latest policy: in.comsat, dbskkd-cdb, ktalkd, ...

[Tom London]

Latest Rawhide policy seems to 'reverse the labeling' of programs
started from xinetd, like in.comsat, ... (strict/enforcing)

tom

Aug 23 08:20:16 fedora kernel: audit(1093274416.210:0): avc:  denied  { 
execute
} for  pid=2505 exe=/usr/sbin/xinetd name=in.comsat dev=hda2 ino=4123335 
scontext=system_u:system_r:inetd_t tcontext=system_u:object_r:sbin_t 
tclass=file
Aug 23 08:20:16 fedora xinetd[2505]: Server /usr/sbin/in.comsat is not 
executable [file=/etc/xinetd.d/comsat] [line=9]
Aug 23 08:20:16 fedora xinetd[2505]: Error parsing attribute server - 
DISABLING
SERVICE [file=/etc/xinetd.d/comsat] [line=9]
Aug 23 08:20:16 fedora ntpd:  succeeded
Aug 23 08:20:16 fedora kernel: audit(1093274416.397:0): avc:  denied  { 
execute
} for  pid=2505 exe=/usr/sbin/xinetd name=dbskkd-cdb dev=hda2 
ino=4119210 scontext=system_u:system_r:inetd_t 
tcontext=system_u:object_r:sbin_t tclass=file
Aug 23 08:20:16 fedora xinetd[2505]: Server /usr/sbin/dbskkd-cdb is not 
executable [file=/etc/xinetd.d/dbskkd-cdb] [line=12]
Aug 23 08:20:16 fedora xinetd[2505]: Error parsing attribute server - 
DISABLING
SERVICE [file=/etc/xinetd.d/dbskkd-cdb] [line=12]
Aug 23 08:20:16 fedora kernel: audit(1093274416.614:0): avc:  denied  { 
execute
} for  pid=2505 exe=/usr/sbin/xinetd name=ktalkd dev=hda2 ino=4122498 
scontext=system_u:system_r:inetd_t tcontext=system_u:object_r:bin_t 
tclass=file
Aug 23 08:20:16 fedora xinetd[2505]: Server /usr/bin/ktalkd is not 
executable [file=/etc/xinetd.d/ktalk] [line=11]
Aug 23 08:20:16 fedora xinetd[2505]: Error parsing attribute server - 
DISABLING
SERVICE [file=/etc/xinetd.d/ktalk] [line=11]
Aug 23 08:20:16 fedora kernel: audit(1093274416.869:0): avc:  denied  { 
execute
} for  pid=2505 exe=/usr/sbin/xinetd name=rsync dev=hda2 ino=426723 
scontext=system_u:system_r:inetd_t tcontext=system_u:object_r:bin_t 
tclass=file
Aug 23 08:20:16 fedora xinetd[2505]: Server /usr/bin/rsync is not 
executable [file=/etc/xinetd.d/rsync] [line=10]
Aug 23 08:20:16 fedora xinetd[2505]: Error parsing attribute server - 
DISABLING
SERVICE [file=/etc/xinetd.d/rsync] [line=10]
Aug 23 08:20:16 fedora kernel: audit(1093274416.935:0): avc:  denied  { 
execute
} for  pid=2505 exe=/usr/sbin/xinetd name=swat dev=hda2 ino=279060 
scontext=system_u:system_r:inetd_t tcontext=system_u:object_r:sbin_t 
tclass=file
Aug 23 08:20:16 fedora xinetd[2505]: Server /usr/sbin/swat is not 
executable [file=/etc/xinetd.d/swat] [line=12]
Aug 23 08:20:16 fedora xinetd[2505]: Error parsing attribute server - 
DISABLING
SERVICE [file=/etc/xinetd.d/swat] [line=12]

[Stephen Smalley]

On Mon, 2004-08-23 at 11:31, Tom London wrote:
>  Latest Rawhide policy seems to 'reverse the labeling' of
> programs
>  started from xinetd, like in.comsat, ... (strict/enforcing) 
inetd.fc entries removed at Russell's request, as the inetd_child_t
domain wasn't sufficient anyway to allow those programs to run properly,
and labeling them inetd_child_exec_t merely masked the lack of proper
security domains for those programs and encouraged bleeding permissions
into inetd_child_t.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Russell Coker]

On Tue, 24 Aug 2004 02:04, Stephen Smalley <sds(a)epoch.ncsc.mil&gt; wrote:
>  On Mon, 2004-08-23 at 11:31, Tom London wrote:
>  > Latest Rawhide policy seems to 'reverse the labeling' of programs
>  > started from xinetd, like in.comsat, ... (strict/enforcing)
>
>  inetd.fc entries removed at Russell's request, as the inetd_child_t
>  domain wasn't sufficient anyway to allow those programs to run properly,
>  and labeling them inetd_child_exec_t merely masked the lack of proper
>  security domains for those programs and encouraged bleeding permissions
>  into inetd_child_t. 
Some of those programs need to have policy written for them.  Some need to be 
re-written, reconfigured, or replaced.  At least now they won't be forgotten.

Tom, if you would like to contribute policy for any of these...

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page