squid.te

[Tom London]

Running strict/enforcing, latest Rawhide

squid and initrc needs to create/write /var/log/squid/squid.out, etc

Suggest adding:
allow { squid_t initrc_t } squid_log_t:dir create_dir_perms;
allow { squid_t initrc_t } squid_log_t:file create_file_perms;

tom
-- 
Tom London

[Giuseppe Greco]

Tom,

Thanks a lot!
I'll be back on Friday, and I'll try then.

j3d.

>  Running strict/enforcing, latest Rawhide
>
>  squid and initrc needs to create/write /var/log/squid/squid.out, etc
>
>  Suggest adding:
>  allow { squid_t initrc_t } squid_log_t:dir create_dir_perms;
>  allow { squid_t initrc_t } squid_log_t:file create_file_perms;
>
>  tom
>  --
>  Tom London
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  

----------------------------------------
Giuseppe Greco

::agamura::

phone:  [phone]
mobile: [phone]
email:  giuseppe.greco(a)agamura.com
web:    www.agamura.com
----------------------------------------

[Giuseppe Greco]

... sorry for my ignorance, but where are *.te files located?
I cannot find them...

j3d.

On Sun, 2004-12-05 at 11:11 -0800, Tom London wrote:
>  Running strict/enforcing, latest Rawhide
>  
>  squid and initrc needs to create/write /var/log/squid/squid.out, etc
>  
>  Suggest adding:
>  allow { squid_t initrc_t } squid_log_t:dir create_dir_perms;
>  allow { squid_t initrc_t } squid_log_t:file create_file_perms;
>  
>  tom 
-- 
----------------------------------------
Giuseppe Greco

::agamura::

phone:  [phone]
mobile: [phone]
email:  giuseppe.greco(a)agamura.com
web:    www.agamura.com
----------------------------------------

[Karsten Wade]

On Fri, 2004-12-10 at 14:23 +0100, Giuseppe Greco wrote:
>  ... sorry for my ignorance, but where are *.te files located?
>  I cannot find them... 
You have to have selinux-policy-<policyname>-sources (the policy source
package) installed.  Then you can find everything
within /etc/selinux/<policyname>/src/policy.  In this case, you
want /etc/selinux/<policyname>/src/policy/domains/program/squid.te.

- Karsten
>  
>  j3d.
>  
>  On Sun, 2004-12-05 at 11:11 -0800, Tom London wrote:
>  > Running strict/enforcing, latest Rawhide
>  > 
>  > squid and initrc needs to create/write /var/log/squid/squid.out, etc
>  > 
>  > Suggest adding:
>  > allow { squid_t initrc_t } squid_log_t:dir create_dir_perms;
>  > allow { squid_t initrc_t } squid_log_t:file create_file_perms;
>  > 
>  > tom 
-- 
Karsten Wade, RHCE, Sr. Tech Writer
a lemon is just a melon in disguise
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115  5F1B D992 0E06 AD0E 0C41

[Giuseppe Greco]

Thanks,

now I've added the following two lines
to /etc/selinux/targeted/src/policy/domains/program/squid.te:

allow { squid_t initrc_t } squid_log_t:dir create_dir_perms;
allow { squid_t initrc_t } squid_log_t:file create_file_perms;

... but I still get the following error message when restarting
squid:

Starting squid: audit(1102241826.255.0): avc: denied { getattr } for
  pid=2435 exe=/usr/sbin/squid path=/boot dev=hda1 ino=2
  scontext=root:system_r:squid_t tcontext=system_u:object_r:boot_t
  tclass=dir

audit(1102241826.255.0): avc: denied { getattr } for
  pid=2435 exe=/usr/sbin/squid path=/tmp dev=dm-3 ino=2
  scontext=root:system_r:squid_t tcontext=system_u:object_r:tmp_t
  tclass=dir

I've also a similar problem with sendmail when accessed via
squirrelmail:

audit(1102761151.989:0): avc denied { search } for
  pid=1841 exe=/usr/sbin/httpd name=spool dev=dm-6 ino=224002
  scontext=user_u:system_r:httpd_t
  tcontext=system_u:object_r:var_spool_t tclass=dir

audit(1102761496.288:0): avc denied { getattr } for
  pid=1841 exe=/usr/sbin/httpd path=/var/spool dev=dm-6 ino=224002
  scontext=user_u:system_r:httpd_t
  tcontext=system_u:object_r:var_spool_t tclass=dir

I don't how to proceed...
j3d.

On Fri, 2004-12-10 at 06:40 -0800, Karsten Wade wrote:
>  On Fri, 2004-12-10 at 14:23 +0100, Giuseppe Greco wrote:
>  > ... sorry for my ignorance, but where are *.te files located?
>  > I cannot find them...
>  
>  You have to have selinux-policy-<policyname>-sources (the policy source
>  package) installed.  Then you can find everything
>  within /etc/selinux/<policyname>/src/policy.  In this case, you
>  want /etc/selinux/<policyname>/src/policy/domains/program/squid.te.
>  
>  - Karsten
>  > 
>  > j3d.
>  > 
>  > On Sun, 2004-12-05 at 11:11 -0800, Tom London wrote:
>  > > Running strict/enforcing, latest Rawhide
>  > > 
>  > > squid and initrc needs to create/write /var/log/squid/squid.out, etc
>  > > 
>  > > Suggest adding:
>  > > allow { squid_t initrc_t } squid_log_t:dir create_dir_perms;
>  > > allow { squid_t initrc_t } squid_log_t:file create_file_perms;
>  > > 
>  > > tom 
-- 
----------------------------------------
Giuseppe Greco

::agamura::

phone:  [phone]
mobile: [phone]
email:  giuseppe.greco(a)agamura.com
web:    www.agamura.com
----------------------------------------

[Daniel J Walsh]

Giuseppe Greco wrote:

> Thanks,
>
> now I've added the following two lines
> to /etc/selinux/targeted/src/policy/domains/program/squid.te:
>
> allow { squid_t initrc_t } squid_log_t:dir create_dir_perms;
> allow { squid_t initrc_t } squid_log_t:file create_file_perms;
>
> ... but I still get the following error message when restarting
> squid:
>
> Starting squid: audit(1102241826.255.0): avc: denied { getattr } for
>   pid=2435 exe=/usr/sbin/squid path=/boot dev=hda1 ino=2
>   scontext=root:system_r:squid_t tcontext=system_u:object_r:boot_t
>   tclass=dir
>
> audit(1102241826.255.0): avc: denied { getattr } for
>   pid=2435 exe=/usr/sbin/squid path=/tmp dev=dm-3 ino=2
>   scontext=root:system_r:squid_t tcontext=system_u:object_r:tmp_t
>   tclass=dir
>
> I've also a similar problem with sendmail when accessed via
> squirrelmail:
>
> audit(1102761151.989:0): avc denied { search } for
>   pid=1841 exe=/usr/sbin/httpd name=spool dev=dm-6 ino=224002
>   scontext=user_u:system_r:httpd_t
>   tcontext=system_u:object_r:var_spool_t tclass=dir
>
> audit(1102761496.288:0): avc denied { getattr } for
>   pid=1841 exe=/usr/sbin/httpd path=/var/spool dev=dm-6 ino=224002
>   scontext=user_u:system_r:httpd_t
>   tcontext=system_u:object_r:var_spool_t tclass=dir
>
> I don't how to proceed...
> j3d.
>
>   
>  
All of these should be covered by the latest policy files.   Have you 
updated your policy files?

Dan

[Giuseppe Greco]

On Mon, 2004-12-13 at 09:26 -0500, Daniel J Walsh wrote:
>  Giuseppe Greco wrote:
>  
>  >Thanks,
>  >
>  >now I've added the following two lines
>  >to /etc/selinux/targeted/src/policy/domains/program/squid.te:
>  >
>  >allow { squid_t initrc_t } squid_log_t:dir create_dir_perms;
>  >allow { squid_t initrc_t } squid_log_t:file create_file_perms;
>  >
>  >... but I still get the following error message when restarting
>  >squid:
>  >
>  >Starting squid: audit(1102241826.255.0): avc: denied { getattr } for
>  >  pid=2435 exe=/usr/sbin/squid path=/boot dev=hda1 ino=2
>  >  scontext=root:system_r:squid_t tcontext=system_u:object_r:boot_t
>  >  tclass=dir
>  >
>  >audit(1102241826.255.0): avc: denied { getattr } for
>  >  pid=2435 exe=/usr/sbin/squid path=/tmp dev=dm-3 ino=2
>  >  scontext=root:system_r:squid_t tcontext=system_u:object_r:tmp_t
>  >  tclass=dir
>  >
>  >I've also a similar problem with sendmail when accessed via
>  >squirrelmail:
>  >
>  >audit(1102761151.989:0): avc denied { search } for
>  >  pid=1841 exe=/usr/sbin/httpd name=spool dev=dm-6 ino=224002
>  >  scontext=user_u:system_r:httpd_t
>  >  tcontext=system_u:object_r:var_spool_t tclass=dir
>  >
>  >audit(1102761496.288:0): avc denied { getattr } for
>  >  pid=1841 exe=/usr/sbin/httpd path=/var/spool dev=dm-6 ino=224002
>  >  scontext=user_u:system_r:httpd_t
>  >  tcontext=system_u:object_r:var_spool_t tclass=dir
>  >
>  >I don't how to proceed...
>  >j3d.
>  >
>  >  
>  >
>  All of these should be covered by the latest policy files.   Have you 
>  updated your policy files?
>   
Yes, I'm up2date...
j3d.

>  Dan
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Daniel J Walsh]

Giuseppe Greco wrote:

> On Mon, 2004-12-13 at 09:26 -0500, Daniel J Walsh wrote:
>   
>
> >Giuseppe Greco wrote:
> >
> >    
> >
> >>Thanks,
> >>
> >>now I've added the following two lines
> >>to /etc/selinux/targeted/src/policy/domains/program/squid.te:
> >>
> >>allow { squid_t initrc_t } squid_log_t:dir create_dir_perms;
> >>allow { squid_t initrc_t } squid_log_t:file create_file_perms;
> >>
> >>... but I still get the following error message when restarting
> >>squid:
> >>
> >>Starting squid: audit(1102241826.255.0): avc: denied { getattr } for
> >> pid=2435 exe=/usr/sbin/squid path=/boot dev=hda1 ino=2
> >> scontext=root:system_r:squid_t tcontext=system_u:object_r:boot_t
> >> tclass=dir
> >>
> >>audit(1102241826.255.0): avc: denied { getattr } for
> >> pid=2435 exe=/usr/sbin/squid path=/tmp dev=dm-3 ino=2
> >> scontext=root:system_r:squid_t tcontext=system_u:object_r:tmp_t
> >> tclass=dir
> >>
> >>I've also a similar problem with sendmail when accessed via
> >>squirrelmail:
> >>
> >>audit(1102761151.989:0): avc denied { search } for
> >> pid=1841 exe=/usr/sbin/httpd name=spool dev=dm-6 ino=224002
> >> scontext=user_u:system_r:httpd_t
> >> tcontext=system_u:object_r:var_spool_t tclass=dir
> >>
> >>audit(1102761496.288:0): avc denied { getattr } for
> >> pid=1841 exe=/usr/sbin/httpd path=/var/spool dev=dm-6 ino=224002
> >> scontext=user_u:system_r:httpd_t
> >> tcontext=system_u:object_r:var_spool_t tclass=dir
> >>
> >>I don't how to proceed...
> >>j3d.
> >>
> >> 
> >>
> >>      
> >>
> >All of these should be covered by the latest policy files.   Have you 
> >updated your policy files?
> >
> >    
> >
>
> Yes, I'm up2date...
> j3d.
>   
>  
What version of selinux-policy-targeted?

>   
>
> >Dan
> >
> >--
> >fedora-selinux-list mailing list
> >fedora-selinux-list(a)redhat.com
> >http://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >    
> >
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>   
>

[Giuseppe Greco]

On Mon, 2004-12-13 at 09:59 -0500, Daniel J Walsh wrote:
>  Giuseppe Greco wrote:
>  
>  >On Mon, 2004-12-13 at 09:26 -0500, Daniel J Walsh wrote:
>  >  
>  >
>  >>Giuseppe Greco wrote:
>  >>
>  >>    
>  >>
>  >>>Thanks,
>  >>>
>  >>>now I've added the following two lines
>  >>>to /etc/selinux/targeted/src/policy/domains/program/squid.te:
>  >>>
>  >>>allow { squid_t initrc_t } squid_log_t:dir create_dir_perms;
>  >>>allow { squid_t initrc_t } squid_log_t:file create_file_perms;
>  >>>
>  >>>... but I still get the following error message when restarting
>  >>>squid:
>  >>>
>  >>>Starting squid: audit(1102241826.255.0): avc: denied { getattr } for
>  >>> pid=2435 exe=/usr/sbin/squid path=/boot dev=hda1 ino=2
>  >>> scontext=root:system_r:squid_t tcontext=system_u:object_r:boot_t
>  >>> tclass=dir
>  >>>
>  >>>audit(1102241826.255.0): avc: denied { getattr } for
>  >>> pid=2435 exe=/usr/sbin/squid path=/tmp dev=dm-3 ino=2
>  >>> scontext=root:system_r:squid_t tcontext=system_u:object_r:tmp_t
>  >>> tclass=dir
>  >>>
>  >>>I've also a similar problem with sendmail when accessed via
>  >>>squirrelmail:
>  >>>
>  >>>audit(1102761151.989:0): avc denied { search } for
>  >>> pid=1841 exe=/usr/sbin/httpd name=spool dev=dm-6 ino=224002
>  >>> scontext=user_u:system_r:httpd_t
>  >>> tcontext=system_u:object_r:var_spool_t tclass=dir
>  >>>
>  >>>audit(1102761496.288:0): avc denied { getattr } for
>  >>> pid=1841 exe=/usr/sbin/httpd path=/var/spool dev=dm-6 ino=224002
>  >>> scontext=user_u:system_r:httpd_t
>  >>> tcontext=system_u:object_r:var_spool_t tclass=dir
>  >>>
>  >>>I don't how to proceed...
>  >>>j3d.
>  >>>
>  >>> 
>  >>>
>  >>>      
>  >>>
>  >>All of these should be covered by the latest policy files.   Have you 
>  >>updated your policy files?
>  >>
>  >>    
>  >>
>  >
>  >Yes, I'm up2date...
>  >j3d.
>  >  
>  >
>  What version of selinux-policy-targeted?
>   
The version is 1.17.30-2.39

j3d.

>  >  
>  >
>  >>Dan
>  >>
>  >>--
>  >>fedora-selinux-list mailing list
>  >>fedora-selinux-list(a)redhat.com
>  >>http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  >>    
>  >>
>  >
>  >--
>  >fedora-selinux-list mailing list
>  >fedora-selinux-list(a)redhat.com
>  >http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  >  
>  >
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list