canna .... still wants to access /tmp

[Tom London]

Looks like the new policy (selinux-strict-policy-1.13.4-2) removes 
access to tmp files in canna.te.  But canna (Canna-0.3.7p3-2) still 
wants to access /tmp/.

Are there new versions of the canna stuff coming that move the files 
from /tmp elsewhere?

tom

Jun  8 09:32:06 dell kernel: audit(1086712326.043:0): avc:  denied  { 
search } for  pid=2094 exe=/usr/sbin/cannaserver name=tmp dev=hdb3 
ino=278529 scontext=system_u:system_r:canna_t 
tcontext=system_u:object_r:tmp_t tclass=dir
Jun  8 09:32:06 dell kernel: audit(1086712326.044:0): avc:  denied  { 
search } for  pid=2094 exe=/usr/sbin/cannaserver name=tmp dev=hdb3 
ino=278529 scontext=system_u:system_r:canna_t 
tcontext=system_u:object_r:tmp_t tclass=dir
Jun  8 09:32:06 dell cannaserver:
Jun  8 09:32:06 dell cannaserver: ERROR:
Jun  8 09:32:06 dell cannaserver:    Another 'cannaserver' is detected.
Jun  8 09:32:06 dell cannaserver:    If 'cannaserver' is not running,
Jun  8 09:32:06 dell cannaserver:    "/tmp/.iroha_unix/IROHA" may remain 
accidentally.
Jun  8 09:32:06 dell cannaserver:    So, after making sure that 
'cannaserver' is not running.
Jun  8 09:32:06 dell cannaserver:    Please execute following command.
Jun  8 09:32:06 dell cannaserver:
Jun  8 09:32:06 dell cannaserver:                rm 
/tmp/.iroha_unix/IROHA Jun 8 09:32:06 dell cannaserver:

[Russell Coker]

On Thu, 10 Jun 2004 04:04, Tom London  wrote:
> Looks like the new policy (selinux-strict-policy-1.13.4-2) removes
> access to tmp files in canna.te.  But canna (Canna-0.3.7p3-2) still
> wants to access /tmp/.
>
> Are there new versions of the canna stuff coming that move the files
> from /tmp elsewhere?

The plan is that canna will be modified to put it's unix domain socket files 
under /var/run.  The current situation is a grave security hole for non-SE 
systems and systems running the targetted policy.

For the current canna implementation you can rename the unix domain socket, 
create your own socket under the well known name, then proxy data across thus 
reading the majority of text that the unsuspecting user types.

[Akira TAGOH]

> > > > > On Thu, 10 Jun 2004 15:16:38 +1000,
> > > > > "RC" == Russell Coker  wrote:

RC> On Thu, 10 Jun 2004 04:04, Tom London  wrote:
> > Looks like the new policy (selinux-strict-policy-1.13.4-2) removes
> > access to tmp files in canna.te.  But canna (Canna-0.3.7p3-2) still
> > wants to access /tmp/.
> >
> > Are there new versions of the canna stuff coming that move the files
> > from /tmp elsewhere?

RC> The plan is that canna will be modified to put it's unix domain socket files 
RC> under /var/run.  The current situation is a grave security hole for non-SE 
RC> systems and systems running the targetted policy.

I'm ready to go change the socket files under /var/run.
Russell, could you change the policy about it?

Regards,
--
Akira TAGOH