Re: Denials from spamc and webalizer on Centos 5.2

[Dominick Grift]

Hello,

With regard to procmail, i think your policy is missing a domain
transition to spamassassin.

A custom policy looking something like the following may or may not
fix that issue:

mkdir ~/myprocmail; cd ~/myprocmail;
echo "policy_module(myprocmail, 0.0.1)" > myprocmail.te;
echo "require { type procmail_t; }" >> myprocmail.te;
echo "optional_policy(`" >> myprocmail.te;
echo "spamassassin_domtrans_spamc(procmail_t)" >> myprocmail.te;
echo "')" >> myprocmail.te;

make -f /usr/share/selinux/devel/Makefile
/usr/sbin/semodule -i myprocmail.pp

With regard to webalizer it looks like webalizer is searching
something in a "bin" directory.
If you want you can allow this.

mkdir ~/mywebalizer; cd ~mywebalizer;
echo "policy_module(mywebalizer, 0.0.1)" > mywebalizer.te;
echo "require { type webalizer_t; }" >> mywebalizer.te;
echo "corecmd_search_bin(webalizer_t)" >> mywebalizer.te;

make -f /usr/share/selinux/devel/Makefile
/usr/sbin/semodule -i  mywebalizer.pp

It may be that both procmail and webalizer domains need more access
after this, but you will notice that if this is the case.

P.s. You may or may not need to escape some of the characters in my example.

Hth,
Dominick

Denials from spamc and webalizer on Centos 5.2

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

domg472 g472 wrote:
>  Hello,
>  
>  With regard to procmail, i think your policy is missing a domain
>  transition to spamassassin.
>  
>  A custom policy looking something like the following may or may not
>  fix that issue:
>  
>  mkdir ~/myprocmail; cd ~/myprocmail;
>  echo "policy_module(myprocmail, 0.0.1)" > myprocmail.te;
>  echo "require { type procmail_t; }" >> myprocmail.te;
>  echo "optional_policy(`" >> myprocmail.te;
>  echo "spamassassin_domtrans_spamc(procmail_t)" >> myprocmail.te;
>  echo "')" >> myprocmail.te;
>  
>  make -f /usr/share/selinux/devel/Makefile
>  /usr/sbin/semodule -i myprocmail.pp
>  
>  With regard to webalizer it looks like webalizer is searching
>  something in a "bin" directory.
>  If you want you can allow this.
>  
>  mkdir ~/mywebalizer; cd ~mywebalizer;
>  echo "policy_module(mywebalizer, 0.0.1)" > mywebalizer.te;
>  echo "require { type webalizer_t; }" >> mywebalizer.te;
>  echo "corecmd_search_bin(webalizer_t)" >> mywebalizer.te;
>  
>  make -f /usr/share/selinux/devel/Makefile
>  /usr/sbin/semodule -i  mywebalizer.pp
>  
>  It may be that both procmail and webalizer domains need more access
>  after this, but you will notice that if this is the case.
>  
>  P.s. You may or may not need to escape some of the characters in my example.
>  
>  Hth,
>  Dominick
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
Fedora 10 and Rawhide
have a domtrans to spamc, but RHEL5 looks like it
only able to execute spamc without a transition.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAklrdkEACgkQrlYvE4MpobNI8ACfRAv7WPFed5YrOQT15aFHIdlZ
> tusAn0jeucaL0XurCwzab9hChLT/eEA/
> =k4Pd
> -----END PGP SIGNATURE-----

Denials from spamc and webalizer on Centos 5.2

[Richard Chapman]

Hi Dominick

It has taken me a while to decide to go ahead with your suggestion 
below... (I think I was hoping the problem would go away...:-)) and it 
looks like I am heading in the right direction - but there is a little 
more work to do.

There seemed to be a problem with the quotes in the line:

echo "optional_policy(`" >> myprocmail.te;

but I edited the .te file - and the make worked fine - after I installed 
the selinux-policy-devel package. Here is myprocmail.te:

policy_module(myprocmail, 0.0.1)
require { type procmail_t; }
optional_policy(`spamassassin_domtrans_spamc(procmail_t)')

I installed the policy file using teh GUI Selinux Administration tool.

I think we have got rid of the procmail error - but now we have a new 
error. (see below). I'm guessing I need another line or two in my 
myprocmail.te file. Can you tell me what it is I need? I'm pretty sure 
this is a new error - which might suggest that there is something wrong 
with the above policy file??

I haven't tried the webalizer changes yet. I have turned webalizer off 
for the time being.

Many thanks

Richard.


Summary
SELinux is preventing the semodule from using potentially mislabeled 
files 
(/root/.nx/C-C5.aardvark.com.au-1005-1EBFEB021BC36FF25B1F49323B3E0A01/session). 

Detailed Description
[SELinux is in permissive mode, the operation would have been denied but 
was permitted due to permissive mode.]

SELinux has denied semodule access to potentially mislabeled file(s) 
(/root/.nx/C-C5.aardvark.com.au-1005-1EBFEB021BC36FF25B1F49323B3E0A01/session). 
This means that SELinux will not allow semodule to use these files. It 
is common for users to edit files in their home directory or tmp 
directories and then move (mv) them to system directories. The problem 
is that the files end up with the wrong file context which confined 
applications are not allowed to access.

Allowing Access
If you want semodule to access this files, you need to relabel them 
using restorecon -v 
'/root/.nx/C-C5.aardvark.com.au-1005-1EBFEB021BC36FF25B1F49323B3E0A01/session'. 
You might want to relabel the entire directory using restorecon -R -v 
'/root/.nx/C-C5.aardvark.com.au-1005-1EBFEB021BC36FF25B1F49323B3E0A01'.
Additional Information

Source Context:   	system_u:system_r:semanage_t
Target Context:   	user_u:object_r:user_home_t
Target Objects:   
/root/.nx/C-C5.aardvark.com.au-1005-1EBFEB021BC36FF25B1F49323B3E0A01/session 
[ file ]
Source:   	semodule
Source Path:   	/usr/sbin/semodule
Port:   	<Unknown>
Host:   	C5.aardvark.com.au
Source RPM Packages:   	policycoreutils-1.33.12-14.el5
Target RPM Packages:   	
Policy RPM:   	selinux-policy-2.4.6-203.el5
Selinux Enabled:   	True
Policy Type:   	targeted
MLS Enabled:   	True
Enforcing Mode:   	Permissive
Plugin Name:   	home_tmp_bad_labels
Host Name:   	C5.aardvark.com.au
Platform:   	Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 
16 11:57:43 EST 2008 x86_64 x86_64
Alert Count:   	1
First Seen:   	Sun Jan 25 14:38:32 2009
Last Seen:   	Sun Jan 25 14:38:32 2009
Local ID:   	5d6e1851-5dc3-49a1-b758-5b33327cdf8f
Line Numbers:   	

Raw Audit Messages :

host=C5.aardvark.com.au type=AVC msg=audit(1232861912.353:38467): avc: 
denied { append } for pid=23410 comm="semodule" 
path="/root/.nx/C-C5.aardvark.com.au-1005-1EBFEB021BC36FF25B1F49323B3E0A01/session"

dev=dm-0 ino=29294829 scontext=system_u:system_r:semanage_t:s0 
tcontext=user_u:object_r:user_home_t:s0 tclass=file
host=C5.aardvark.com.au type=AVC msg=audit(1232861912.353:38467): avc: 
denied { append } for pid=23410 comm="semodule" 
path="/root/.nx/C-C5.aardvark.com.au-1005-1EBFEB021BC36FF25B1F49323B3E0A01/session"

dev=dm-0 ino=29294829 scontext=system_u:system_r:semanage_t:s0 
tcontext=user_u:object_r:user_home_t:s0 tclass=file
host=C5.aardvark.com.au type=SYSCALL msg=audit(1232861912.353:38467): 
arch=c000003e syscall=59 success=yes exit=0 a0=34ab410 a1=34ab7b0 
a2=34aa660 a3=3 items=0 ppid=23404 pid=23410 auid=102 uid=0 gid=0 euid=0 
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3534 comm="semodule" 
exe="/usr/sbin/semodule" subj=system_u:system_r:semanage_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1232861912.353:38467): 
arch=c000003e syscall=59 success=yes exit=0 a0=34ab410 a1=34ab7b0 
a2=34aa660 a3=3 items=0 ppid=23404 pid=23410 auid=102 uid=0 gid=0 euid=0 
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3534 comm="semodule" 
exe="/usr/sbin/semodule" subj=system_u:system_r:semanage_t:s0 key=(null)


domg472 g472 wrote:
>  Hello,
>
>  With regard to procmail, i think your policy is missing a domain
>  transition to spamassassin.
>
>  A custom policy looking something like the following may or may not
>  fix that issue:
>
>  mkdir ~/myprocmail; cd ~/myprocmail;
>  echo "policy_module(myprocmail, 0.0.1)" > myprocmail.te;
>  echo "require { type procmail_t; }" >> myprocmail.te;
>  echo "optional_policy(`" >> myprocmail.te;
>  echo "spamassassin_domtrans_spamc(procmail_t)" >> myprocmail.te;
>  echo "')" >> myprocmail.te;
>
>  make -f /usr/share/selinux/devel/Makefile
>  /usr/sbin/semodule -i myprocmail.pp
>
>  With regard to webalizer it looks like webalizer is searching
>  something in a "bin" directory.
>  If you want you can allow this.
>
>  mkdir ~/mywebalizer; cd ~mywebalizer;
>  echo "policy_module(mywebalizer, 0.0.1)" > mywebalizer.te;
>  echo "require { type webalizer_t; }" >> mywebalizer.te;
>  echo "corecmd_search_bin(webalizer_t)" >> mywebalizer.te;
>
>  make -f /usr/share/selinux/devel/Makefile
>  /usr/sbin/semodule -i  mywebalizer.pp
>
>  It may be that both procmail and webalizer domains need more access
>  after this, but you will notice that if this is the case.
>
>  P.s. You may or may not need to escape some of the characters in my example.
>
>  Hth,
>  Dominick
>
>

Denials from spamc and webalizer on Centos 5.2

[Richard Chapman]

Sorry Dominick - I pasted the wrong error into this email. I've pasted 
the right one below.

Richard Chapman wrote:
>  Hi Dominick
>
>  It has taken me a while to decide to go ahead with your suggestion 
>  below... (I think I was hoping the problem would go away...:-)) and it 
>  looks like I am heading in the right direction - but there is a little 
>  more work to do.
>
>  There seemed to be a problem with the quotes in the line:
>
>  echo "optional_policy(`" >> myprocmail.te;
>
>  but I edited the .te file - and the make worked fine - after I 
>  installed the selinux-policy-devel package. Here is myprocmail.te:
>
>  policy_module(myprocmail, 0.0.1)
>  require { type procmail_t; }
>  optional_policy(`spamassassin_domtrans_spamc(procmail_t)')
>
>  I installed the policy file using teh GUI Selinux Administration tool.
>
>  I think we have got rid of the procmail error - but now we have a new 
>  error. (see below). I'm guessing I need another line or two in my 
>  myprocmail.te file. Can you tell me what it is I need? I'm pretty sure 
>  this is a new error - which might suggest that there is something 
>  wrong with the above policy file??
>
>  I haven't tried the webalizer changes yet. I have turned webalizer off 
>  for the time being.
>
>  Many thanks
>
>  Richard.
>
>  Summary
>  SELinux is preventing spamc (spamc_t) "write" to pipe (postfix_local_t).
>  Detailed Description
>  [SELinux is in permissive mode, the operation would have been denied 
>  but was permitted due to permissive mode.]
>
>  SELinux denied access requested by spamc. It is not expected that this 
>  access is required by spamc and this access may signal an intrusion 
>  attempt. It is also possible that the specific version or 
>  configuration of the application is causing it to require additional 
>  access.
>
>  Allowing Access
>  You can generate a local policy module to allow this access - see FAQ 
>  <http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385> Or you can 
>  disable SELinux protection altogether. Disabling SELinux protection is 
>  not recommended. Please file a bug report 
>  <http://bugzilla.redhat.com/bugzilla/enter_bug.cgi> against this package.
>  Additional Information
>
>  Source Context:   	system_u:system_r:spamc_t
>  Target Context:   	system_u:system_r:postfix_local_t
>  Target Objects:   	pipe [ fifo_file ]
>  Source:   	spamc
>  Source Path:   	/usr/bin/spamc
>  Port:   	<Unknown>
>  Host:   	C5.aardvark.com.au
>  Source RPM Packages:   	spamassassin-3.2.4-1.el5
>  Target RPM Packages:   	
>  Policy RPM:   	selinux-policy-2.4.6-203.el5
>  Selinux Enabled:   	True
>  Policy Type:   	targeted
>  MLS Enabled:   	True
>  Enforcing Mode:   	Permissive
>  Plugin Name:   	catchall
>  Host Name:   	C5.aardvark.com.au
>  Platform:   	Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue 
>  Dec 16 11:57:43 EST 2008 x86_64 x86_64
>  Alert Count:   	8
>  First Seen:   	Mon Jan 26 14:24:43 2009
>  Last Seen:   	Mon Jan 26 17:10:19 2009
>  Local ID:   	8cff6375-1acd-4f86-bb7f-7c99129a9a2b
>  Line Numbers:   	
>
>  Raw Audit Messages :
>
>  host=C5.aardvark.com.au type=AVC msg=audit(1232957419.466:2987): avc: 
>  denied { write } for pid=17103 comm="spamc" path="pipe:[224027]" 
>  dev=pipefs ino=224027 scontext=system_u:system_r:spamc_t:s0 
>  tcontext=system_u:system_r:postfix_local_t:s0 tclass=fifo_file
>  host=C5.aardvark.com.au type=AVC msg=audit(1232957419.466:2987): avc: 
>  denied { write } for pid=17103 comm="spamc" path="pipe:[224027]" 
>  dev=pipefs ino=224027 scontext=system_u:system_r:spamc_t:s0 
>  tcontext=system_u:system_r:postfix_local_t:s0 tclass=fifo_file
>  host=C5.aardvark.com.au type=SYSCALL msg=audit(1232957419.466:2987): 
>  arch=c000003e syscall=59 success=yes exit=0 a0=ac072e0 a1=ac09310 
>  a2=ac09260 a3=8 items=0 ppid=17102 pid=17103 auid=4294967295 uid=500 
>  gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 
>  tty=(none) ses=4294967295 comm="spamc" exe="/usr/bin/spamc" 
>  subj=system_u:system_r:spamc_t:s0 key=(null)
>  host=C5.aardvark.com.au type=SYSCALL msg=audit(1232957419.466:2987): 
>  arch=c000003e syscall=59 success=yes exit=0 a0=ac072e0 a1=ac09310 
>  a2=ac09260 a3=8 items=0 ppid=17102 pid=17103 auid=4294967295 uid=500 
>  gid=501 euid=500 suid=500 fsuid=500 egid=501 sgid=501 fsgid=501 
>  tty=(none) ses=4294967295 comm="spamc" exe="/usr/bin/spamc" 
>  subj=system_u:system_r:spamc_t:s0 key=(null)
>
>
>
>  domg472 g472 wrote:
> > Hello,
> >
> > With regard to procmail, i think your policy is missing a domain
> > transition to spamassassin.
> >
> > A custom policy looking something like the following may or may not
> > fix that issue:
> >
> > mkdir ~/myprocmail; cd ~/myprocmail;
> > echo "policy_module(myprocmail, 0.0.1)" > myprocmail.te;
> > echo "require { type procmail_t; }" >> myprocmail.te;
> > echo "optional_policy(`" >> myprocmail.te;
> > echo "spamassassin_domtrans_spamc(procmail_t)" >> myprocmail.te;
> > echo "')" >> myprocmail.te;
> >
> > make -f /usr/share/selinux/devel/Makefile
> > /usr/sbin/semodule -i myprocmail.pp
> >
> > With regard to webalizer it looks like webalizer is searching
> > something in a "bin" directory.
> > If you want you can allow this.
> >
> > mkdir ~/mywebalizer; cd ~mywebalizer;
> > echo "policy_module(mywebalizer, 0.0.1)" > mywebalizer.te;
> > echo "require { type webalizer_t; }" >> mywebalizer.te;
> > echo "corecmd_search_bin(webalizer_t)" >> mywebalizer.te;
> >
> > make -f /usr/share/selinux/devel/Makefile
> > /usr/sbin/semodule -i  mywebalizer.pp
> >
> > It may be that both procmail and webalizer domains need more access
> > after this, but you will notice that if this is the case.
> >
> > P.s. You may or may not need to escape some of the characters in my 
> > example.
> >
> > Hth,
> > Dominick
> >
> >   
>
>  -- 
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>

Interesting Denials from semodule on Centos 5.2

[Richard Chapman]

Hi

I have an interesting denial here - and I think I understand what is 
causing it - but I'm not sure of the best method of resolving it. I have 
pasted the denial below.

What seems to cause it is running the gui "System/Administration/Selinux 
Management" tool - while in a gnome x session in an "nx" session. I'm 
not sure how well know it is - but "nx" is a very good gui remote 
terminal (like vnc but much better imho) running over ssh. Very fast ad 
accurate and presumably secure. I use nx to manage the Centos 5.2 server 
- rather than use a physical terminal.
Every time I start the gui Selinux Management tool I get one of these 
denials. Note that the /root/.nx directory must be a housekeeping 
directory for nx where it keeps session information.

I have run audit2allow on this denial and it suggests this very simple 
policy
---------
module mynx 1.0;

require {
        type semanage_t;
        type user_home_t;
        class file append;
}

#============= semanage_t ==============
allow semanage_t user_home_t:file append;
-------

Is this a good solution - or is it freeing up the wrong thing?
Does anyone understand why this configuration should cause the denial - 
and can anyone suggest a better solution?

BTW: I have tried the suggested re-labelling - and it didn't help.

Richard.





Summary
SELinux is preventing the semodule from using potentially mislabeled 
files 
(/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session). 

Detailed Description
[SELinux is in permissive mode, the operation would have been denied but 
was permitted due to permissive mode.]

SELinux has denied semodule access to potentially mislabeled file(s) 
(/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session). 
This means that SELinux will not allow semodule to use these files. It 
is common for users to edit files in their home directory or tmp 
directories and then move (mv) them to system directories. The problem 
is that the files end up with the wrong file context which confined 
applications are not allowed to access.

Allowing Access
If you want semodule to access this files, you need to relabel them 
using restorecon -v 
'/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session'. 
You might want to relabel the entire directory using restorecon -R -v 
'/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9'.
Additional Information

Source Context:   	system_u:system_r:semanage_t
Target Context:   	user_u:object_r:user_home_t
Target Objects:   
/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session 
[ file ]
Source:   	semodule
Source Path:   	/usr/sbin/semodule
Port:   	<Unknown>
Host:   	C5.aardvark.com.au
Source RPM Packages:   	policycoreutils-1.33.12-14.el5
Target RPM Packages:   	
Policy RPM:   	selinux-policy-2.4.6-203.el5
Selinux Enabled:   	True
Policy Type:   	targeted
MLS Enabled:   	True
Enforcing Mode:   	Permissive
Plugin Name:   	home_tmp_bad_labels
Host Name:   	C5.aardvark.com.au
Platform:   	Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1 SMP Tue Dec 
16 11:57:43 EST 2008 x86_64 x86_64
Alert Count:   	3
First Seen:   	Sun Feb 1 15:21:40 2009
Last Seen:   	Sun Feb 1 16:01:16 2009
Local ID:   	31b6bb16-26ba-419d-8057-7bb9eee9708a
Line Numbers:   	

Raw Audit Messages :

host=C5.aardvark.com.au type=AVC msg=audit(1233471676.49:19106): avc: 
denied { append } for pid=25330 comm="semodule" 
path="/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session"

dev=dm-0 ino=29294826 scontext=system_u:system_r:semanage_t:s0 
tcontext=user_u:object_r:user_home_t:s0 tclass=file
host=C5.aardvark.com.au type=AVC msg=audit(1233471676.49:19106): avc: 
denied { append } for pid=25330 comm="semodule" 
path="/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session"

dev=dm-0 ino=29294826 scontext=system_u:system_r:semanage_t:s0 
tcontext=user_u:object_r:user_home_t:s0 tclass=file
host=C5.aardvark.com.au type=SYSCALL msg=audit(1233471676.49:19106): 
arch=c000003e syscall=59 success=yes exit=0 a0=16674410 a1=166747b0 
a2=16673660 a3=3 items=0 ppid=25327 pid=25330 auid=102 uid=0 gid=0 
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1740 
comm="semodule" exe="/usr/sbin/semodule" 
subj=system_u:system_r:semanage_t:s0 key=(null)
host=C5.aardvark.com.au type=SYSCALL msg=audit(1233471676.49:19106): 
arch=c000003e syscall=59 success=yes exit=0 a0=16674410 a1=166747b0 
a2=16673660 a3=3 items=0 ppid=25327 pid=25330 auid=102 uid=0 gid=0 
euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1740 
comm="semodule" exe="/usr/sbin/semodule" 
subj=system_u:system_r:semanage_t:s0 key=(null)

Interesting Denials from semodule on Centos 5.2

[Vadym Chepkov]

root's home has a different context then the rest of the users:

# ls -dZ /root
drwxr-x---  root root system_u:object_r:admin_home_t   /root

I would do something like this:

policy_module(nx, 0.0.1)
type nx_home_t;
userdom_user_home_content(user, nx_home_t)

HOME_DIR/\.nx(/.*)? gen_context(system_u:object_r:nx_home_t,s0)
/root/\.nx(/.*)?    gen_context(system_u:object_r:nx_home_t,s0)

and work with this domain instead. 
Hopefuly it will lead you to a nice policy one day :) 

Sincerely yours,
  Vadym Chepkov


--- On Sun, 2/1/09, Richard Chapman <rchapman(a)aardvark.com.au&gt; wrote:

>  From: Richard Chapman <rchapman(a)aardvark.com.au&gt;
>  Subject: Interesting Denials from semodule on Centos 5.2
>  To: fedora-selinux-list(a)redhat.com
>  Cc: "Daniel J Walsh" <dwalsh(a)redhat.com&gt;
>  Date: Sunday, February 1, 2009, 6:37 AM
>  Hi
>  
>  I have an interesting denial here - and I think I
>  understand what is causing it - but I'm not sure of the
>  best method of resolving it. I have pasted the denial below.
>  
>  What seems to cause it is running the gui
>  "System/Administration/Selinux Management" tool -
>  while in a gnome x session in an "nx" session.
>  I'm not sure how well know it is - but "nx" is
>  a very good gui remote terminal (like vnc but much better
>  imho) running over ssh. Very fast ad accurate and presumably
>  secure. I use nx to manage the Centos 5.2 server - rather
>  than use a physical terminal.
>  Every time I start the gui Selinux Management tool I get
>  one of these denials. Note that the /root/.nx directory must
>  be a housekeeping directory for nx where it keeps session
>  information.
>  
>  I have run audit2allow on this denial and it suggests this
>  very simple policy
>  ---------
>  module mynx 1.0;
>  
>  require {
>         type semanage_t;
>         type user_home_t;
>         class file append;
>  }
>  
>  #============= semanage_t ==============
>  allow semanage_t user_home_t:file append;
>  -------
>  
>  Is this a good solution - or is it freeing up the wrong
>  thing?
>  Does anyone understand why this configuration should cause
>  the denial - and can anyone suggest a better solution?
>  
>  BTW: I have tried the suggested re-labelling - and it
>  didn't help.
>  
>  Richard.
>  
>  
>  
>  
>  
>  Summary
>  SELinux is preventing the semodule from using potentially
>  mislabeled files
>  (/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session).
>  
>  Detailed Description
>  [SELinux is in permissive mode, the operation would have
>  been denied but was permitted due to permissive mode.]
>  
>  SELinux has denied semodule access to potentially
>  mislabeled file(s)
>  (/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session).
>  This means that SELinux will not allow semodule to use these
>  files. It is common for users to edit files in their home
>  directory or tmp directories and then move (mv) them to
>  system directories. The problem is that the files end up
>  with the wrong file context which confined applications are
>  not allowed to access.
>  
>  Allowing Access
>  If you want semodule to access this files, you need to
>  relabel them using restorecon -v
>  '/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session'.
>  You might want to relabel the entire directory using
>  restorecon -R -v
>  '/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9'.
>  Additional Information
>  
>  Source Context:   	system_u:system_r:semanage_t
>  Target Context:   	user_u:object_r:user_home_t
>  Target Objects:  
>  /root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session
>  [ file ]
>  Source:   	semodule
>  Source Path:   	/usr/sbin/semodule
>  Port:   	<Unknown>
>  Host:   	C5.aardvark.com.au
>  Source RPM Packages:   	policycoreutils-1.33.12-14.el5
>  Target RPM Packages:   	
>  Policy RPM:   	selinux-policy-2.4.6-203.el5
>  Selinux Enabled:   	True
>  Policy Type:   	targeted
>  MLS Enabled:   	True
>  Enforcing Mode:   	Permissive
>  Plugin Name:   	home_tmp_bad_labels
>  Host Name:   	C5.aardvark.com.au
>  Platform:   	Linux C5.aardvark.com.au 2.6.18-92.1.22.el5 #1
>  SMP Tue Dec 16 11:57:43 EST 2008 x86_64 x86_64
>  Alert Count:   	3
>  First Seen:   	Sun Feb 1 15:21:40 2009
>  Last Seen:   	Sun Feb 1 16:01:16 2009
>  Local ID:   	31b6bb16-26ba-419d-8057-7bb9eee9708a
>  Line Numbers:   	
>  
>  Raw Audit Messages :
>  
>  host=C5.aardvark.com.au type=AVC
>  msg=audit(1233471676.49:19106): avc: denied { append } for
>  pid=25330 comm="semodule"
>
> path="/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session"
>  dev=dm-0 ino=29294826
>  scontext=system_u:system_r:semanage_t:s0
>  tcontext=user_u:object_r:user_home_t:s0 tclass=file
>  host=C5.aardvark.com.au type=AVC
>  msg=audit(1233471676.49:19106): avc: denied { append } for
>  pid=25330 comm="semodule"
>
> path="/root/.nx/C-C5.aardvark.com.au-1001-A809D35DE6DD5692B6DD14987FACDFC9/session"
>  dev=dm-0 ino=29294826
>  scontext=system_u:system_r:semanage_t:s0
>  tcontext=user_u:object_r:user_home_t:s0 tclass=file
>  host=C5.aardvark.com.au type=SYSCALL
>  msg=audit(1233471676.49:19106): arch=c000003e syscall=59
>  success=yes exit=0 a0=16674410 a1=166747b0 a2=16673660 a3=3
>  items=0 ppid=25327 pid=25330 auid=102 uid=0 gid=0 euid=0
>  suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1740
>  comm="semodule" exe="/usr/sbin/semodule"
>  subj=system_u:system_r:semanage_t:s0 key=(null)
>  host=C5.aardvark.com.au type=SYSCALL
>  msg=audit(1233471676.49:19106): arch=c000003e syscall=59
>  success=yes exit=0 a0=16674410 a1=166747b0 a2=16673660 a3=3
>  items=0 ppid=25327 pid=25330 auid=102 uid=0 gid=0 euid=0
>  suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1740
>  comm="semodule" exe="/usr/sbin/semodule"
>  subj=system_u:system_r:semanage_t:s0 key=(null)
>  
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list