semanage error when upgrading to RHEL 6.5
by Andy Ruch
Hello,
I have a policy that was originally written for RHEL 6.2. I’m now trying to upgrade to RHEL 6.5 and I’m having problems with semanage. I can install a fresh RHEL 6.5 system with the targeted policy and everything works fine. I then uninstall the targeted policy and install my policy and I can’t link the linux user and selinux user.
>> semanage user –a -R sysadm_r -R staff_r -r s0-s0:c0.c1023 testuser_u
>> useradd -G wheel testuser
>> semanage login -a -r s0-s0:c0.c1023 -s testuser_u testuser
libsemanage.dbase_llist_query: could not query record value
/usr/sbin/semanage: Could not query user for testuser
I have the RHEL 6.5 source code for libsemanage and the targeted policy but so far I haven't been able to find differences that would affect this problem. Could someone please point me in the right direction as far as what semanage is expecting? What would prevent libsemanage from querying for the user?
Thanks,
Andy
9 years, 8 months
Correct way to use booleans
by Jayson Hurst
Audit2Allow is suggesting that a boolean be turned on.
#!!!! This avc can be allowed using the boolean 'allow_ypbind'
allow vasd_t ldap_port_t:tcp_socket name_bind;
setsebool -P allow_ypbind 1
Should this boolean be enabled via my domains policy, or is this something the system administrator should turn on if they know they will be using NIS?
The same question can be asked for other things like http and samba.
#!!!! This avc can be allowed using one of the these booleans:
# samba_export_all_ro, samba_export_all_rw
allow smbd_t tmp_t:file getattr;
#!!!! This avc can be allowed using one of the these booleans:
# samba_create_home_dirs, samba_export_all_rw
allow smbd_t user_home_dir_t:dir { write create add_name };
setsebool -P samba_export_all_rw 1
9 years, 9 months
Re: Knowing policy contents
by Maciej Lasyk
On Mon, Feb 24, 2014 at 10:08:52AM -0500, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 02/24/2014 04:49 AM, Maciej Lasyk wrote:
> > On Mon, Feb 24, 2014 at 09:52:02AM +0100, Dominick Grift wrote:
> >> On Mon, 2014-02-24 at 00:44 +0100, Maciej Lasyk wrote:
> >>> Hi guys,
> >>>
> >>> Let's say that I have file
> >>> /etc/selinux/targeted/modules/active/modules/lvm.pp
> >>>
> >>> What would be the easiest way to view the policy that this file
> >>> contains? Normally when creating policy myself I firstly create .te
> >>> file which contains my desired policy rules.
> >>>
> >>> But how could I know how the policy looks like for already created and
> >>> loaded policies? Let's stick to that lvm.pp as the example.
> >>>
> >>> Thanks for your help,
> >>
> >> You can use the semodule_unpackage command to extract the policy package
> >> (.pp) See man semodule_unpackage
> >>
> >> Then you can disassemble the extracted module (.mod) with the (se)dismod
> >> command ( i do not believe there is a manual for that program but its for
> >> example sedismod lvm.mod (or something))
> >>
> >> The (se)dismod program has a menu that allows you to query most of the
> >> modules content (what waas in the lvm.te) file
> >>
> >> The program is a bit unfriendly an rough on the edges but it does help
> >
> > I already tried with semodule_unpackage (found about it here:
> > http://serverfault.com/questions/321301/how-do-i-view-the-contents-of-a-s...
> >
> >
> ) but unfortunately every time I try to unpack *any* module from
> > targeted active modules I get:
> >
> > root:modules/ # semodule_unpackage lvm.pp lvm.mod
> > libsepol.module_package_read_offsets: wrong magic number for module
> > package: expected 0xf97cff8f, got 0x39685a42 semodule_unpackage: Error
> > while reading policy module from lvm.pp
> >
> > Stracing this semodule_unpackage gave me nothing, so I stucked here.
> >
> > Is there any repo that I could browse .te files from the official Fedora /
> > targeted policy?
> >
> > Maciek
> >
> >
> >
> > -- selinux mailing list selinux(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
> >
> Usually sesearch is a better solution then just looking at the source. The
> source is just going to show you the interfaces called, where is sesearch will
> show you the results.
>
> sesearch -A -s lvm_t
>
> Will show you every allow rule that effects the lvm_t process domain.
Great - thanks - that really did the job :)
9 years, 9 months
Knowing policy contents
by Maciej Lasyk
Hi guys,
Let's say that I have file
/etc/selinux/targeted/modules/active/modules/lvm.pp
What would be the easiest way to view the policy that this file
contains? Normally when creating policy myself I firstly create .te file
which contains my desired policy rules.
But how could I know how the policy looks like for already created and
loaded policies? Let's stick to that lvm.pp as the example.
Thanks for your help,
--
pozdrawiam,
Maciej Lasyk
GPG key ID: FFA8AEEC
GPG info: http://maciek.lasyk.info/gpg.txt
9 years, 9 months
Re: selinux Digest, Vol 120, Issue 17
by Lucrecia Trippel
Am 22.02.2014 um 16:14 schrieb selinux-request(a)lists.fedoraproject.org:
> Send selinux mailing list submissions to
> selinux(a)lists.fedoraproject.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://admin.fedoraproject.org/mailman/listinfo/selinux
> or, via email, send a message with subject or body 'help' to
> selinux-request(a)lists.fedoraproject.org
>
> You can reach the person managing the list at
> selinux-owner(a)lists.fedoraproject.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of selinux digest..."
>
>
> Today's Topics:
>
> 1. Re: selinux Digest, Vol 120, Issue 14 (Lucrecia Trippel)
> 2. Re: selinux Digest, Vol 120, Issue 15 (Lucrecia Trippel)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Sat, 22 Feb 2014 16:13:48 +0100
> From: Lucrecia Trippel <antracit2009(a)gmail.com>
> To: selinux(a)lists.fedoraproject.org
> Subject: Re: selinux Digest, Vol 120, Issue 14
> Message-ID: <31477F4C-C6DF-4598-AB74-8C2490985E74(a)gmail.com>
> Content-Type: text/plain; charset=windows-1252
>
>
> Am 20.02.2014 um 23:23 schrieb selinux-request(a)lists.fedoraproject.org:
>
>> Send selinux mailing list submissions to
>> selinux(a)lists.fedoraproject.org
>>
>> To subscribe or unsubscribe via the World Wide Web, visit
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>> or, via email, send a message with subject or body 'help' to
>> selinux-request(a)lists.fedoraproject.org
>>
>> You can reach the person managing the list at
>> selinux-owner(a)lists.fedoraproject.org
>>
>> When replying, please edit your Subject line so it is more specific
>> than "Re: Contents of selinux digest..."
>>
>>
>> Today's Topics:
>>
>> 1. Re: Correct way to use booleans (Daniel J Walsh)
>> 2. RE: Correct way to use booleans (Jayson Hurst)
>> 3. Re: Correct way to use booleans (Daniel J Walsh)
>> 4. RE: Correct way to use booleans (Jayson Hurst)
>> 5. Re: Correct way to use booleans (Daniel J Walsh)
>> 6. Re: semanage error when upgrading to RHEL 6.5 (Daniel J Walsh)
>> 7. Re: semanage error when upgrading to RHEL 6.5 (Andy Ruch)
>> 8. Re: semanage error when upgrading to RHEL 6.5 (Daniel J Walsh)
>> 9. Re: semanage error when upgrading to RHEL 6.5 (Andy Ruch)
>> 10. Re: semanage error when upgrading to RHEL 6.5 (Daniel J Walsh)
>>
>>
>> ----------------------------------------------------------------------
>>
>> Message: 1
>> Date: Thu, 20 Feb 2014 08:03:44 -0500
>> From: Daniel J Walsh <dwalsh(a)redhat.com>
>> To: Jayson Hurst <swazup(a)hotmail.com>,
>> "selinux(a)lists.fedoraproject.org" <selinux(a)lists.fedoraproject.org>
>> Subject: Re: Correct way to use booleans
>> Message-ID: <5305FD30.1050504(a)redhat.com>
>> Content-Type: text/plain; charset=UTF-8
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 02/19/2014 08:20 PM, Jayson Hurst wrote:
>>> Audit2Allow is suggesting that a boolean be turned on.
>>>
>>> #!!!! This avc can be allowed using the boolean 'allow_ypbind'
>>>
>>> allow vasd_t ldap_port_t:tcp_socket name_bind;
>>>
>>> setsebool -P allow_ypbind 1
>>>
>>> Should this boolean be enabled via my domains policy, or is this something
>>> the system administrator should turn on if they know they will be using
>>> NIS?
>>>
>> Only the system admin should turn this on in an NIS environment. This is an
>> incredibly permissive boolean. Allows all processes to use any network port.
>>
>>> The same question can be asked for other things like http and samba. #!!!!
>>> This avc can be allowed using one of the these booleans: #
>>> samba_export_all_ro, samba_export_all_rw
>>>
>>> allow smbd_t tmp_t:file getattr;
>> There really should not be tmp_t files on a system. Any idea how this file
>> got created? smbd_t in permissive mode?
>>
>>> #!!!! This avc can be allowed using one of the these booleans: #
>>> samba_create_home_dirs, samba_export_all_rw
>>>
>>> allow smbd_t user_home_dir_t:dir { write create add_name };
>>>
>>> setsebool -P samba_export_all_rw 1
>>>
>>>
>>>
>>>
>>>
>>> -- selinux mailing list selinux(a)lists.fedoraproject.org
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>
>> If a user is exporting the home dirs it would be better to use
>> samba_enable_home_dirs
>>
>> But if he is sharing the entire system then use samba_export_all_rw
>>
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1
>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>>
>> iEYEARECAAYFAlMF/TAACgkQrlYvE4MpobMN+gCg08PlPOaB43Nz9roPpjJ2y4vP
>> bDwAnRm8tguT3laMqY1sz3T0eaKUzcnI
>> =Wvgh
>> -----END PGP SIGNATURE-----
>>
>>
>> ------------------------------
>>
>> Message: 2
>> Date: Thu, 20 Feb 2014 09:30:40 -0700
>> From: Jayson Hurst <swazup(a)hotmail.com>
>> To: Daniel J Walsh <dwalsh(a)redhat.com>,
>> "selinux(a)lists.fedoraproject.org" <selinux(a)lists.fedoraproject.org>
>> Subject: RE: Correct way to use booleans
>> Message-ID: <BLU172-W115B3FEB4027CC4152DD06D59A0(a)phx.gbl>
>> Content-Type: text/plain; charset="iso-8859-1"
>>
>> So it sounds like booleans are meant to be set by the admin if they need that sort of thing on. In the case of samba if the admin wanted to share out user directories they would need to turn on a boolean that would allow them to do so like samba_enable_home_dirs.
>>
>> I see a few different files in /tmp that are labelled as tmp_t, but the ones I care about are the krb5cc_X files. If I use kinit to generate the krb5cc file it is labelled as user_tmp_t but if I login through ssh,local_login, gdm, etc... they get created as tmp_t. Seeing that my daemon is responsible for kerberos login I can only guess that it is generating them incorrectly. In my SELinux module should I have a transition for files created in tmp to have them created as user_tmp_t or is there a better way?
>>
>>> Date: Thu, 20 Feb 2014 08:03:44 -0500
>>> From: dwalsh(a)redhat.com
>>> To: swazup(a)hotmail.com; selinux(a)lists.fedoraproject.org
>>> Subject: Re: Correct way to use booleans
>>>
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> On 02/19/2014 08:20 PM, Jayson Hurst wrote:
>>>> Audit2Allow is suggesting that a boolean be turned on.
>>>>
>>>> #!!!! This avc can be allowed using the boolean 'allow_ypbind'
>>>>
>>>> allow vasd_t ldap_port_t:tcp_socket name_bind;
>>>>
>>>> setsebool -P allow_ypbind 1
>>>>
>>>> Should this boolean be enabled via my domains policy, or is this something
>>>> the system administrator should turn on if they know they will be using
>>>> NIS?
>>>>
>>> Only the system admin should turn this on in an NIS environment. This is an
>>> incredibly permissive boolean. Allows all processes to use any network port.
>>>
>>>> The same question can be asked for other things like http and samba. #!!!!
>>>> This avc can be allowed using one of the these booleans: #
>>>> samba_export_all_ro, samba_export_all_rw
>>>>
>>>> allow smbd_t tmp_t:file getattr;
>>> There really should not be tmp_t files on a system. Any idea how this file
>>> got created? smbd_t in permissive mode?
>>>
>>>> #!!!! This avc can be allowed using one of the these booleans: #
>>>> samba_create_home_dirs, samba_export_all_rw
>>>>
>>>> allow smbd_t user_home_dir_t:dir { write create add_name };
>>>>
>>>> setsebool -P samba_export_all_rw 1
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> -- selinux mailing list selinux(a)lists.fedoraproject.org
>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>>
>>> If a user is exporting the home dirs it would be better to use
>>> samba_enable_home_dirs
>>>
>>> But if he is sharing the entire system then use samba_export_all_rw
>>>
>>>
>>> -----BEGIN PGP SIGNATURE-----
>>> Version: GnuPG v1
>>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>>>
>>> iEYEARECAAYFAlMF/TAACgkQrlYvE4MpobMN+gCg08PlPOaB43Nz9roPpjJ2y4vP
>>> bDwAnRm8tguT3laMqY1sz3T0eaKUzcnI
>>> =Wvgh
>>> -----END PGP SIGNATURE-----
>>
>>
9 years, 9 months
Re: selinux Digest, Vol 120, Issue 16
by Lucrecia Trippel
Am 22.02.2014 um 13:00 schrieb selinux-request(a)lists.fedoraproject.org:
> Send selinux mailing list submissions to
> selinux(a)lists.fedoraproject.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://admin.fedoraproject.org/mailman/listinfo/selinux
> or, via email, send a message with subject or body 'help' to
> selinux-request(a)lists.fedoraproject.org
>
> You can reach the person managing the list at
> selinux-owner(a)lists.fedoraproject.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of selinux digest..."
>
>
> Today's Topics:
>
> 1. Re: semanage error when upgrading to RHEL 6.5 (Andy Ruch)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Fri, 21 Feb 2014 07:06:26 -0800 (PST)
> From: Andy Ruch <adruch2002(a)yahoo.com>
> To: Miroslav Grepl <mgrepl(a)redhat.com>
> Cc: Daniel J Walsh <dwalsh(a)redhat.com>, Fedora SELinux
> <selinux(a)lists.fedoraproject.org>
> Subject: Re: semanage error when upgrading to RHEL 6.5
> Message-ID:
> <1392995186.92907.YahooMailNeo(a)web124901.mail.ne1.yahoo.com>
> Content-Type: text/plain; charset=utf-8
>
>
>
>
>
>
>> On Friday, February 21, 2014 1:55 AM, Miroslav Grepl <mgrepl(a)redhat.com> wrote:
>>> On 02/20/2014 11:30 PM, Andy Ruch wrote:
>>>
>>>
>>>
>>>
>>>> On Thursday, February 20, 2014 3:23 PM, Daniel J Walsh
>> <dwalsh(a)redhat.com> wrote:
>>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>> Hash: SHA1
>>>>
>>>> On 02/20/2014 04:44 PM, Andy Ruch wrote:
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>> On Thursday, February 20, 2014 2:36 PM, Daniel J Walsh
>>>>>> <dwalsh(a)redhat.com> wrote:
>>>>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>>>> Hash: SHA1
>>>>>>
>>>>>> On 02/20/2014 03:46 PM, Andy Ruch wrote:
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> On Thursday, February 20, 2014 1:38 PM, Daniel J Walsh
>>>>>> <dwalsh(a)redhat.com>
>>>>>>> wrote:
>>>>>>>
>>>>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>>>>>> Hash: SHA1
>>>>>>>>
>>>>>>>>
>>>>>>>> On 02/19/2014 11:56 AM, Andy Ruch wrote:
>>>>>>>>> Hello,
>>>>>>>>>
>>>>>>>>> I have a policy that was originally written for
>> RHEL 6.2.
>>>> I’m now
>>>>>>>>> trying to upgrade to RHEL 6.5 and I’m having
>> problems with
>>>>>> semanage. I
>>>>>>>>> can install a fresh RHEL 6.5 system with the
>> targeted
>>>> policy and
>>>>>>>>> everything works fine. I then uninstall the
>> targeted policy
>>>> and
>>>>>> install
>>>>>>>>> my policy and I can’t link the linux user and
>> selinux user.
>>>>>>>>>
>>>>>>>>>>> semanage user –a -R sysadm_r -R staff_r
>> -r
>>>> s0-s0:c0.c1023
>>>>>>>>>>> testuser_u useradd -G wheel testuser
>> semanage login
>>>> -a -r
>>>>>>>>>>> s0-s0:c0.c1023 -s testuser_u testuser
>>>>>>>>> libsemanage.dbase_llist_query: could not query
>> record value
>>>>>>>>> /usr/sbin/semanage: Could not query user for
>> testuser
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> I have the RHEL 6.5 source code for libsemanage
>> and the
>>>> targeted
>>>>>> policy
>>>>>>>>> but so far I haven't been able to find
>> differences that
>>>> would
>>>>>> affect
>>>>>>>>> this problem. Could someone please point me in
>> the right
>>>> direction
>>>>>> as
>>>>>>>>> far as what semanage is expecting? What would
>> prevent
>>>> libsemanage
>>>>>> from
>>>>>>>>> querying for the user?
>>>>>>>>>
>>>>>>>>> Thanks, Andy
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> -- selinux mailing list
>> selinux(a)lists.fedoraproject.org
>>>>>>>>>
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>>>>>>>
>>>>>>>> What does semanage login -l and semanage user -l
>> show?
>>>> -----BEGIN
>>>>>>>> PGP SIGNATURE----- Version: GnuPG v1 Comment: Using
>> GnuPG with
>>>>>>>> Thunderbird
>>>>>> -
>>>>>>>> http://www.enigmail.net/
>>>>>>>>
>>>>>>>>
>>>> iEYEARECAAYFAlMGZ6gACgkQrlYvE4MpobPPDACfZf1lDin/LicVoZbykbsMS2rX
>>>>>>>> OuoAoIIa11SrGGVgJiFblx4aCFjPWF9o =iiCj -----END PGP
>>>> SIGNATURE-----
>>>>>>> semanage user -l shows:
>>>>>>>
>>>>>>>
>>>>>>> Labeling MLS/ MLS/ SELinux User Prefix MCS
>> Level
>>>> MCS
>>>>>>> Range SELinux Roles
>>>>>>>
>>>>>>> root user s0 s0-s0:c0.c1023
>> system_r
>>>> system_u
>>>>>>> user s0 s0-s0:c0.c1023 system_r testuser_u
>> user
>>>>>>> s0 s0-s0:c0.c1023 staff_r sysadm_r user_u
>> user
>>>>>>> s0 s0 user_r
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> semanage login -l shows:
>>>>>>>
>>>>>>>
>>>>>>> Login Name SELinux User
>> MLS/MCS Range
>>>>>>>
>>>>>>>
>>>>>>> root root
>> s0-s0:c0.c1023
>>>>>>> system_u system_u
>> s0-s0:c0.c1023
>>>> --
>>>>>>> selinux mailing list selinux(a)lists.fedoraproject.org
>>>>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>>>>>
>>>>>>>
>>>>>> And the testuser exists in /etc/passwd? -----BEGIN PGP
>> SIGNATURE-----
>>>>>> Version: GnuPG v1 Comment: Using GnuPG with Thunderbird -
>>>>>> http://www.enigmail.net/
>>>>>>
>>>>>>
>> iEYEARECAAYFAlMGdVYACgkQrlYvE4MpobPSyQCgkQxSuJh2rUYvkDcNjCo2aeai
>>>>>> DugAniPjTv6IbODBn+ADnsIPdpf1M55a =TUJs
>>>>>>
>>>>>> -----END PGP SIGNATURE-----
>>>>>>
>>>>>
>>>>> Yes. The commands "semanage user -a" and
>> "useradd"
>>>> appear to work fine.
>>>>> It's the "semanage login -a" that has trouble.
>>>>>
>>>> And this is with the stock policycoreutils or a rebuilt one?
>>>> -----BEGIN PGP SIGNATURE-----
>>>> Version: GnuPG v1
>>>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>>>>
>>>> iEYEARECAAYFAlMGgHUACgkQrlYvE4MpobOltACgqKw0AFB/7VRzT08hJRTh5A2v
>>>> i1EAn1oG1gBOGN9R3npTRx7aMdR0fV5H
>>>> =gXXZ
>>>>
>>>> -----END PGP SIGNATURE-----
>>>>
>>> Stock. Fresh install from RHEL 6.5 image. Then I remove the selinux-policy
>> and selinux-policy-targeted RPMs and add my policy RPMs.
>>
>>> --
>>> selinux mailing list
>>> selinux(a)lists.fedoraproject.org
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>> Probably not related but could you test it in permissive?
>>
>> Also any chance to strace it and send us your output?
>>
>> Regards,
>> Miroslav
>>
>
> Sorry. I should have specified that earlier. This has all been in permissive.
>
> I will work on getting an strace.
>
>
> ------------------------------
>
> --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
> End of selinux Digest, Vol 120, Issue 16
> ****************************************
9 years, 9 months
Re: selinux Digest, Vol 120, Issue 15
by Lucrecia Trippel
Am 21.02.2014 um 10:32 schrieb selinux-request(a)lists.fedoraproject.org:
> Send selinux mailing list submissions to
> selinux(a)lists.fedoraproject.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://admin.fedoraproject.org/mailman/listinfo/selinux
> or, via email, send a message with subject or body 'help' to
> selinux-request(a)lists.fedoraproject.org
>
> You can reach the person managing the list at
> selinux-owner(a)lists.fedoraproject.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of selinux digest..."
>
>
> Today's Topics:
>
> 1. Re: semanage error when upgrading to RHEL 6.5 (Andy Ruch)
> 2. RE: Correct way to use booleans (Jayson Hurst)
> 3. Re: semanage error when upgrading to RHEL 6.5 (Miroslav Grepl)
> 4. Re: Correct way to use booleans (Miroslav Grepl)
> 5. Re: how to change the context of running process (Miroslav Grepl)
> 6. Re: How to properly setup my domains security contexts in the
> domain.fc file? (Miroslav Grepl)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Thu, 20 Feb 2014 14:30:06 -0800 (PST)
> From: Andy Ruch <adruch2002(a)yahoo.com>
> To: Daniel J Walsh <dwalsh(a)redhat.com>, Fedora SELinux
> <selinux(a)lists.fedoraproject.org>
> Subject: Re: semanage error when upgrading to RHEL 6.5
> Message-ID:
> <1392935406.63212.YahooMailNeo(a)web124903.mail.ne1.yahoo.com>
> Content-Type: text/plain; charset=utf-8
>
>
>
>
>
>
>> On Thursday, February 20, 2014 3:23 PM, Daniel J Walsh <dwalsh(a)redhat.com> wrote:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 02/20/2014 04:44 PM, Andy Ruch wrote:
>>>
>>>
>>>
>>>
>>>
>>>> On Thursday, February 20, 2014 2:36 PM, Daniel J Walsh
>>>> <dwalsh(a)redhat.com> wrote:
>>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>> Hash: SHA1
>>>>
>>>> On 02/20/2014 03:46 PM, Andy Ruch wrote:
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Thursday, February 20, 2014 1:38 PM, Daniel J Walsh
>>>> <dwalsh(a)redhat.com>
>>>>> wrote:
>>>>>
>>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>>>> Hash: SHA1
>>>>>>
>>>>>>
>>>>>> On 02/19/2014 11:56 AM, Andy Ruch wrote:
>>>>>>> Hello,
>>>>>>>
>>>>>>> I have a policy that was originally written for RHEL 6.2.
>> I’m now
>>>>>>> trying to upgrade to RHEL 6.5 and I’m having problems with
>>>> semanage. I
>>>>>>> can install a fresh RHEL 6.5 system with the targeted
>> policy and
>>>>>>> everything works fine. I then uninstall the targeted policy
>> and
>>>> install
>>>>>>> my policy and I can’t link the linux user and selinux user.
>>>>>>>
>>>>>>>>> semanage user –a -R sysadm_r -R staff_r -r
>> s0-s0:c0.c1023
>>>>>>>>> testuser_u useradd -G wheel testuser semanage login
>> -a -r
>>>>>>>>> s0-s0:c0.c1023 -s testuser_u testuser
>>>>>>> libsemanage.dbase_llist_query: could not query record value
>>
>>>>>>> /usr/sbin/semanage: Could not query user for testuser
>>>>>>>
>>>>>>>
>>>>>>> I have the RHEL 6.5 source code for libsemanage and the
>> targeted
>>>> policy
>>>>>>> but so far I haven't been able to find differences that
>> would
>>>> affect
>>>>>>> this problem. Could someone please point me in the right
>> direction
>>>>>>>
>>>> as
>>>>>>> far as what semanage is expecting? What would prevent
>> libsemanage
>>>>>>>
>>>> from
>>>>>>> querying for the user?
>>>>>>>
>>>>>>> Thanks, Andy
>>>>>>>
>>>>>>>
>>>>>>> -- selinux mailing list selinux(a)lists.fedoraproject.org
>>>>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>>>>>
>>>>>> What does semanage login -l and semanage user -l show?
>> -----BEGIN
>>>>>> PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with
>>>>>> Thunderbird
>>>> -
>>>>>> http://www.enigmail.net/
>>>>>>
>>>>>>
>> iEYEARECAAYFAlMGZ6gACgkQrlYvE4MpobPPDACfZf1lDin/LicVoZbykbsMS2rX
>>>>>> OuoAoIIa11SrGGVgJiFblx4aCFjPWF9o =iiCj -----END PGP
>> SIGNATURE-----
>>>>>>
>>>>>
>>>>> semanage user -l shows:
>>>>>
>>>>>
>>>>> Labeling MLS/ MLS/ SELinux User Prefix MCS Level
>> MCS
>>>>> Range SELinux Roles
>>>>>
>>>>> root user s0 s0-s0:c0.c1023 system_r
>> system_u
>>>>> user s0 s0-s0:c0.c1023 system_r testuser_u user
>>>>> s0 s0-s0:c0.c1023 staff_r sysadm_r user_u user
>>>>> s0 s0 user_r
>>>>>
>>>>>
>>>>>
>>>>> semanage login -l shows:
>>>>>
>>>>>
>>>>> Login Name SELinux User MLS/MCS Range
>>>>>
>>>>>
>>>>> root root s0-s0:c0.c1023
>>>>> system_u system_u s0-s0:c0.c1023
>> --
>>>>> selinux mailing list selinux(a)lists.fedoraproject.org
>>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>>>
>>>>>
>>>> And the testuser exists in /etc/passwd? -----BEGIN PGP SIGNATURE-----
>>>> Version: GnuPG v1 Comment: Using GnuPG with Thunderbird -
>>>> http://www.enigmail.net/
>>>>
>>>> iEYEARECAAYFAlMGdVYACgkQrlYvE4MpobPSyQCgkQxSuJh2rUYvkDcNjCo2aeai
>>>> DugAniPjTv6IbODBn+ADnsIPdpf1M55a =TUJs
>>>>
>>>> -----END PGP SIGNATURE-----
>>>>
>>>
>>>
>>> Yes. The commands "semanage user -a" and "useradd"
>> appear to work fine.
>>> It's the "semanage login -a" that has trouble.
>>>
>> And this is with the stock policycoreutils or a rebuilt one?
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1
>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>>
>> iEYEARECAAYFAlMGgHUACgkQrlYvE4MpobOltACgqKw0AFB/7VRzT08hJRTh5A2v
>> i1EAn1oG1gBOGN9R3npTRx7aMdR0fV5H
>> =gXXZ
>>
>> -----END PGP SIGNATURE-----
>>
>
> Stock. Fresh install from RHEL 6.5 image. Then I remove the selinux-policy and selinux-policy-targeted RPMs and add my policy RPMs.
>
>
> ------------------------------
>
> Message: 2
> Date: Thu, 20 Feb 2014 16:54:18 -0700
> From: Jayson Hurst <swazup(a)hotmail.com>
> To: Daniel J Walsh <dwalsh(a)redhat.com>,
> "selinux(a)lists.fedoraproject.org" <selinux(a)lists.fedoraproject.org>
> Subject: RE: Correct way to use booleans
> Message-ID: <BLU172-W3728825C096AEDF18A065DD59A0(a)phx.gbl>
> Content-Type: text/plain; charset="iso-8859-1"
>
> I see the same thing on RHEL 6.5.
>
> So should I assume this is a bug in SElinux/OS? Even so is there a way that I can work around it? Would there be anything wrong with transitioning files I create in tmp from tmp_t to user_tmp_t?
>
>> Date: Thu, 20 Feb 2014 14:21:55 -0500
>> From: dwalsh(a)redhat.com
>> To: swazup(a)hotmail.com; selinux(a)lists.fedoraproject.org
>> Subject: Re: Correct way to use booleans
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 02/20/2014 01:41 PM, Jayson Hurst wrote:
>>> I am running in permissive mode, my module is in permissive mode.
>>>
>>> I am actually running on RHEL 6.0.
>>>
>>> So in this scenario even though my daemon is authenticating the user it is
>>> not responsible for context that the krb5cc_xxx file gets created as?
>>>
>>
>> The login daemons should be creating this file with the correct context.
>> user_tmp_t.
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1
>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>>
>> iEYEARECAAYFAlMGVdMACgkQrlYvE4MpobPm+QCfX1s69csbRU8xfg8m796N+9Si
>> cZYAmgP8bmo4vV+ug10x8tlxKSr6rTqI
>> =2zvU
>> -----END PGP SIGNATURE-----
>
>
9 years, 9 months
Re: selinux Digest, Vol 120, Issue 14
by Lucrecia Trippel
Am 20.02.2014 um 23:23 schrieb selinux-request(a)lists.fedoraproject.org:
> Send selinux mailing list submissions to
> selinux(a)lists.fedoraproject.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://admin.fedoraproject.org/mailman/listinfo/selinux
> or, via email, send a message with subject or body 'help' to
> selinux-request(a)lists.fedoraproject.org
>
> You can reach the person managing the list at
> selinux-owner(a)lists.fedoraproject.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of selinux digest..."
>
>
> Today's Topics:
>
> 1. Re: Correct way to use booleans (Daniel J Walsh)
> 2. RE: Correct way to use booleans (Jayson Hurst)
> 3. Re: Correct way to use booleans (Daniel J Walsh)
> 4. RE: Correct way to use booleans (Jayson Hurst)
> 5. Re: Correct way to use booleans (Daniel J Walsh)
> 6. Re: semanage error when upgrading to RHEL 6.5 (Daniel J Walsh)
> 7. Re: semanage error when upgrading to RHEL 6.5 (Andy Ruch)
> 8. Re: semanage error when upgrading to RHEL 6.5 (Daniel J Walsh)
> 9. Re: semanage error when upgrading to RHEL 6.5 (Andy Ruch)
> 10. Re: semanage error when upgrading to RHEL 6.5 (Daniel J Walsh)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Thu, 20 Feb 2014 08:03:44 -0500
> From: Daniel J Walsh <dwalsh(a)redhat.com>
> To: Jayson Hurst <swazup(a)hotmail.com>,
> "selinux(a)lists.fedoraproject.org" <selinux(a)lists.fedoraproject.org>
> Subject: Re: Correct way to use booleans
> Message-ID: <5305FD30.1050504(a)redhat.com>
> Content-Type: text/plain; charset=UTF-8
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 02/19/2014 08:20 PM, Jayson Hurst wrote:
>> Audit2Allow is suggesting that a boolean be turned on.
>>
>> #!!!! This avc can be allowed using the boolean 'allow_ypbind'
>>
>> allow vasd_t ldap_port_t:tcp_socket name_bind;
>>
>> setsebool -P allow_ypbind 1
>>
>> Should this boolean be enabled via my domains policy, or is this something
>> the system administrator should turn on if they know they will be using
>> NIS?
>>
> Only the system admin should turn this on in an NIS environment. This is an
> incredibly permissive boolean. Allows all processes to use any network port.
>
>> The same question can be asked for other things like http and samba. #!!!!
>> This avc can be allowed using one of the these booleans: #
>> samba_export_all_ro, samba_export_all_rw
>>
>> allow smbd_t tmp_t:file getattr;
> There really should not be tmp_t files on a system. Any idea how this file
> got created? smbd_t in permissive mode?
>
>> #!!!! This avc can be allowed using one of the these booleans: #
>> samba_create_home_dirs, samba_export_all_rw
>>
>> allow smbd_t user_home_dir_t:dir { write create add_name };
>>
>> setsebool -P samba_export_all_rw 1
>>
>>
>>
>>
>>
>> -- selinux mailing list selinux(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>
> If a user is exporting the home dirs it would be better to use
> samba_enable_home_dirs
>
> But if he is sharing the entire system then use samba_export_all_rw
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iEYEARECAAYFAlMF/TAACgkQrlYvE4MpobMN+gCg08PlPOaB43Nz9roPpjJ2y4vP
> bDwAnRm8tguT3laMqY1sz3T0eaKUzcnI
> =Wvgh
> -----END PGP SIGNATURE-----
>
>
> ------------------------------
>
> Message: 2
> Date: Thu, 20 Feb 2014 09:30:40 -0700
> From: Jayson Hurst <swazup(a)hotmail.com>
> To: Daniel J Walsh <dwalsh(a)redhat.com>,
> "selinux(a)lists.fedoraproject.org" <selinux(a)lists.fedoraproject.org>
> Subject: RE: Correct way to use booleans
> Message-ID: <BLU172-W115B3FEB4027CC4152DD06D59A0(a)phx.gbl>
> Content-Type: text/plain; charset="iso-8859-1"
>
> So it sounds like booleans are meant to be set by the admin if they need that sort of thing on. In the case of samba if the admin wanted to share out user directories they would need to turn on a boolean that would allow them to do so like samba_enable_home_dirs.
>
> I see a few different files in /tmp that are labelled as tmp_t, but the ones I care about are the krb5cc_X files. If I use kinit to generate the krb5cc file it is labelled as user_tmp_t but if I login through ssh,local_login, gdm, etc... they get created as tmp_t. Seeing that my daemon is responsible for kerberos login I can only guess that it is generating them incorrectly. In my SELinux module should I have a transition for files created in tmp to have them created as user_tmp_t or is there a better way?
>
>> Date: Thu, 20 Feb 2014 08:03:44 -0500
>> From: dwalsh(a)redhat.com
>> To: swazup(a)hotmail.com; selinux(a)lists.fedoraproject.org
>> Subject: Re: Correct way to use booleans
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 02/19/2014 08:20 PM, Jayson Hurst wrote:
>>> Audit2Allow is suggesting that a boolean be turned on.
>>>
>>> #!!!! This avc can be allowed using the boolean 'allow_ypbind'
>>>
>>> allow vasd_t ldap_port_t:tcp_socket name_bind;
>>>
>>> setsebool -P allow_ypbind 1
>>>
>>> Should this boolean be enabled via my domains policy, or is this something
>>> the system administrator should turn on if they know they will be using
>>> NIS?
>>>
>> Only the system admin should turn this on in an NIS environment. This is an
>> incredibly permissive boolean. Allows all processes to use any network port.
>>
>>> The same question can be asked for other things like http and samba. #!!!!
>>> This avc can be allowed using one of the these booleans: #
>>> samba_export_all_ro, samba_export_all_rw
>>>
>>> allow smbd_t tmp_t:file getattr;
>> There really should not be tmp_t files on a system. Any idea how this file
>> got created? smbd_t in permissive mode?
>>
>>> #!!!! This avc can be allowed using one of the these booleans: #
>>> samba_create_home_dirs, samba_export_all_rw
>>>
>>> allow smbd_t user_home_dir_t:dir { write create add_name };
>>>
>>> setsebool -P samba_export_all_rw 1
>>>
>>>
>>>
>>>
>>>
>>> -- selinux mailing list selinux(a)lists.fedoraproject.org
>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>>
>> If a user is exporting the home dirs it would be better to use
>> samba_enable_home_dirs
>>
>> But if he is sharing the entire system then use samba_export_all_rw
>>
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1
>> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>>
>> iEYEARECAAYFAlMF/TAACgkQrlYvE4MpobMN+gCg08PlPOaB43Nz9roPpjJ2y4vP
>> bDwAnRm8tguT3laMqY1sz3T0eaKUzcnI
>> =Wvgh
>> -----END PGP SIGNATURE-----
>
>
9 years, 9 months
RE: How to properly setup my domains security contexts in the domain.fc file?
by Jayson Hurst
If the context for /var/opt/quest/vas/vasd(/.*)? all files system_u:object_r:vasd_var_auth_t:s0
Is already in place before the product is installed via rpm, should rpm correctly label the dir/files as they are laid down?
Sent from my Windows Phone
________________________________
From: Daniel J Walsh<mailto:dwalsh@redhat.com>
Sent: 2/14/2014 6:52 AM
To: Jayson Hurst<mailto:swazup@hotmail.com>; selinux(a)lists.fedoraproject.org<mailto:selinux@lists.fedoraproject.org>
Subject: Re: How to properly setup my domains security contexts in the domain.fc file?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/14/2014 01:23 AM, Jayson Hurst wrote:
> The policy was in play before installing the product, also why doesn't the
> pid file get labeled correctly?
Pid files are created by the app, and the app does not look at the file
context. file_context is just there to tell SELinux aware apps how to label
content. (restorecon,rpm) If non SELinux aware apps create content then you
need file transition rules.
>
> Sent from my Windows Phone
> --------------------------------------------------------------------------------
>
>
From: Daniel J Walsh <mailto:dwalsh@redhat.com>
> Sent: 2/13/2014 6:58 PM To: Jayson Hurst <mailto:swazup@hotmail.com>;
> selinux(a)lists.fedoraproject.org <mailto:selinux@lists.fedoraproject.org>
> Subject: Re: How to properly setup my domains security contexts in the
> domain.fc file?
>
> On 02/13/2014 08:30 PM, Jayson Hurst wrote:
>> I have a file context installed as follows:
>>
>> # semanage fcontext -l | grep vasd
>>
>> /etc/rc.d/init.d/vasd regular file
>> system_u:object_r:vasd_initrc_exec_t:s0 /opt/quest/sbin/vasd regular
>> file system_u:object_r:vasd_exec_t:s0 /var/opt/quest(/.*)? all files
>> system_u:object_r:vasd_var_t:s0 /var/opt/quest/vas/vasd(/.*)? all files
>> system_u:object_r:vasd_var_auth_t:s0 /var/opt/quest/vas/vasd/.vasd.pid
>> regular file system_u:object_r:vasd_var_run_t:s0
>>
>> After a fresh install I see the following:
>>
>> # ls -laZ /var/opt/quest/vas/vasd/ drwxr-xr-x. root root
>> unconfined_u:object_r:vasd_var_t:s0 . drwxr-xr-x. root root
>> unconfined_u:object_r:vasd_var_t:s0 .. -rw-r--r--. root root
>> unconfined_u:object_r:vasd_var_t:s0 vas_ident.vdb -rw-r--r--. root root
>> unconfined_u:object_r:vasd_var_t:s0 vas_misc.vdb
>>
>>
>> Why are the files being created under /var/opt/quest/vas/vasd not being
>> labelled correctly as qasd_var_auth_t as the fcontext states? Is the
>> software installer supposed to force a relabel on a post-install?
>>
>> After a restart of the daemon I do not see the pid file being labelled
>> correctly:
>>
>> # /etc/init.d/vasd restart Stopping vasd: vasd does not appear to be
>> running. Starting vasd: [
>> OK ]
>>
>> # ls -laZ /var/opt/quest/vas/vasd/ drwxr-xr-x. daemon daemon
>> unconfined_u:object_r:vasd_var_t:s0 . drwxr-xr-x. root root
>> unconfined_u:object_r:vasd_var_t:s0 .. srwxrwxrwx. daemon daemon
>> unconfined_u:object_r:vasd_var_t:s0 .vasd_19574 srwxrwxrwx. daemon
>> daemon unconfined_u:object_r:vasd_var_t:s0 .vasd_19575 srwxrwxrwx. daemon
>> daemon unconfined_u:object_r:vasd_var_t:s0 .vasd_19576 srwxrwxrwx. daemon
>> daemon unconfined_u:object_r:vasd_var_t:s0 .vasd40_ipc_sock -rw-r--r--.
>> daemon daemon unconfined_u:object_r:vasd_var_t:s0 .vasd.pid -rw-r--r--.
>> daemon daemon unconfined_u:object_r:vasd_var_t:s0 vas_ident.vdb
>> -rw-r--r--. daemon daemon unconfined_u:object_r:vasd_var_t:s0
>> vas_misc.vdb
>>
>> After forcing a relabel:
>>
>> # restorecon -F -R /var/opt/quest/vas/vasd/
>>
>> # ls -laZ /var/opt/quest/vas/vasd/ drwxr-xr-x. daemon daemon
>> system_u:object_r:vasd_var_auth_t:s0 . drwxr-xr-x. root root
>> unconfined_u:object_r:vasd_var_t:s0 .. srwxrwxrwx. daemon daemon
>> system_u:object_r:vasd_var_auth_t:s0 .vasd_19574 srwxrwxrwx. daemon
>> daemon system_u:object_r:vasd_var_auth_t:s0 .vasd_19575 srwxrwxrwx.
>> daemon daemon system_u:object_r:vasd_var_auth_t:s0 .vasd_19576
>> srwxrwxrwx. daemon daemon system_u:object_r:vasd_var_auth_t:s0
>> .vasd40_ipc_sock -rw-r--r--. daemon daemon
>> system_u:object_r:vasd_var_auth_t:s0 .vasd.pid -rw-r--r--. daemon daemon
>> system_u:object_r:vasd_var_auth_t:s0 vas_ident.vdb -rw-r--r--. daemon
>> daemon system_u:object_r:vasd_var_auth_t:s0 vas_misc.vdb
>>
>> I get the files and directory labelled correctly, but not the pid file.
>> I can set a pid transition in the policy but then what is the point of
>> setting a file context in the <domain>.fc for the pid file if it never
>> gets picked up? Apparently I am missing something important here.
>>
>> Does anyone know a place for good documentation on this subject?
>>
>>
>>
>>
>>
>>
>>
>> -- selinux mailing list selinux(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>
> If RPM puts the files on disk and then installs your policy in post
> install, it will not fix the labels.
>
> You could create an vasd-selinux.rpm and require this to be installed
> before the vasd.rpm is installed. In that case the rpm should do the right
> thing, at least on Fedora/RHEL7. Not sure about RHEL6.
>
> Otherwise you can just run restorecon in the post install.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlL+H6YACgkQrlYvE4MpobOO0QCdGcCRlnqq7Awd6NhbBUBUVAXQ
2cEAnjuKTxPbeMJb6WJRtXPwgwUJRMIc
=IrPG
-----END PGP SIGNATURE-----
9 years, 9 months
