12:49 a.m.
I just installed (via yum) and started squid.
I then noticed I had some SELinux alert
Summary
SELinux is preventing /usr/sbin/squid (squid_t) "read write" to socket
(unconfined_t).
Detailed Description
SELinux denied access requested by /usr/sbin/squid. It is not expected that
this access is required by /usr/sbin/squid and this access may signal an
intrusion attempt. It is also possible that the specific version or
configuration of the application is causing it to require additional access.
Allowing Access
You can generate a local policy module to allow this access - see
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
SELinux protection altogether. Disabling SELinux protection is not
recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
against this package.
Additional Information
Source Context system_u:system_r:squid_t:s0
Target Context system_u:system_r:unconfined_t:s0
Target Objects socket [ unix_stream_socket ]
Affected RPM Packages squid-2.6.STABLE17-1.fc8 [application]
Policy RPM selinux-policy-3.0.8-44.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall
Host Name susannah.colina.demon.co.uk
Platform Linux susannah.colina.demon.co.uk 2.6.23.1-42.fc8
#1 SMP Tue Oct 30 13:18:33 EDT 2007 x86_64 x86_64
Alert Count 1
First Seen Sat 26 Jan 2008 06:39:04 GMT
Last Seen Sat 26 Jan 2008 06:39:04 GMT
Local ID b8ea13f6-922f-4bb8-a448-09e80221eb2a
Line Numbers
and additional similar alerts for sh (xdm), ntpd, and /usr/bin/gcin
Is it safe to ignore these?
--
Colin Adams
Preston Lancashire
2:55 a.m.
Colin Paul Adams wrote:
I just installed (via yum) and started squid.
I then noticed I had some SELinux alert
Summary
SELinux is preventing /usr/sbin/squid (squid_t) "read write" to socket
(unconfined_t).
Detailed Description
SELinux denied access requested by /usr/sbin/squid. It is not expected that
this access is required by /usr/sbin/squid and this access may signal an
intrusion attempt. It is also possible that the specific version or
configuration of the application is causing it to require additional access.
Allowing Access
You can generate a local policy module to allow this access - see
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
SELinux protection altogether. Disabling SELinux protection is not
recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
against this package.
Additional Information
Source Context system_u:system_r:squid_t:s0
Target Context system_u:system_r:unconfined_t:s0
Target Objects socket [ unix_stream_socket ]
Affected RPM Packages squid-2.6.STABLE17-1.fc8 [application]
Policy RPM selinux-policy-3.0.8-44.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall
Host Name susannah.colina.demon.co.uk
Platform Linux susannah.colina.demon.co.uk 2.6.23.1-42.fc8
#1 SMP Tue Oct 30 13:18:33 EDT 2007 x86_64 x86_64
Alert Count 1
First Seen Sat 26 Jan 2008 06:39:04 GMT
Last Seen Sat 26 Jan 2008 06:39:04 GMT
Local ID b8ea13f6-922f-4bb8-a448-09e80221eb2a
Line Numbers
and additional similar alerts for sh (xdm), ntpd, and /usr/bin/gcin
Is it safe to ignore these?
I run squid and ignore this message ... looks like something the Fedora
guys will fix eventually.
1:57 a.m.
On Sat, 2008-01-26 at 06:49 +0000, Colin Paul Adams wrote:
I just installed (via yum) and started squid.
I then noticed I had some SELinux alert
Have you configured SELinux to allow Squid? The default was, and
probably still is, not to allow Squid to use the network until you
explicitly allow it.
There's a SELinux management tool that lets you easily tweak the
booleans.
--
(This computer runs FC7, my others run FC4, FC5 & FC6, in case that's
important to the thread.)
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
2:04 a.m.
>>>> "Tim" == Tim
<ignored_mailbox(a)yahoo.com.au> writes:
Tim> On Sat, 2008-01-26 at 06:49 +0000, Colin Paul Adams wrote:
> I just installed (via yum) and started squid.
>
> I then noticed I had some SELinux alert
Tim> Have you configured SELinux to allow Squid? The default was,
Tim> and probably still is, not to allow Squid to use the network
Tim> until you explicitly allow it.
No.
Tim> There's a SELinux management tool that lets you easily tweak
Tim> the booleans.
What package is that in? Whereabouts in the GNOME menus will it appear
(I can't find it).
--
Colin Adams
Preston Lancashire
2:19 a.m.
Colin Paul Adams wrote:
What package is that in? Whereabouts in the GNOME menus will it appear
(I can't find it).
# yum info setroubleshoot
Available Packages
Name : setroubleshoot
Arch : noarch
Version: 1.10.7
Release: 1.fc8
Size : 100 k
Repo : fedora
Summary: Helps troubleshoot SELinux problems
Description:
setroubleshoot gui. Application that allows you to view
setroubleshoot-server messages.
Provides tools to help diagnose SELinux problems. When AVC messages
are generated an alert can be generated that will give information
about the problem and help track its resolution. Alerts can be
configured to user preference. The same tools can be run on existing log
files.
Rahul
2:23 a.m.
>>>> "Tim" == Tim
<ignored_mailbox(a)yahoo.com.au> writes:
Tim> On Sat, 2008-01-26 at 06:49 +0000, Colin Paul Adams wrote:
> I just installed (via yum) and started squid.
>
> I then noticed I had some SELinux alert
Tim> Have you configured SELinux to allow Squid? The default was,
Tim> and probably still is, not to allow Squid to use the network
Tim> until you explicitly allow it.
Tim> There's a SELinux management tool that lets you easily tweak
Tim> the booleans.
I found it now.
The boolean for squid reads:
Allow squid to connect to all ports, not just HTTP, FTP and Gopher.
It is not checked. I'm not sure that I want to check it. I would first
like to know what squid was trying to connect to. The alert did not
tell me that (at least, if it did, i didn't understand it).
Is there a way I can find out which port was being accessed?
Hm. It doesn't mention HTTPS, but maybe that is subsumed by HTTP.
--
Colin Adams
Preston Lancashire
4:10 a.m.
On Sun, 2008-01-27 at 08:23 +0000, Colin Paul Adams wrote:
The boolean for squid reads:
Allow squid to connect to all ports, not just HTTP, FTP and Gopher.
It is not checked. I'm not sure that I want to check it. I would first
like to know what squid was trying to connect to. The alert did not
tell me that (at least, if it did, i didn't understand it).
Is there a way I can find out which port was being accessed?
Hm. It doesn't mention HTTPS, but maybe that is subsumed by HTTP.
HTTPS isn't generally cached, that'd introduce a security weakness,
though it can be proxied. That, too, has issues, but not as bad.
I'm still on FC7, and there's a different description for the boolean
option. It just says "Allow Squid daemon to connect to network,"
without mentioning how much it allows.
Unless there's further options, you will need to check the option to
allow Squid to have HTTP access, at least. What Squid can actually do,
you'd configure within the Squid configuration file.
--
(This computer runs FC7, my others run FC4, FC5 & FC6, in case that's
important to the thread.)
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
3:29 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Colin Paul Adams wrote:
I just installed (via yum) and started squid.
I then noticed I had some SELinux alert
Summary
SELinux is preventing /usr/sbin/squid (squid_t) "read write" to socket
(unconfined_t).
Detailed Description
SELinux denied access requested by /usr/sbin/squid. It is not expected that
this access is required by /usr/sbin/squid and this access may signal an
intrusion attempt. It is also possible that the specific version or
configuration of the application is causing it to require additional access.
Allowing Access
You can generate a local policy module to allow this access - see
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
SELinux protection altogether. Disabling SELinux protection is not
recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
against this package.
Additional Information
Source Context system_u:system_r:squid_t:s0
Target Context system_u:system_r:unconfined_t:s0
Target Objects socket [ unix_stream_socket ]
Affected RPM Packages squid-2.6.STABLE17-1.fc8 [application]
Policy RPM selinux-policy-3.0.8-44.fc8
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name plugins.catchall
Host Name susannah.colina.demon.co.uk
Platform Linux susannah.colina.demon.co.uk 2.6.23.1-42.fc8
#1 SMP Tue Oct 30 13:18:33 EDT 2007 x86_64 x86_64
Alert Count 1
First Seen Sat 26 Jan 2008 06:39:04 GMT
Last Seen Sat 26 Jan 2008 06:39:04 GMT
Local ID b8ea13f6-922f-4bb8-a448-09e80221eb2a
Line Numbers
and additional similar alerts for sh (xdm), ntpd, and /usr/bin/gcin
Is it safe to ignore these?
Yes. This is just the unix stream socket connected to
the pup
application. You should upgrade selinux-policy though to a newer policy.
pub opens a unix_stream_socket that yum-updated connects to and then
sets stdout/stderr/stdin too. When rpm restarts or starts the squid
service, the kernel checks if the squid domain can talk to the open file
descriptors. It is not allowed so the kernel closes the file
descriptors and replaces them with ones connected to /dev/null. These
are dontaudited in the latest policy I believe.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkeeSTEACgkQrlYvE4MpobMH7QCdE010G6EBQcGxpXfrjvgi42uU
7vAAoNponOTc3uFhxnrSljMRv2TbbHNy
=LnnZ
-----END PGP SIGNATURE-----
5932
days inactive
5934
days old
7 comments
5 participants
participants (5)
-
Brian Chadwick -
Colin Paul Adams -
Daniel J Walsh -
Rahul Sundaram -
Tim