January 2012 - selinux - Fedora mailing-lists

[sandbox] modifying the Xephyr window title (patch)
by Christoph A. 25 Jun '12

25 Jun '12

Hi, If most of your windows are sandboxed applications, your bar looks like: [Sandbox sandbo..] [Sandbox sandbo..] [Sandbox sandbo..] and it is hard to find a specific application. example of a current Xephyr title: Sandbox sandbox_web_t:s0:c112,c991 -- /usr/bin/firefox with the modification in the attached patch titles will look like: /usr/bin/firefox (sandbox_web_t) and it should be easier to find a specific application. In addition to the type I would find it handy to also include the DISPLAY in the title (needed when using xsel for copy'n paste). The second patch only adds '-nolisten tcp' to Xephyr, but if there are use cases where one needs Xephyr to open a listener this patch will break thinks. regards, Christoph A. btw: secon's manpage doesn't contain the '-l' option.

2 10

Policy for CouchDB
by Michael Milverton 17 Mar '12

17 Mar '12

Hi, I'm in the process of writing a policy for couchdb (nosql database). I'm using the selinux-polgengui and eclipse slide tools to help. I've hit a road block because it won't start but I'm not getting any more AVC's. I'm wondering if anybody might be able to offer some clue about getting more AVC's from it because if it won't talk to me I can't get much further. The only entries in audit.log are: type=CRED_ACQ msg=audit(1309362790.614:1343): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="couchdb" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' type=USER_START msg=audit(1309362790.619:1344): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="couchdb" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' type=USER_END msg=audit(1309362790.640:1345): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="couchdb" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' type=CRED_DISP msg=audit(1309362790.641:1346): user pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="couchdb" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' type=SERVICE_START msg=audit(1309362790.676:1347): user pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="couchdb" exe=2F62696E2F73797374656D64202864656C6574656429 hostname=? addr=? terminal=? res=failed' Now, it will start fine (and run) when it is unlabeled (not what I want of course). Couchdb runs under the username/group couchdb but I haven't added any transition rules for this yet (any help on this would be appreciated). FC FILE: /usr/bin/couchdb -- gen_context(system_u:object_r:couchdb_exec_t,s0) /usr/bin/couchjs -- gen_context(system_u:object_r:couchdb_exec_t,s0) TE FILE: policy_module(couchdb,1.0.0) require { type bin_t; type fs_t; type proc_t; } type couchdb_t; domain_type(couchdb_t) permissive couchdb_t; # Access to shared libraries libs_use_ld_so(couchdb_t) libs_use_shared_libs(couchdb_t) miscfiles_read_localization(couchdb_t) dev_read_urand(couchdb_t) # Type for the daemon type couchdb_exec_t; files_type(couchdb_exec_t) domain_entry_file(couchdb_t, couchdb_exec_t) init_daemon_domain(couchdb_t, couchdb_exec_t) # Logging logging_send_syslog_msg(couchdb_t) logging_log_file(couchdb_t) # Temp files type couchdb_tmp_t; files_tmp_file(couchdb_tmp_t) manage_dirs_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t) manage_files_pattern(couchdb_t, couchdb_tmp_t, couchdb_tmp_t) files_tmp_filetrans(couchdb_t, couchdb_tmp_t, { dir file }) #type couchdb_config_t; files_read_etc_files(couchdb_t) # /bin/basename and some others allow couchdb_t bin_t:file { read getattr open execute execute_no_trans }; allow couchdb_t fs_t:filesystem getattr; allow couchdb_t proc_t:file { read getattr open }; allow couchdb_t self:fifo_file { read write getattr }; # Not sure about this auth_domtrans_chk_passwd(couchdb_t) # Not sure about this either. domain_use_interactive_fds(couchdb_t) Any clues, tips, advice would be most appreciated Thanks

5 20

making a file context change work for initrc_t and unconfined_t
by Maria Iano 08 Feb '12

08 Feb '12

I have a RHEL 6.2 server running LikewiseOpen. It appears to me that I will take care of a large number of denials if I can change the type of /var/lib/likewise/.lsassd to be lsassd_var_socket_t. I added the file context rule with semanage, and used restorecon to change it to lsassd_var_socket_t as desired. But later I found that / var/lib/likewise/.lsassd had type var_lib_t again. I assume that is because the likewise processes run as initrc_t. I'd like to change the policy and tell it that services running in either initrc_t or unconfined_t domains should create the file /var/ lib/likewise/.lsassd with type lsassd_var_socket_t. (A command line tool lwsm for managing the processes runs in unconfined_t so I'd like to include that domain to be safe. ) How can I go about doing that in RHEL 6 (or can I)? Thanks, Maria

4 28

SELinux for LXC Container
by Shweta Shinde 08 Feb '12

08 Feb '12

Hi everyone, I am interested in the security aspects of LXC. How can we use SELinux to secure LXC containers? Any information will be very helpful. -- Regards, Shweta

3 5

Suggestion on autorelabel
by mark 01 Feb '12

01 Feb '12

Y'know, folks, fsck -c gives you a clue that not only is it running, but a vague feel for how much longer it'll be. .autorelabel, esp with several 2TB drives in a system, gives screens and screens and screens of asterisks, with no clue if it'll *ever* finish (which matters, when I'm going to be leaving soon, and it needs to be up for an overnight backup....) mark

8 9

Domain transition not working
by Nabeel Moidu 01 Feb '12

01 Feb '12

Hi I've got an executable file script.sh labeled xyz_exec_t. I've also defined a domain xyz_t and added daemon_domain(xyz_t, xyz_exec_t) in the .te file. When compiled and inserted, the file context labels seem to be enforced correctly. Normally the executable script.sh is invoked by the init scripts. As per the domain transition rule, I expect it show up xyz_t as its domain in ps -efZ . But the transition does not work as expected. The process runs as an unconfined domain. But when I add runcon in the line where the init script invokes the executable with the domain as xyz_t, the process runs in the proper context. Once I remove the runcon and invoke the init script, the domain transition I applied in the custom module does not work out. Any suggestions ? NB: The system is on permissive mode and this particular domain xyz_t has also been defined as a permissive domain. Nabeel

4 4

Issue with updating denyhosts to use systemd
by Jason L Tibbitts III 31 Jan '12

31 Jan '12

So I'm trying to get denyhosts updated to use systemd to keep it from being kicked out of the distribution, and I'm running into an odd problem that at the end comes down to selinux. denyhosts wants the hostname in the environment when it starts up. (This lets it add the hostname to the subject of messages it sends.) The initscript used to do this but of course not with systemd so I need another method. Using /etc/sysconfig/network as an EnvironmentFile seems a terrible, horrible hack so I just fixed denyhosts to so it internally by just calling platform.node() (python if it's not obvious) at the appropriate place. Unfortunately selinux disallows this. I guess the policy needs to be opened a bit but I'm not sure how to do this properly or without compromising security. - J< Jan 31 13:58:16 ld93 denyhosts.py[1785]: Traceback (most recent call last): Jan 31 13:58:16 ld93 denyhosts.py[1785]: File "/usr/bin/denyhosts.py", line 113, in <module> Jan 31 13:58:16 ld93 denyhosts.py[1785]: os.environ['HOSTNAME'] = platform.node() Jan 31 13:58:16 ld93 denyhosts.py[1785]: File "/usr/lib64/python2.7/platform.py", line 1292, in node Jan 31 13:58:16 ld93 denyhosts.py[1785]: return uname()[1] Jan 31 13:58:16 ld93 denyhosts.py[1785]: File "/usr/lib64/python2.7/platform.py", line 1249, in uname Jan 31 13:58:16 ld93 denyhosts.py[1785]: processor = _syscmd_uname('-p','') Jan 31 13:58:16 ld93 denyhosts.py[1785]: File "/usr/lib64/python2.7/platform.py", line 1005, in _syscmd_uname Jan 31 13:58:16 ld93 denyhosts.py[1785]: output = string.strip(f.read()) Jan 31 13:58:16 ld93 denyhosts.py[1785]: IOError: [Errno 13] Permission denied time->Tue Jan 31 13:58:16 2012 type=SYSCALL msg=audit(1328039896.475:18367): arch=c000003e syscall=5 success=no exit=-13 a0=3 a1=7fff61069bc0 a2=7fff61069bc0 a3=ffffc000 items=0 ppid=1 pid=1785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="denyhosts.py" exe="/usr/bin/python" subj=system_u:system_r:denyhosts_t:s0 key=(null) type=AVC msg=audit(1328039896.475:18367): avc: denied { getattr } for pid=1785 comm="denyhosts.py" path="pipe:[1105844]" dev=pipefs ino=1105844 scontext=system_u:system_r:denyhosts_t:s0 tcontext=system_u:system_r:denyhosts_t:s0 tclass=fifo_file ---- time->Tue Jan 31 13:58:16 2012 type=SYSCALL msg=audit(1328039896.475:18368): arch=c000003e syscall=5 success=no exit=-13 a0=3 a1=7fff61069bc0 a2=7fff61069bc0 a3=1 items=0 ppid=1 pid=1785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="denyhosts.py" exe="/usr/bin/python" subj=system_u:system_r:denyhosts_t:s0 key=(null) type=AVC msg=audit(1328039896.475:18368): avc: denied { getattr } for pid=1785 comm="denyhosts.py" path="pipe:[1105844]" dev=pipefs ino=1105844 scontext=system_u:system_r:denyhosts_t:s0 tcontext=system_u:system_r:denyhosts_t:s0 tclass=fifo_file ---- time->Tue Jan 31 13:58:16 2012 type=SYSCALL msg=audit(1328039896.475:18369): arch=c000003e syscall=59 success=no exit=-13 a0=398ed70c1e a1=7fff61067b60 a2=7fff6106a6b0 a3=7f5312d0d9d0 items=0 ppid=1785 pid=1786 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="denyhosts.py" exe="/usr/bin/python" subj=system_u:system_r:denyhosts_t:s0 key=(null) type=AVC msg=audit(1328039896.475:18369): avc: denied { execute } for pid=1786 comm="denyhosts.py" name="bash" dev=dm-0 ino=686466 scontext=system_u:system_r:denyhosts_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file ---- time->Tue Jan 31 13:58:16 2012 type=SYSCALL msg=audit(1328039896.475:18370): arch=c000003e syscall=5 success=no exit=-13 a0=3 a1=7fff61069b40 a2=7fff61069b40 a3=2025 items=0 ppid=1 pid=1785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="denyhosts.py" exe="/usr/bin/python" subj=system_u:system_r:denyhosts_t:s0 key=(null) type=AVC msg=audit(1328039896.475:18370): avc: denied { getattr } for pid=1785 comm="denyhosts.py" path="pipe:[1105844]" dev=pipefs ino=1105844 scontext=system_u:system_r:denyhosts_t:s0 tcontext=system_u:system_r:denyhosts_t:s0 tclass=fifo_file ---- time->Tue Jan 31 13:58:16 2012 type=SYSCALL msg=audit(1328039896.475:18371): arch=c000003e syscall=0 success=no exit=-13 a0=3 a1=7f5312d36000 a2=2000 a3=22 items=0 ppid=1 pid=1785 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="denyhosts.py" exe="/usr/bin/python" subj=system_u:system_r:denyhosts_t:s0 key=(null) type=AVC msg=audit(1328039896.475:18371): avc: denied { read } for pid=1785 comm="denyhosts.py" path="pipe:[1105844]" dev=pipefs ino=1105844 scontext=system_u:system_r:denyhosts_t:s0 tcontext=system_u:system_r:denyhosts_t:s0 tclass=fifo_file

3 4

SLIDE for RHEL6 and Derivatives
by David Quigley 31 Jan '12

31 Jan '12

<resent as I sent it from the wrong mailing address> I am preparing resources for a talk and I'm trying to build a CentOS 6.2 VM with all the SELinux tools installed on it. Most of them are easy as they are in the yum repo but I can't seem to find any RPMs for SLIDE. The tresys yum repo relies on things that aren't in RHEL6 or EPEL6 and only seem to be for RHEL 5 at the moment. Has anyone gotten SLIDE installed on RHEL6? Is Tresys working on releasing RHEL 6 rpms for SLIDE? Dave

5 14

Fedora 16 AVC at boot time
by David Highley 30 Jan '12

30 Jan '12

Must be an order issue at boot time. We did a reboot today after a kernel update and saw the following even though we have, selinux-policy-3.10.0-72.fc16.noarch: getsebool allow_ypbind allow_ypbind --> on ---- time->Tue Jan 24 06:17:02 2012 type=SYSCALL msg=audit(1327414622.867:2517): arch=c000003e syscall=59 success=yes exit=0 a0=9669f0 a1=cc8170 a2=7fff1bf396c8 a3=1f items=0 ppid=5248 pid=5253 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=293 comm="sh" exe="/bin/bash" subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1327414622.867:2517): avc: denied { transition } for pid=5253 comm="rpm" path="/bin/bash" dev=dm-1 ino=393240 scontext=unconfined_u:system_r:bootloader_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 tclass=process ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.410:38): arch=c000003e syscall=2 success=no exit=-13 a0=7fff0fc10e50 a1=0 a2=7fff0fc10e79 a3=68 items=0 ppid=1180 pid=1359 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="/usr/sbin/httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1327415018.410:38): avc: denied { search } for pid=1359 comm="/usr/sbin/httpd" name="yp" dev=dm-1 ino=1313161 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_yp_t:s0 tclass=dir ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.410:39): arch=c000003e syscall=2 success=no exit=-13 a0=7fff0fc10e50 a1=0 a2=7fff0fc10e79 a3=68 items=0 ppid=1180 pid=1360 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="/usr/sbin/httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1327415018.410:39): avc: denied { search } for pid=1360 comm="/usr/sbin/httpd" name="yp" dev=dm-1 ino=1313161 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_yp_t:s0 tclass=dir ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.411:40): arch=c000003e syscall=2 success=no exit=-13 a0=7fff0fc10e50 a1=0 a2=7fff0fc10e79 a3=68 items=0 ppid=1180 pid=1361 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="/usr/sbin/httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1327415018.411:40): avc: denied { search } for pid=1361 comm="/usr/sbin/httpd" name="yp" dev=dm-1 ino=1313161 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_yp_t:s0 tclass=dir ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.411:41): arch=c000003e syscall=2 success=no exit=-13 a0=7fff0fc10e50 a1=0 a2=7fff0fc10e79 a3=68 items=0 ppid=1180 pid=1362 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="/usr/sbin/httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1327415018.411:41): avc: denied { search } for pid=1362 comm="/usr/sbin/httpd" name="yp" dev=dm-1 ino=1313161 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_yp_t:s0 tclass=dir ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.414:42): arch=c000003e syscall=2 success=no exit=-13 a0=7fff0fc10e50 a1=0 a2=7fff0fc10e79 a3=68 items=0 ppid=1180 pid=1365 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="/usr/sbin/httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1327415018.414:42): avc: denied { search } for pid=1365 comm="/usr/sbin/httpd" name="yp" dev=dm-1 ino=1313161 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_yp_t:s0 tclass=dir ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.414:43): arch=c000003e syscall=2 success=no exit=-13 a0=7fff0fc10e50 a1=0 a2=7fff0fc10e79 a3=68 items=0 ppid=1180 pid=1364 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="/usr/sbin/httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1327415018.414:43): avc: denied { search } for pid=1364 comm="/usr/sbin/httpd" name="yp" dev=dm-1 ino=1313161 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_yp_t:s0 tclass=dir ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.415:44): arch=c000003e syscall=2 success=no exit=-13 a0=7fff0fc10e50 a1=0 a2=7fff0fc10e79 a3=68 items=0 ppid=1180 pid=1366 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="/usr/sbin/httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1327415018.415:44): avc: denied { search } for pid=1366 comm="/usr/sbin/httpd" name="yp" dev=dm-1 ino=1313161 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_yp_t:s0 tclass=dir ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.416:45): arch=c000003e syscall=2 success=no exit=-13 a0=7fff0fc10e50 a1=0 a2=7fff0fc10e79 a3=68 items=0 ppid=1180 pid=1363 auid=4294967295 uid=0 gid=48 euid=0 suid=0 fsuid=0 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="/usr/sbin/httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 key=(null) type=AVC msg=audit(1327415018.416:45): avc: denied { search } for pid=1363 comm="/usr/sbin/httpd" name="yp" dev=dm-1 ino=1313161 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_yp_t:s0 tclass=dir ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.418:46): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=7fff071131f0 a2=10 a3=98 items=0 ppid=1367 pid=1369 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/lib64/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1327415018.418:46): avc: denied { name_connect } for pid=1369 comm="dbus-daemon-lau" dest=111 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:portmap_port_t:s0 tclass=tcp_socket ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.418:47): arch=c000003e syscall=49 success=no exit=-13 a0=3 a1=7fff07112f60 a2=10 a3=98 items=0 ppid=1367 pid=1369 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/lib64/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1327415018.418:47): avc: denied { name_bind } for pid=1369 comm="dbus-daemon-lau" src=697 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=tcp_socket ---- time->Tue Jan 24 06:23:38 2012 type=SYSCALL msg=audit(1327415018.418:48): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=7fff071131f0 a2=10 a3=98 items=0 ppid=1367 pid=1369 auid=4294967295 uid=81 gid=81 euid=0 suid=0 fsuid=0 egid=81 sgid=81 fsgid=81 tty=(none) ses=4294967295 comm="dbus-daemon-lau" exe="/lib64/dbus-1/dbus-daemon-launch-helper" subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1327415018.418:48): avc: denied { name_connect } for pid=1369 comm="dbus-daemon-lau" dest=111 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:portmap_port_t:s0 tclass=tcp_socket

4 17

Fedora 16 and procmail
by David Highley 26 Jan '12

26 Jan '12

module myprocmail 1.0; require { type quota_db_t; type etc_aliases_t; type procmail_t; type admin_home_t; type spamc_t; type shadow_t; class file { getattr read open append lock }; class dir { getattr read open write }; class capability { dac_read_search dac_override }; } #============= procmail_t ============== allow procmail_t etc_aliases_t:file { getattr read open }; allow procmail_t quota_db_t:file { getattr append open lock }; allow procmail_t admin_home_t:dir write; allow procmail_t admin_home_t:file open; allow spamc_t self:capability { dac_read_search dac_override }; allow spamc_t shadow_t:file read; Then everytime we do a restorecon -vR for a home directory we get the following and if you repeat the command you will get the same output. We did do, semanage fcontext -a -e /home /export/home, so selinux knows that this is a home directory structure for NFS automounting. restorecon -vR /export/home/chighley restorecon reset /export/home/chighley/.pyzor context system_u:object_r:spamc_home_t:s0->system_u:object_r:pyzor_home_t:s0 restorecon reset /export/home/chighley/.pyzor/servers context system_u:object_r:spamc_home_t:s0->system_u:object_r:pyzor_home_t:s0 restorecon reset /export/home/chighley/.razor context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/identity context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/razor-agent.log context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c101.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c102.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c103.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c104.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c105.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c118.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c121.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c122.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c123.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c301.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c302.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c303.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c304.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.c305.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.folly.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.joy.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.n001.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.n002.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.n003.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/server.n004.cloudmark.com.conf context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/servers.catalogue.lst context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/servers.discovery.lst context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/servers.nomination.lst context unconfined_u:object_r:spamc_home_t:s0->unconfined_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/servers.catalogue.lst.lock context system_u:object_r:spamc_home_t:s0->system_u:object_r:razor_home_t:s0 restorecon reset /export/home/chighley/.razor/servers.nomination.lst.lock context system_u:object_r:spamc_home_t:s0->system_u:object_r:razor_home_t:s0

2 5

Recent /proc/pid/mem exploit
by David Quigley 25 Jan '12

25 Jan '12

So I read through the recent privilege escalation vulnerability using su and gpasswd which exploits weak permission checks in /proc/pid/mem and tried to figure out why we didn't stop it. What it comes down to is that /proc/pid and everything under it is given the same type as the process itself. In the case of the gpasswd that type is groupadd_t. Looking at the kernel code for /proc/pid/mem and its read/write functions it seems that the only permission checking we do on that node is done by the vfs. So from the SELinux perspective you would need allow groupadd_t groupadd_t file:{open read write} to have access to /proc/pid/mem. For some odd reason tons and tons of applications have file:{open read and write} on itself. One question that should be asked is why is is that we have so many rules that contain sometype_t sometype_t file: {open read write}. Is it necessary or something that is just being pulled in from a macro. If this is necessary for other reasons the followup to this would be should /proc/pid/mem have the same type as the process or should we have some additional requirements permission wise for a process to read and write to its own memory through /proc/pid/mem. What are the valid reasons for a process to be poking around through its memory using /proc/pid/mem? Dave

2 1

Re: Creating files from initrc_t
by Dominick Grift 24 Jan '12

24 Jan '12

On Mon, 2012-01-23 at 15:57 +0000, Moray Henderson wrote: > Hi > > On CentOS 5.6, I have just noticed that if a process running under context > initrc_t creates a file or directory within a user's home directory, that > object gets user_home_dir_t. > > If an unconfined_t process does the same thing, they correctly get > user_home_t. > > Was this a bug or a feature? > > selinux-policy-2.4.6-300.el5_6.1 > selinux-policy-targeted-2.4.6-300.el5_6.1 > > > Moray. > "To err is human; to purr, feline." I guess that depends on how you look at it but compared to recent fedora policy i guess you could consider this to be a bug. This is supported in Fedora 16: # sesearch --allow -s initrc_t -t user_home_dir_t -T | grep user_home_t type_transition initrc_t user_home_dir_t : file user_home_t; type_transition initrc_t user_home_dir_t : dir user_home_t; type_transition initrc_t user_home_dir_t : lnk_file user_home_t; type_transition initrc_t user_home_dir_t : sock_file user_home_t; type_transition initrc_t user_home_dir_t : fifo_file user_home_t; > > > > -- > selinux mailing list > selinux(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/selinux

5 6

Constraint violation question
by Joe Nall 23 Jan '12

23 Jan '12

When I'm tracking down a constraint violation, is there any automated way to determine which constraint is being violated? joe

3 2

Defining new access vectors & security classes in policy modules ?
by Daniel P. Berrange 23 Jan '12

23 Jan '12

I'm working on adding fine grained access control to libvirt and need to define a bunch of new object classes & their corresponding access vectors. For the sake of simplifying my developement / testing cycle, I'm wondering if it is possible to define access vectors / security classes in the individual policy module files, rather than in the top level global flash/{access_vectors,security_classes} file, which would require me to rebuild the entire policy for every change I make. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

2 3

Creating files from initrc_t
by Moray Henderson 23 Jan '12

23 Jan '12

Hi On CentOS 5.6, I have just noticed that if a process running under context initrc_t creates a file or directory within a user's home directory, that object gets user_home_dir_t. If an unconfined_t process does the same thing, they correctly get user_home_t. Was this a bug or a feature? selinux-policy-2.4.6-300.el5_6.1 selinux-policy-targeted-2.4.6-300.el5_6.1 Moray. "To err is human; to purr, feline."

1 0

Report ot not, Rawhide
by Frank Murphy 23 Jan '12

23 Jan '12

When there are sealerts on Rawhide. Where the only suggestion is to either create a mypol, or report as bug. If I don't know whether to allow or not Should I bz or c&p here? -- Regards, Frank Murphy UTF_8 Encoded

3 3

avc_init deprecation vs avc_open + selinux_set_callback()
by Daniel P. Berrange 20 Jan '12

20 Jan '12

I'm adding support to libvirt for a userspace access controller, and have been basing my code on that done in DBus (dbus/bus/selinux.c). That code uses avc_init() and provides the whole set of callbacks that method requires. The man page for avc_init(), however, states that is is deprecated and we should use a combination of avc_open() + selinux_set_callback() in new code. The selinux_set_callback() function, while able to set the log & audit callbacks, does not have any way to set the thread, mutex or memory allocation callbacks. I've verified from looking at the code that avc_init() is the only API that can set these. Why is it deprecated, if the replacement quoted can't actually replace its functionality ? I'm inclined it to use avc_init() despite it being deprecated. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

1 0

FC recursive directories
by Nabeel Moidu 19 Jan '12

19 Jan '12

Hi Can the file context specification recursively assign contexts when using regex ? Eg. I have a/b/c/d and if I specify in selinuxrule.fc a* gen_context(system_u:object_r:myapp_exec_t) Will this apply to only files under a or files under a/b, a/b/c and a/b/c/d etc. also ? -- Thanks and Regards Nabeel Moidu

2 2

Problems auditing yum behaviour
by Jonathan Gazeley 17 Jan '12

17 Jan '12

Hi list, We recently migrated all our servers from CentOS 5 to 6 and in the process we decided to default to keeping SELinux on, and learning how to configure it properly :) So far we've had good success with setting booleans and writing custom policies, except for one Nagios plugin that checks yum status[1]. On my boxes, the check_yum plugin is executed under NRPE as a non-privileged user. This works fine with SELinux in permissive mode. I've checked the audit log and this message is produced every time the plugin tries to run: type=AVC msg=audit(1326802289.462:4127902): avc: denied { read write } for pid=3278 comm="yum" name="__db.001" dev=sda3 ino=8128221 scontext=unconfined_u:system_r:nagios_services_plugin_t:s0 tcontext=system_u:object_r:rpm_var_lib_t:s0 tclass=file type=SYSCALL msg=audit(1326802289.462:4127902): arch=c000003e syscall=2 success=no exit=-13 a0=1e85440 a1=2 a2=0 a3=16 items=0 ppid=3277 pid=3278 auid=56933 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=87175 comm="yum" exe="/usr/bin/python" subj=unconfined_u:system_r:nagios_services_plugin_t:s0 key=(null) Running this through audit2allow produces this output: #============= nagios_services_plugin_t ============== #!!!! This avc is allowed in the current policy allow nagios_services_plugin_t rpm_var_lib_t:file { read write }; It says the AVC is already allowed, but to make sure I packaged it and loaded the new module. But, the AVC is still blocked and the plugin can't run. I've tried running semodule -DB to force dontaudit entries to be logged to make sure I haven't missed anything that was being blocked silently. Am I misisng something else, or is something wrong? Thanks, Jonathan [1] http://exchange.nagios.org/directory/Plugins/Uncategorized/Operating-System…

3 2

selinux and openVPN and no log entries
by Ed Greshko 17 Jan '12

17 Jan '12

This is actually a "multi-part" question..... I'm on F16 using KDE. As a regular user I'm attempting to create an openVPN configuration which uses X.509 certs. I wanted to place the certs in $HOME/.openVPN but ran into a problem. The logs showed the following error: Jan 15 10:31:51 f16-1 nm-openvpn[2611]: Cannot load certificate file /home/egreshko/.openVPN/CERT: error:0200100D:system library:fopen:Permission denied: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib After a bunch of head scratching and diagnosing I guessed that it must have been due to an selinux setting and confirmed this by switching to "permissive" mode. There were no log entries for the selinux denial. I saw in the archives the pointer to http://danwalsh.livejournal.com/11673.html but running the suggested "semodule -DB" didn't result in what I expected. I didn't get any "usable" error message but these appeared instead. Jan 15 10:36:05 f16-1 sedispatch: AVC Message for setroubleshoot, dropping message. So, I have (I think) 2 questions..... 1. What would need to be done to have meaningful selinux messages written to the logs so they can be troubleshot? 2. What change could be made to allow the certs to be in $HOME/.openVPN? Another comment would also be.... Why is the default situation that no log entries or alerts are created? Doesn't that obscure the fact that a selinux issue is preventing something and making it harder to diagnose? Thanks, Ed

2 4

SSHFS (SELinux) frustrations
by Mr Dash Four 17 Jan '12

17 Jan '12

I am trying to implement SSH FS on a shared DMZ box running SELinux (the latest policy in FC15) and have the layout almost a carbon copy of what is described in [1]. I have been frustrated by multiple failures, however. The first thing I did after creating the directories is to set the SELinux domain on these: /home/sftp-chroot -d gen_context(system_u:object_r:user_home_dir_t,s0) /home/sftp-chroot/home(/.*)? gen_context(system_u:object_r:user_home_dir_t,s0) /home/sftp-chroot/dev -d gen_context(system_u:object_r:device_t,s0) /home/sftp-chroot/dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) I've also altered the rsyslog in the way described in [1] so that a log socket can be used inside chroot. I also altered the policy to enable ssh home dirs access - gen_tunable(sftpd_enable_homedirs, true) in ftp.te. On a side note, is there a way to do that in my policy (sftpd_enable_homedirs -> on), without either altering ftp.te or using setsebool? I've also noticed that /usr/libexec/openssh/sftp-server has "bin_t" type - shouldn't that be "sftpd_t"? When I try to use SSHFS with a dedicated using user account I used to get a lot of AVC's, but I eventually got them reduced to just 2 - one known (below), and one unknown: type=AVC msg=audit(1326034699.037:356): avc: denied { create } for pid=2713 comm="sshd" name="ltm-0.42.0.tar.bz2" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_home_dir_t:s0 tclass=file type=SYSCALL msg=audit(1326034699.037:356): arch=40000003 syscall=5 success=no exit=-13 a0=241388 a1=80c1 a2=81b4 a3=233284 items=0 ppid=2710 pid=2713 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=30 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) This happens when I try to copy a single file (ltm-0.42.0.tar.bz2 in this case) to the SSHFS partition. So, in effect, even though I can look at my newly-shared partition I can't do anything with it because of SELinux. If I go into permisive mode - everything is fine (though I get a lot of avcs, but that's to be expected). The other error I get is when rsyslogd starts (at the very beginning when the DMZ box starts) - I get "Permission denied" message and rsyslogd cannot open that socket in /home/sftp-chroot/dev/log for some reason - don't know why as it appears the context is properly set there! Any help? [1] - http://blog.famzah.net/2011/02/03/secure-chroot-remote-file-access-via-sftp… (Secure chroot() remote file access via SFTP and SSH)

2 3

SELinux newbie help please
by Alain Williams 16 Jan '12

16 Jan '12

I am building a new machine and am trying very hard to not do as I have done before and switch selinux off. I am having problems getting things to work. I want one user to, on login, run a script setuid root -- it needs to be able to read all files in one part of the file system to back that part up to an externally mounted USB drive. I have a small setuid root program (written in C) that just runs the shell script. 1) Making that setuid prgram user's login shell does not work. I could not see what to do. so I tried an intermediate step. 2) Giving the user a standard bash login shell, then running the setuid root program at the command line does not do what I want. I put 'id' at the start of the script and got: uid=501(backup) gid=502(backup) groups=502(backup) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 I was expecting to see a 'uid=0'. The script then fails since it cannot do things that I want it to. I am running CentOS 6. I have done a lot of reading, but end up going round in circles and much of what I read seems to be out of date or refer to commands that I do not have. I understand that I ought to perhaps produce a specific security profile for the 'backup' user - but can't see how to start. Any pointers would be gratefully received. -- Alain Williams Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer. +44 (0) 787 668 0256 http://www.phcomp.co.uk/ Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php #include <std_disclaimer.h>

3 5

adding port restrictions to policy generated by sepolgen
by Michael Atighetchi 16 Jan '12

16 Jan '12

Hi, I have a question about how to restrict network access via SELinux.I generated a policy via sepolgen on Fedora 14, and there are some network specific rules and macros in it, for example: corenet_tcp_bind_generic_node(CZtp_t) corenet_tcp_connect_postgresql_port(CZtp_t) corenet_tcp_connect_vnc_port(CZtp_t) corenet_udp_bind_generic_node(CZtp_t) allow CZtp_t self:tcp_socket { setopt read bind create accept write getattr connect shutdown getopt listen }; allow CZtp_t self:udp_socket { setopt read bind create ioctl write getattr connect getopt }; Here is what I would like to change 1) Restrict privs so that the process can only bind to a specific custom port, e.g., 2222 (controlled by my app) 2) Restrict privs so that the only processes on the local machine allowed to connect to this port is in the same domain as the process who created the listening socket (same policy as above) Is this doable? -- Michael Atighetchi Senior Scientist Raytheon BBN Technologies 617-873-1679 matighet(a)bbn.com

3 5

F17\Rawhide boot avc's
by Frank Murphy 13 Jan '12

13 Jan '12

Hi, Am getting lots of avc's and failed services on Rawhide as below. Can only boot with enforcing=0 as per: https://lists.fedoraproject.org/pipermail/devel/2012-January/161127.html Snip from my logwatch below: -------------------------------------------------- **Unmatched Entries** (Only first 10 out of 71 are printed) No rules AUDIT_STATUS: enabled=1 flag=1 pid=626 rate_limit=0 backlog_limit=320 lost=0 backlog=0 type=1130 audit(1326356505.927:102): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="plymouth-reboot" exe="/bin/systemd" hostname=? addr=? terminal=? res=failed' type=1130 audit(1326356505.678:94): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="systemd-random-seed-save" exe="/bin/systemd" hostname=? addr=? terminal=? res=success' type=1131 audit(1326356505.686:95): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="systemd-random-seed-save" exe="/bin/systemd" hostname=? addr=? terminal=? res=success' type=1131 audit(1326356505.714:96): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="dbus" exe="/bin/systemd" hostname=? addr=? terminal=? res=success' type=1130 audit(1326356505.764:97): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="alsa-store" exe="/bin/systemd" hostname=? addr=? terminal=? res=success' type=1131 audit(1326356505.766:98): user pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="alsa-store" exe="/bin/systemd" hostname=? addr=? terminal=? res=success' type=1131 audit(1326356505.785:99):Jan 12 08:22:52 test05 kernel: imklog 5.8.6, log source = /proc/kmsg started. No rules --------------------------------------------------- How can I help debug this? selinux-policy-3.10.0-74.fc17 selinux-policy-targeted-3.10.0-74.fc17 32 and 64 bit -- Regards, Frank Murphy UTF_8 Encoded Friend of fedoraproject.org

3 2

circular policy references generated by sepolgen
by Michael Atighetchi 11 Jan '12

11 Jan '12

All, I have a number of custom policies that I developed on a Fedora 14 system by using sepolgen and iterating over the policies up to a point where they are violation free. When trying to install those policies on another system, I've run into a circular dependency issue. No matter what order I call the 6 .sh scripts created by sepolgen, I always end up with missing required types, e.g.,: ---- [proxyuser@lime selinux]$ sudo ./CZwd.sh Building and Loading Policy + make -f /usr/share/selinux/devel/Makefile make: Nothing to be done for `all'. + /usr/sbin/semodule -i CZwd.pp libsepol.print_missing_requirements: CZwd's global requirements were not met: type/attribute CZfwa_t (No such file or directory). libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory). /usr/sbin/semodule: Failed! ---- Presumably, one can break these cycles by defining all required types first. Is there a manual way to do this using the SELinux tools? Thanks Michael -- Michael Atighetchi Senior Scientist Raytheon BBN Technologies 617-873-1679 matighet(a)bbn.com

3 3

Proper settings to allow web server to send mail
by SternData 11 Jan '12

11 Jan '12

I found this in my maillog: Jan 10 13:54:02 scarletfire sendmail[9824]: NOQUEUE: SYSERR(apache): can not chdir(/var/spool/clientmqueue/): Permission denied coming from an AVC: Jan 10 13:54:02 scarletfire kernel: type=1400 audit(1326225242.351:5): avc: denied { search } for pid=9824 comm="sendmail" name="clientmqueue" dev=dm-0 ino=1312124 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:mqueue_spool_t:s0 tclass=dir What is the proper settings to allow a web server to do whatever it was trying to do here... (Or was this something bad that SELINUX prevented) -- -- Steve

4 3

security contexts
by mark 09 Jan '12

09 Jan '12

In CentOS 6.2, I'm getting sshd[6116]: pam_selinux(sshd:session): Security context unconfined_u:system_r:abrt_helper_t:s0-s0:c0.c1023 is not allowed for and sshd[6116]: pam_selinux(sshd:session): Unable to get valid context for root Googling shows me nothing useful - what's causing this? Is it a process or a file that needs something changed? This is a production and home directory server, so I can't touch /.autorelabel and reboot, though I can certainly do whole directory trees. mark

2 3

MySQL's LOAD DATA INFILE statement
by Marcio B. Jr. 09 Jan '12

09 Jan '12

Hi, I'm incurring some problems with MySQL and SELinux, and I need help. Running a 64-bit Fedora 12 with mysql-server-5.1.47-2.fc12.x86_64. $ ps -eZ | grep mysqld system_u:system_r:mysqld_safe_t:s0 1321 ? 00:00:00 mysqld_safe system_u:system_r:mysqld_t:s0 1410 ? 00:00:01 mysqld My problem is: it is only possible to use "LOAD DATA INFILE" statement if SELinux is in its permissive state. Strangely, logs below show no avc denial (all I can tell from them is Chinese tried to break into, and last line probably refers to when I added mysql user to some group I created). But statement won't work in enforcing state. Nothing gives me any tip concerning the referred MySQL statement issue. # cat /var/log/audit/audit.log | grep mysql type=USER_LOGIN msg=audit(1305401554.802:34): user pid=2229 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="mysql" exe="/usr/sbin/sshd" hostname=? addr=218.241.236.69 terminal=sshd res=failed' type=USER_LOGIN msg=audit(1305401556.759:36): user pid=2229 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="mysql" exe="/usr/sbin/sshd" hostname=? addr=218.241.236.69 terminal=sshd res=failed' type=USER_LOGIN msg=audit(1305404558.850:1653): user pid=3709 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="mysql" exe="/usr/sbin/sshd" hostname=? addr=218.241.236.69 terminal=sshd res=failed' type=USER_LOGIN msg=audit(1305404560.536:1655): user pid=3709 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="mysql" exe="/usr/sbin/sshd" hostname=? addr=218.241.236.69 terminal=sshd res=failed' type=USER_LOGIN msg=audit(1305404563.834:1656): user pid=3711 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="mysql" exe="/usr/sbin/sshd" hostname=? addr=218.241.236.69 terminal=sshd res=failed' type=USER_LOGIN msg=audit(1305404566.207:1658): user pid=3711 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="mysql" exe="/usr/sbin/sshd" hostname=? addr=218.241.236.69 terminal=sshd res=failed' type=ADD_GROUP msg=audit(1322849937.081:18): user pid=1989 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding group acct="mysql" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' Firstly, where could that avc denial be in? And, well, I want to keep SELinux enforcing its policies, except for what is needed in order to make "LOAD DATA INFILE" work. So, what would be the proper way to achieve that? Marcio Barbado, Jr.

4 4

filesystem relabeling not working for /tmp after enabling SELinux
by Bennett Haselton 08 Jan '12

08 Jan '12

Quick version: Anyone know why, if you try to relabel your filesystem for SELinux, files in /tmp do not get relabeled? Detailed version: I have a CentOS 5.7 machine where I am trying to enable SELinux to improve the machine's security. I specified "SELINUX=permissive" in /etc/selinux/config and rebooted, and sestatus reports that it's on: [root@g6950-21025 tmp]# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: permissive Policy version: 21 Policy from config file: targeted But when I try to relabel the filesystem, files in /tmp do not get relabeled, although files everywhere except /tmp do get relabeled properly. I relabeled by doing # genhomedircon # touch /.autorelabel # reboot in accordance with directions at http://wiki.centos.org/HowTos/SELinux and the /.autorelabel was deleted after I rebooted (indicating that it had been processed), and most files were relabeled correctly: >> [root@g6950-21025 tmp]# ls -lZ /var/www/html/robots.txt -rw-rw-rw- root root system_u:object_r:httpd_sys_content_t /var/www/html/robots.txt >> However, the ones in /tmp were not: >> [root@g6950-21025 tmp]# ls -lZ /tmp/hostname_SKYSLICE.INFO -rw-r--r-- apache apache system_u:object_r:file_t /tmp/hostname_SKYSLICE.INFO >> (sealert says that any file of type "file_t" means it was not relabeled properly.) I have a number of CGI scripts that rely on reading and writing to files in the /tmp directory and SELinux would block most of them from working because of the labeling problem. (Plus PHP writes to /tmp so I assume many PHP scripts would have errors as well.) Any idea why the files in /tmp were not relabeled, and how to fix it? My only guess is that since I think /tmp is a different partition, maybe the relabeling relabeled everything on the "/" partition but not on /tmp? If that's correct, how would I fix it? I tried creating a file at /tmp/.autorelabel and rebooting, but that didn't work (and the file did not get deleted, suggesting it wasn't processed at all). Bennett

1 0

CIPSO Labeling of Network Packets to/from KVM Windows Guest OS
by djackso1＠rockwellcollins.com 06 Jan '12

06 Jan '12

Is there any method by which KVM in conjunction with Netlabel or other labeling function can be configured such that a statically configured label is added for all outgoing network traffic generated by a specific Windows Guest OS instance is verified and then removed for all incoming network traffic delivered to a specific Windows Guest OS instance in a manner which is transparent to Windows and Windows applications?

1 0

sealert error
by Nabeel Moidu 05 Jan '12

05 Jan '12

Hi I'm trying to create an SELinux policy for an rpm software installation. I've been getting sealerts in the var/log/messages but I am unable to view them due to this error, *[root@nmk-centos-60-1 policy]# sealert -l 6a6e02bc-23a7-4e55-adab-b06d0cdc2832 Error query_alerts error (1003): id (6a6e02bc-23a7-4e55-adab-b06d0cdc2832) not found * I believe this has to do with the setroubleshoot daemon not running. * [root@nmk-centos-60-1 policy]# service setroubleshoot status setroubleshoot: unrecognized service [root@nmk-centos-60-1 policy]# service --status-all | grep setro* I have the setroubleshoot softwares installed * [root@nmk-centos-60-1 policy]# rpm -qa | grep setroubles 92:setroubleshoot-server-3.0.38-2.1.el6.x86_64 425:setroubleshoot-plugins-3.0.16-1.el6.noarch 426:setroubleshoot-3.0.38-2.1.el6.x86_64 587:setroubleshoot-doc-3.0.38-2.1.el6.x86_64 [root@nmk-centos-60-1 policy]# * I don't see the setroubleshoot rpms creating any init script file in init.d or elsewhere. * [root@nmk-centos-60-1 policy]# rpm -qa --list setroubleshoot-server | grep -v ^/usr 1:/etc/audisp/plugins.d/sedispatch.conf 2:/etc/dbus-1/system.d/org.fedoraproject.SetroubleshootFixit.conf 3:/etc/dbus-1/system.d/org.fedoraproject.Setroubleshootd.conf 4:/etc/logrotate.d/setroubleshoot 5:/etc/setroubleshoot 6:/etc/setroubleshoot/setroubleshoot.conf 172:/var/lib/setroubleshoot 173:/var/lib/setroubleshoot/email_alert_recipients 174:/var/lib/setroubleshoot/setroubleshoot_database.xml 175:/var/log/setroubleshoot 176:/var/run/setroubleshoot *SELinux is running in permissive mode with mls type on my system.* [root@nmk-centos-60-1 policy]# sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: permissive Policy version: 24 Policy from config file: mls *I am running Centos 6.0* [root@nmk-centos-60-1 policy]# cat /etc/issue CentOS Linux release 6.0 (Final) Kernel \r on an \m [root@nmk-centos-60-1 policy]# uname -a Linux nmk-centos-60-1 2.6.32-71.el6.x86_64 #1 SMP Fri May 20 03:51:51 BST 2011 x86_64 x86_64 x86_64 GNU/Linux [root@nmk-centos-60-1 policy]# * 1) Did I miss anything with regards to the troubleshooting daemon installation ? 2) How can I fix the query alert error and view the sealert output ? Nabeel

2 2

F16: firefox in sandbox_web_t not working (blank window)
by Christoph A. 03 Jan '12

03 Jan '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I upgraded F14->F15->F16. I used to run firefox like this: sandbox -X -t sandbox_web_t firefox but since the upgrade this does not work anymore. Only a black window opens with no content. I tried also in permissive mode and I don't have anything in the audit.log. Installed package versions: libselinux-python-2.1.6-5.fc16.x86_64 libselinux-utils-2.1.6-5.fc16.x86_64 libselinux-2.1.6-5.fc16.i686 selinux-policy-3.10.0-69.fc16.noarch libselinux-devel-2.1.6-5.fc16.x86_64 libselinux-2.1.6-5.fc16.x86_64 selinux-policy-targeted-3.10.0-69.fc16.noarch policycoreutils-2.1.4-13.fc16.x86_64 policycoreutils-python-2.1.4-13.fc16.x86_64 policycoreutils-sandbox-2.1.4-13.fc16.x86_64 Is this a known problem? kind regards, Christoph -----BEGIN PGP SIGNATURE----- iEYEAREKAAYFAk8CN7cACgkQrq+riTAIEg1EaACfeFnKNqeuvw3aNN7soiVVDafN ncQAnjnObrd7tM2FNU85e4x4DN6vCEFZ =r0c/ -----END PGP SIGNATURE-----

2 2

where is "selinux.h" in F16?
by Shintaro Fujiwara 02 Jan '12

02 Jan '12

Hi, I'm trying to compile my segatex in several years late. I try to fit my segatex to F16. In F10, I had no problem but, In my program, there is a some file written down below. #include <selinux/selinux.h> This line makes an error. In Makefile, I added "-lselinux" in LIBS line. How this happened and how can I resolve this problem? Thanks in advance.

2 2

selinux denial not appearing in logs
by Edward Harvey 02 Jan '12

02 Jan '12

How can this happen? It's getting denied, but not appearing in either the audit log or the messages file. Running Centos 6 fully updated, php (drupal) inside of httpd tries to send mail via postfix (postdrop). When I have setenforce 0, the mail goes through. No errors in any logs (audit.log, error_log, messages) When I have setenforce 1, the mail gets blocked. I get this message in httpd error_log: sendmail: fatal: execvp /usr/sbin/postdrop: Permission denied sendmail: warning: command "/usr/sbin/postdrop -r" exited with status 1 sendmail: fatal: email(a)example.com(48): unable to execute /usr/sbin/postdrop -r: Success I have auditd running. In fact, I regularly use audit2allow to create allow policies on this machine. So I can confidently say normally my selinux denials get logged in the audit.log. I am at a loss to think of any reason this particular failure is not getting logged the same way my other error messages usually get logged. I believe I can write a custom allow script by hand, but I believe I probably shouldn't, or if I try, it will fail for some reason. Thanks for your help...

4 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux January 2012