selinux July 2004

selinux@lists.fedoraproject.org

40 participants
54 discussions

How to use other LSM modules
by Bruno Castro da Silva 28 Jul '04

28 Jul '04

Hi, I'm trying to install, on fedora core 2, some modules which also use the LSM framework. Currently selinux is disabled (/usr/bin/selinuxenabled returns 1), but I can't seem to load any other modules. I always get the "There is already a security framework initialized, register_security failed" error. Is there anyway to completly disable selinux or to allow other LSM-based software to run? Also, I think this problem wouldn't exist if selinux was compiled as a module. Is there any reason why this isn't so? Thanks in advance! Bruno

2 1

Fedora Project Mailing Lists reminder
by Elliot Lee 27 Jul '04

27 Jul '04

This is a reminder of the mailing lists for the Fedora Project, and the purpose of each list. You can view this information at http://fedora.redhat.com/participate/communicate/ When you're using these mailing lists, please take the time to choose the one that is most appropriate to your post. If you don't know the right mailing list to use for a question or discussion, please contact me. This will help you get the best possible answer for your question, and keep other list subscribers happy! Mailing Lists Mailing lists are email addresses which send email to all users subscribed to the mailing list. Sending an email to a mailing list reaches all users interested in discussing a specific topic and users available to help other users with the topic. The following mailing lists are available. To subscribe, send email to <listname>-request(a)redhat.com (replace <listname> with the desired mailing list name such as fedora-list) with the word subscribe in the subject. fedora-announce-list - Announcements of changes and events. To stay aware of news, subscribe to this list. fedora-list - For users of releases. If you want help with a problem installing or using , this is the list for you. fedora-test-list - For testers of test releases. If you would like to discuss experiences using TEST releases, this is the list for you. fedora-devel-list - For developers, developers, developers. If you are interested in helping create releases, this is the list for you. fedora-docs-list - For participants of the docs project fedora-desktop-list - For discussions about desktop issues such as user interfaces, artwork, and usability fedora-config-list - For discussions about the development of configuration tools fedora-legacy-announce - For announcements about the Fedora Legacy Project fedora-legacy-list - For discussions about the Fedora Legacy Project fedora-selinux-list - For discussions about the Fedora SELinux Project fedora-de-list - For discussions about Fedora in the German language fedora-es-list - For discussions about Fedora in the Spanish language fedora-ja-list - For discussions about Fedora in the Japanese language fedora-i18n-list - For discussions about the internationalization of Fedora Core fedora-trans-list - For discussions about translating the software and documentation associated with the Fedora Project German: fedora-trans-de French: fedora-trans-fr Spanish: fedora-trans-es Italian: fedora-trans-it Brazilian Portuguese: fedora-trans-pt_br Japanese: fedora-trans-ja Korean: fedora-trans-ko Simplified Chinese: fedora-trans-zh_cn Traditional Chinese: fedora-trans-zh_tw

1 0

mozilla-1.7 startup, lib_t vs. shlib_t?
by Tom London 26 Jul '04

26 Jul '04

[running latest FC3T1 w/ mods from devel tree, strict/enforcing] When starting up mozilla as normal user, I noticed the following avc's: Jul 22 06:58:24 fedora kernel: audit(1090504704.981:0): avc: denied { execute } for pid=3527 path=/usr/java/j2sdk1.5.0/jre/lib/i386/client/libjvm.so dev=hda2 ino=4279850 scontext=user_u:user_r:user_mozilla_t tcontext=system_u:object_r:lib_t tclass=file Jul 22 06:58:34 fedora kernel: audit(1090504714.317:0): avc: denied { execute } for pid=3517 path=/usr/java/j2sdk1.5.0/jre/lib/i386/libjavaplugin_nscp.so dev=hda2 ino=4279868 scontext=user_u:user_r:user_mozilla_t tcontext=system_u:object_r:lib_t tclass=file Jul 22 06:59:06 fedora kernel: audit(1090504746.751:0): avc: denied { read } for pid=3517 exe=/usr/lib/mozilla-1.7/mozilla-bin name=tmp dev=hda2 ino=4112506 scontext=user_u:user_r:user_mozilla_t tcontext=system_u:object_r:tmp_t tclass=lnk_file The last of these describes an access to the link '/usr/tmp->../var/tmp'. [I can't tell if this is 'breaking' anything, so I don't know if anything needs to change here. Help anyone?] The first 2 denials appear to interfere with plugins. Going into permissive mode identifies the following list of 'java library executes' from scontext=user_u:user_r:user_mozilla_t: /usr/java/j2sdk1.5.0/jre/lib/i386/client/libjvm.so /usr/java/j2sdk1.5.0/jre/lib/i386/libjavaplugin_nscp.so /usr/java/j2sdk1.5.0/jre/lib/i386/native_threads/libhpi.so /usr/java/j2sdk1.5.0/jre/lib/i386/libverify.so /usr/java/j2sdk1.5.0/jre/lib/i386/libjava.so /usr/java/j2sdk1.5.0/jre/lib/i386/libzip.so I changed their contexts to 'system_u:object_r:shlib_t' and plugins started working again. The j2 entries in types.fc are: /usr/java/j2.*/bin(/.*)? system_u:object_r:bin_t /usr/java/j2.*/jre/lib(64)?/i386(/.*)? system_u:object_r:lib_t /usr/java/j2.*/plugin/i386(/.*)?/lib[^/]*\.so(\.[^/]*)* -- system_u:object_r:shlib_t I admit to not really understanding what needs to be here. Is it appropriate to change the second line to /usr/java/j2.*/jre/lib(64)?/i386(/.*)? system_u:object_r:shlib_t or something more specific to 1.5.0? tom

2 1

sshd....denied transition...funny looking avc
by Tom London 26 Jul '04

26 Jul '04

[running latest FC3T1 w/ latest mods from devel tree, strict/enforcing kernel-2.6.7-1.494, openssh-3.8.1p1-4] Attempting to scp into this host fails with 'Read from remote host HOST: connection reset by peer' /var/log/messages on this host shows: Jul 22 12:05:18 fedora sshd(pam_unix)[13899]: session opened for user root by (uid=0) Jul 22 12:05:18 fedora kernel: audit(1090523118.784:0): avc: denied { transition } for pid=13899 exe=/usr/sbin/sshd Jul 22 12:05:26 fedora sshd(pam_unix)[13902]: session opened for user root by (uid=0) Jul 22 12:05:26 fedora kernel: audit(1090523126.143:0): avc: denied { transition } for pid=13902 exe=/usr/sbin/sshd [There appear to be 145 blank characters after 'kernel:' and before 'audit(' on the lines above.] /usr/sbin/sshd appears to be labeled correctly; -rwxr-xr-x root root system_u:object_r:sshd_exec_t /usr/sbin/sshd tom

3 3

auxv entry ?
by Alexis Wagner 26 Jul '04

26 Jul '04

Hi, How do I check if my glibc have the auxv entry for AT_SECURE ? By the way, what is a auxv entry ! Thank you.

2 1

Best Source to learn more about seLinux?
by Tom Weeks 22 Jul '04

22 Jul '04

Hey guys... I need to come up to speed fast on seLinux... What's the best source to dive into for this? Tweeks

4 5

rhgb - bootup denials
by Tom London 21 Jul '04

21 Jul '04

With strict/enforcing, I get the following avcs at bootup. Looks like rhgb does not 'run'; I get a text-style boot display. Jul 21 10:47:52 fedora kernel: audit(1090406834.263:0): avc: denied { mounton } for pid=533 exe=/usr/bin/rhgb path=/initrd dev=ram0 ino=2 scontext=system_u:system_r:rhgb_t tcontext=system_u:object_r:file_t tclass=dir Jul 21 10:47:52 fedora kernel: audit(1090406834.263:0): avc: denied { sys_admin } for pid=533 exe=/usr/bin/rhgb capability=21 scontext=system_u:system_r:rhgb_t tcontext=system_u:system_r:rhgb_t tclass=capability audit2allow on this yields: allow rhgb_t file_t:dir { mounton }; allow rhgb_t rhgb_t:capability { sys_admin }; but this seems a bit too 'heavy'..... tom

2 3

/dev/jsflash -> mouse_device_t ??
by Tom London 21 Jul '04

21 Jul '04

I think the latest file_contexts is mislabeling /dev/jsflash.... The problem line is types.fc:/u?dev/js.* -c system_u:object_r:mouse_device_t It overrides earlier lines: types.fc:/u?dev/jsfd -b system_u:object_r:fixed_disk_device_t types.fc:/u?dev/jsflash -c system_u:object_r:fixed_disk_device_t tom

2 1

.udev.tdb ?
by Tom London 21 Jul '04

21 Jul '04

I'm getting lots of of 'denied' avc for /dev/.udev.tdb from /sbin/udev. I see an entry in file_contexts for '/dev/udev.tbl' (which doesn't seem to exist on my system). Has .udev.tbd replaced udev.tbl? (udev_db in /etc/udev/udev.conf is set to /dev/.udev.tdb). tom [udev-029-4, selinux-policy-strict-1.15.7-1] ---------------------------------------------------------------- Jul 19 18:58:54 fedora kernel: audit(1090288734.253:0): avc: denied { read write } for pid=2720 exe=/sbin/udev name=.udev.tdb dev=hda2 ino=2698913 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:device_t tclass=file Jul 19 18:58:54 fedora kernel: audit(1090288734.284:0): avc: denied { read write } for pid=2727 exe=/sbin/udev name=.udev.tdb dev=hda2 ino=2698913 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:device_t tclass=file Jul 19 18:58:54 fedora kernel: audit(1090288734.314:0): avc: denied { read write } for pid=2734 exe=/sbin/udev name=.udev.tdb dev=hda2 ino=2698913 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:device_t tclass=file Jul 19 18:58:54 fedora kernel: audit(1090288734.344:0): avc: denied { read write } for pid=2741 exe=/sbin/udev name=.udev.tdb dev=hda2 ino=2698913 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:device_t tclass=file Jul 19 18:58:54 fedora kernel: audit(1090288734.705:0): avc: denied { read write } for pid=2824 exe=/sbin/udev name=.udev.tdb dev=hda2 ino=2698913 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:device_t tclass=file Jul 19 18:58:54 fedora kernel: audit(1090288734.707:0): avc: denied { read write } for pid=2825 exe=/sbin/udev name=.udev.tdb dev=hda2 ino=2698913 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:device_t tclass=file Jul 19 18:58:54 fedora kernel: audit(1090288734.710:0): avc: denied { read write } for pid=2826 exe=/sbin/udev name=.udev.tdb dev=hda2 ino=2698913 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:device_t tclass=file

2 4

hpoj?
by Tom London 21 Jul '04

21 Jul '04

I'm getting some messages from hpoj that I don't remember getting before, shown below. After starting in permissive mode, checking on '/var/run/ptal-mlcd and ptal-printd' shows files (fifos) with context 'system_u:object_r:var_run_t'. I was expecting them to be 'system_u:object_r:ptal_var_run_t'. Have I missed configuring this properly? thanks, tom Audit2allow on permissive avc's yield: allow ptal_t etc_runtime_t:file { getattr }; allow ptal_t etc_t:file { read }; allow ptal_t staff_home_dir_t:dir { search }; allow ptal_t usbdevfs_t:dir { getattr read }; allow ptal_t var_run_t:fifo_file { create read setattr }; allow ptal_t var_run_t:sock_file { create setattr }; (enforcing); Jul 19 09:58:07 fedora kernel: audit(1090256287.964:0): avc: denied { create } for pid=5638 exe=/usr/sbin/ptal-mlcd name=usb:PSC_900_Series scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:var_run_t tclass=sock_file Jul 19 09:58:07 fedora ptal-mlcd: FATAL ERROR at ExMgr.cpp:1250, dev=<mlc:usb:PSC_900_Series>, pid=5638, e=13, t=1090256287 bind(/var/run/ptal-mlcd/usb:PSC_900_Series) failed! Ensure /var/run/ptal-mlcd/ exists. Jul 19 09:58:07 fedora kernel: audit(1090256287.972:0): avc: denied { search } for pid=5639 exe=/usr/sbin/ptal-printd name=root dev=hda2 ino=1196033 scontext=system_u:system_r:ptal_t tcontext=root:object_r:staff_home_dir_t tclass=dir Jul 19 09:58:07 fedora kernel: audit(1090256287.972:0): avc: denied { read } for pid=5639 exe=/usr/sbin/ptal-printd name=mlc:usb:PSC_900_Series dev=hda2 ino=738368 scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:etc_t tclass=file Jul 19 09:58:07 fedora kernel: audit(1090256287.972:0): avc: denied { getattr } for pid=5639 exe=/usr/sbin/ptal-printd path=/etc/ptal/ptal-printd-like dev=hda2 ino=737289 scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:etc_runtime_t tclass=file Jul 19 09:58:07 fedora ptal-printd: ptal-printd(mlc:usb:PSC_900_Series): Unable to read file permissions from "/etc/ptal/ptal-printd-like"! Jul 19 09:58:09 fedora ptal-photod: ptal-photod(mlc:usb:PSC_900_Series) successfully initialized, listening on port 5703. (permissive): Jul 19 09:59:41 fedora ptal-mlcd: SYSLOG at ExMgr.cpp:652, dev=<mlc:usb:PSC_900_Series>, pid=5694, e=2, t=1090256381 ptal-mlcd successfully initialized. Jul 19 09:59:41 fedora ptal-printd: ptal-printd(mlc:usb:PSC_900_Series) successfully initialized using /var/run/ptal-printd/mlc_usb_PSC_900_Series*. Jul 19 09:59:41 fedora kernel: audit(1090256381.301:0): avc: denied { create } for pid=5693 exe=/usr/sbin/ptal-mlcd name=usb:PSC_900_Series scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:var_run_t tclass=sock_file Jul 19 09:59:41 fedora kernel: audit(1090256381.301:0): avc: denied { setattr } for pid=5693 exe=/usr/sbin/ptal-mlcd name=usb:PSC_900_Series dev=hda2 ino=4493726 scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:var_run_t tclass=sock_file Jul 19 09:59:41 fedora kernel: audit(1090256381.301:0): avc: denied { read } for pid=5693 exe=/usr/sbin/ptal-mlcd dev=usbdevfs ino=1417 scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:usbdevfs_t tclass=dir Jul 19 09:59:41 fedora kernel: audit(1090256381.301:0): avc: denied { getattr } for pid=5693 exe=/usr/sbin/ptal-mlcd path=/proc/bus/usb dev=usbdevfs ino=1417 scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:usbdevfs_t tclass=dir Jul 19 09:59:41 fedora kernel: audit(1090256381.308:0): avc: denied { search } for pid=5695 exe=/usr/sbin/ptal-printd name=root dev=hda2 ino=1196033 scontext=system_u:system_r:ptal_t tcontext=root:object_r:staff_home_dir_t tclass=dir Jul 19 09:59:41 fedora kernel: audit(1090256381.309:0): avc: denied { read } for pid=5695 exe=/usr/sbin/ptal-printd name=mlc:usb:PSC_900_Series dev=hda2 ino=738368 scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:etc_t tclass=file Jul 19 09:59:41 fedora kernel: audit(1090256381.309:0): avc: denied { getattr } for pid=5695 exe=/usr/sbin/ptal-printd path=/etc/ptal/ptal-printd-like dev=hda2 ino=737289 scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:etc_runtime_t tclass=file Jul 19 09:59:41 fedora kernel: audit(1090256381.309:0): avc: denied { create } for pid=5695 exe=/usr/sbin/ptal-printd name=mlc_usb_PSC_900_Series scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:var_run_t tclass=fifo_file Jul 19 09:59:41 fedora kernel: audit(1090256381.309:0): avc: denied { setattr } for pid=5695 exe=/usr/sbin/ptal-printd name=mlc_usb_PSC_900_Series dev=hda2 ino=4493727 scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:var_run_t tclass=fifo_file Jul 19 09:59:41 fedora kernel: audit(1090256381.309:0): avc: denied { read } for pid=5695 exe=/usr/sbin/ptal-printd name=mlc_usb_PSC_900_Series dev=hda2 ino=4493727 scontext=system_u:system_r:ptal_t tcontext=system_u:object_r:var_run_t tclass=fifo_file Jul 19 09:59:43 fedora ptal-photod: ptal-photod(mlc:usb:PSC_900_Series) successfully initialized, listening on port 5703.

2 6

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux July 2004