selinux April 2004

selinux@lists.fedoraproject.org

84 participants
96 discussions

nVIDIA binary driver audits generated by OpenGL apps
by Andrew Farris 07 May '04

07 May '04

I am working toward getting Enforcing mode to work with the nvidia binary drivers, and having some difficulties. I see that there is some policy with this intention , but it is not quite adequate yet, as below. Some hints how to proceed, or solutions to this would be appreciated. Running enforcing with /dev/nvidia* labeled as xserver_misc_device_t: Apr 26 17:13:59 CirithUngol kernel: audit(1083024839.937:0): avc: denied { read write } for pid=15200 exe=/usr/X11R6/bin/glxinfo name=nvidiactl dev=hdb8 ino=65738 scontext=LordMorgul:user_r:user_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file Apr 26 17:14:04 CirithUngol kernel: audit(1083024844.641:0): avc: denied { read write } for pid=15209 exe=/usr/X11R6/bin/glxgears name=nvidiactl dev=hdb8 ino=65738 scontext=LordMorgul:user_r:user_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file The X server can start up as normal user without any audit of X itself startinghen X is started in permissive mode only these audits appear, but glxgears and glxinfo work as expected. These programs, and all my other openGL apps, need access to /dev/nvidiactl. The error message generated at command prompt in enforcing mode is: Error: Could not open /dev/nvidiactl because the permissions are too resticitive. Please see the FREQUENTLY ASKED QUESTIONS section of /usr/share/doc/NVIDIA_GLX-1.0/README for steps to correct. Although the unix perms of the device nodes are all identical as below: crw-rw-rw- 0 0 system_u:object_r:xserver_misc_device_t /dev/nvidiactl crw-rw-rw- 1 0 0 195, 255 Apr 17 16:28 /dev/nvidiactl To relabel the devices I uncommented the definition of xserver_misc_device_t from ./types/device.te, and added the following line to ./file_contexts/program/xserver.fc (then make reload, followed by setfiles on these devices). /dev/nvidia.* system_u:object_r:xserver_misc_device_t And I rely on these (there are 4) lines in policy.conf after the make (I do not understand how these are generated yet). allow user_xserver_t xserver_misc_device_t:chr_file { ioctl read getattr lock write append }; When running enforcing with the /dev/nvidia* devices labeled as dri_device_t (had to try), the same behavior exists, X runs.. but glxgears/glxinfo (and GL games) cannot access the nvidiactl device. -- Andrew Farris, CPE senior (California Polytechnic State University, SLO) fedora(a)andrewfarris.com :: lmorgul on irc.freenode.net "The only thing necessary for the triumph of evil is for good men to do nothing." (Edmond Burke)

2 7

Policy file for 'aide' and/or 'tripwire'?
by Valdis.Kletnieks＠vt.edu 03 May '04

03 May '04

Has anybody already done a policy file for Tripwire or its open-sourced replacement 'aide'? Trying to run 'tripwire --check' from a cron job gets this: Apr 27 04:03:37 orange kernel: audit(1083053017.355:0): avc: denied { write } for pid=14045 exe=/usr/sbin/tripwire name=tripwire dev=dm-5 ino=22529 scontext=system_u:system_r:system_crond_t tcontext=system_u:object_r:var_t tclass=dir when trying to open the TEMPDIRECTORY directory: # ls -ld --context /var/tripwire/ drwx------+ root root system_u:object_r:var_t /var/tripwire/ (The actual database files are here: # ls --context /var/lib/tripwire -rw-------+ root root system_u:object_r:var_lib_t orange.cirt.vt.edu.twd -rw------- root root system_u:object_r:var_lib_t orange.cirt.vt.edu.twd.bak drwxr-xr-x+ root root system_u:object_r:var_lib_t report It occurs to me that it would be simple but incorrect to just use setfilecon to coerce the contexts into something that works, and that a separate set of tripwire_t and/or aide_t contexts is probably desired. Having no wish to reinvent the wheel, has anybody done this already?

3 4

Core 2 SELinux installation
by Nick 03 May '04

03 May '04

>From the message titled 'Fedora Core 2 and SELinux' > SELinux *will* be included in Fedora Core 2 test 3 and the final > Fedora Core 2 release. However, SELinux will be disabled by default. > To install with SELinux support, pass 'selinux' to the installer > on the command line. (Or, configure it appropriately in kickstart). Why are we using the command line option to install SELinux process. I provided to the SEL list, a comp.xml skeleton that I used to add SEL to Core 1. In the original framework I just added dependencies that were not on the std Linux install (i.e. sharutils). A follow through to this could provide a separate selection within the group for policy tools and source to allow the installer to put the source in place as well (as shown in the category section below) <group> <id>selinux</id> <uservisible>true</uservisible> <default>true</default> <name>SELinux Installation</name> <description>Install this group of packages to configure the system for SELinux installation.</description> <grouplist> </grouplist> <packagelist> <packagereq type="mandatory">sharutils</packagereq> <packagereq type="mandatory">linuxdoc-tools</packagereq> <packagereq type="mandatory">netpbm-progs</packagereq> <packagereq type="mandatory">tetex-latex</packagereq> <packagereq type="mandatory">autoconf213</packagereq> <packagereq type="mandatory">elfutils-devel</packagereq> <packagereq type="mandatory">libcroco-devel</packagereq> </packagelist> </group> <category> <name>SELinux</name> <subcategories> <subcategory>selinux</subcategory> <subcategory>policy tools/source</subcategory> </subcategories> </category> -- Nick Gray Senior Systems Engineer Bruzenak Inc. nagray(a)austin.rr.com (512) 331-7998

13 25

Problem with Tresys tools on Core 2
by Nick 03 May '04

03 May '04

Conditions: ----------- Install from DVD ISO yum upgrade installation of RPMS checkpolicy-1.10-1.i386.rpm policy-sources-1.11.2-18.noarch.rpm setools-1.3-2.i386.rpm setools-gui-1.3-2.i386.rpm Results ------- [root@rocket policy]# seinfo -r Could not open policy! [root@rocket policy]# seuser -X Error in StartScript (/usr/share/setools/se_user.tcl): Thanks Nick -- Nick Gray Senior Systems Engineer Bruzenak Inc. nagray(a)austin.rr.com (512) 331-7998

4 6

Access to cd device denied for cdp
by Andrew Farris 02 May '04

02 May '04

Playing a cd from the terminal using cdp, or cdplay (non-interactive), results in the following avc in permissive mode (but the cd is allowed to play): Apr 26 15:09:24 CirithUngol kernel: audit(1083017364.035:0): avc: denied { ioctl } for pid=10129 exe=/usr/bin/cdp path=/dev/hdc dev=hdb8 ino=66203 scontext=user_u:user_r:user_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file This is not audited in enforcing mode.. but does not work either (program exits with "please chmod 666 /dev/cdrom as root"). /dev/cdrom is symlinked directly to /dev/hdc. 4.0K lrwxrwxrwx 1 0 0 8 Mar 29 17:26 /dev/cdrom -> /dev/hdc 4.0K brw-rw-rw- 1 0 6 22, 0 Feb 23 13:02 /dev/hdc Is this expected, or desired behavior? Shouldn't a locally logged in user be allowed access to audio cds? (perhaps should be -or is- tunable) I'm working with policy-sources-1.11.2-13. -- Andrew Farris, CPE senior (California Polytechnic State University, SLO) fedora(a)andrewfarris.com :: lmorgul on irc.freenode.net "The only thing necessary for the triumph of evil is for good men to do nothing." (Edmond Burke)

6 7

Trying to get user modification tools and policy source
by Nick 29 Apr '04

29 Apr '04

Conditions: Install from DVD Download of Tresys tools Installation of several RPMs that were needed to compile these tools yum update of system. Problem: I can't build the Tresys tools for user account modification. I had been doing this in the past: > #1. useradd -m developer > #2. passwd developer > #3. sed -i -e /user\ root/a\ user\ developer\ roles\ \{\ staff_r\ \ > sysadm_r\ \}\; /etc/security/selinux/src/policy/users > > #4. cd /etc/security/selinux/src/policy > #5. make policy > #6. make load I asked the SEL list about this and it was recommeded that I try Tresys setools? seuser, seuseradd?. Problem is, I can't build them I keep getting a message about TCL being in the wrong place? Anyone seen this? This is a new install, without deviations from what needs to be done initially. I would think this would be a pretty common problem I obviously can't do my old procedure since the policy source wasn't installed. Thanks Nix -- Nick Gray Senior Systems Engineer Bruzenak Inc. nagray(a)austin.rr.com (512) 331-7998

4 3

RFE: provide a command to display all roles available to a user
by Gene Czarcinski 29 Apr '04

29 Apr '04

OK, this got closed on bugzilla with the suggestion to bring it up for discussion on the mailing list. The problem: Currently, there is no way for a user to display what roles are available ... available for switching to via a newrole command. Solution: Provide a command to display the roles available to a user ... what roles could be specified for that user on a newroles command. Gene

2 1

AVC attaching gdb to Mozilla process.
by Aleksey Nogin 28 Apr '04

28 Apr '04

Under policy-sources-1.11.2-18: audit(1083131647.146:0): avc: denied { signal } for pid=28661 exe=/usr/bin/gdb scontext=aleksey:staff_r:staff_mozilla_t tcontext=aleksey:staff_r:staff_t tclass=process -- Aleksey Nogin Home Page: http://nogin.org/ E-Mail: nogin(a)cs.caltech.edu (office), aleksey(a)nogin.org (personal) Office: Jorgensen 70, tel: (626) 395-2907

2 3

FC2-T2 and selinux
by Gene Czarcinski 28 Apr '04

28 Apr '04

Let me empahsize -- please be sure to specify enforcing=0 for the first boot after install if you have installed with selinux "active". If you do not, the X configuration and firstboot get screwed up. I may be easier to just reinstall than trying to fix things. Gene

2 2

FC2-T3 selinux warning
by Gene Czarcinski 28 Apr '04

28 Apr '04

Install (fresh, everything) FC2-T3 seems to have some policy related problems: 1. /root/.default_contexts has wrong attribute (restorecon fixes it). 2. I seems to need to boot enforcing=0 for the firstboot (otherwise the display does not initialize properly). After updating to latest updates from development (including policy, policycoreutils, and libselinux): 1. trying to login a syadm_r user cannot find the home directory 2. creating new users definitiely assigns wrong attributes to /home/user/* Gene

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux April 2004