AVCs with ntpd

[Felipe Alfaro Solana]

OK, so I'm trying SElinux after having it disabled for some time. 
That's what I did:

1. Installed selinux-policy-targeted-1.17.16-2
2. Recompiled the kernel with SElinux support
3. Booted into single user mode
4. Ran "fixfiles relabel"
5. Rebooted with "selinux=1"

Now, I'm seeing a lot of these:

audit(1095681913.039:0(: avc: denied  { search } for  pid=2515 
exe=/usr/sbin/ntpd dev=tmpfs ino=357 scontext=user_u:system_r:ntpd_t 
tcontext=user_u:object_r"tmpfs_t tclass=dir

The problem here is that I'm using UDEV and that the initial ramdisk 
mounts a tmpfs on top of "/dev", thus, covering the labeled "/dev"
that 
resides on disk.

How should I fix this?

[Daniel J Walsh]

Felipe Alfaro Solana wrote:

>  OK, so I'm trying SElinux after having it disabled for some time.
>
>  That's what I did:
>
>  1. Installed selinux-policy-targeted-1.17.16-2
>  2. Recompiled the kernel with SElinux support
>  3. Booted into single user mode
>  4. Ran "fixfiles relabel"
>  5. Rebooted with "selinux=1"
>
>  Now, I'm seeing a lot of these:
>
>  audit(1095681913.039:0(: avc: denied  { search } for  pid=2515 
>  exe=/usr/sbin/ntpd dev=tmpfs ino=357 scontext=user_u:system_r:ntpd_t 
>  tcontext=user_u:object_r"tmpfs_t tclass=dir
>
>  The problem here is that I'm using UDEV and that the initial ramdisk 
>  mounts a tmpfs on top of "/dev", thus, covering the labeled "/dev" 
>  that resides on disk.
>
>  How should I fix this?
>  
Try the policy available on people.redhat.com:~dwalsh/Fedora/

>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Stephen Smalley]

On Mon, 2004-09-20 at 08:18, Felipe Alfaro Solana wrote:
>  2. Recompiled the kernel with SElinux support 
The Fedora kernel SRPM or a kernel.org kernel?

>  audit(1095681913.039:0(: avc: denied  { search } for  pid=2515 
>  exe=/usr/sbin/ntpd dev=tmpfs ino=357 scontext=user_u:system_r:ntpd_t 
>  tcontext=user_u:object_r"tmpfs_t tclass=dir
>  
>  The problem here is that I'm using UDEV and that the initial ramdisk 
>  mounts a tmpfs on top of "/dev", thus, covering the labeled "/dev"
> that 
>  resides on disk.
>  
>  How should I fix this? 
This works fine on my rawhide systems, but I am using the Fedora kernel,
and it includes a patch to add xattr support to tmpfs so that udev can
label the tmpfs inodes with the correct security context.  The tmpfs
xattr support is not yet in the mainline kernel, but should be soon.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Bob Gustafson]

I wonder about step 2. below. If you have the latest (and even just a
recent) kernel, all of the SELinux patches are in the kernel already.

[doing the patches by hand after looking them over is always a good idea
for a secure system, but if you just want to get things up for a sanity
check, maybe not necessary at the moment..]

Bringing your system up2date is also a good idea as some of the utilities
(nptd?) have SELinux related patches.

I also think that step 5. needs to be done before steps 3 and 4.

You might boot a couple of times with 5. set, then do 3. and 4.

At least that is what I have done.

BobG

On Mon, 20 Sep 2004 14:18:17 +0200, Felipe Alfaro Solana wrote:
> OK, so I'm trying SElinux after having it disabled for some time.
> That's what I did:
>
> 1. Installed selinux-policy-targeted-1.17.16-2
> 2. Recompiled the kernel with SElinux support
> 3. Booted into single user mode
> 4. Ran "fixfiles relabel"
> 5. Rebooted with "selinux=1"
>
> Now, I'm seeing a lot of these:
>
> audit(1095681913.039:0(: avc: denied  { search } for  pid=2515
> exe=/usr/sbin/ntpd dev=tmpfs ino=357 scontext=user_u:system_r:ntpd_t
> tcontext=user_u:object_r"tmpfs_t tclass=dir
>
> The problem here is that I'm using UDEV and that the initial ramdisk
> mounts a tmpfs on top of "/dev", thus, covering the labeled "/dev"
> that
> resides on disk.
>
> How should I fix this?
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Felipe Alfaro Solana]

>  I wonder about step 2. below. If you have the latest (and even just
> a
>  recent) kernel, all of the SELinux patches are in the kernel already. 
I´m running a custom kernel (exactly 2.6.9-rc2-mm1-VP-S1). Since I 
disabled SElinux, I had no support for it compiled in the kernel, thus 
the recompilation.

>  Bringing your system up2date is also a good idea as some of the 
>  utilities
>  (nptd?) have SELinux related patches. 
I'm always running from RawHide ;-)

>  I also think that step 5. needs to be done before steps 3 and 4.
>
>  You might boot a couple of times with 5. set, then do 3. and 4.
>
>  At least that is what I have done. 
AFAIK, you don't need to get SElinux enabled in order to relabel the 
filesystem. It seems my problems are caused by vanilla kernels not 
having xattrs support for tmpfs yet. I'll take the RedHat kernel SRPM 
and will extract the tmpfs xattr support.

Thanks!
>  BobG
>
>  On Mon, 20 Sep 2004 14:18:17 +0200, Felipe Alfaro Solana wrote:
> > OK, so I'm trying SElinux after having it disabled for some time.
> > That's what I did:
> >
> > 1. Installed selinux-policy-targeted-1.17.16-2
> > 2. Recompiled the kernel with SElinux support
> > 3. Booted into single user mode
> > 4. Ran "fixfiles relabel"
> > 5. Rebooted with "selinux=1"
> >
> > Now, I'm seeing a lot of these:
> >
> > audit(1095681913.039:0(: avc: denied  { search } for  pid=2515
> > exe=/usr/sbin/ntpd dev=tmpfs ino=357 scontext=user_u:system_r:ntpd_t
> > tcontext=user_u:object_r"tmpfs_t tclass=dir
> >
> > The problem here is that I'm using UDEV and that the initial ramdisk
> > mounts a tmpfs on top of "/dev", thus, covering the labeled
> "/dev" 
> > that
> > resides on disk.
> >
> > How should I fix this?
> >
> > --
> > fedora-selinux-list mailing list
> > fedora-selinux-list(a)redhat.com
> > http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Russell Coker]

On Tue, 21 Sep 2004 00:15, Bob Gustafson <bobgus(a)rcn.com&gt; wrote:
>  Bringing your system up2date is also a good idea as some of the
> utilities
>  (nptd?) have SELinux related patches. 
You are correct that some of the utilities have SE Linux related patches.  
Also one thing to note is that utilities and policy are changed in 
synchronisation.  So if you upgrade one without the other when tracking 
rawhide then things might not work (NB upgrades other than from one release 
to another are not officially supported, tracking rawhide in every way should 
work but with partial upgrades you are on your own).

ntpd does not have SE Linux related patches and we have no plans to do such 
things.

>  I also think that step 5. needs to be done before steps 3 and 4.
Yes.  Boot with "selinux=1 enforcing=0" to relabel it.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page