9:35 p.m.
Hello. I started playing with SELinux on FC2, and recently moved
to FC3, and I must say it's much better now, with the targeted policy.
Congrats on this.
I still had to change a few things in my policies, though.
Following is a collection of the avc errors justifying my changes. I'm
not experienced with SElinux yet, so I may be doing something
wrong...please let me know if these changes are correct or not. Also,
the unlink allow for httpd_t is because, for some reason, when I try to
remove a file from within PHP, it uses httpd_t instead of
httpd_sys_script_t . I would also like a rule(which I'm not sure how to
write) to allow PHP programs to execute external programs, since I have
a script which receives an uploaded file, does a lot of processing with
it through external programs, and stores it in the database - when I run
that, it gives me avc execute errors trying to run bash and the other
utilities.
Apache:
Nov 12 16:50:46 fireball kernel: audit(1100285446.637:0): avc: denied
{ connectto } for pid=2522 exe=/usr/sbin/httpd path=/tmp/.s.PGSQL.5432
scontext=user_u:system_r:httpd_t tcontext=user_u:system_r:unconfined_t
tclass=unix_stream_socket
NTPd:
Nov 11 19:51:49 fireball kernel: audit(1100209909.743:0): avc: denied
{ create } for pid=2293 exe=/usr/sbin/ntpd
scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t
tclass=netlink_route_socket
Nov 11 19:51:49 fireball kernel: audit(1100209909.745:0): avc: denied
{ bind } for pid=2293 exe=/usr/sbin/ntpd
scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t
tclass=netlink_route_socket
Nov 11 19:51:49 fireball kernel: audit(1100209909.745:0): avc: denied
{ getattr } for pid=2293 exe=/usr/sbin/ntpd
scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t
tclass=netlink_route_socket
Nov 11 19:51:49 fireball kernel: audit(1100209909.747:0): avc: denied
{ write } for pid=2293 exe=/usr/sbin/ntpd
scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t
tclass=netlink_route_socket
Nov 11 19:51:49 fireball kernel: audit(1100209909.749:0): avc: denied
{ net_admin } for pid=2293 exe=/usr/sbin/ntpd capability=12
scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t
tclass=capability
Nov 11 19:51:49 fireball kernel: audit(1100209909.750:0): avc: denied
{ nlmsg_read } for pid=2293 exe=/usr/sbin/ntpd
scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t
tclass=netlink_route_socket
Nov 11 19:51:49 fireball kernel: audit(1100209909.752:0): avc: denied
{ read } for pid=2293 exe=/usr/sbin/ntpd
scontext=user_u:system_r:ntpd_t tcontext=user_u:system_r:ntpd_t
tclass=netlink_route_socket
DHCPd:
Nov 12 23:37:25 fireball kernel: audit(1100309845.314:0): avc: denied
{ create } for pid=10002 exe=/usr/sbin/dhcpd
scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t
tclass=netlink_route_socket
Nov 12 23:37:25 fireball kernel: audit(1100309845.317:0): avc: denied
{ bind } for pid=10002 exe=/usr/sbin/dhcpd
scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t
tclass=netlink_route_socket
Nov 12 23:37:25 fireball kernel: audit(1100309845.320:0): avc: denied
{ getattr } for pid=10002 exe=/usr/sbin/dhcpd
scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t
tclass=netlink_route_socket
Nov 12 23:37:25 fireball kernel: audit(1100309845.323:0): avc: denied
{ write } for pid=10002 exe=/usr/sbin/dhcpd
scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t
tclass=netlink_route_socket
Nov 12 23:37:25 fireball kernel: audit(1100309845.325:0): avc: denied
{ net_admin } for pid=10002 exe=/usr/sbin/dhcpd capability=12
scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t
tclass=capability
Nov 12 23:37:25 fireball kernel: audit(1100309845.326:0): avc: denied
{ nlmsg_read } for pid=10002 exe=/usr/sbin/dhcpd
scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t
tclass=netlink_route_socket
Nov 12 23:37:25 fireball kernel: audit(1100309845.327:0): avc: denied
{ read } for pid=10002 exe=/usr/sbin/dhcpd
scontext=root:system_r:dhcpd_t tcontext=root:system_r:dhcpd_t
tclass=netlink_route_socket
Nov 12 23:37:25 fireball kernel: audit(1100309845.909:0): avc: denied
{ unlink } for pid=10008 exe=/usr/sbin/dhcpd name=dhcpd.leases~
dev=hda1 ino=425472 scontext=root:system_r:dhcpd_t
tcontext=system_u:object_r:file_t tclass=file
named:
Nov 12 23:41:25 fireball kernel: audit(1100310085.797:0): avc: denied
{ create } for pid=10183 exe=/usr/sbin/named
scontext=root:system_r:named_t tcontext=root:system_r:named_t
tclass=netlink_route_socket
Nov 12 23:41:25 fireball kernel: audit(1100310085.798:0): avc: denied
{ bind } for pid=10183 exe=/usr/sbin/named
scontext=root:system_r:named_t tcontext=root:system_r:named_t
tclass=netlink_route_socket
Nov 12 23:41:25 fireball kernel: audit(1100310085.799:0): avc: denied
{ getattr } for pid=10183 exe=/usr/sbin/named
scontext=root:system_r:named_t tcontext=root:system_r:named_t
tclass=netlink_route_socket
Nov 12 23:41:25 fireball kernel: audit(1100310085.803:0): avc: denied
{ write } for pid=10183 exe=/usr/sbin/named
scontext=root:system_r:named_t tcontext=root:system_r:named_t
tclass=netlink_route_socket
Nov 12 23:41:25 fireball kernel: audit(1100310085.806:0): avc: denied
{ nlmsg_read } for pid=10183 exe=/usr/sbin/named
scontext=root:system_r:named_t tcontext=root:system_r:named_t
tclass=netlink_route_socket
Nov 12 23:41:25 fireball kernel: audit(1100310085.809:0): avc: denied
{ read } for pid=10183 exe=/usr/sbin/named
scontext=root:system_r:named_t tcontext=root:system_r:named_t
tclass=netlink_route_socket
Thanks,
Rodrigo