selinux August 2013

selinux@lists.fedoraproject.org

14 participants
15 discussions

Creating and packaging a new policy module
by Juan Orti Alcaine 22 Aug '13

22 Aug '13

Hello, I'm the package mantainer of gogoc, and I'm creating my first policy module for it following the instructions of this draft in the wiki [1]. It says you must build your module for three policies: mls, scritct and targeted, but I don't see any strict policy, is this information still correct? Must I build it also for minimum? Also I have doubts if the module will always live in the gogoc package or it will be migrated sometime to the main selinux-policy-targeted package. If you can take a look at the policy to find any possible error it would be great. It's already in the git repository of gogoc [2] Kind regards. [1] https://fedoraproject.org/wiki/SELinux_Policy_Modules_Packaging_Draft [2] http://pkgs.fedoraproject.org/cgit/gogoc.git/tree/

3 8

Issue with semodule after fedup to Fedora 19
by David Highley 11 Aug '13

11 Aug '13

After doing a fedup upgrade process from Fedora 18 to Fedora 19 I'm getting the following error when trying to install a local policy to fix some avc issue: semodule -i *.te libsepol.module_package_read_offsets: wrong magic number for module package: expected 0xf97cff8f, got 0x75646f6d libsemanage.parse_module_headers: Could not parse module data. semodule: Failed on my_sosreport.te! The te file looks like this: module my_sosreport 1.0; require { type sosreport_t; type configfs_t; type devpts_t; type initctl_t; class chr_file { getattr }; class dir { getattr }; class fifo_file { getattr }; } #============= sosreport_t ============== allow sosreport_t configfs_t:dir getattr; allow sosreport_t devpts_t:chr_file getattr; allow sosreport_t initctl_t:fifo_file getattr; The audit avc look like the following: ---- time->Sat Aug 10 16:38:22 2013 type=SYSCALL msg=audit(1376177902.497:110): arch=c000003e syscall=16 success=no exit=-65 a0=3 a1=8940 a2=7fff72ed5bf0 a3=7fff72ed59a0 items=0 ppid=3710 pid=3736 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=429 4967295 tty=(none) comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:sos report_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1376177902.497:110): avc: denied { module_request } for pi d=3736 comm="brctl" kmod="bridge" scontext=system_u:system_r:sosreport_t:s0-s0:c 0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=system ---- time->Sat Aug 10 16:38:22 2013 type=SYSCALL msg=audit(1376177902.968:111): arch=c000003e syscall=6 success=no e xit=-13 a0=7fff425f9af0 a1=1dcd140 a2=1dcd140 a3=fffff800 items=0 ppid=3710 pid= 3764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses =4294967295 tty=(none) comm="ls" exe="/usr/bin/ls" subj=system_u:system_r:sosrep ort_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1376177902.968:111): avc: denied { getattr } for pid=3764 comm="ls" path="/dev/initctl" dev="devtmpfs" ino=8906 scontext=system_u:system_r :sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initctl_t:s0 tclass=fifo_ file ---- ---- time->Sat Aug 10 16:38:22 2013 type=SYSCALL msg=audit(1376177902.980:112): arch=c000003e syscall=6 success=no exit=-13 a0=7fff425f9af0 a1=1ddbb30 a2=1ddbb30 a3=fffffff8 items=0 ppid=3710 pid=3764 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="ls" exe="/usr/bin/ls" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1376177902.980:112): avc: denied { getattr } for pid=3764 comm="ls" path="/dev/pts/ptmx" dev="devpts" ino=2 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:devpts_t:s0 tclass=chr_file ---- time->Sat Aug 10 16:38:23 2013 type=SYSCALL msg=audit(1376177903.375:113): arch=c000003e syscall=4 success=no exit=-13 a0=2051cb0 a1=7fff82adf0c0 a2=7fff82adf0c0 a3=0 items=0 ppid=3710 pid=3772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="df" exe="/usr/bin/df" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1376177903.375:113): avc: denied { getattr } for pid=3772 comm="df" path="/sys/fs/pstore" dev="pstore" ino=9238 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:pstorefs_t:s0 tclass=dir ---- time->Sat Aug 10 16:38:23 2013 type=SYSCALL msg=audit(1376177903.408:114): arch=c000003e syscall=4 success=no exit=-13 a0=2052470 a1=7fff82adf0c0 a2=7fff82adf0c0 a3=0 items=0 ppid=3710 pid=3772 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="df" exe="/usr/bin/df" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1376177903.408:114): avc: denied { getattr } for pid=3772 comm="df" path="/sys/kernel/config" dev="configfs" ino=15409 scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:object_r:configfs_t:s0 tclass=dir ---- time->Sat Aug 10 16:38:24 2013 type=SYSCALL msg=audit(1376177904.575:115): arch=c000003e syscall=41 success=no exit=-13 a0=10 a1=80803 a2=f a3=d2be50 items=0 ppid=3710 pid=3803 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="lsusb" exe="/usr/bin/lsusb" subj=system_u:system_r:sosreport_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1376177904.575:115): avc: denied { create } for pid=3803 comm="lsusb" scontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sosreport_t:s0-s0:c0.c1023 tclass=netlink_kobject_uevent_socket

2 2

Puppet 3 troubles on F19
by Robin Lee Powell 05 Aug '13

05 Aug '13

So I just upgraded to F19, which means I get Puppet 3 (yay!). I'm running with unconfined disabled. Unfortunately, it looks like the policy hasn't been updated for puppet in quite a while. For example, from serefpolicy-contrib-3.12.1/puppet.fc (which I got from selinux-policy-3.12.1-66.fc19.src.rpm ) I see: /etc/rc\.d/init\.d/puppet -- gen_context(system_u:object_r:puppet_initrc_exec_t,s0) /etc/rc\.d/init\.d/puppetmaster -- gen_context(system_u:object_r:puppetmaster_initrc_exec_t,s0) /usr/sbin/puppetca -- gen_context(system_u:object_r:puppetca_exec_t,s0) /usr/sbin/puppetd -- gen_context(system_u:object_r:puppet_exec_t,s0) /usr/sbin/puppetmasterd -- gen_context(system_u:object_r:puppetmaster_exec_t,s0) Not a one of those files exists anymore. This means that things go quite poorly. For example, "sudo systemctl restart puppetmaster.service" gets me: type=AVC msg=audit(07/29/2013 22:07:49.780:2300368) : avc: denied { open } for pid=28302 comm=ruby-mri path=/var/lib/puppet/ssl/ca/ca_key.pem dev="dm-1" ino=401335 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file type=AVC msg=audit(07/29/2013 22:07:49.780:2300368) : avc: denied { read } for pid=28302 comm=ruby-mri name=ca_key.pem dev="dm-1" ino=401335 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file ---- type=AVC msg=audit(07/29/2013 22:07:49.780:2300369) : avc: denied { ioctl } for pid=28302 comm=ruby-mri path=/var/lib/puppet/ssl/ca/ca_key.pem dev="dm-1" ino=401335 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file ---- type=AVC msg=audit(07/29/2013 22:07:49.966:2300370) : avc: denied { create } for pid=28307 comm=ruby-mri name=master.pid scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_var_run_t:s0 tclass=file type=AVC msg=audit(07/29/2013 22:07:49.966:2300370) : avc: denied { add_name } for pid=28307 comm=ruby-mri name=master.pid scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_var_run_t:s0 tclass=dir ---- type=SOCKADDR msg=audit(07/29/2013 22:07:49.982:2300371) : saddr=inet host:0.0.0.0 serv:8140 type=AVC msg=audit(07/29/2013 22:07:49.982:2300371) : avc: denied { name_bind } for pid=28307 comm=ruby-mri src=8140 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:puppet_port_t:s0 tclass=tcp_socket because it's running as initrc_t instead of puppetmaster_t: system_u:system_r:initrc_t:s0 puppet 28307 0.0 0.5 309556 43464 ? Ssl 22:07 0:00 /usr/bin/ruby-mri /usr/bin/puppet master My knowledge of puppet is considerable, but my selinux is only decent. In particular, the Right Thing here is for the systemd launch of puppetmaster to put things into the right context, but I've no idea how to accomplish that. Is there someone I can work with to fix up this policy? -Robin

3 7

Executables in a home directory
by mark 05 Aug '13

05 Aug '13

We've got a service (motion) that has an NFS-mounted home directory. In that directory is ./bin, and some executables. Is there a boolean to allow that to be executed, or do I have to add a policy to allow that on every system that is running the service? Btw, the system it just showed up on is a newly updated FC19. mark

2 1

Oracle d/b file and dumpfile contexts
by mark 02 Aug '13

02 Aug '13

Hi, folks, Googling is just getting me how to set the contexts on the Oracle executables and libraries; I have yet to find anything that tells me the appropriate context for the database files and dumpfiles themselves. Clues for the poor? mark

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux August 2013