selinux

selinux@lists.fedoraproject.org

4 participants
4882 discussions

Not possible to specify smtp password for setroubleshootd?
by Matt Kinni 09 Jun '24

09 Jun '24

Hello, I run a Fedora 35 server and would like setroubleshootd to send email alerts for avc denials, but I'm having trouble configuring this due to the apparent lack of support for configuring an smtp password. The out of the box setroubleshoot.conf sets > smtp_host = localhost > smtp_port = 25 > from_address = SELinux_Troubleshoot , but there is no config parameter for smtp password. For this to actually work on a machine acting as an MTA (I have postfix running locally), the mail server would have to be configured to allow unauthenticated port 25 connections to masquerade as any local system user, which no decent postfix setup would allow. I am not a python programmer, but in my reading of https://pagure.io/setroubleshoot/blob/main/f/framework/src/setroubleshoot/e…, it doesn't appear there is any built in way to support authenticated email sending despite the underlying smtplib being able to do it. I would suggest either a) adding password support for smtplib, or/and b) adding an option to send mail using the sendmail binary, which allows postfix to recognize the running user without any password needed. Has anyone else run into problems deploying the setroubleshootd email alerts in practice? email_alert.py appears simple enough to hack in password support, but I feel a security oriented project like selinux shouldn't require an insecure mail setup in order to send its alerts. Any tips are welcome, Thanks, Matt

2 4

get rid of setenforce
by Henry Zhang 09 Jun '24

09 Jun '24

Hi folks, setenforce allows users to swap selinux mode between enforcing and permissive. If I want my selinux to stay in enforcing mode forever so that nobody is able to interfere with my selinux. What should I do? Thanks. ---henry

5 13

Help with test failures
by Orion Poplawski 06 Jun '24

06 Jun '24

We have the following PR for zabbix SELinux policy: https://src.fedoraproject.org/rpms/zabbix/pull-request/10 and we're getting some test failures, but I can't really interpret them. :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Unsound/dangerous policy practices :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 21:15:26 ] :: [ BEGIN ] :: Running 'semodule -lfull | grep zabbix' :: [ 21:15:26 ] :: [ PASS ] :: Command 'semodule -lfull | grep zabbix' (Expected 0, got 0) :: [ 21:15:26 ] :: [ BEGIN ] :: Running 'semodule -X 200 --cil -E zabbix' :: [ 21:15:26 ] :: [ PASS ] :: Command 'semodule -X 200 --cil -E zabbix' (Expected 0, got 0) :: [ 21:15:26 ] :: [ BEGIN ] :: Running 'python3 test.py zabbix.cil policy/zabbix.te' /var/str/DSP_test/test.py:64: SyntaxWarning: invalid escape sequence '$' out = subprocess.run(['grep', '-E', '[A-Za-z_]+\(.*$', te_source_file], capture_output=True, text=True) :: [ 21:15:27 ] :: [ FAIL ] :: Command 'python3 test.py zabbix.cil policy/zabbix.te' (Expected 0, got 4) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 1s :: Assertions: 2 good, 1 bad :: RESULT: FAIL (Unsound/dangerous policy practices) This seems like it might be a python error in the test. :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: SELint static analysis :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 21:15:27 ] :: [ BEGIN ] :: Running 'selint -s -r -d E-005 -d W-004 -d W-005 -d W-010 -d S-001 -d S-010 --context=base-policy policy/zabbix.fc policy/zabbix.te 2>&1 | tee /tmp/tmp.DVGZL996ny' :: [ 21:15:27 ] :: [ PASS ] :: Command 'selint -s -r -d E-005 -d W-004 -d W-005 -d W-010 -d S-001 -d S-010 --context=base-policy policy/zabbix.fc policy/zabbix.te 2>&1 | tee /tmp/tmp.DVGZL996ny' (Expected 0, got 0) :: [ 21:15:27 ] :: [ BEGIN ] :: Running 'grep -v 'F-002' '/tmp/tmp.DVGZL996ny'' :: [ 21:15:27 ] :: [ FAIL ] :: Command 'grep -v 'F-002' '/tmp/tmp.DVGZL996ny'' (Expected 1, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 0s :: Assertions: 1 good, 1 bad :: RESULT: FAIL (SELint static analysis) No idea about this. In the installability teest: BAD install: zabbix-1:6.0.30-1.fc41.x86_64 (selinux AVCs) ---- type=AVC msg=audit(05/28/2024 21:15:28.247:957) : avc: denied { map_read map_write } for pid=4601 comm=selinux-autorel scontext=system_u:system_r:selinux_autorelabel_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 ---- type=AVC msg=audit(05/28/2024 21:15:28.254:958) : avc: denied { map_read map_write } for pid=4605 comm=systemd-fstab-g scontext=system_u:system_r:systemd_fstab_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 ---- type=AVC msg=audit(05/28/2024 21:15:28.261:959) : avc: denied { map_read map_write } for pid=4609 comm=systemd-gpt-aut scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 ---- type=AVC msg=audit(05/28/2024 21:15:28.273:960) : avc: denied { map_read map_write } for pid=4613 comm=systemd-rc-loca scontext=system_u:system_r:systemd_rc_local_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 ---- type=AVC msg=audit(05/28/2024 21:15:28.281:961) : avc: denied { read } for pid=4615 comm=systemd-ssh-gen name=vsock dev="devtmpfs" ino=388 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:vsock_device_t:s0 tclass=chr_file permissive=0 ---- type=AVC msg=audit(05/28/2024 21:15:28.284:962) : avc: denied { map_read map_write } for pid=4619 comm=systemd-sysv-ge scontext=system_u:system_r:systemd_sysv_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 and more, but these seem unrelated to the zabbix package. -- Orion Poplawski he/him/his - surely the least important thing about me Manager of IT Systems 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

3 2

certmonger post-save scripts & certmonger_unconfined_t domain
by Sam Morris 06 Jun '24

06 Jun '24

Certmonger allows for the configuration of a post-save command to be run after it has obtained new certificates. This can be used to copy the key & certificates out of wherever certmonger is allowed to put them, and save them elsewhere with a particular owner/group, combine the certificate & chain into a single file as required by some software, etc. The problem comes with SELinux which prevents my post-save scripts from being able to do all of that. I thought the solution was to give the scripts the context of certmonger_unconfined_exec_t, which would cause a transition to the certmonger_unconfined_t domain which is as its name suggests unconfined; but I can't get this to work. I'm trying to use runcon to simulate certmonger executing a fake script: # cat /tmp/fakescript #!/bin/bash set -eu id -Z # /tmp/fakescript unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 # ls -Z /tmp/fakescript unconfined_u:object_r:certmonger_unconfined_exec_t:s0 /tmp/fakescript # runcon system_u:system_r:certmonger_t:s0 /tmp/fakescript runcon: ‘/tmp/fakescript’: Permission denied Here is the avc denial: ---- type=PROCTITLE msg=audit(27/04/21 16:16:47.156:153492) : proctitle=runcon system_u:system_r:certmonger_t:s0 /tmp/fakescript type=SYSCALL msg=audit(27/04/21 16:16:47.156:153492) : arch=x86_64 syscall=execve success=no exit=EACCES(Permission denied) a0=0x7ffd8aa768ab a1=0x7ffd8aa75888 a2=0x7ffd8aa75898 a3=0x0 items=0 ppid=177795 pid=177796 auid=sam.admin uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts5 ses=103 comm=runcon exe=/usr/bin/runcon subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(27/04/21 16:16:47.156:153492) : avc: denied { entrypoint } for pid=177796 comm=runcon path=/tmp/fakescript dev="dm-0" ino=33563064 scontext=system_u:system_r:certmonger_t:s0 tcontext=unconfined_u:object_r:certmonger_unconfined_exec_t:s0 tclass=file permissive=0 Even though: # sepolicy transition -s certmonger_t -t certmonger_unconfined_t certmonger_t @ certmonger_unconfined_exec_t --> certmonger_unconfined_t Diving in a little deeper, I can see that certmonger can execute the file: # sesearch -s certmonger_t -t certmonger_unconfined_exec_t -c file -p execute -A allow certmonger_t certmonger_unconfined_exec_t:file { execute execute_no_trans getattr ioctl map open read }; ... and that the file type is an entrypoint for the certmonger_unconfined_t domain: # sesearch -s certmonger_unconfined_t -t certmonger_unconfined_exec_t -c file -p entrypoint -A allow certmonger_unconfined_t certmonger_unconfined_exec_t:file { entrypoint execute getattr ioctl lock map open read }; ... and that transition is permitted from certmonger_t: # sesearch -s certmonger_t -t certmonger_unconfined_t -c process -p transition -A allow certmonger_t certmonger_unconfined_t:process transition; Which leaves me scratching my head, unsure why it doesn't work in practice... -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

2 4

Proper way to handle errors from python restorecon binding?
by Brian J. Murrell 09 May '24

09 May '24

It's not clear to me in which ways the restorecon() python binding can return an error/failure? Can it raise an exception or does it always simply report errors in it's return code? I.e. I need to do: rc = selinux.restorecon(path) if rc != 0: [error handling] And/or do I need a try/except block around restorecon() as something it calls could raise an exception? I have seen reference to code that calls it as such: try: selinux.restorecon(path) except selinux.SELinuxError: [error handling]

2 1

Re: [CentOS-devel] Making the redhat selinux-policy repository publicly available
by Zdenek Pytela 15 Apr '24

15 Apr '24

On Tue, Jul 11, 2023 at 10:37 PM Troy Dawson <tdawson(a)redhat.com> wrote: > On Tue, Jul 11, 2023 at 12:50 PM Neal Gompa <ngompa13(a)gmail.com> wrote: > >> On Tue, Jul 11, 2023 at 9:31 AM Troy Dawson <tdawson(a)redhat.com> wrote: >> > >> > On Tue, Jul 11, 2023 at 4:28 AM Daan De Meyer <daan.j.demeyer(a)gmail.com> >> wrote: >> >> >> >> Hi, >> >> >> >> It seems that the selinux-policy rpm is built from >> >> git@gitlab.cee.redhat.com:SELinux/selinux-policy.git which seems to be >> >> a redhat internal repository. More specifically, if I try to checkout >> >> the commit listed in the selinux-policy spec >> >> ( >> https://gitlab.com/redhat/centos-stream/rpms/selinux-policy/-/blob/c9s/seli… >> ) >> >> in the fedora-selinux repository cloned from github, I get an error >> >> saying that the commit does not exist. It would be great if the >> >> repository containing this commit was publicly available and open for >> >> external contributors just like all the other packages in CentOS >> >> Stream. Is it possible to make this happen? >> > >> > >> > I'm not the selinux-policy maintainer, so I can't comment on where they >> work on the selinux-policy source code. >> > >> > But this is how I get the sources, if that is what you are ultimately >> looking for. >> > >> > centpkg clone selinux-policy >> > cd selinux-policy >> > centpkg sources >> > or if you want to know where they really are >> > centpkg -v sources >> > This shows it to be coming from >> > >> https://sources.stream.centos.org/sources/rpms/selinux-policy/selinux-polic… >> > >> > The sources information is found in the sources file >> > >> https://gitlab.com/redhat/centos-stream/rpms/selinux-policy/-/blob/c9s/sour… >> > >> > I know this isn't exactly what you asked for, but I hope it still helps. >> > >> >> I think the idea is that having the Git repository in a public >> location would allow the CentOS Hyperscale SIG to contribute to the >> SELinux policy in a meaningful way. >> > > Ah, ok. That makes sense. > As I said, I'm not the maintainer so I don't know why it's where it is. > So I'll step out of the conversation. > Hi, I am one of the selinux-policy maintainers. Currently, repository for Fedora is at github.com and RHEL sources are in an internal repo. We have already discussed moving centos stream sources to some of the public repositories, but it did not happen. Currently we are discussing it again, there are a few options how to do so. To get just the latest repository content, steps described by Troy should work. Additionally, most of the upstream work is done in Fedora and anyway every new commit should go to Fedora first, RHEL content is mostly a subset of Fedora, there are very few differences. -- Zdenek Pytela Security SELinux team

2 3

permitting reading files in /proc owned by a user?
by James Ralston 25 Mar '24

25 Mar '24

I am writing an SELinux module to confine a commercial VPN application. The application consists of two server processes that run as root, with a “tray” process that users run. The tray process talks to the server processes via various mechanisms, including D-Bus. I have both server processes running in the myvpn_t domain. For now, my module is in permissive mode, so that I can work through the various SELinux denials and see how to best allow (or in some cases, dontaudit) the actions the server processes take. I noticed that the server processes were attempting to perform certain actions on unconfined_t directories/files. From audit2allow: allow myvpn_t unconfined_t:dir search; allow myvpn_t unconfined_t:file read; allow myvpn_t unconfined_t:lnk_file read; Looking through the raw AVC audit messages, the issue is that once the tray process contacts the server processes, the server processes begin watching the health of the tray process, by reading (e.g.): /proc/12345/exe …where 12345 is the pid of the tray process. (My guess is that the server processes are attempting to verify not just that the tray process is still running, but that it’s still the tray process, and not some other process that grabbed the same pid after the tray process exited.) Because our users run in unconfined_t, the /proc/12345 directory (and files underneath it) are owned by the user running the tray and are in the unconfined_t context. There are a bunch of macros to permit domains to perform various operations in /proc, but they all assume the file context is proc_t. So these macros aren’t really designed to permit access to the individual pid directories in /proc. If I deny (dontaudit) these accesses, I will likely break the server processes, as they will no longer be able to monitor the tray. But I see no way to grant them the access they want without doing as audit2allow suggests: allow myvpn_t unconfined_t:dir search; allow myvpn_t unconfined_t:file read; allow myvpn_t unconfined_t:lnk_file read; …which will grant the server processes the ability to read/search unconfined_t files/directories *anywhere*, not just in /proc. That’s undesirable. Is there some way to grant the above access, but only if the files/directories are in /proc? Alternatively, it occurred to me that a better solution might be to set up a transition so that when a user invokes the tray executable, it transitions to (e.g.) myvpn_user_t. But I can find vanishingly few examples of user-level transitions like this anywhere else in Fedora and/or RHEL, so I don’t know if it’s something to be avoided. (xserver_exec_t (/usr/libexec/Xorg) transitioning to xserver_t when invoked by a user context is the only obvious example I found.) Is there a better solution that I’m not seeing?

1 0

postfix as a resource under HA/cluster ?
by lejeczek 15 Feb '24

15 Feb '24

Hi guys On Centos 9 I thing with my yesterday updates I am now getting: -> $ ausearch -x /usr/sbin/postdrop --raw | audit2allow #============= postfix_postdrop_t ============== allow postfix_postdrop_t cluster_t:fifo_file write; Postifx seems to work okey but even it it does indeed, it would be nice to rid of those _errors_ I wonder if this could be something for @devel - perhaps a future _boolean_ ? These denials seem to be absent when _postfix_ is under "regular" control of _systemd_ many thanks, L.

1 0

execstack protections doesn't work for executables
by Dmitry Mastykin 23 Jan '24

23 Jan '24

Dear all, I'm on Fedora release 37 and have two files with execstack flag set: $ readelf -a ./testx | grep -A1 STACK GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RWE 0x10 $ readelf -a ./libtestx.so | grep -A1 STACK GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RWE 0x10 Protection is enabled: # getsebool selinuxuser_execstack selinuxuser_execstack --> off Library is not loadable: $ enable -f ./libtestx.so x -bash: enable: cannot open shared object ./libtestx.so: ./libtestx.so: cannot enable executable stack as shared object requires: Permission denied type=AVC msg=audit(01/23/2024 15:44:26.837:637) : avc: denied { execstack } for pid=1685 comm=bash scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 But the executable runs without restriction: $ ./testx This executable should be rejected as execstack Is it wrong behaviour? I think that the needed LSM hook is not called from all the needed places in the kernel. I wrote a mail about this here: https://www.spinics.net/lists/linux-security-module/msg56376.html Usually kernel people pay attention to problems that really affect users. So if someone could confirm the problem - it would help to fix it. Thank you for the attention. Kind regards, Dmitry Mastykin

1 0

relabelto and relabelfrom
by Henry Zhang 18 Dec '23

18 Dec '23

Hi folks, In SELinux, relabelto and relabelfrom are terms that inform the policy if a relabel operation (change of context) is allowed from a particular label (context) or towards a particular label (context). Without using them, no relabel is allowed? Thanks. ---henry

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux