincerely yours, > > > > > > > > Vadym > > Chepkov > > > > > > > > > > > > > > A domain transition would > be: > > > > > > > > > > > > > > policy_module(mywinbind, > 0.0.1) > > > > > > > > > > > > > > require { type > system_cronjob_t, > > > > winbind_exec_t, > > > > > > winbind_t; } > > > > > > > > > domain_auto_trans(system_cronjob_t, > > > > winbind_exec_t, > > > > > > winbind_t) > > > > > > > > > > > > > > Can you show us the full raw > avc > > denial? > > > > > > > > > > > > > > > > > > But personally would deal with > this in > > a > > > > different way. I > > > > > > would write > > > > > > policy for the script that > restarts > > winbind and > > > > then i > > > > > > would create a > > > > > > domain transition for the domain > in > > which the > > > > script runs > > > > > > to winbind_t. > > > > > > > > > > > > Mainly because i wouldnt want to > > extend/modify > > > > > > system_cronjob_t > > > > > > > > > > > > So: system_cronjob_t -> > > myscript_exec_t -> > > > > myscript_t > > > > > > -> winbind_exec_t > > > > > > -> winbind_t > > > > > > > > > > > > > > -- > > > > > > > > fedora-selinux-list > mailing > > list > > > > > > > > fedora-selinux-list(a)redhat.com > > > > > > > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >

3 2

SELinux and gitosis (FC11)
by Jonathan Stott 13 Jul '09

13 Jul '09

Hi all Today I updated to FC11 and gitosis stopped working (gitosis is a collection of scripts for easing multiuser access to git repositories over ssh). I can tell it's an SELinux problem, because '/sbin/setenforcing 0' clears it up. On the server, the git repositories are managed by the 'git' user, which has the guest_u selinux type (though it also fails when given the user_u user). The home directory (/home/git) has the correct selinux context (user_home_t) as far as I can tell and I've run 'restorecon -Rvv' anyway, just to be sure. gitosis works by calling a system binary, gitosis-serve, which lives in /usr/bin/ and has the type of 'bin_t' so guest_u should be able to execute it. Even with 'setenforcing 0' no AVC denials are created though. Checking /var/log/secure shows that the key is being accepted, and it seems like the process then hangs. Any suggestions appreciated, Regards Jon

4 10

Re: spamassassin pre-compiled rules
by Vadym Chepkov 12 Jul '09

12 Jul '09

I figured it out. There is a proper label in the policy /var/lib/spamassassin/compiled/.*\.so.* regular file system_u:object_r:lib_t:s0 It seems when a script that compiles this library runs, it creates shared libraries with spamd_var_lib_t instead. So I guess the only way to fix this issue is to run restorecon -R /var/lib/spamassassin/compiled/ right after sa-compile finishes. Sincerely yours, Vadym Chepkov --- On Sat, 7/11/09, Dominick Grift <domg472(a)gmail.com> wrote: > From: Dominick Grift <domg472(a)gmail.com> > Subject: Re: spamassassin pre-compiled rules > To: "Vadym Chepkov" <chepkov(a)yahoo.com> > Cc: "Fedora SELinux" <fedora-selinux-list(a)redhat.com> > Date: Saturday, July 11, 2009, 12:38 PM > On Sat, 2009-07-11 at 05:06 -0700, > Vadym Chepkov wrote: > > spamassassin rules got updated recently and I got this > avc > > > > type=AVC msg=audit(1247216252.200:31900): avc: > denied { execute } for pid=24001 comm="spamd" > path="/var/lib/spamassassin/compiled/5.010/3.002005/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so" > dev=dm-3 ino=124989 scontext=system_u:system_r:spamd_t:s0 > tcontext=system_u:object_r:spamd_var_lib_t:s0 tclass=file > > > > audit2allow suggests this > > #============= spamd_t ============== > > allow spamd_t spamd_var_lib_t:file execute; > > seems reasonable, but why is it missing in standard > policy? > > > > Sincerely yours, > > Vadym Chepkov > > Is that file part of the package? > /var/lib/spamassassin/compiled/5.010/3.002005/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so > > It is probably created by spamd_t. > > The problem is that if you allow spamd_t to execute files > with type > spamd_var_lib_t then spamd_t can run everything > in /var/lib/spamassassin. > > This is not so nice but it might not be a problem either > > Looking at the path it appears that spamd put compiled > stuff > under /var/lib/spamassassin/compiled/ > > assuming that all stuff under there should be executable by > spamd_t, one > could consider to introduce a new type for spamd_t > executable files > there. > > That would look something like this: > > myspamd.te: > policy_module(myspamd, 0.0.1) > type spamd_var_lib_exec_t; > files_type(spamd_var_lib_exec_t) > require { type spamd_t; } > filetrans_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t, > { dir file }) > manage_dirs_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t) > manage_files_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t) > exec_files_pattern(spamd_t, spamd_var_lib_exec_t, > spamd_var_lib_exec_t) > > myspamd.fc: > /var/lib/spamassassin/compiled(/.*)? -- > gen_context(system_u:object_r:spamd_var_lib_exec_t, s0) > > But i guess that depends on your security requirements > > For now this could be considered a bug in selinux-policy > > > > fedora-selinux-list mailing list > > fedora-selinux-list(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list >

2 2

SELinux is preventing gconf-defaults- (gconfdefaultsm_t) "read" security_t.
by Robert Nichols 11 Jul '09

11 Jul '09

When trying to set a new default for Power Management Preferences: Detailed Description: SELinux denied access requested by gconf-defaults-. It is not expected that this access is required by gconf-defaults- and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable SELinux protection altogether. Disabling SELinux protection is not recommended. Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against this package. Additional Information: Source Context system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 Target Context system_u:object_r:security_t:s0 Target Objects mls [ file ] Source gconf-defaults- Source Path /usr/libexec/gconf-defaults-mechanism Port <Unknown> Host omega-3p.local Source RPM Packages GConf2-2.26.2-1.fc11 Target RPM Packages Policy RPM selinux-policy-3.6.12-53.fc11 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name catchall Host Name omega-3p.local Platform Linux omega-3p.local 2.6.29.5-191.fc11.i586 #1 SMP Tue Jun 16 23:11:39 EDT 2009 i686 i686 Alert Count 2 First Seen Fri 10 Jul 2009 04:20:11 PM CDT Last Seen Fri 10 Jul 2009 04:20:11 PM CDT Local ID de1d32d5-dded-47ec-9eb5-9dc8167a8685 Line Numbers Raw Audit Messages node=omega-3p.local type=AVC msg=audit(1247260811.959:37): avc: denied { read } for pid=3541 comm="gconf-defaults-" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file node=omega-3p.local type=AVC msg=audit(1247260811.959:37): avc: denied { open } for pid=3541 comm="gconf-defaults-" name="mls" dev=selinuxfs ino=12 scontext=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file node=omega-3p.local type=SYSCALL msg=audit(1247260811.959:37): arch=40000003 syscall=5 success=yes exit=3 a0=bfd414e8 a1=8000 a2=0 a3=bfd414e8 items=0 ppid=3540 pid=3541 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gconf-defaults-" exe="/usr/libexec/gconf-defaults-mechanism" subj=system_u:system_r:gconfdefaultsm_t:s0-s0:c0.c1023 key=(null) -- Bob Nichols "NOSPAM" is really part of my email address. Do NOT delete it.

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2009