selinux

selinux@lists.fedoraproject.org

4882 discussions

unconfined_t access to a new file type
by Wart 05 Dec '23

05 Dec '23

I created a new policy module using sepolgen for my RL9 server to manage the shibboleth service, then started customizing it. Part of the new policy is a new shibboleth_etc_t file type. This system is also using puppet to manage various config files on the filesystem. The shibd process, running in its shibd_t domain, is able to read this file type with no problem, but I notice that puppet (running in the unconfined_t domain) now generates a new AVC denial when trying to access files of this new file type. Do I need to explicitly allow the unconfined_t domain access to my new file type, or is there some other piece that I'm missing? --Mike fc file: /usr/sbin/shibd -- gen_context(system_u:object_r:shibd_exec_t,s0) /etc/shibboleth(/.*)? -- gen_context(system_u:object_r:shibboleth_etc_t,s0) /var/log/shibboleth(/.*)? gen_context(system_u:object_r:shibboleth_var_log_t,s0) /var/cache/shibboleth(/.*)? gen_context(system_u:object_r:shibboleth_var_cache_t,s0) /var/run/shibboleth -d gen_context(system_u:object_r:shibboleth_var_run_t,s0) /var/run/shibboleth/shibd.sock -s gen_context(system_u:object_r:shibboleth_var_run_t,s0) /etc/shibboleth/.*.pem -- gen_context(system_u:object_r:cert_t,s0) /etc/shibboleth/.*pem -- gen_context(system_u:object_r:cert_t,s0) if file: ## <summary>policy for shibd</summary> ######################################## ## <summary> ## Execute shibd_exec_t in the shibd domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed to transition. ## </summary> ## </param> # interface(`shibd_domtrans',` gen_require(` type shibd_t, shibd_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, shibd_exec_t, shibd_t) ') ###################################### ## <summary> ## Execute shibd in the caller domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`shibd_exec',` gen_require(` type shibd_exec_t; ') corecmd_search_bin($1) can_exec($1, shibd_exec_t) ') te file: policy_module(local_shibd, 1.0.0) ######################################## # # Declarations # require { type httpd_t; type var_run_t; type cert_t; type http_port_t; type kernel_t; class file { append create getattr open read rename unlink write }; class dir { add_name remove_name search write }; class tcp_socket { name_connect }; class sock_file { create setattr write }; class unix_stream_socket { connectto }; class unix_dgram_socket { create getopt sendto setopt }; } type shibd_t; type shibd_exec_t; type shibboleth_etc_t; type shibboleth_var_log_t; type shibboleth_var_cache_t; type shibboleth_var_run_t; init_daemon_domain(shibd_t, shibd_exec_t) permissive shibd_t; ######################################## # # shibd local policy # allow shibd_t self:capability { setgid setuid }; allow shibd_t self:process { fork signal_perms }; allow shibd_t self:fifo_file rw_fifo_file_perms; allow shibd_t self:unix_stream_socket create_stream_socket_perms; domain_use_interactive_fds(shibd_t) files_read_etc_files(shibd_t) auth_use_nsswitch(shibd_t) miscfiles_read_localization(shibd_t) allow shibd_t shibboleth_etc_t:file { getattr open read }; allow shibd_t shibboleth_var_log_t:dir { add_name remove_name search write }; allow shibd_t shibboleth_var_log_t:file { append create getattr open read rename unlink write }; allow shibd_t cert_t:file { open read }; allow shibd_t shibboleth_var_run_t:dir { add_name remove_name search write }; allow shibd_t shibboleth_var_run_t:sock_file { create setattr unlink }; allow shibd_t shibboleth_var_cache_t:dir { add_name remove_name search write }; allow shibd_t shibboleth_var_cache_t:file { create getattr open read unlink write }; allow shibd_t http_port_t:tcp_socket name_connect; # Let apache talk to shibd and vice versa allow httpd_t shibboleth_etc_t:file { getattr open read }; allow httpd_t shibd_t:unix_stream_socket connectto; allow httpd_t shibboleth_var_run_t:dir search; allow httpd_t shibboleth_var_run_t:sock_file write; allow shibd_t kernel_t:unix_dgram_socket sendto; allow shibd_t self:unix_dgram_socket { create getopt setopt }; The AVC denial: ---- time->Mon Dec 4 14:40:45 2023 node=llodmt.ligo-la.caltech.edu type=PROCTITLE msg=audit(1701722445.997:630306): proctitle=707570706574206167656E743A206170706C79696E6720636F6E66696775726174696F6E node=llodmt.ligo-la.caltech.edu type=PATH msg=audit(1701722445.997:630306): item=0 name="/etc/shibboleth/shibboleth2.xml" inode=17384656 dev=09:7e mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shibboleth_etc_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 node=llodmt.ligo-la.caltech.edu type=CWD msg=audit(1701722445.997:630306): cwd="/" node=llodmt.ligo-la.caltech.edu type=SYSCALL msg=audit(1701722445.997:630306): arch=c000003e syscall=257 success=yes exit=35 a0=ffffff9c a1=7fa634a38e68 a2=80000 a3=0 items=1 ppid=2725223 pid=4135271 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="puppet" exe="/opt/puppetlabs/puppet/bin/ruby" subj=system_u:system_r:unconfined_service_t:s0 key=(null) node=llodmt.ligo-la.caltech.edu type=AVC msg=audit(1701722445.997:630306): avc: denied { open } for pid=4135271 comm="puppet" path="/etc/shibboleth/shibboleth2.xml" dev="md126" ino=17384656 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=system_u:object_r:shibboleth_etc_t:s0 tclass=file permissive=1 node=llodmt.ligo-la.caltech.edu type=AVC msg=audit(1701722445.997:630306): avc: denied { read } for pid=4135271 comm="puppet" name="shibboleth2.xml" dev="md126" ino=17384656 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=system_u:object_r:shibboleth_etc_t:s0 tclass=file permissive=1

2 2

Okay to move cobbler SELinux policy into the cobbler package?
by Orion Poplawski 13 Nov '23

13 Nov '23

Would there be any objections to moving the cobbler SELinux policy into the Fedora cobbler package as has been done with other packages? -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 3

MongoDB
by lejeczek 03 Nov '23

03 Nov '23

Hi guys. Anybody uses MongoDB on Centos? I’ve just installed vanilla-default MongoDB (following their official docs) and right away SELinux shows denials: ... SELinux is preventing /usr/bin/mongod from search access on the directory /var/lib/containers/storage/overlay-containers/fe6f1040c1373930efe68c777805ecd4c921631e3a87b8806af1fe0cdf266d8b/userdata/shm. For complete SELinux messages run: sealert -l 5263cddc-183a-472b-9098-bf4599c8453c ... What is Mongo’s business in checking such path (and there is more paths)? ... SELinux is preventing /usr/bin/mongod from search access on the directory /var/lib/nfs/rpc_pipefs. For complete SELinux messages run: sealert -l bc61357c-c100-4d44-a43a-5b90008b44b8 ... I refuse to believe (for now) that my Mongo is trojaned. Many thanks, L.

1 0

dac_override with Cobbler
by lejeczek 03 Nov '23

03 Nov '23

Hi guys. I wonder if someone might have seen _cobbler_ trying to claim this. I've tried a few sebools but regardless SELinux denies cobbler: #============= cobblerd_t ============== allow cobblerd_t self:capability dac_override; and from what I gather _dac_override_ is pretty big thing and I wonder if _cobbler_ should have it. many thanks, L.

2 2

label rootfs in compile time not run time
by Henry Zhang 30 Aug '23

30 Aug '23

Hi folks, Any document talking about how to set the SELinux security context of files and directories of rootfs at compile time. Any suggestions? Thanks. ---henry

1 0

busybox with selinux
by Henry Zhang 16 Aug '23

16 Aug '23

Hi folks, New version of SELinux complains of busybox when relabeling. My busybox was compiled as CONFIG_FEATURE_INDIVIDUAL=n That means all applets of busybox share the same inode. But SElinux requires each file assigned to an individual inode so that each file can be defined by file_contexts. Any suggestions? Thanks ---henry

2 2

conflicting specifications during booting up
by Henry Zhang 11 Aug '23

11 Aug '23

Hi guys, My selinux complains during booting. setfiles complains conflicting specifications: selinux-autorelabel.sh[1524]: /sbin/setfiles: conflicting specifications for /tmp/tmp.flCsmAYyao/usr/lib/systemd/system/smartcard.target and /tmp/tmp.flCsmAYyao/usr/lib/systemd/user/smartcard.target, using system_u:object_r:systemd_user_unit_t:s0. # ls -Z /usr/lib/systemd/system/sound.target system_u:object_r:systemd_user_unit_t:s0 /usr/lib/systemd/system/sound.target ls -Z /usr/lib/systemd/user/sound.target system_u:object_r:systemd_user_unit_t:s0 /usr/lib/systemd/user/sound.target # grep "/usr/lib/systemd/system" /etc/selinux/mcs/contexts/files/file_contexts /usr/lib/systemd/system(/.*)? system_u:object_r:systemd_unit_t:s0 /usr/lib/systemd/user(/.*)? system_u:object_r:systemd_user_unit_t:s0 My question is why "/usr/lib/systemd/system/smartcard.target " does not take systemd_unit_t from file_contexts? What is wrong in my selinux? Thanks. ----henry

1 0

selinux_init() is not executed in booting in kernel 5.15
by Henry Zhang 10 Aug '23

10 Aug '23

2 8

Found conflicting filecon rules
by Henry Zhang 24 Jul '23

24 Jul '23

Vit, I have met "Found conflicting filecon rules" at (filecon "/usr/bin/sh" file (system_u object_r shell_exec_t ((s0) (s0)))) both cli files has same issue: at .....image/var/lib/selinux/mcs/tmp/modules/100/fwmon/cil:528 at ...../image/var/lib/selinux/mcs/tmp/modules/100/base/cil:5864 How do I solve such an issue? Would you please give me a hint? ---henry

1 0

how to read cil file in selinux
by Henry Zhang 21 Jul '23

21 Jul '23

Folks, I got error: | Failed to resolve permission remove_name | Failed to resolve allow statement at build/tmp/work/fsl-linux/refpolicy-mcs/2/image/var/lib/selinux/mcs/tmp/modules/100/cert_manager/cil:342 | Failed to resolve AST | semodule: Failed! | WARNING: build/tmp/work/fsl-linux/refpolicy-mcs/2/temp/run.do_install.21106:247 exit 1 from 'semodule -p build/tmp/work/fsl-linux/refpolicy-mcs/2/image -s mcs -n -B -D' How can I read the cil file? Thanks. ---henry

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux