selinux

selinux@lists.fedoraproject.org

4882 discussions

arch=c00000b7 syscall=35
by Henry Zhang 02 Jun '23

02 Jun '23

Hi folks, I want to analyze audit.log and see arch=c00000b7 syscall=35 Where can I find what c00000b7 and 35 mean respectively for arm64 device? Thanks. ---henry

2 4

find context of the command process
by Henry Zhang 01 Jun '23

01 Jun '23

Hi folks, It is hard to list a context of a process. For example: ps -ZC ls or ps -ZC tar only "ps -ZC sleep" returns context of the sleep process. # ps -ZC sleep LABEL PID TTY TIME CMD system_u:system_r:initrc_t:s0 11744 ? 00:00:00 sleep system_u:system_r:initrc_t:s0 13006 ? 00:00:00 sleep system_u:system_r:initrc_t:s0 14087 ? 00:00:00 sleep Any suggestions? --henry

2 1

Files created with the wrong context
by Dridi Boukelmoune 25 May '23

25 May '23

Greetings, I have a custom policy that has a label for a directory and all its contents, except for one specific sub-directory that uses a more specific type. When a file is created in that sub-directory, it gets the general label instead of the specific one. It looks wrong, and at least restorecon seems to agree because it will happily relabel the offending file, meeting my expectations. I must be doing something wrong, probably missing something, but I have no idea what. Or could it be a bug? The kernel module could be evaluating rules in a different order, hence the discrepancy at file creation time. In my policy file contexts are sorted from least to most specific. Anyway, I can't share that, so I made a minimal reproducer: https://github.com/dridi/selinux-lostlabel Any help appreciated, I tried really hard to understand what is going on, to no avail. The only similar search result was wrong labels in home directories showing up in several places but I couldn't find my nugget there. I initially sent an email and it's not showing up in the archive, so instead I subscribed to the list and started a new thread using the Hyperkitty interface. Apologies in advance if you receive it twice. Thanks, Dridi

2 2

Re: Relocating mysql
by Gionatan Danti 19 May '23

19 May '23

Il 2023-05-19 18:56 Casper ha scritto: > With audit2allow, you can read from "auditd" logs then try to generate > the .te file, then compile it into a Module Policy. > > If you know how to write Type Enforcement[1] (.te) file, you will have > to compile it manually into a loadable Module Policy file. This step > is done automatically by audit2allow. > > """ > Module (or Non-base) Policy - These are optional policy source files > that when compiled, can be dynamically loaded or unloaded within the > policy store. By convention these files are named after the module or > application they represent, with the compiled binary having a '.pp' > extension. These files are compiled using the checkmodule command. > """ > > CIL modules can be used with semodule because they are compiled by > semodule directly, at install time.[2] > > [1] https://selinuxproject.org/page/NB_TE > [2] https://selinuxproject.org/page/PolicyLanguage Thank you so much. Regards. -- Danti Gionatan Supporto Tecnico Assyoma S.r.l. - www.assyoma.it email: g.danti(a)assyoma.it - info(a)assyoma.it GPG public key ID: FF5F32A8

1 0

Relocating mysql
by Gionatan Danti 18 May '23

18 May '23

Hi all, I have a question about mysql relocation. I already created an equivalency rule such as "semanage fcontext --list -C" returns the following: SELinux Local fcontext Equivalence /mnt/lv_data/var/lib/mysql = /var/lib/mysql Then I created a symlink in /var/lib: system_u:object_r:mysqld_db_t:s0 26 May 17 14:39 mysql -> /mnt/lv_data/var/lib/mysql However, httpd/php can not connect to the database. The following message is logged in audit.log: type=AVC msg=audit(1684352064.936:232): avc: denied { read } for pid=8558 comm="httpd" name="mysql" dev="sda4" ino=147925 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:mysqld_db_t:s0 tclass=lnk_file permissive=0 My understanding is that httpd can not read the symlink. I expected to find a boolean to allow this kind of access, to no avail. So my question is: can I allow httpd symlink access without manually modifying the actual policy (ie: using audit2allow and the likes)? Thanks. -- Danti Gionatan Supporto Tecnico Assyoma S.r.l. - www.assyoma.it email: g.danti(a)assyoma.it - info(a)assyoma.it GPG public key ID: FF5F32A8

3 4

foresee policy triggered by a process
by Henry Zhang 13 Apr '23

13 Apr '23

Hi Folks, I want to trace policy triggered by a process from the command line. Tried ps -Z $(pgrep cmd) ----> cmd is either command or executable file name But it does not pick up any policy type. Any suggestions? Thanks. ----henry

2 1

Fwd: [Bug 2170630] New: SELinux is preventing zabbix_agentd from 'getattr' accesses on the file /proc/kcore.
by Orion Poplawski 04 Apr '23

04 Apr '23

I would really appreciate some SELinux expertise with this issue. There is a little more discussion in the report. Thanks, Orion -------- Forwarded Message -------- Subject: [Bug 2170630] New: SELinux is preventing zabbix_agentd from 'getattr' accesses on the file /proc/kcore. Date: Thu, 16 Feb 2023 20:25:15 +0000 From: bugzilla(a)redhat.com To: orion(a)nwra.com https://bugzilla.redhat.com/show_bug.cgi?id=2170630 Bug ID: 2170630 Summary: SELinux is preventing zabbix_agentd from 'getattr' accesses on the file /proc/kcore. Product: Fedora Version: 37 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:c24d6bdbf305be68dc05545d71227a8d033fc8ba37b3 982373781ae7fc12670e;VARIANT_ID=workstation; Component: zabbix Assignee: gwync(a)protonmail.com Reporter: b.gatessucks(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: bennie.joubert(a)jsdaav.com, dan(a)danny.cz, gwync(a)protonmail.com, orion(a)nwra.com Target Milestone: --- Classification: Fedora Description of problem: SELinux is preventing zabbix_agentd from 'getattr' accesses on the file /proc/kcore. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that zabbix_agentd should be allowed getattr access on the kcore file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'zabbix_agentd' --raw | audit2allow -M my-zabbixagentd # semodule -X 300 -i my-zabbixagentd.pp Additional Information: Source Context system_u:system_r:zabbix_agent_t:s0 Target Context system_u:object_r:proc_kcore_t:s0 Target Objects /proc/kcore [ file ] Source zabbix_agentd Source Path zabbix_agentd Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-37.19-1.fc37.noarch Local Policy RPM zabbix-selinux-6.0.8-1.fc37.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.1.11-200.fc37.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Feb 9 19:20:24 UTC 2023 x86_64 x86_64 Alert Count 6 First Seen 2023-02-15 20:44:35 GMT Last Seen 2023-02-16 19:44:35 GMT Local ID a7f07d90-52c4-48bf-b944-2dbf3b82932b Raw Audit Messages type=AVC msg=audit(1676576675.836:523): avc: denied { getattr } for pid=5913 comm="zabbix_agentd" path="/proc/kcore" dev="proc" ino=4026532075 scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file permissive=0 Hash: zabbix_agentd,zabbix_agent_t,proc_kcore_t,file,getattr Version-Release number of selected component: selinux-policy-targeted-37.19-1.fc37.noarch Additional info: component: zabbix reporter: libreport-2.17.4 hashmarkername: setroubleshoot kernel: 6.1.11-200.fc37.x86_64 type: libreport -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2170630 -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

1 0

How is the upstream SELinux refpolicy tied into Fedora?
by David Sommerseth 04 Apr '23

04 Apr '23

Hi, I had an upstream SELinux pull-request merged in autumn 2020 [1]. But I still don't see this SELinux boolean flag (renamed [2] to "dbus_pass_tuntap_fd") present in Fedora 38. So I wonder how the SELinux refpolicy is consumed into Fedora's SELinux policies ... when can I expect to see this in Fedora and RHEL SELinux policies? [1] <https://github.com/SELinuxProject/refpolicy/commit/79c7859a4807236693c73442…> [2] <https://github.com/SELinuxProject/refpolicy/commit/ba3818ebcc3a627bc331c61a…> -- kind regards, David Sommerseth OpenVPN Inc

4 13

Label for executable in tmp
by Aleksei Bedniakov 31 Mar '23

31 Mar '23

Hi, I have a case with script which connects via ssh, transfers executable to /tmp folder and tries to run it. SELinux is blocking the execution, which is expected behavior from a security perspective. Simple way is to create a rule `allow user_t user_home_t:file { execute };` execution, but I am unable to affect the user_t or process_t in my case. And that it is not secure to allow too wide execution rights for the /tmp folder. I believe this scenario is common, but still unable to find a way to properly handle this. Is there a proper way to do this? Thanks!

1 0

foresee rules needed
by Henry Zhang 27 Mar '23

27 Mar '23

Hi folks, Is there any way to foresee any new rule should be allowed? Now I have to wait for QA reporting new denied message from /var/log/audit/audit.log Any suggestions? --henry

1 0

← Newer
1
2
3
4
5
6
7
...
489
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux