selinux December 2013

selinux@lists.fedoraproject.org

12 participants
12 discussions

VASD policy
by Vadym Chepkov 23 Jan '14

23 Jan '14

Hi, I noticed just one vasd related entry found it's way into SELinux policy: # grep vasd ./serefpolicy-3.7.19/policy/modules/system/authlogin.fc /var/opt/quest/vas/vasd(/.*)? gen_context(system_u:object_r:var_auth_t,s0) vasd is part of Quest Auth Services and I wonder if somebody already has a policy defined for it or I have to start from scratch. Quest suggested to disable SELinux, of cause. Thanks, Vadym

3 5

sound within sandboxed firefox
by fedorauser 07 Jan '14

07 Jan '14

Hi, I'm running my firefox in a SELinux sandbox, but have the following problem: Sound will always play via the integrated speakers but never on the "remote" screen (which is attached via HDMI). This problem only occurs within a sandboxed firefox (but not in "natively" run firefox). Can this be fixed via a changing certain settings or is this a bug? thanks! ------------------------------------------------- VFEmail.net - http://www.vfemail.net ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the NSA's hands! $24.95 ONETIME Lifetime accounts with Privacy Features! 15GB disk! No bandwidth quotas! Commercial and Bulk Mail Options!

5 16

SELinux is preventing /usr/bin/dbus-daemon from using the sys_resource capability.
by Shintaro Fujiwara 02 Jan '14

02 Jan '14

Hi, I recently updated my box to Fedora20. I run my segatex program and got this error. [root@localhost ~]# less /var/log/audit/audit.log|grep capability type=AVC msg=audit(1388174188.785:534): avc: denied { sys_resource } for pid=2819 comm="dbus-daemon" capability=24 scontext=unconfined_u:unconfined_r:segatex_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:segatex_t:s0-s0:c0.c1023 tclass=capability ////////////////////////////////////////////////////////////////////// And, here's SETtroubleshoot Details window says. ////////////////////////////////////////////////////////////////////// Additional Information: Source Context unconfined_u:unconfined_r:segatex_t:s0-s0:c0.c1023 Target Context unconfined_u:unconfined_r:segatex_t:s0-s0:c0.c1023 Target Objects [ capability ] Source dbus-daemon Source Path /usr/bin/dbus-daemon Port <Unknown> Host localhost.localdomain Source RPM Packages dbus-1.6.12-2.fc19.i686 Target RPM Packages Policy RPM selinux-policy-3.12.1-106.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost.localdomain Platform Linux localhost.localdomain 3.11.10-301.fc20.i686+PAE #1 SMP Thu Dec 5 14:12:06 UTC 2013 i686 i686 Alert Count 1 First Seen 2013-12-28 04:56:28 JST Last Seen 2013-12-28 04:56:28 JST Local ID deb7259c-4795-48a1-a74f-61c331ddd21c Raw Audit Messages type=AVC msg=audit(1388174188.785:534): avc: denied { sys_resource } for pid=2819 comm="dbus-daemon" capability=24 scontext=unconfined_u:unconfined_r:segatex_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:segatex_t:s0-s0:c0.c1023 tclass=capability type=SYSCALL msg=audit(1388174188.785:534): arch=i386 syscall=setrlimit success=no exit=EPERM a0=7 a1=bfd61e28 a2=b7594000 a3=b8d8cee0 items=0 ppid=1 pid=2819 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1 tty=(none) comm=dbus-daemon exe=/usr/bin/dbus-daemon subj=unconfined_u:unconfined_r:segatex_t:s0-s0:c0.c1023 key=(null) Hash: dbus-daemon,segatex_t,segatex_t,capability,sys_resource ////////////////////////////////////////////////////// Is it just complaining for the more use for the resource?

2 2

A policy from scratch and permissive mode
by Stefan Schulze Frielinghaus 25 Dec '13

25 Dec '13

Hi everyone, its been a while since I wrote my last policy but today I gave it a try and ran immediately into a problem. The target is an user X11 application, so I started with the following TE file which was basically generated via selinux-polgengui: ====================================================================== policy_module(foobar, 1.0.0) attribute_role foobar_roles; roleattribute system_r foobar_roles; type foobar_t; type foobar_exec_t; application_domain(foobar_t, foobar_exec_t) role foobar_roles types foobar_t; permissive foobar_t; optional_policy(` gen_require(` type unconfined_t; role unconfined_r; ') foobar_run(unconfined_t, unconfined_r) ') ====================================================================== The interesting part of the IF file is ====================================================================== interface(`foobar_domtrans',` gen_require(` type foobar_t, foobar_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, foobar_exec_t, foobar_t) ') interface(`foobar_run',` gen_require(` type foobar_t; attribute_role foobar_roles; ') foobar_domtrans($1) roleattribute $2 foobar_roles; ') ====================================================================== Now comes the funny part. If I label the target binary as foobar_exec_t and execute it (from unconfined_t), then I receive an error message from the application itself, telling me that the application has not the rights to access a resource. However, if I label the target binary as e.g. usr_t and execute it (again from unconfined_t), then the application starts as expected and does it job. This confuses me, since I put foobar_t into permissive mode. I tried to narrow it down by disabling all dontaudit rules via "semodule -DB" and allowed everything which was then logged. However, even that did not help. I did a last try by labeling again the binary as foobar_exec_t and enabled *globally* the permissive mode. Then the application starts as expected. This is kind of strange to me since I said that the type foobar_t should be permissive. I actually expected no change if I start it as unconfined_t and transit to foobar_t, or, if I execute it as unconfined_t directly. Does someone has a pointer for me? Cheers, Stefan

1 1

New SELinux support in Coreutils
by Daniel J Walsh 18 Dec '13

18 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 http://danwalsh.livejournal.com/67751.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlKxoP0ACgkQrlYvE4MpobM8HACfWDinw72LsHgihmVUpsDYHQfp fr4AoMom60QUCptzt2FejHZkLS3e1e12 =pOXG -----END PGP SIGNATURE-----

1 0

latest F19 policy update killed qemu ?
by Dmitry Makovey 17 Dec '13

17 Dec '13

Hi everybody, today, right after update my machine refuses to start any of the VMs it was happily running just a minute ago. Some details: $ rpm -qa | grep selinux-policy selinux-policy-targeted-3.12.1-74.15.fc19.noarch selinux-policy-devel-3.12.1-74.15.fc19.noarch selinux-policy-3.12.1-74.15.fc19.noarch # grep qemu-system-x86 /var/log/audit/audit.log | audit2allow #============= svirt_t ============== allow svirt_t virt_image_t:file read; # ls -laZ /var/lib/libvirt/images/ drwx--x--x. qemu qemu system_u:object_r:virt_image_t:s0 . drwxr-xr-x. root root system_u:object_r:virt_var_lib_t:s0 .. -rw-r--r--. qemu qemu system_u:object_r:virt_image_t:s0 devstack-f.qcow2 ... in other words - I see no reason why this should fail, what did I miss? Should I head over to bugzilla and report? -- This communication is intended for the use of the recipient to whom it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communications received in error, or subsequent reply, should be deleted or destroyed. ---

2 5

FYI: I was on the dgshow.com this week talking RHEL7/Security/SELinux/Containers.
by Daniel J Walsh 17 Dec '13

17 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 http://atechnologyjobisnoexcuse.com/2013/12/37-crimes-against-humanity/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlKwXJsACgkQrlYvE4MpobO/GwCfZ/G860Lu1M6Pk8LAZ2kz7aQe sOAAnAnRHiT6NoVKNgh5DUoWhyyhchAr =sZoa -----END PGP SIGNATURE-----

1 0

[rawhide] python3, selinux policycoreutils-python, and cloud-init
by Matthew Miller 12 Dec '13

12 Dec '13

Because Python is not small, I would really like to avoid pulling Python 3 into the base cloud image until we can move Python 2 out. (Ideally, I'd like to move Python out _entirely_, but that's a long, long path. ) It looks like policycoreutils-python in Rawhide is now Python 3. Cloud-init pulls this in because when it moves things around or creates files, it then runs selinux.restorecon on them. I don't _really_ want to say that policycoreutils-python should go back to Python 2, but I don't think everything else is in the cloud image going to be ready for F21. See the change coordination page for Python3 at https://fedoraproject.org/wiki/Changes/Python_3_as_Default) What are the options here? A python 2 module in parallel? Execing /sbin/restorecon instead of using the bindings? Refactoring the code so that running restorecon all the time isn't necessary? -- Matthew Miller -- Fedora Project Architect -- <mattdm(a)fedoraproject.org>

2 2

priority between file context rules
by Vidalie Hervé 12 Dec '13

12 Dec '13

Hi, I am trying to set contexts on httpd files on a server running CentOS release 6.4 (Final). The server has several httpd running serving different hosts. The directory tree is : /WEBS/client_name/service_name/ contains configuration files, documents to serve, ... /WEBLOGS/client_name/service_name/ contains httpd logs /WEBDATA/client_name/service_name/ contains datas Here are the rules I wrote : [root@odbfi007v ~]# semanage fcontext -l | grep WEB /WEBDATA/lost\+found(/.*)? all files system_u:object_r:lost_found_t:s0 /WEBLOGS(/.*) all files system_u:object_r:httpd_log_t:s0 /WEBLOGS/lost\+found(/.*)? all files system_u:object_r:lost_found_t:s0 /WEBS/[^/]+/[^/]+/conf(/.*)? all files system_u:object_r:httpd_config_t:s0 /WEBS/[^/]+/[^/]+/docs(/.*)? all files system_u:object_r:httpd_sys_content_t:s0 /WEBS/[^/]+/[^/]+/logs all files system_u:object_r:httpd_log_t:s0 /WEBS/lost\+found(/.*)? all files system_u:object_r:lost_found_t:s0 I would like to set a default type on /WEBS and his subfolders: semanage fcontext -a -t httpd_sys_content_t '/WEBS(/.*)?' restorecon -Rv /WEBS* However, this command sets the type httpd_sys_content_t recursively on everything in /WEBS What is the priority between file context rules? I thought more precise rules will prevail on others. Regards, Hervé ________________________________ Ce message et les pièces jointes sont confidentiels et réservés à l'usage exclusif de ses destinataires. Il peut également être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de le détruire. L'intégrité du message ne pouvant être assurée sur Internet, la responsabilité de Worldline ne pourra être recherchée quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus transmis. This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.

4 19

SPICE plugin
by Ian Pilcher 10 Dec '13

10 Dec '13

Just got this when trying to use the SPICE plugin. The alert browser is telling me that I need to: setsebool -P unconfined_mozilla_plugin_transition 0 Is there any more target way to make this work? SELinux is preventing /usr/bin/remote-viewer from read access on the file /var/cache/fontconfig/beeeeb3dfe132a8a0633a017c99ce0c0-le64.cache-4. ***** Plugin restorecon (57.3 confidence) suggests ************************* If you want to fix the label. /var/cache/fontconfig/beeeeb3dfe132a8a0633a017c99ce0c0-le64.cache-4 default label should be fonts_cache_t. Then you can run restorecon. Do # /sbin/restorecon -v /var/cache/fontconfig/beeeeb3dfe132a8a0633a017c99ce0c0-le64.cache-4 ***** Plugin mozplugger (43.1 confidence) suggests ************************* If you want to use the spice-xpi package Then you must turn off SELinux controls on the Firefox plugins. Do # setsebool -P unconfined_mozilla_plugin_transition 0 ***** Plugin catchall (1.06 confidence) suggests *************************** If you believe that remote-viewer should be allowed read access on the beeeeb3dfe132a8a0633a017c99ce0c0-le64.cache-4 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep remote-viewer /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c 0.c1023 Target Context system_u:object_r:auth_cache_t:s0 Target Objects /var/cache/fontconfig/beeeeb3dfe132a8a0633a017c99c e0c0-le64.cache-4 [ file ] Source remote-viewer Source Path /usr/bin/remote-viewer Port <Unknown> Host ian.penurio.us Source RPM Packages virt-viewer-0.5.6-1.fc19.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-74.14.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name ian.penurio.us Platform Linux ian.penurio.us 3.11.10-200.fc19.x86_64 #1 SMP Mon Dec 2 20:28:03 UTC 2013 x86_64 x86_64 Alert Count 1 First Seen 2013-12-09 11:19:32 CST Last Seen 2013-12-09 11:19:32 CST Local ID 44b7c402-60fc-4573-8a7f-0d065c5ff85b Raw Audit Messages type=AVC msg=audit(1386609572.209:484): avc: denied { read } for pid=15147 comm="remote-viewer" name="beeeeb3dfe132a8a0633a017c99ce0c0-le64.cache-4" dev="dm-1" ino=13121 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:auth_cache_t:s0 tclass=file type=AVC msg=audit(1386609572.209:484): avc: denied { open } for pid=15147 comm="remote-viewer" path="/var/cache/fontconfig/beeeeb3dfe132a8a0633a017c99ce0c0-le64.cache-4" dev="dm-1" ino=13121 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:auth_cache_t:s0 tclass=file type=SYSCALL msg=audit(1386609572.209:484): arch=x86_64 syscall=open success=yes exit=ENOTTY a0=24bc310 a1=80000 a2=3126fba788 a3=0 items=0 ppid=15138 pid=15147 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=22 tty=(none) comm=remote-viewer exe=/usr/bin/remote-viewer subj=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 key=(null) Hash: remote-viewer,mozilla_plugin_t,auth_cache_t,file,read -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com Sent from the cloud -- where it's already tomorrow ========================================================================

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux December 2013