Re: AVC denied messages for openvpn and procmail

[Daniel J Walsh]

Tony Molloy wrote:
>  Hi,
>
>  I'm trying to get up to speed on SElinux so sorry for being so long.
>
>  I've managed to get rid of various avc denied messages. However I'm 
>  getting the following two AVC denied messages from setroubleshoot. They 
>  are not causing any problems but I would like to know how to go about 
>  getting rid of them. Would I need to have some sort of local policy.
>
>  I'll include the complete message here.
>
>    
> > Summary
> >     
>
>    
> > SELinux is preventing /sbin/ifconfig (ifconfig_t) "write" 
> > to /etc/openvpn/openvpn.log (openvpn_etc_t).
> >     
>
>    
> > Detailed Description
> >     
>
>    
> > SELinux denied access requested by /sbin/ifconfig. It is not expected 
> > that this access is required by /sbin/ifconfig and this access may 
> > signal an intrusion attempt. It is also possible that the specific 
> > version or configuration of the application is causing it to require 
> > additional access.
> >     
>
>    
> > Allowing Access
> >     
>
>    
> > Sometimes labeling problems can cause SELinux denials. You could try to 
> > restore the default system file context for /etc/openvpn/openvpn.log, 
> > restorecon -v /etc/openvpn/openvpn.log If this does not work, there is 
> > currently no automatic way to allow this access. Instead, you can 
> > generate a local policy module to allow this access - see FAQ Or you can 
> > disable SELinux protection altogether. Disabling SELinux protection is 
> > not recommended. Please file a bug report against this package.
> >     
>
>    
> > Additional Information
> >     
>
>    
> > Source Context	system_u:system_r:ifconfig_t:s0
> > Target Context	system_u:object_r:openvpn_etc_t:s0
> > Target Objects	/etc/openvpn/openvpn.log [ file ]
> > Affected RPM Packages	net-tools-1.60-73 [application]
> > Policy RPM	selinux-policy-2.4.3-10.fc6
> > Selinux Enabled	True
> > Policy Type	targeted
> > MLS Enabled	True
> > Enforcing Mode	Enforcing
> > Plugin Name	plugins.catchall
> > Host Name	localhost
> > Platform	Linux localhost 2.6.18-1.8492.fc6 #1 SMP Fri Nov 10 12:45:28 EST 
> > 2006 i686 i686
> >     
>
>    
> > Raw Audit Messages
> >     
>
>    
> > avc: denied { write } for comm='"ifconfig"' dev='sda10'
> egid='0' euid='0' 
> > exe='"/sbin/ifconfig"' exit='0' fsgid='0'
> fsuid='0' gid='0' items='0' 
> > name='"openvpn.log"'
> path='"/etc/openvpn/openvpn.log"' pid='2983' 
> > scontext=system_u:system_r:ifconfig_t:s0 sgid='0' 
> > subj='system_u:system_r:ifconfig_t:s0' suid='0' tclass='file'
>
> > tcontext=system_u:object_r:openvpn_etc_t:s0 tty='(none)' uid='0' 
> >     
>
>  This is on a laptop. I tried "restorecon -v /etc/openvpn/openvpn.log"  but 
>  since openvpn.log is recreated on each boot then it's always going to 
>  have the wrong label. How can I get rid of this. 
>     
This is a bug in openvpn.  Please report to them that they are leaking 
the open file descript to their log file.   Basically it is leaking a 
file descriptor which is causing this access.  This is not really a 
problem.  In that ifconfig does not need this access to function 
correctly.  You can tell setroubleshoot to ignore the message and it 
will stop bothering you, until openvpn fixes their problem.
>    
> > Summary
> >     
>
>    
> > SELinux is preventing access to files with the default label, default_t.
> >     
>
>    
> > Detailed Description
> >     
>
>    
> > These files have the default label on them. This can indicate a labeling 
> > problem, especially if the files being referred to are not top level 
> > directories. IE everything under /usr, /var. /dev, /tmp, ... should not 
> > be labeled with the default label. The default label is for files who do 
> > not have a label on a parent directory. So if you create a new directory 
> > in / you might legitimately get this label.
> >     
>
>    
> > Allowing Access
> >     
>
>    
> > If you want a confined domain to use these files you will probably need 
> > to relabel the file/directory with chcon. In some cases it is just 
> > easier to relabel the system, to relabel execute: "touch /.autorelabel; 
> > reboot"
> >     
>
>    
> > Additional Information
> >     
>
>    
> > Source Context	system_u:system_r:procmail_t:s0
> > Target Context	system_u:object_r:default_t:s0
> > Target Objects	/ [ dir ]
> > Affected RPM Packages	procmail-3.22-17.1 [application]filesystem-2.4.0-1 
> > [target]
> > Policy RPM	selinux-policy-2.4.3-10.fc6
> > Selinux Enabled	True
> > Policy Type	targeted
> > MLS Enabled	True
> > Enforcing Mode	Enforcing
> > Plugin Name	plugins.default
> > Host Name	localhost
> > Platform	Linux localhost 2.6.18-1.2849.fc6 #1 SMP Fri Nov 10 12:45:28 EST 
> > 2006 i686 i686
> >     
>
>    
> > Raw Audit Messages
> >     
>
>    
> > avc: denied { search } for comm='"procmail"' dev='sda8'
> egid='12' 
> > euid='0' exe='"/usr/bin/procmail"' exit='-13'
> fsgid='12' fsuid='0' 
> > gid='12' items='0' name='"/"' pid='3112' 
> > scontext=system_u:system_r:procmail_t:s0 sgid='12' 
> > subj='system_u:system_r:procmail_t:s0' suid='0' tclass='dir'
>
> > tcontext=system_u:object_r:default_t:s0 tty='(none)' uid='0' 
> >     
>
>
>  Again I tried "touch /.autorelabel; >reboot" but I keep getting the avc 
>  denied message.
>
>  Regards,
>
>  Tony
>     
/ should be labeled root_t? not default_t?

ls -lZd /
restorcon /
ls -lZd /