Where are targeted policy sources for FC5?

[James Garrison]

Many references exist to an RPM package called
selinux-policy-targeted-sources in FC4, but this
package doesn't seem to exist in FC5. Anyonw know
where the corresponding package for FC5 is located?

-- 
James Garrison                                Athens Group, Inc.
mailto:[e-mail]                    5608 Parkcrest Dr
http://www.athensgroup.com                    Austin, TX 78731
SKYPE callto:jhg-athensgroup                  [phone] x150
PGP: RSA=0x92E90A3B DH/DSS=0x498D331C

[Paul Howarth]

On Thu, 2006-05-11 at 07:26 -0500, James Garrison wrote:
>  Many references exist to an RPM package called
>  selinux-policy-targeted-sources in FC4, but this
>  package doesn't seem to exist in FC5. Anyonw know
>  where the corresponding package for FC5 is located? 
The policies are built from the selinux-policy SRPM in FC5. Like with
kernel-source, shipping a binary package for sources is no longer done.

Paul.

selinux preventing Bugzilla on FC5

[James Garrison]

Objective:   Run bugzilla on FC5
Problem:     selinux is getting in the way

First I had to change the file context for all of Bugzilla
to httpd_sys_content_t, and the .cgi components to
httpd_sys_script_exec_t.  Next, I get the following when
Bugzilla tries to open a tcp socket to talk to the database:

>  May 11 16:26:34 bugzilla kernel: audit(1147382794.700:3): avc:  
>  denied  { create } for  pid=18527 comm="index.cgi" 
>  scontext=user_u:system_r:httpd_sys_script_t:s0 
>  tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=tcp_socket 
No problem, according to the FAQ, just make a local module with audit2allow
and install it with semodule.  Here's what actually happens:

>  [jhg@bugzilla ~]$ audit2allow -M local < avc.dat
>  Generating type enforcment file: local.te
>  Compiling policy
>  checkmodule -M -m -o local.mod local.te
>  semodule_package -o local.pp -m local.mod
>
>  ******************** IMPORTANT ***********************
>
>  In order to load this newly created policy package into the kernel,
>  you are required to execute
>
>  semodule -i local.pp
>
>
>  [jhg@bugzilla ~]$ sudo semodule -i local.pp
>  semodule:  Could not read file 'local.pp':
>  [jhg@bugzilla ~]$ ls local*
>  local.mod  local.pp  local.te
>  [jhg@bugzilla ~]$ 
The problem is that semodule is not being allowed to read local.pp
by selinux itself:

>  May 11 17:36:53 bugzilla kernel: audit(1147387013.477:14): avc:  
>  denied  { search } for  pid=19191 comm="semodule" name="root" dev=md1
>
>  ino=942849 scontext=user_u:system_r:semanage_t:s0 
>  tcontext=root:object_r:user_home_dir_t:s0 tclass=dir 
I've tried various combinations of sudo vs being logged on
as root.

So I'm stuck.  At this point I'm inclined to switch back to
non-enforcing mode and be done with it.  Is it supposed to
be this hard to configure?

-- 
James Garrison                                Athens Group, Inc.
mailto:[e-mail]                    5608 Parkcrest Dr
http://www.athensgroup.com                    Austin, TX 78731
SKYPE callto:jhg-athensgroup                  [phone] x150
PGP: RSA=0x92E90A3B DH/DSS=0x498D331C

selinux preventing Bugzilla on FC5

[Paul Howarth]

On Thu, 2006-05-11 at 17:41 -0500, James Garrison wrote:
>  Objective:   Run bugzilla on FC5
>  Problem:     selinux is getting in the way
>  
>  First I had to change the file context for all of Bugzilla
>  to httpd_sys_content_t, and the .cgi components to
>  httpd_sys_script_exec_t.  Next, I get the following when
>  Bugzilla tries to open a tcp socket to talk to the database:
>  
>  > May 11 16:26:34 bugzilla kernel: audit(1147382794.700:3): avc:  
>  > denied  { create } for  pid=18527 comm="index.cgi" 
>  > scontext=user_u:system_r:httpd_sys_script_t:s0 
>  > tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=tcp_socket
>  
>  No problem, according to the FAQ, just make a local module with audit2allow
>  and install it with semodule.  Here's what actually happens:
>  
>  > [jhg@bugzilla ~]$ audit2allow -M local < avc.dat
>  > Generating type enforcment file: local.te
>  > Compiling policy
>  > checkmodule -M -m -o local.mod local.te
>  > semodule_package -o local.pp -m local.mod
>  >
>  > ******************** IMPORTANT ***********************
>  >
>  > In order to load this newly created policy package into the kernel,
>  > you are required to execute
>  >
>  > semodule -i local.pp
>  >
>  >
>  > [jhg@bugzilla ~]$ sudo semodule -i local.pp
>  > semodule:  Could not read file 'local.pp':
>  > [jhg@bugzilla ~]$ ls local*
>  > local.mod  local.pp  local.te
>  > [jhg@bugzilla ~]$
>  
>  The problem is that semodule is not being allowed to read local.pp
>  by selinux itself:
>  
>  > May 11 17:36:53 bugzilla kernel: audit(1147387013.477:14): avc:  
>  > denied  { search } for  pid=19191 comm="semodule" name="root"
> dev=md1 
>  > ino=942849 scontext=user_u:system_r:semanage_t:s0 
>  > tcontext=root:object_r:user_home_dir_t:s0 tclass=dir 
Try this:

Move the files you've used for this process (the .te/.pp files etc.) to
a new, empty directory (I used /root/selinux.local) and change to that
directory. Then do:

# chcon -Rh -t usr_t .

Then try the semanage command again.

Paul.

selinux preventing Bugzilla on FC5

[James Garrison]

The continuing saga....

>  May 11 18:11:05 bugzilla kernel: audit(1147389065.041:16): avc:  
>  denied  { read } for  pid=19398 comm="index.cgi" name="resolv.conf" 
>  dev=md1 ino=1106152 scontext=user_u:system_r:httpd_sys_script_t:s0 
>  tcontext=system_u:object_r:net_conf_t:s0 tclass=file
>  May 11 18:11:05 bugzilla kernel: audit(1147389065.045:17): avc:  
>  denied  { create } for  pid=19398 comm="index.cgi" 
>  scontext=user_u:system_r:httpd_sys_script_t:s0 
>  tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket
>  May 11 18:11:05 bugzilla kernel: audit(1147389065.045:18): avc:  
>  denied  { create } for  pid=19398 comm="index.cgi" 
>  scontext=user_u:system_r:httpd_sys_script_t:s0 
>  tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket
>  May 11 18:11:05 bugzilla kernel: audit(1147389065.045:19): avc:  
>  denied  { shutdown } for  pid=19398 comm="index.cgi" 
>  scontext=user_u:system_r:httpd_sys_script_t:s0 
>  tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=tcp_socket 
It seems like I'm just going to have to keep trying and adding new
allow rules, 2 or 3 at a time, until I've hit everything not allowed
by selinux.  Surely I'm not the first person to try to get Bugzilla
running on FC5?

Is there a better way to do this than trial and error?

-- 
James Garrison                                Athens Group, Inc.
mailto:[e-mail]                    5608 Parkcrest Dr
http://www.athensgroup.com                    Austin, TX 78731
SKYPE callto:jhg-athensgroup                  [phone] x150
PGP: RSA=0x92E90A3B DH/DSS=0x498D331C

selinux preventing Bugzilla on FC5

[Paul Howarth]

On Thu, 2006-05-11 at 18:21 -0500, James Garrison wrote:
>  The continuing saga....
>  
>  > May 11 18:11:05 bugzilla kernel: audit(1147389065.041:16): avc:  
>  > denied  { read } for  pid=19398 comm="index.cgi"
> name="resolv.conf" 
>  > dev=md1 ino=1106152 scontext=user_u:system_r:httpd_sys_script_t:s0 
>  > tcontext=system_u:object_r:net_conf_t:s0 tclass=file
>  > May 11 18:11:05 bugzilla kernel: audit(1147389065.045:17): avc:  
>  > denied  { create } for  pid=19398 comm="index.cgi" 
>  > scontext=user_u:system_r:httpd_sys_script_t:s0 
>  > tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket
>  > May 11 18:11:05 bugzilla kernel: audit(1147389065.045:18): avc:  
>  > denied  { create } for  pid=19398 comm="index.cgi" 
>  > scontext=user_u:system_r:httpd_sys_script_t:s0 
>  > tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket
>  > May 11 18:11:05 bugzilla kernel: audit(1147389065.045:19): avc:  
>  > denied  { shutdown } for  pid=19398 comm="index.cgi" 
>  > scontext=user_u:system_r:httpd_sys_script_t:s0 
>  > tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=tcp_socket
>  
>  It seems like I'm just going to have to keep trying and adding new
>  allow rules, 2 or 3 at a time, until I've hit everything not allowed
>  by selinux.  Surely I'm not the first person to try to get Bugzilla
>  running on FC5?
>  
>  Is there a better way to do this than trial and error? 
You could put SELinux in permissive mode:

# setenforce 0

then run bugzilla and get all of the SELinux denials logged, so you can
deal with them all in one go. Then turn enforcing mode back on:

# setenforce 1

You might also consider looking at the bugzilla package currently making
its way through the Fedora Extras review process:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188359

This probably doesn't include any SELinux support (at least not yet),
but might be better to use from a maintainability standpoint.

Paul.

selinux preventing Bugzilla on FC5

[Daniel J Walsh]

Paul Howarth wrote:
>  On Thu, 2006-05-11 at 18:21 -0500, James Garrison wrote:
>    
> > The continuing saga....
> >
> >     
> >> May 11 18:11:05 bugzilla kernel: audit(1147389065.041:16): avc:  
> >> denied  { read } for  pid=19398 comm="index.cgi"
> name="resolv.conf" 
> >> dev=md1 ino=1106152 scontext=user_u:system_r:httpd_sys_script_t:s0 
> >> tcontext=system_u:object_r:net_conf_t:s0 tclass=file
> >> May 11 18:11:05 bugzilla kernel: audit(1147389065.045:17): avc:  
> >> denied  { create } for  pid=19398 comm="index.cgi" 
> >> scontext=user_u:system_r:httpd_sys_script_t:s0 
> >> tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket
> >> May 11 18:11:05 bugzilla kernel: audit(1147389065.045:18): avc:  
> >> denied  { create } for  pid=19398 comm="index.cgi" 
> >> scontext=user_u:system_r:httpd_sys_script_t:s0 
> >> tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=udp_socket
> >> May 11 18:11:05 bugzilla kernel: audit(1147389065.045:19): avc:  
> >> denied  { shutdown } for  pid=19398 comm="index.cgi" 
> >> scontext=user_u:system_r:httpd_sys_script_t:s0 
> >> tcontext=user_u:system_r:httpd_sys_script_t:s0 tclass=tcp_socket
> >>       
> > It seems like I'm just going to have to keep trying and adding new
> > allow rules, 2 or 3 at a time, until I've hit everything not allowed
> > by selinux.  Surely I'm not the first person to try to get Bugzilla
> > running on FC5?
> >
> > Is there a better way to do this than trial and error?
> >     
>
>     
The latest policy will allow semodule to read users home directories 
also.  Since this bug seems to be coming up often.
Please send me you final policy files when you have it working.

>  You could put SELinux in permissive mode:
>
>  # setenforce 0
>
>  then run bugzilla and get all of the SELinux denials logged, so you can
>  deal with them all in one go. Then turn enforcing mode back on:
>
>  # setenforce 1
>
>  You might also consider looking at the bugzilla package currently making
>  its way through the Fedora Extras review process:
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188359
>
>  This probably doesn't include any SELinux support (at least not yet),
>  but might be better to use from a maintainability standpoint.
>
>  Paul.
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>    
>
>
>  The latest policy will allow semodule to read users home directories also.  Since this
> bug seems to be coming up often.
>
>  Please send me you final policy files 
>
>