selinux-policy update

[Zdenek Pytela]

	Hello everyone,
every time I upgrade selinux-policy packages, I get

SELinux is preventing /usr/sbin/load_policy from 'read, append' accesses on
the file /tmp/tmp5vo8of.

Raw Audit Messages
type=AVC msg=audit(1340799402.853:3866): avc:  denied  { read append } for
pid=22456 comm="load_policy" path="/tmp/tmp5vo8of"
dev="tmpfs" ino=464186
scontext=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023
tcontext=system_u:object_r:tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1340799402.853:3866): arch=x86_64 syscall=execve
success=yes exit=0 a0=ff5f80 a1=ff5f60 a2=ff2e90 a3=10 items=0 ppid=22449
pid=22456 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=pts16 ses=357 comm=load_policy exe=/usr/sbin/load_policy
subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)

The command load_policy is executed by the rpm postinstall scriptlet.
It happens on workstations with f16 or f17, the only less usual thing is
that /tmp is mounted as tmpfs with
rw,nodev,noexec,noatime,nodiratime,context=system_u:object_r:tmp_t:s0
Context of /tmp is the same as it was before and the same as physical
directory /var/tmp.

I know how to make local policy rules, but I would like to know if there
is a better solution. Thanks,

-- 

--Zdenek Pytela, <pytela(a)phil.muni.cz&gt;

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/28/2012 08:08 AM, Zdenek Pytela wrote:
>  Hello everyone, every time I upgrade selinux-policy packages, I get
>  
>  SELinux is preventing /usr/sbin/load_policy from 'read, append' accesses
>  on the file /tmp/tmp5vo8of.
>  
>  Raw Audit Messages type=AVC msg=audit(1340799402.853:3866): avc:  denied  {
>  read append } for pid=22456 comm="load_policy" path="/tmp/tmp5vo8of"
>  dev="tmpfs" ino=464186 
>  scontext=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 
>  tcontext=system_u:object_r:tmp_t:s0 tclass=file type=SYSCALL
>  msg=audit(1340799402.853:3866): arch=x86_64 syscall=execve success=yes
>  exit=0 a0=ff5f80 a1=ff5f60 a2=ff2e90 a3=10 items=0 ppid=22449 pid=22456
>  auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts16
>  ses=357 comm=load_policy exe=/usr/sbin/load_policy 
>  subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>  
>  The command load_policy is executed by the rpm postinstall scriptlet. It
>  happens on workstations with f16 or f17, the only less usual thing is that
>  /tmp is mounted as tmpfs with 
>  rw,nodev,noexec,noatime,nodiratime,context=system_u:object_r:tmp_t:s0 
>  Context of /tmp is the same as it was before and the same as physical 
>  directory /var/tmp.
>  
>  I know how to make local policy rules, but I would like to know if there is
>  a better solution. Thanks,
>   
This is a leaked file descriptor from who ever created the file /tmp/tmp5v080f
or a redirected stdin/stdout/stderr.  Possible candidates would be puppet or
simple redirection using bash

command << _EOF
input
input
_EOF

Could cause something like this if the command eventually executed
rpm/load_policy.

Simplest thing would be to generate an audit2allow rule for it to dontaudit
this action.



> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
>
> iEYEARECAAYFAlA8vgIACgkQrlYvE4MpobNJagCfUwLA6oGAiVCr36J42INVFkXi
> ZAIAn2vNBMsy1W2rTsMSvGrRqxHHaw4F
> =Wk72
> -----END PGP SIGNATURE-----

[Zdenek Pytela]

Daniel J Walsh pise:
>  > Hello everyone, every time I upgrade selinux-policy packages, I
> get
>  > 
>  > SELinux is preventing /usr/sbin/load_policy from 'read, append' accesses
>  > on the file /tmp/tmp5vo8of.
>  > 
>  > Raw Audit Messages type=AVC msg=audit(1340799402.853:3866): avc:  denied  {
>  > read append } for pid=22456 comm="load_policy"
> path="/tmp/tmp5vo8of"
>  > dev="tmpfs" ino=464186 
>  > scontext=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 
>  > tcontext=system_u:object_r:tmp_t:s0 tclass=file type=SYSCALL
>  > msg=audit(1340799402.853:3866): arch=x86_64 syscall=execve success=yes
>  > exit=0 a0=ff5f80 a1=ff5f60 a2=ff2e90 a3=10 items=0 ppid=22449 pid=22456
>  > auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts16
>  > ses=357 comm=load_policy exe=/usr/sbin/load_policy 
>  > subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>  > 
>  > The command load_policy is executed by the rpm postinstall scriptlet. It
>  > happens on workstations with f16 or f17, the only less usual thing is that
>  > /tmp is mounted as tmpfs with 
>  > rw,nodev,noexec,noatime,nodiratime,context=system_u:object_r:tmp_t:s0 
>  > Context of /tmp is the same as it was before and the same as physical 
>  > directory /var/tmp.
>  > 
>  > I know how to make local policy rules, but I would like to know if there is
>  > a better solution. Thanks,
>  > 
>  
>  This is a leaked file descriptor from who ever created the file /tmp/tmp5v080f
>  or a redirected stdin/stdout/stderr.  Possible candidates would be puppet or
>  simple redirection using bash
>  
>  command << _EOF
>  input
>  input
>  _EOF
>  
>  Could cause something like this if the command eventually executed
>  rpm/load_policy. 
	The only occurence of load_policy in postinstall script is 
	
   [ "${SELINUXTYPE}" == "targeted" ] && [ selinuxenabled ]
&& load_policy; 

I guess that the tmp file is created by rpm in the phase of upgrading
package for executing the script.
 
>  Simplest thing would be to generate an audit2allow rule for it to
> dontaudit
>  this action. 
	Thanks, dontaudit rule is fine solution for me.

-- 

--Zdenek Pytela, <pytela(a)phil.muni.cz&gt;

[Mr Dash Four]

>  This is a leaked file descriptor from who ever created the file
> /tmp/tmp5v080f
>  or a redirected stdin/stdout/stderr.  Possible candidates would be puppet or
>  simple redirection using bash
>
>  command << _EOF
>  input
>  input
>  _EOF
>
>  Could cause something like this if the command eventually executed
>  rpm/load_policy.
>     
Apologies for hijacking this thread, but the solution to the above 
(which I have come across on so many occasions in the past that I care 
to remember) is the following (assuming bash is used):

 my=$(cat <<_EOF
input
input
_EOF
)
  echo "$my" | command

where "command" is the command expecting input/reading the "file" 
enclosed within _EOF. That way, no avcs are produced and SELinux is kept 
at bay. The "standard" use, like:

command <<_EOF
input
input
_EOF

makes SELinux very angry, hence the above workaround.

I think we need to have a good look at polkit in f18

[Dominick Grift]

I noticed some paths changed like : 

+/usr/lib/polkit-1/polkit-agent-helper-1	--
gen_context(system_u:object_r:policykit_auth_exec_t,s0)
+/usr/lib/polkit-1/polkitd			--
gen_context(system_u:object_r:policykit_exec_t,s0)

But also stuff like:

/usr/libexec/polkit-gnome-authentication-agent-1

polkit-kde has its own

also might want to take a look at:

gksu-polkit
lxpolkit

etc:

i noticed this when i was writing policy in f18.

I also had to add stuff like:

-allow policykit_t self:process getattr;
+allow policykit_t self:process { execmem getattr getsched setsched };

+dev_search_sysfs(policykit_t)

+optional_policy(`
+	dbus_connect_system_bus(policykit_t)
+	dbus_system_bus_client(policykit_t)
+
+	systemd_dbus_chat_logind(policykit_t)
+')

and some more.

It obviously needs some attention

I think we need to have a good look at polkit in f18

[Dominick Grift]

Never mind most of this. Its there and so i must have overlooked

On Sat, 2012-09-08 at 11:37 +0200, Dominick Grift wrote:
>  I noticed some paths changed like : 
>  
>  +/usr/lib/polkit-1/polkit-agent-helper-1	--
>  gen_context(system_u:object_r:policykit_auth_exec_t,s0)
>  +/usr/lib/polkit-1/polkitd			--
>  gen_context(system_u:object_r:policykit_exec_t,s0)
>  
>  But also stuff like:
>  
>  /usr/libexec/polkit-gnome-authentication-agent-1
>  
>  polkit-kde has its own
>  
>  also might want to take a look at:
>  
>  gksu-polkit
>  lxpolkit
>  
>  etc:
>  
>  i noticed this when i was writing policy in f18.
>  
>  I also had to add stuff like:
>  
>  -allow policykit_t self:process getattr;
>  +allow policykit_t self:process { execmem getattr getsched setsched };
>  
>  +dev_search_sysfs(policykit_t)
>  
>  +optional_policy(`
>  +	dbus_connect_system_bus(policykit_t)
>  +	dbus_system_bus_client(policykit_t)
>  +
>  +	systemd_dbus_chat_logind(policykit_t)
>  +')
>  
>  and some more.
>  
>  It obviously needs some attention
>