List of avc for fedora 16

David Highley dhighley at highley-recommended.com
Sun Sep 25 02:45:49 UTC 2011 

"Dominick Grift wrote:"
> 
> 
> --===============4683794954818469668==
> Content-Type: multipart/signed; micalg="pgp-sha512";
> 	protocol="application/pgp-signature"; boundary="=-W/U2hq2saAQVGsubU72y"
> 
> 
> --=-W/U2hq2saAQVGsubU72y
> Content-Type: text/plain; charset="UTF-8"
> Content-Transfer-Encoding: quoted-printable
> 
> On Fri, 2011-09-23 at 20:10 -0700, David Highley wrote:
> > I checked bugzilla but did not see anything about this list of avc
> > alerts for fedora 16. Should they be reported or is something miss
> > configured?
> >=20
> >=20
> 
> sesebool-P allow_ypbind on

The bool gets turned off in the reboot process. It solves almost all the
avc issues but a few remained which were solved with this policy file:
module mysystemd 1.0;

require {
        type systemd_logind_t;
        type var_yp_t;
        type node_t;
        type hi_reserved_port_t;
        class udp_socket { name_bind bind create setopt node_bind };
        class file { read open };
}

#============= systemd_logind_t ==============
allow systemd_logind_t hi_reserved_port_t:udp_socket name_bind;
allow systemd_logind_t node_t:udp_socket node_bind;
allow systemd_logind_t self:udp_socket { bind create setopt };
allow systemd_logind_t var_yp_t:file { read open };

We also need to do a systemctl restart autofs.service after boot up. We
use NIS and auto mounted home directories.

> 
> should fix it. if it does than this should not be reported
> 
> There is a way to check whether a specified AVC denial can be allowed,
> for example your first avc denial:
> 
> > #=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D accountsd_t =3D=3D=3D=3D=3D=3D=
> =3D=3D=3D=3D=3D=3D=3D=3D
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow accountsd_t hi_reserved_port_t:tcp_socket name_bind;
> > #!!!! This avc is allowed in the current policy
> 
> # sesearch -SCT --allow -s accountsd_t -t hi_reserved_port_t -c
> tcp_socket -p name_bind
> 
> Found 1 semantic av rules:
> DT allow nsswitch_domain rpc_port_type : tcp_socket name_bind ;
> [ allow_ypbind ]
> 
> This tells me that this access can be allowed by toggling the
> allow_ypbind boolean to enabled. The DT tells me that this boolean is
> currently disabled.
> 
> > allow accountsd_t portmap_port_t:tcp_socket name_connect;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow accountsd_t var_yp_t:dir search;
> >=20
> > #=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D automount_t =3D=3D=3D=3D=3D=3D=
> =3D=3D=3D=3D=3D=3D=3D=3D
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow automount_t var_yp_t:file read;
> >=20
> > #=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D policykit_t =3D=3D=3D=3D=3D=3D=
> =3D=3D=3D=3D=3D=3D=3D=3D
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow policykit_t hi_reserved_port_t:tcp_socket name_bind;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow policykit_t kerberos_port_t:tcp_socket name_bind;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow policykit_t kprop_port_t:tcp_socket name_bind;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow policykit_t portmap_port_t:tcp_socket name_connect;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow policykit_t var_yp_t:dir search;
> >=20
> > #=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D sshd_t =3D=3D=3D=3D=3D=3D=3D=3D=
> =3D=3D=3D=3D=3D=3D
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow sshd_t ftp_port_t:tcp_socket name_bind;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow sshd_t hi_reserved_port_t:tcp_socket name_bind;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow sshd_t hi_reserved_port_t:udp_socket name_bind;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow sshd_t spamd_port_t:tcp_socket name_bind;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow sshd_t var_yp_t:dir search;
> >=20
> > #=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D system_dbusd_t =3D=3D=3D=3D=3D=
> =3D=3D=3D=3D=3D=3D=3D=3D=3D
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow system_dbusd_t hi_reserved_port_t:tcp_socket name_bind;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow system_dbusd_t portmap_port_t:tcp_socket name_connect;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow system_dbusd_t rndc_port_t:tcp_socket name_bind;
> >=20
> > #=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D xdm_dbusd_t =3D=3D=3D=3D=3D=3D=
> =3D=3D=3D=3D=3D=3D=3D=3D
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow xdm_dbusd_t hi_reserved_port_t:tcp_socket name_bind;
> > #!!!! This avc is allowed in the current policy
> >=20
> > allow xdm_dbusd_t portmap_port_t:tcp_socket name_connect;
> > --
> > selinux mailing list
> > selinux at lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
> 
> 
> --=-W/U2hq2saAQVGsubU72y
> Content-Type: application/pgp-signature; name="signature.asc"
> Content-Description: This is a digitally signed message part
> Content-Transfer-Encoding: 7bit
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> 
> iQIcBAABCgAGBQJOfabTAAoJEBqhFeh0z2SRaEwQAIuB5ZFYNJqlBCsaE7HYaYuP
> pugsjSpzeQheJQC/i2Qa6BCLIKNiLmlkc3J5jBf4msvw3JTfLzgyWJCgo5gQBkLv
> y5JeRd81fgtEzhIIeS2Bg3J/HfXVcxmaAAvSXHvo4DQk7L+STT7ikCfsekPshOvP
> Y+8hOp/24IGm+wsteUMYGZy+JAHsDmSVGyGKMjo881cyCSclInwkoDTUDCv8vm+i
> 3qUs04ahfkfiBlpAH9a0SoVA9Tbnw5N1kbbvY3Up1qqvwtSXIMz2yfAB2uLQ9uBw
> NB0xzpYoBl6b3WLLBx/1DiZG0tmZbJ9q7bLGf22/5V1FArH2FpQ0MAPYxLtby/9x
> iOQiBdDKyAinz4EBMcGmB6B9M+YQROTtrMoTHm5J19J6e46vgt/vvfRcPJYna8DL
> gtHMQroB9Ky/yCHiG2nxsvoNDi7OUw5TX344px4hFDR2wESdrJ8wV9mIhjgwIsjB
> uQWJ4IIbYxJzJ578Le5dEWs9cfNqdEAPm24j9BPWo4VNyUL/ck3LRF/VdiW6rzF9
> fA66bPW2pqe15wpOtR831rO6PQN6Zdne6s+qRQYTu5IiRKINDi4HYe+dAzJzAuel
> avVkH84mznAy2wvoNYX5gvaeVBAE8ZqxMZOzF8cSnqCu+RZ+N/bj53XVN9Wsc9bU
> qFJjNtZOZfKswyZUYHSk
> =+k0S
> -----END PGP SIGNATURE-----
> 
> --=-W/U2hq2saAQVGsubU72y--
> 
> 
> --===============4683794954818469668==
> Content-Type: text/plain; charset="us-ascii"
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Content-Disposition: inline
> 
> --
> selinux mailing list
> selinux at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
> --===============4683794954818469668==--
> 


-- 

Regards,

David Highley
Highley Recommended, Inc.       Phone: (206) 669-0081
2927 SW 339th Street            WEB: http://www.highley-recommended.com
Federal Way, WA 98023-7732

More information about the selinux mailing list