SElinux issues with vanilla 2.6.9 kernel on FC3

[Orion Poplawski]

I've installed a kernel.org 2.6.9 kernel updated to acpi 20041203.  I'm 
seeing lots of SElinux audit messages that I don't see with the Fedora 
kernels.  Is there something I can do short of disabling SElinux?

audit(1103024554.837:0): avc:  denied  { read write } for  pid=656 
exe=/sbin/minilogd name=console dev=tmpfs ino=1138 
scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t 
tclass=chr_file
audit(1103024554.838:0): avc:  denied  { write } for  pid=656 
exe=/sbin/minilogd dev=tmpfs ino=1137 scontext=user_u:system_r:syslogd_t 
tcontext=user_u:object_r:tmpfs_t tclass=dir
audit(1103024554.838:0): avc:  denied  { add_name } for  pid=656 
exe=/sbin/minilogd name=log scontext=user_u:system_r:syslogd_t 
tcontext=user_u:object_r:tmpfs_t tclass=dir
audit(1103024554.838:0): avc:  denied  { create } for  pid=656 
exe=/sbin/minilogd name=log scontext=user_u:system_r:syslogd_t 
tcontext=user_u:object_r:tmpfs_t tclass=sock_file
audit(1103024554.839:0): avc:  denied  { getattr } for  pid=662 
exe=/sbin/minilogd path=/dev/log dev=tmpfs ino=2056 
scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t 
tclass=sock_file
audit(1103024559.699:0): avc:  denied  { write } for  pid=662 
exe=/sbin/minilogd name=log dev=tmpfs ino=2056 
scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t 
tclass=sock_file
audit(1103024569.926:0): avc:  denied  { remove_name } for  pid=1547 
exe=/sbin/minilogd name=log dev=tmpfs ino=2056 
scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t 
tclass=dir
audit(1103024569.926:0): avc:  denied  { unlink } for  pid=1547 
exe=/sbin/minilogd name=log dev=tmpfs ino=2056 
scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t 
tclass=sock_file
audit(1103049789.825:0): avc:  denied  { write } for  pid=2254 
exe=/sbin/syslogd dev=tmpfs ino=1137 scontext=user_u:system_r:syslogd_t 
tcontext=user_u:object_r:tmpfs_t tclass=dir
audit(1103049789.826:0): avc:  denied  { remove_name } for  pid=2254 
exe=/sbin/syslogd name=log dev=tmpfs ino=5419 
scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t 
tclass=dir
audit(1103049789.826:0): avc:  denied  { add_name } for  pid=2254 
exe=/sbin/syslogd name=log scontext=user_u:system_r:syslogd_t 
tcontext=user_u:object_r:tmpfs_t tclass=dir
audit(1103049789.826:0): avc:  denied  { setattr } for  pid=2254 
exe=/sbin/syslogd name=log dev=tmpfs ino=5849 
scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t 
tclass=sock_file
audit(1103049790.187:0): avc:  denied  { search } for  pid=2277 
exe=/sbin/portmap dev=tmpfs ino=1137 scontext=user_u:system_r:portmap_t 
tcontext=user_u:object_r:tmpfs_t tclass=dir
audit(1103049791.885:0): avc:  denied  { search } for  pid=2381 
exe=/sbin/ypbind dev=tmpfs ino=1137 scontext=user_u:system_r:ypbind_t 
tcontext=user_u:object_r:tmpfs_t tclass=dir
audit(1103049797.552:0): avc:  denied  { search } for  pid=2808 
exe=/usr/sbin/ntpdate dev=tmpfs ino=1137 scontext=user_u:system_r:ntpd_t 
tcontext=user_u:object_r:tmpfs_t tclass=dir
audit(1103049797.552:0): avc:  denied  { write } for  pid=2808 
exe=/usr/sbin/ntpdate name=log dev=tmpfs ino=5849 
scontext=user_u:system_r:ntpd_t 
tcontext=user_u:object_r:tmpfs_ttclass=sock_file

# mount
/dev/hda3 on / type ext3 (rw)
none on /proc type proc (rw)
none on /sys type sysfs (rw)
none on /dev/pts type devpts (rw,gid=5,mode=620)
usbfs on /proc/bus/usb type usbfs (rw)
/dev/hda2 on /boot type ext3 (rw)
none on /dev/shm type tmpfs (rw)
/dev/hda7 on /export type ext3 (rw)
/dev/hda6 on /var type ext3 (rw)
tmpfs on /tmp type tmpfs (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
automount(pid2496) on /opt type autofs 
(rw,fd=5,pgrp=2496,minproto=2,maxproto=4)
automount(pid2483) on /fs type autofs 
(rw,fd=5,pgrp=2483,minproto=2,maxproto=4)
automount(pid2543) on /data type autofs 
(rw,fd=5,pgrp=2543,minproto=2,maxproto=4)
automount(pid2587) on /home type autofs 
(rw,fd=5,pgrp=2587,minproto=2,maxproto=4)
nfsd on /proc/fs/nfsd type nfsd (rw)


-- 
Orion Poplawski
System Administrator                   303-415-9701 x222
Colorado Research Associates/NWRA      FAX: [phone]
3380 Mitchell Lane, Boulder CO 80301   http://www.co-ra.com

[Stephen Smalley]

On Tue, 2004-12-14 at 13:47, Orion Poplawski wrote:
>  I've installed a kernel.org 2.6.9 kernel updated to acpi
> 20041203.  I'm 
>  seeing lots of SElinux audit messages that I don't see with the Fedora 
>  kernels.  Is there something I can do short of disabling SElinux?
>  
>  audit(1103024554.837:0): avc:  denied  { read write } for  pid=656 
>  exe=/sbin/minilogd name=console dev=tmpfs ino=1138 
>  scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t 
>  tclass=chr_file 
In order for SELinux to work with udev and a tmpfs /dev, you need tmpfs
xattr support.  That exists in 2.6.10-rc3, as well as in the Fedora
kernels.

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Serge de Souza]

Stephen Smalley wrote:
>  On Tue, 2004-12-14 at 13:47, Orion Poplawski wrote:
>  
> >I've installed a kernel.org 2.6.9 kernel updated to acpi 20041203.  I'm 
> >seeing lots of SElinux audit messages that I don't see with the Fedora 
> >kernels.  Is there something I can do short of disabling SElinux?
> >
> >audit(1103024554.837:0): avc:  denied  { read write } for  pid=656 
> >exe=/sbin/minilogd name=console dev=tmpfs ino=1138 
> >scontext=user_u:system_r:syslogd_t tcontext=user_u:object_r:tmpfs_t 
> >tclass=chr_file
>  
>  
>  In order for SELinux to work with udev and a tmpfs /dev, you need tmpfs
>  xattr support.  That exists in 2.6.10-rc3, as well as in the Fedora
>  kernels.
>   

Or you can just apply the linux-2.6.9-xattr-rework-tmpfs-mm.patch to the 
2.6.9 vanilla kernel and enable it in the config. The patch is in the 
current fedora source kernel rpm.

Serge

[Alexander Dalloz]

Am Di, den 14.12.2004 schrieb Orion Poplawski um 19:47:

>  I've installed a kernel.org 2.6.9 kernel updated to acpi
> 20041203.  I'm 
>  seeing lots of SElinux audit messages that I don't see with the Fedora 
>  kernels.  Is there something I can do short of disabling SElinux? 
>  Orion Poplawski 
You can append "selinux=0" to the kernel boot parameter line in grub for
the vanilla kernel without SELinux support.

http://fedora.redhat.com/docs/selinux-faq-fc3/

Alexander


-- 
Alexander Dalloz | Enger, Germany | new address - new key: 0xB366A773
legal statement: http://www.uni-x.org/legal.html
Fedora GNU/Linux Core 2 (Tettnang) on Athlon kernel 2.6.9-1.6_FC2smp 
Serendipity 19:53:44 up 4 days, 14:34, load average: 1.57, 1.02, 0.94

[Rahul Sundaram]

On Tue, 14 Dec 2004 11:47:46 -0700, Orion Poplawski <orion(a)cora.nwra.com&gt; wrote:
>  I've installed a kernel.org 2.6.9 kernel updated to acpi
> 20041203.  I'm
>  seeing lots of SElinux audit messages that I don't see with the Fedora
>  kernels.  Is there something I can do short of disabling SElinux?
>   
did you enable the selinux related configuration options in the stock
kernel. read the fedora selinux faq.  restorecon and chcon are used to
change the context. if you choose to use the upstream kernel due to
acpi bugs in the fedora ones its better to get them resolved in
bugzilla.redhat.com


-- 
Regards,
Rahul Sundaram