selinux November 2024

selinux@lists.fedoraproject.org

5 participants
2 discussions

Help with test failures
by Orion Poplawski 12 Dec '24

12 Dec '24

We have the following PR for zabbix SELinux policy: https://src.fedoraproject.org/rpms/zabbix/pull-request/10 and we're getting some test failures, but I can't really interpret them. :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Unsound/dangerous policy practices :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 21:15:26 ] :: [ BEGIN ] :: Running 'semodule -lfull | grep zabbix' :: [ 21:15:26 ] :: [ PASS ] :: Command 'semodule -lfull | grep zabbix' (Expected 0, got 0) :: [ 21:15:26 ] :: [ BEGIN ] :: Running 'semodule -X 200 --cil -E zabbix' :: [ 21:15:26 ] :: [ PASS ] :: Command 'semodule -X 200 --cil -E zabbix' (Expected 0, got 0) :: [ 21:15:26 ] :: [ BEGIN ] :: Running 'python3 test.py zabbix.cil policy/zabbix.te' /var/str/DSP_test/test.py:64: SyntaxWarning: invalid escape sequence '\(' out = subprocess.run(['grep', '-E', '[A-Za-z_]+\(.*\)', te_source_file], capture_output=True, text=True) :: [ 21:15:27 ] :: [ FAIL ] :: Command 'python3 test.py zabbix.cil policy/zabbix.te' (Expected 0, got 4) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 1s :: Assertions: 2 good, 1 bad :: RESULT: FAIL (Unsound/dangerous policy practices) This seems like it might be a python error in the test. :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: SELint static analysis :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 21:15:27 ] :: [ BEGIN ] :: Running 'selint -s -r -d E-005 -d W-004 -d W-005 -d W-010 -d S-001 -d S-010 --context=base-policy policy/zabbix.fc policy/zabbix.te 2>&1 | tee /tmp/tmp.DVGZL996ny' :: [ 21:15:27 ] :: [ PASS ] :: Command 'selint -s -r -d E-005 -d W-004 -d W-005 -d W-010 -d S-001 -d S-010 --context=base-policy policy/zabbix.fc policy/zabbix.te 2>&1 | tee /tmp/tmp.DVGZL996ny' (Expected 0, got 0) :: [ 21:15:27 ] :: [ BEGIN ] :: Running 'grep -v 'F-002' '/tmp/tmp.DVGZL996ny'' :: [ 21:15:27 ] :: [ FAIL ] :: Command 'grep -v 'F-002' '/tmp/tmp.DVGZL996ny'' (Expected 1, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 0s :: Assertions: 1 good, 1 bad :: RESULT: FAIL (SELint static analysis) No idea about this. In the installability teest: BAD install: zabbix-1:6.0.30-1.fc41.x86_64 (selinux AVCs) ---- type=AVC msg=audit(05/28/2024 21:15:28.247:957) : avc: denied { map_read map_write } for pid=4601 comm=selinux-autorel scontext=system_u:system_r:selinux_autorelabel_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 ---- type=AVC msg=audit(05/28/2024 21:15:28.254:958) : avc: denied { map_read map_write } for pid=4605 comm=systemd-fstab-g scontext=system_u:system_r:systemd_fstab_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 ---- type=AVC msg=audit(05/28/2024 21:15:28.261:959) : avc: denied { map_read map_write } for pid=4609 comm=systemd-gpt-aut scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 ---- type=AVC msg=audit(05/28/2024 21:15:28.273:960) : avc: denied { map_read map_write } for pid=4613 comm=systemd-rc-loca scontext=system_u:system_r:systemd_rc_local_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 ---- type=AVC msg=audit(05/28/2024 21:15:28.281:961) : avc: denied { read } for pid=4615 comm=systemd-ssh-gen name=vsock dev="devtmpfs" ino=388 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:vsock_device_t:s0 tclass=chr_file permissive=0 ---- type=AVC msg=audit(05/28/2024 21:15:28.284:962) : avc: denied { map_read map_write } for pid=4619 comm=systemd-sysv-ge scontext=system_u:system_r:systemd_sysv_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 and more, but these seem unrelated to the zabbix package. -- Orion Poplawski he/him/his - surely the least important thing about me Manager of IT Systems 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

4 5

SELinux Context for web server data files in another part of filesystem?
by Jeffrey Walton 03 Dec '24

03 Dec '24

Hi Everyone, I need a little help in determining the proper SELinux context for data files served by Nginx. SELinux is in enforcing mode. The web server static pages are at /var/www/html (for historic reasons). The data files are in the filesystem in /var, but at /var/ftc-data. There's also a soft symlink at /var/www/html/ftc-data that points to /var/ftc-data. /var/www/html is working as expected, but I am getting a 403 on the data files and the data file directory. I.e., I get a 403 on http://www.example.com/ftc-data, even though the directory is ugo+x. The filesystem topology of interest is: +------+ | /var | +------+ / \ / \ / \ www ftc-data / |+ file1.dat / |+ file2.dat / |+ file3.dat html |+ index.html |+ symlink to ftc-data /var/www and /var/www/html have system_u:object_r:httpd_sys_content_t:s0. The web server is serving the static html files Ok. /var/ftc-data has unconfined_u:object_r:var_t:s0. I am not thrilled about unconfined_u, and I am pretty sure var_t should be httpd_sys_content_t. The last wrinkle is, the data files get updated once a day using a systemd timer. So systemd needs write access to /var/ftc-data. Would someone help me understand what SELinux context should be for /var/ftc-data, please? Thanks in advance.

5 8

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux November 2024