selinux November 2010

selinux@lists.fedoraproject.org

17 participants
22 discussions

selinux policy UBAC question
by Roberto Sassu 04 Nov '10

04 Nov '10

Hi all i'm using the selinux policy shipped with Fedora 13 and UBAC turned on. I removed the unconfined package and i noted the unconfined_t domain with unconfined_u user is unable to access a file with another selinux user. I tried to build a custom module which contains the line: ubac_process_exempt(unconfined_t) but this does not solve the issue. How do i configure the policy to allow some domains to circumvent the UBAC enforcement? Thanks in advance for replies. Roberto Sassu

2 11

selinux blocking access, no AVC warnings in /var/log/messages or /var/log/audit/audit.log
by Jonathan Kamens 03 Nov '10

03 Nov '10

Hi all, I need to set up a procmail rule that receives an aliases file via email, saves it within the home directory of the user receiving the email, and builds a postfix hash map out of it with postalias. There were various selinux denied messages associated with the work the script has to do, which I fixed incrementally with several test runs of the script combined with audit2allow, yielding this eventual policy: module aliasupdate 1.0; require { type postfix_postdrop_t; type user_home_t; type postfix_master_exec_t; type procmail_t; class file { getattr append read open execute execute_no_trans }; } allow postfix_postdrop_t user_home_t:file { getattr append }; allow procmail_t postfix_master_exec_t:file execute_no_trans; allow procmail_t postfix_master_exec_t:file { read execute open getattr }; Now, however, I'm still getting a permission problem. From my procmail log: postalias: fatal: open /etc/postfix/main.cf: Permission denied I know this is an selinux issue, since the problem goes away if I do "setenforce 0", but here's the weird thing: when this error occurs, nothing gets logged in either /var/log/messages or /var/log/audit/audit.log, so I can't figure out how to fix my selinux policy to allow whatever action is being denied here. Can somebody help me figure out why selinux would fail to log any sort of message when blocking access, and what I can do to fix it? Thank you, Jonathan Kamens

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2010