need help for local.te

[Hongwei Li]

Hi,

I need help about local.te.  My system:

kernel:         2.6.16-1.2111_FC5smp
selinux-policy-targeted:     2.2.38-1.fc5
audit:          1.1.5-1
sendmail:       8.13.6-0.FC5.1
squirrelmail:   1.4.6-5.fc5

When I try to create an email folder in squirrelmail, I got Error.  So, I run
the following to create my local.te and add my module.  Here are what I run
and get:

# audit2allow -M local < /var/log/audit/audit.log
Generating type enforcment file: local.te
Compiling policy
checkmodule -M -m -o local.mod local.te
semodule_package -o local.pp -m local.mod

******************** IMPORTANT ***********************

In order to load this newly created policy package into the kernel,
you are required to execute

semodule -i local.pp

# ls -l
total 40
-rw-r--r-- 1 root root 2448 May 19 09:46 local.mod
-rw-r--r-- 1 root root 2464 May 19 09:46 local.pp
-rw-r--r-- 1 root root  733 May 19 09:46 local.te

# semodule -i local.pp
libsepol.check_assertion_helper: assertion on line 0 violated by allow httpd_t
shadow_t:file { read };
libsepol.check_assertions: 1 assertion violations occured
libsemanage.semanage_expand_sandbox: Expand module failed
semodule:  Failed!

How to solve the problem?

Thanks!

Hongwei

[Stephen Smalley]

On Fri, 2006-05-19 at 09:58 -0500, Hongwei Li wrote:
>  Hi,
>  
>  I need help about local.te.  My system:
>  
>  kernel:         2.6.16-1.2111_FC5smp
>  selinux-policy-targeted:     2.2.38-1.fc5
>  audit:          1.1.5-1
>  sendmail:       8.13.6-0.FC5.1
>  squirrelmail:   1.4.6-5.fc5
>  
>  When I try to create an email folder in squirrelmail, I got Error.  So, I run
>  the following to create my local.te and add my module.  Here are what I run
>  and get:
>  
>  # audit2allow -M local < /var/log/audit/audit.log
>  Generating type enforcment file: local.te
>  Compiling policy
>  checkmodule -M -m -o local.mod local.te
>  semodule_package -o local.pp -m local.mod
>  
>  ******************** IMPORTANT ***********************
>  
>  In order to load this newly created policy package into the kernel,
>  you are required to execute
>  
>  semodule -i local.pp
>  
>  # ls -l
>  total 40
>  -rw-r--r-- 1 root root 2448 May 19 09:46 local.mod
>  -rw-r--r-- 1 root root 2464 May 19 09:46 local.pp
>  -rw-r--r-- 1 root root  733 May 19 09:46 local.te
>  
>  # semodule -i local.pp
>  libsepol.check_assertion_helper: assertion on line 0 violated by allow httpd_t
>  shadow_t:file { read };
>  libsepol.check_assertions: 1 assertion violations occured
>  libsemanage.semanage_expand_sandbox: Expand module failed
>  semodule:  Failed!
>  
>  How to solve the problem?
>  
>  Thanks! 
This means that your local.te file includes a rule that allows httpd to
read your /etc/shadow file, and this violates an assertion in the base
policy.  Review your local.te file, prune entries that are not
legitimate, and rebuild the .mod and .pp files, e.g.
# vi local.te # edit out bogus entries or replace them with dontaudit rules
# checkmodule -m -M -o local.mod local.te
# semodule_package -o local.pp -m local.mod
# semodule -i local.pp

-- 
Stephen Smalley
National Security Agency

[Hongwei Li]

>  On Fri, 2006-05-19 at 09:58 -0500, Hongwei Li wrote:
> > Hi,
> >
> > I need help about local.te.  My system:
> >
> > kernel:         2.6.16-1.2111_FC5smp
> > selinux-policy-targeted:     2.2.38-1.fc5
> > audit:          1.1.5-1
> > sendmail:       8.13.6-0.FC5.1
> > squirrelmail:   1.4.6-5.fc5
> >
> > When I try to create an email folder in squirrelmail, I got Error.  So, I
> > run
> > the following to create my local.te and add my module.  Here are what I run
> > and get:
> >
> > # audit2allow -M local < /var/log/audit/audit.log
> > Generating type enforcment file: local.te
> > Compiling policy
> > checkmodule -M -m -o local.mod local.te
> > semodule_package -o local.pp -m local.mod
> >
> > ******************** IMPORTANT ***********************
> >
> > In order to load this newly created policy package into the kernel,
> > you are required to execute
> >
> > semodule -i local.pp
> >
> > # ls -l
> > total 40
> > -rw-r--r-- 1 root root 2448 May 19 09:46 local.mod
> > -rw-r--r-- 1 root root 2464 May 19 09:46 local.pp
> > -rw-r--r-- 1 root root  733 May 19 09:46 local.te
> >
> > # semodule -i local.pp
> > libsepol.check_assertion_helper: assertion on line 0 violated by allow
> > httpd_t
> > shadow_t:file { read };
> > libsepol.check_assertions: 1 assertion violations occured
> > libsemanage.semanage_expand_sandbox: Expand module failed
> > semodule:  Failed!
> >
> > How to solve the problem?
> >
> > Thanks!
>
>  This means that your local.te file includes a rule that allows httpd to
>  read your /etc/shadow file, and this violates an assertion in the base
>  policy.  Review your local.te file, prune entries that are not
>  legitimate, and rebuild the .mod and .pp files, e.g.
>  # vi local.te # edit out bogus entries or replace them with dontaudit rules
>  # checkmodule -m -M -o local.mod local.te
>  # semodule_package -o local.pp -m local.mod
>  # semodule -i local.pp
>
>  --
>  Stephen Smalley
>  National Security Agency 
The problem is I need to re-do for local.te from time to time, and whenver I
run (after rebooting)
# audit2allow -M local < /var/log/audit/audit.log
the line

allow httpd_t shadow_t:file { getattr read write };

is automatically added to local.te -- this time, it added more, not just read.
 I believe that this is because I need to run change_password plugin in
squirrelmail.  It is not a problem in fc4 selinux -- I run audit2allow to add
entry into local.te and run make load, then everything is working.  But, in
fc5, it is a problem.  If I remove that line, then whenever I run the above
command, it is automatically added.

How to fix the problem?

Thanks!

Hongwei

[Kayvan A. Sylvan]

On Fri, May 19, 2006 at 12:13:15PM -0500, Hongwei Li wrote:
>  
>  The problem is I need to re-do for local.te from time to time, and whenver I
>  run (after rebooting)
>  # audit2allow -M local < /var/log/audit/audit.log
>  the line
>  
>  allow httpd_t shadow_t:file { getattr read write };
>  
>  is automatically added to local.te -- [...]
>  How to fix the problem? 
How about something like this?

audit2allow -l -i /var/log/audit/audit.log | grep -v shadow >> local.te

-- 
Kayvan A. Sylvan          | Proud husband of       | Father to my kids:
Sylvan Associates, Inc.   | Laura Isabella Sylvan, | Katherine Yelena (8/8/89)
http://sylvan.com/~kayvan | my beautiful Queen.    | Robin Gregory (2/28/92)

[Hongwei Li]

>  On Fri, May 19, 2006 at 12:13:15PM -0500, Hongwei Li wrote:
> >
> > The problem is I need to re-do for local.te from time to time, and whenver I
> > run (after rebooting)
> > # audit2allow -M local < /var/log/audit/audit.log
> > the line
> >
> > allow httpd_t shadow_t:file { getattr read write };
> >
> > is automatically added to local.te -- [...]
> > How to fix the problem?
>
>  How about something like this?
>
>  audit2allow -l -i /var/log/audit/audit.log | grep -v shadow >> local.te
>
>  --
>  Kayvan A. Sylvan          | Proud husband of       | Father to my kids:
>  Sylvan Associates, Inc.   | Laura Isabella Sylvan, | Katherine Yelena (8/8/89) 
I did and got:

# audit2allow -l -i /var/log/audit/audit.log | grep -v shadow >> local.te
# checkmodule -M -m -o local.mod local.te
checkmodule:  loading policy configuration from local.te
(unknown source)::ERROR 'unknown type dovecot_auth_t' at token ';' on line
33:
allow procmail_t tmp_t:dir { search write };
allow dovecot_auth_t initrc_var_run_t:file { read write };
checkmodule:  error(s) encountered while parsing configuration

I manually edit local.te to add a line
        type dovecot_auth_t;
and run it again, then got

# checkmodule -M -m -o local.mod local.te
checkmodule:  loading policy configuration from local.te
(unknown source)::ERROR 'unknown type initrc_var_run_t' at token ';' on
line 34:
allow procmail_t tmp_t:dir { search write };
allow dovecot_auth_t initrc_var_run_t:file { read write };
checkmodule:  error(s) encountered while parsing configuration

The line 34 is:

allow dovecot_auth_t initrc_var_run_t:file { read write };

What to do next? Thanks!

Hongwei

[Ketut Mahaindra]

Hello,

Everytime I need to make a local.te I always localized (read: make new file,
and extract the msg) the corresponding AVC denied messages to another log
file to be sure that I will get from audit2allow only those needed policies
related to the localized AVC denied message and not from the whole audit.log
file.

You might try to use that practice.

-- 
Best regards,
 
Ketut Mahaindra (Ito)
"The race for perfection has no finish line"
 

-----Original Message-----
From: fedora-selinux-list-bounces(a)redhat.com
[mailto:[e-mail]] On Behalf Of Hongwei Li
Sent: Saturday, May 20, 2006 1:13 AM
To: fedora-selinux-list(a)redhat.com
Subject: Re: need help for local.te

>  This means that your local.te file includes a rule that allows httpd
> to
>  read your /etc/shadow file, and this violates an assertion in the base
>  policy.  Review your local.te file, prune entries that are not
>  legitimate, and rebuild the .mod and .pp files, e.g.
>  # vi local.te # edit out bogus entries or replace them with dontaudit 
rules
>  # checkmodule -m -M -o local.mod local.te
>  # semodule_package -o local.pp -m local.mod
>  # semodule -i local.pp
>
>  --
>  Stephen Smalley
>  National Security Agency 
The problem is I need to re-do for local.te from time to time, and whenver I
run (after rebooting)
# audit2allow -M local < /var/log/audit/audit.log
the line

allow httpd_t shadow_t:file { getattr read write };

is automatically added to local.te -- this time, it added more, not just
read.
 I believe that this is because I need to run change_password plugin in
squirrelmail.  It is not a problem in fc4 selinux -- I run audit2allow to
add
entry into local.te and run make load, then everything is working.  But, in
fc5, it is a problem.  If I remove that line, then whenever I run the above
command, it is automatically added.

How to fix the problem?

Thanks!

Hongwei


--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Daniel J Walsh]

Hongwei Li wrote:
> > On Fri, 2006-05-19 at 09:58 -0500, Hongwei Li wrote:
> >     
> >> Hi,
> >>
> >> I need help about local.te.  My system:
> >>
> >> kernel:         2.6.16-1.2111_FC5smp
> >> selinux-policy-targeted:     2.2.38-1.fc5
> >> audit:          1.1.5-1
> >> sendmail:       8.13.6-0.FC5.1
> >> squirrelmail:   1.4.6-5.fc5
> >>
> >> When I try to create an email folder in squirrelmail, I got Error.  So, I
> >> run
> >> the following to create my local.te and add my module.  Here are what I run
> >> and get:
> >>
> >> # audit2allow -M local < /var/log/audit/audit.log
> >> Generating type enforcment file: local.te
> >> Compiling policy
> >> checkmodule -M -m -o local.mod local.te
> >> semodule_package -o local.pp -m local.mod
> >>
> >> ******************** IMPORTANT ***********************
> >>
> >> In order to load this newly created policy package into the kernel,
> >> you are required to execute
> >>
> >> semodule -i local.pp
> >>
> >> # ls -l
> >> total 40
> >> -rw-r--r-- 1 root root 2448 May 19 09:46 local.mod
> >> -rw-r--r-- 1 root root 2464 May 19 09:46 local.pp
> >> -rw-r--r-- 1 root root  733 May 19 09:46 local.te
> >>
> >> # semodule -i local.pp
> >> libsepol.check_assertion_helper: assertion on line 0 violated by allow
> >> httpd_t
> >> shadow_t:file { read };
> >> libsepol.check_assertions: 1 assertion violations occured
> >> libsemanage.semanage_expand_sandbox: Expand module failed
> >> semodule:  Failed!
> >>
> >> How to solve the problem?
> >>
> >> Thanks!
> >>       
> > This means that your local.te file includes a rule that allows httpd to
> > read your /etc/shadow file, and this violates an assertion in the base
> > policy.  Review your local.te file, prune entries that are not
> > legitimate, and rebuild the .mod and .pp files, e.g.
> > # vi local.te # edit out bogus entries or replace them with dontaudit rules
> > # checkmodule -m -M -o local.mod local.te
> > # semodule_package -o local.pp -m local.mod
> > # semodule -i local.pp
> >
> > --
> > Stephen Smalley
> > National Security Agency
> >     
>
>  The problem is I need to re-do for local.te from time to time, and whenver I
>  run (after rebooting)
>  # audit2allow -M local < /var/log/audit/audit.log
>  the line
>
>  allow httpd_t shadow_t:file { getattr read write };
>
>  is automatically added to local.te -- this time, it added more, not just read.
>   I believe that this is because I need to run change_password plugin in
>  squirrelmail.  It is not a problem in fc4 selinux -- I run audit2allow to add
>  entry into local.te and run make load, then everything is working.  But, in
>  fc5, it is a problem.  If I remove that line, then whenever I run the above
>  command, it is automatically added.
>
>  How to fix the problem?
>     
If this is not causing a problem for squirrelmail, how about

dontaudit httpd_t shadow_t:file { getattr read write };

Also you can create more than one pp file.  So you could create 
local1.pp and local2.pp ...

You should always edit make sure you only have the rules in your pp file 
that you want.

If these are legitimate problems with policy or some package, are you 
submitting bugzillas?

Dan
>  Thanks!
>
>  Hongwei
>
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>