SELinux stops new X11?

[Richard Hally]

The new xorg-X11(6.7.99.902-1) will not start with the current strict 
SELinux policy(1.15.16-1) in enforcing mode. (xorg-x11-*6.7.0-7.2 works 
just fine). I have not tried permissive mode.
 It looks like something has changed in X11 that has to do with the 
fonts and the SE policy has not been  updated to  handle it but that is 
just speculation.

from my Xorg.0.log:
<snip>
 (II) Mouse0: ps2EnableDataReporting: succeeded
Could not init font path element unix/:7100, removing from list!
 
Fatal server error:
could not open default font 'fixed'
 
Please consult the The X.Org Foundation support
         at http://wiki.X.Org
 for help.
Please also check the log file at "/var/log/Xorg.0.log" for additional 
information.
 
 
   *** If unresolved symbols were reported above, they might not
   *** be the reason for the server aborting.
 
FatalError re-entered, aborting
Caught signal 11.  Server aborting
----------------------------------------------------------------------end 
of xorg log-----------------------------------------

 From /var/log/messages:

Aug 19 17:34:53 new2 kernel: audit(1092951293.022:0): avc:  denied  { 
getattr }
for  pid=2578 exe=/usr/X11R6/bin/xfs path=/tmp/.font-unix dev=hda2 
ino=1840549 scontext=system_u:system_r:xfs_t 
tcontext=system_u:object_r:initrc_tmp_t tclass=dir
Aug 19 17:34:53 new2 xfs[2578]: cannot establish any listening sockets
Aug 19 17:34:53 new2 xfs: xfs startup succeeded
Aug 19 17:34:53 new2 xfs[2578]: ignoring font path element 
/usr/X11R6/lib/X11/fonts/Speedo (unreadable)

Aug 19 17:35:13 new2 kernel: audit(1092951313.544:0): avc:  denied  { 
read } for  pid=2995 exe=/usr/X11R6/bin/Xorg name=fb dev=hda2 
ino=1061221 scontext=system_u:system_r:xdm_xserver_t 
tcontext=system_u:object_r:device_t tclass=lnk_file
Aug 19 17:35:13 new2 last message repeated 2 times
Aug 19 17:35:13 new2 kernel: audit(1092951313.545:0): avc:  denied  { 
read } for  pid=2995 exe=/usr/X11R6/bin/Xorg name=fb dev=hda2 
ino=1061221 scontext=system_u:system_r:xdm_xserver_t 
tcontext=system_u:object_r:device_t tclass=lnk_file
Aug 19 17:35:13 new2 last message repeated 4 times
Aug 19 17:35:15 new2 kernel: audit(1092951315.876:0): avc:  denied  { 
search } for  pid=2995 exe=/usr/X11R6/bin/Xorg name=.font-unix dev=hda2 
ino=1840549 scontext=system_u:system_r:xdm_xserver_t 
tcontext=system_u:object_r:initrc_tmp_t tclass=dir

Aug 19 17:35:19 new2 kernel: audit(1092951319.457:0): avc:  denied  { 
read } for  pid=3329 exe=/usr/X11R6/bin/Xorg name=fb dev=hda2 
ino=1061221 scontext=system_u:system_r:xdm_xserver_t 
tcontext=system_u:object_r:device_t tclass=lnk_file
Aug 19 17:35:19 new2 last message repeated 3 times
Aug 19 17:35:19 new2 kernel: audit(1092951319.458:0): avc:  denied  { 
read } for  pid=3329 exe=/usr/X11R6/bin/Xorg name=fb dev=hda2 
ino=1061221 scontext=system_u:system_r:xdm_xserver_t 
tcontext=system_u:object_r:device_t tclass=lnk_file
Aug 19 17:35:19 new2 last message repeated 3 times

Aug 19 17:35:21 new2 kernel: audit(1092951321.333:0): avc:  denied  { 
search } for  pid=3329 exe=/usr/X11R6/bin/Xorg name=.font-unix dev=hda2 
ino=1840549 scontext=system_u:system_r:xdm_xserver_t 
tcontext=system_u:object_r:initrc_tmp_t tclass=dir
Aug 19 17:35:21 new2 gdm[3304]: gdm_slave_xioerror_handler: Fatal X 
error - Restarting :0

Aug 19 17:35:24 new2 kernel: audit(1092951324.885:0): avc:  denied  { 
read } for  pid=3494 exe=/usr/X11R6/bin/Xorg name=fb dev=hda2 
ino=1061221 scontext=system_u:system_r:xdm_xserver_t 
tcontext=system_u:object_r:device_t tclass=lnk_file
Aug 19 17:35:24 new2 kernel: audit(1092951324.886:0): avc:  denied  { 
read } for  pid=3494 exe=/usr/X11R6/bin/Xorg name=fb dev=hda2 
ino=1061221 scontext=system_u:system_r:xdm_xserver_t 
tcontext=system_u:object_r:device_t tclass=lnk_file
Aug 19 17:35:24 new2 last message repeated 6 times

FWIW
Richard Hally

[Stephen Smalley]

On Thu, 2004-08-19 at 19:10, Richard Hally wrote:
>  The new xorg-X11(6.7.99.902-1) will not start with the current strict
>
>  SELinux policy(1.15.16-1) in enforcing mode. (xorg-x11-*6.7.0-7.2 works 
>  just fine). I have not tried permissive mode.
>   It looks like something has changed in X11 that has to do with the 
>  fonts and the SE policy has not been  updated to  handle it but that is 
>  just speculation. 
I applied the patch below to my /etc/init.d/xfs to fix.  This patch
restores the type on /tmp/.font-unix when it is re-created by
/etc/init.d/xfs.  I assume that previously xfs was directly creating the
directory itself, so that the file_type_auto_trans rule for xfs_t was
sufficient to label it, but since it is now being created by the init
script, it is getting a different type.

--- /etc/init.d/xfs.old	2004-08-18 14:45:54.000000000 -0400
+++ /etc/init.d/xfs	2004-08-20 07:16:01.539914488 -0400
@@ -78,6 +78,7 @@
    mkdir $FONT_UNIX_DIR
    chown root:root $FONT_UNIX_DIR
    chmod 1777 $FONT_UNIX_DIR
+   restorecon $FONT_UNIX_DIR
 
    daemon xfs -droppriv -daemon
    ret=$?

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Russell Coker]

On Fri, 20 Aug 2004 21:20, Stephen Smalley <sds(a)epoch.ncsc.mil&gt; wrote:
>  I applied the patch below to my /etc/init.d/xfs to fix.  This patch
>  restores the type on /tmp/.font-unix when it is re-created by
>  /etc/init.d/xfs.  I assume that previously xfs was directly creating the
>  directory itself, so that the file_type_auto_trans rule for xfs_t was
>  sufficient to label it, but since it is now being created by the init
>  script, it is getting a different type. 
I created a bugzilla entry:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=130421

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Russell Coker]

On Fri, 20 Aug 2004 09:10, Richard Hally <rhallyx(a)mindspring.com&gt; wrote:
>  Aug 19 17:35:13 new2 kernel: audit(1092951313.544:0): avc:  denied 
> {
>  read } for  pid=2995 exe=/usr/X11R6/bin/Xorg name=fb dev=hda2
>  ino=1061221 scontext=system_u:system_r:xdm_xserver_t
>  tcontext=system_u:object_r:device_t tclass=lnk_file 
The attached policy patch xserv.diff fixes this.

The other is fixed by restorecon.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Jim Cornette]

Stephen Smalley wrote:

> On Thu, 2004-08-19 at 19:10, Richard Hally wrote:
>   
>
> >The new xorg-X11(6.7.99.902-1) will not start with the current strict 
> >SELinux policy(1.15.16-1) in enforcing mode. (xorg-x11-*6.7.0-7.2 works 
> >just fine). I have not tried permissive mode.
> > It looks like something has changed in X11 that has to do with the 
> >fonts and the SE policy has not been  updated to  handle it but that is 
> >just speculation.
> >    
> >
>
> I applied the patch below to my /etc/init.d/xfs to fix.  This patch
> restores the type on /tmp/.font-unix when it is re-created by
> /etc/init.d/xfs.  I assume that previously xfs was directly creating the
> directory itself, so that the file_type_auto_trans rule for xfs_t was
> sufficient to label it, but since it is now being created by the init
> script, it is getting a different type.
>
> --- /etc/init.d/xfs.old	2004-08-18 14:45:54.000000000 -0400
> +++ /etc/init.d/xfs	2004-08-20 07:16:01.539914488 -0400
> @@ -78,6 +78,7 @@
>     mkdir $FONT_UNIX_DIR
>     chown root:root $FONT_UNIX_DIR
>     chmod 1777 $FONT_UNIX_DIR
> +   restorecon $FONT_UNIX_DIR
>  
>     daemon xfs -droppriv -daemon
>     ret=$?
>
>   
>  
with 903-1, I was getting the below errors and am running targeted and 
enforcing. I noted these in /var/log/messages when trying to track down 
another problem. I don't know if this is applicable or not to the 
problem described.

Jim

/var/log/messages displays the below xfs errors regarding the speedo font.

Aug 29 13:34:22 localhost xfs[3371]: ignoring font path element
/usr/X11R6/lib/X11/fonts/Speedo (unreadable)
Aug 29 14:27:32 localhost xfs[3371]: ignoring font path element
/usr/X11R6/lib/X11/fonts/Speedo (unreadable)
Aug 29 16:00:00 localhost xfs[3595]: ignoring font path element
/usr/X11R6/lib/X11/fonts/Speedo (unreadable)
Aug 29 16:14:59 localhost xfs[3154]: ignoring font path element
/usr/X11R6/lib/X11/fonts/Speedo (unreadable)



-- 
Old age is too high a price to pay for maturity.